🤖 feat: Daytona sandboxes as a workspace runtime

docs/config/providers.mdx

@@ -91,7 +91,7 @@ Scripts that the agent runs in the bash tool (test harnesses, `make bug-bash`, S
 - Xum sends the calls with the provider keys from this page. The command never sees the real key.
 - Local and Worktree commands reach Xum directly. SSH and Coder commands reach it through a reverse SSH forward (`ssh -R`) that Xum opens to each host, on the host's `127.0.0.1`. The first turn on a host can wait up to 10 seconds for it. The forward uses its own SSH connection without the forwards in your `~/.ssh/config`. A host that refuses forwarding (`AllowTcpForwarding no`) gets no variables, and Xum tries it again after 5 minutes. After a connection failure Xum tries again after 30 seconds. A host that asks for a password or a key passphrase gets no variables: the forward does not prompt, so load the key into `ssh-agent`.
 - With `XUM_ALLOW_MULTIPLE_INSTANCES=1`, or while a `xum server` of another process uses the same Xum home, SSH and Coder commands get no variables: a host keeps one forwarded port per Xum home, and two backends would each pick their own. Xum does not detect a desktop app started with `XUM_NO_API_SERVER=1` next to `xum server`.
-- Docker and devcontainer commands keep their environment: they have no route to Xum.
+- Docker, devcontainer and Daytona commands keep their environment: they have no route to Xum (Daytona's SSH gateway refuses `ssh -R`).
 - Bash commands in `xum run` and `xum workflow` sessions do not get the variables.
 - Commands in untrusted projects, and every command while `XUM_DISABLE_PROJECT_AUTOMATION=1` is set, get no variables: Xum blanks provider keys there, so repo code cannot spend through the proxy. Revoking a project's trust also refuses calls from its commands that are still running.
 - A provider without a Xum API key (for example OpenAI with Codex OAuth only) gets no variables. A provider that your [project secrets](/config/project-secrets) configure keeps the secret values. This includes `OPENAI_ORG_ID` and `OPENAI_PROJECT_ID`.

docs/docs.json

@@ -67,6 +67,7 @@
                   "runtime/worktree",
                   "runtime/ssh",
                   "runtime/coder",
+                  "runtime/daytona",
                   "runtime/docker",
                   "runtime/devcontainer"
                 ]

docs/hooks/tools.mdx

@@ -182,7 +182,7 @@ Xum searches for each hook file in this order:
 
 This applies to `tool_pre`, `tool_post`, and `tool_env`.
 
-For SSH workspaces, hooks execute **on the remote machine**.
+For SSH workspaces (including Coder and Daytona), hooks execute **on the remote machine**, and the user-level location there is `~/.mux/<hook>`, not `~/.xum/<hook>`. Docker workspaces read user-level hooks from `/var/mux/<hook>` inside the container.
 
 </Accordion>
 

docs/runtime/daytona.mdx

@@ -0,0 +1,82 @@
+---
+title: Daytona Runtime
+description: Run agents in Daytona Cloud sandboxes
+---
+
+Xum can run workspaces in [Daytona](https://www.daytona.io/docs) sandboxes. Each new Daytona workspace gets its own sandbox, and Xum connects to it over SSH through Daytona's SSH gateway. Builds, tests, and other agent commands use the sandbox's CPU and memory, not your machine's. Under the hood a Daytona workspace is an [SSH workspace](/runtime/ssh), so `XUM_RUNTIME` is `ssh`.
+
+## Requirements
+
+- A Daytona account and an API key from the Daytona dashboard
+- `ssh` installed on the machine running Xum
+- A Linux snapshot (or Daytona's default) with git and your toolchain. Xum runs Linux shell commands over SSH, so it does not offer Windows snapshots, and refuses one before it creates a sandbox.
+
+## Set up access
+
+1. Open **Settings > Runtimes** and find the **Daytona** row.
+2. Paste your API key and click **Save**.
+3. Click **Test connection**.
+
+Xum stores the key in `~/.xum/daytona.json` (under `XUM_ROOT` when it is set) with file mode `0600`. The settings page never shows a saved key again: to change it, enter a new one, or click **Remove key**.
+
+Without a saved key, Xum uses `DAYTONA_API_KEY` from its own environment. A saved key wins over the environment.
+
+For a self-hosted (BYOC) Daytona install, set `DAYTONA_API_URL` in the environment of the Xum server. It must use `https://`, so that no one on the network can read the API key; `http://` works only for a loopback host (`localhost`, `127.0.0.1` or `::1`). A `DAYTONA_API_URL` that is not accepted keeps Daytona unavailable until you fix it; Xum never sends the key to another deployment instead. `DAYTONA_TARGET` picks a default region; without it, Daytona uses its default.
+
+<Warning>
+  Do not put your Daytona API key in **Secrets**. Xum passes secrets to agent turns and terminals,
+  so an agent could read the key and create or delete sandboxes in your organization.
+</Warning>
+
+## Sizes
+
+| Size   | vCPU | Memory | Disk   |
+| ------ | ---- | ------ | ------ |
+| Small  | 2    | 4 GiB  | 10 GiB |
+| Medium | 4    | 8 GiB  | 20 GiB |
+| Large  | 8    | 16 GiB | 40 GiB |
+
+Small is the default. Xum offers only these sizes, which keeps costs predictable.
+
+## Create a workspace
+
+1. In the new-workspace controls, choose **Daytona** as the runtime.
+2. Pick a snapshot and a size.
+3. Xum creates the sandbox, waits until it starts, clones the project, and runs the [init hook](/hooks/init).
+
+Xum labels each sandbox it creates with `xum.instance`, `xum.workspaceId`, and `xum.project`. If Daytona rejects the size for a snapshot, Xum creates the sandbox at the snapshot's size and then resizes it.
+
+Xum uses only sandboxes it creates: a workspace cannot use an existing sandbox.
+
+## Lifecycle
+
+| Xum event                           | Daytona action                                                                        |
+| ----------------------------------- | ------------------------------------------------------------------------------------- |
+| A turn starts                       | Start the sandbox if it is stopped or archived (waits up to 3 minutes)                |
+| An agent is streaming or a job runs | Report activity every minute, so Daytona does not stop the sandbox                    |
+| Idle                                | Daytona stops the sandbox after 30 minutes and archives it after 1 day stopped        |
+| Sub-agent with a forked workspace   | A new worktree in the same sandbox, not a second sandbox                              |
+| Archive                             | Delete the sandbox at once, without a check for uncommitted work                      |
+| Delete                              | Delete the sandbox; a running one is first checked for uncommitted or unpushed work   |
+| Opening a workspace                 | Background git and PR status checks do not start the sandbox; they wait until it runs |
+| Sandbox no longer exists            | The workspace reports it; Xum does not recreate it                                    |
+
+Each sandbox belongs to the workspace that created it. Archiving or deleting that workspace deletes the sandbox, even while forks of it (sub-agent worktrees) still use it; **Settings > General > Remote box on archive** does not apply to Daytona. Unarchiving a workspace whose sandbox was deleted does not bring the sandbox back, so push or copy any work you need before you archive. An agent cannot archive the workspace that created a sandbox: it asks you to do it. Archiving or deleting a fork removes only its worktree and never stops or deletes the sandbox. Xum records the id of each sandbox it creates in the workspace's settings, and every Daytona request about the sandbox uses that id, so a sandbox that later gets the same name is never touched. Before Xum starts a sandbox, opens SSH access to it, or deletes it, it also checks that the sandbox carries this install's `xum.instance` label. A sandbox without it (for example one whose label was removed) is never used or deleted, and Xum notes it in its log.
+
+A forced delete removes the workspace even when Daytona refuses to delete the sandbox; it then shows a warning that names the sandbox, which you delete in the Daytona dashboard.
+
+Xum does not stop or delete sandboxes that no workspace uses (for example one whose delete failed); Daytona stops them after 30 minutes idle. Delete them in the Daytona dashboard.
+
+## SSH setup
+
+Xum writes the SSH settings for its sandboxes to `~/.xum/ssh/daytona.conf` and adds a managed block to the top of `~/.ssh/config` that includes it for hosts named `<sandbox-name>.xum--daytona`. The gateway's access token is the SSH user name; Xum keeps it in memory and gets it for one hour. When Xum brings a sandbox up for a turn or a terminal, it replaces a token that has less than 15 minutes left. Xum does not replace tokens in the background, so your own SSH clients can be refused after the hour until Xum uses the sandbox again. Xum revokes the token when it replaces it, when you change the Daytona settings, and when it deletes the sandbox. At startup, Xum takes over the tokens that an earlier run left in `daytona.conf`, so it can filter and revoke them too. Before each SSH command it reads the file again, in case that read failed at startup. When an SSH command to a running sandbox fails (for example the gateway refuses a token revoked outside Xum, or Daytona moved its gateway or changed its host keys), Xum reads the gateway settings from Daytona again, rewrites the SSH settings, gets a new token, and runs the command again once. Xum replaces any token it finds in SSH errors and logs with `<daytona-token>`; output of commands that you or an agent run in a terminal is not filtered.
+
+Xum pins the gateway's host keys in `~/.xum/ssh/daytona_known_hosts` and refuses a gateway whose key does not match, with OpenSSH and with the built-in SSH2 transport alike. This holds for `xum server` too, which otherwise skips host key checks for SSH hosts.
+
+Xum's own SSH connections to sandboxes read only `daytona.conf` (OpenSSH runs with `-F`), so nothing in your `~/.ssh/config` or in `/etc/ssh/ssh_config` applies to them: a `Host *` entry's `User`, `ProxyCommand`, `KnownHostsCommand`, forwards or `Match exec` never run for a sandbox, and neither does a system-wide proxy or jump host. The managed block in `~/.ssh/config` is for your own SSH clients, such as an editor's Remote-SSH, which do read your config. OpenSSH uses the first value it finds for each setting, and Xum keeps its block first in the file, so its settings win for sandboxes in those clients too: strict host key checking against the pinned keys, the token as the user name, no proxy or jump host, no agent or X11 forwarding, and `LogLevel QUIET`, because an ssh error message would print the token. Your other entries still apply to every other host. A `KnownHostsCommand` or `Match exec` line in your config still runs for sandboxes in your own clients, with the token as `%r`; scope such lines to the hosts that need them. OpenSSH adds up `RemoteForward` lines instead of keeping the first, so a `RemoteForward` in a `Host *` entry also opens a tunnel from the sandbox to your machine in those clients; scope it to the hosts that need it.
+
+## Notes
+
+- **Costs:** Daytona bills running sandboxes by size and time. Archive or delete workspaces you no longer need, and pick the smallest size that works.
+- **CPU count:** `nproc` inside a sandbox reports the host's CPUs, not the sandbox's, so builds may start too many parallel jobs. Set job counts (for example `MAKEFLAGS=-j4`) in your snapshot or in the project's [`.xum/tool_env`](/hooks/tools).
+- User-level hooks and skills in a sandbox live under `~/.mux`, the same as on other SSH hosts.

docs/runtime/index.mdx

@@ -10,6 +10,7 @@ Runtimes determine where and how Xum executes agent workspaces.
 | **[Local](/runtime/local)**                | All workspaces share the project directory | Quick edits to your working copy            |
 | **[Worktree](/runtime/worktree)**          | Each workspace gets its own directory      | Running multiple agents in parallel         |
 | **[SSH](/runtime/ssh)**                    | Remote execution over SSH                  | Security, performance, heavy parallelism    |
+| **[Daytona](/runtime/daytona)**            | Cloud sandbox per workspace, over SSH      | Remote compute without managing hosts       |
 | **[Docker](/runtime/docker)**              | Isolated container per workspace           | Full isolation, reproducible environments   |
 | **[Dev Container](/runtime/devcontainer)** | Container from devcontainer.json           | Projects with existing devcontainer configs |
 

src/browser/components/ChatPane/WorkspaceFooterBar.tsx

@@ -3,10 +3,10 @@
 import { cn } from "@/common/lib/utils";
 import { stopKeyboardPropagation } from "@/browser/utils/events";
 import { updateUserPreferences, useUserPreferences } from "@/browser/stores/AppConfigStore";
-import { isDevcontainerRuntime, type RuntimeConfig } from "@/common/types/runtime";
+import { isDevcontainerRuntime, isSSHRuntime, type RuntimeConfig } from "@/common/types/runtime";
 import type { FrontendWorkspaceMetadata } from "@/common/types/workspace";
 import type { ProjectConfig } from "@/common/types/project";
-import { getDevcontainerStatusChip } from "@/browser/utils/runtimeUi";
+import { getRuntimeStatusChip } from "@/browser/utils/runtimeUi";
 import { formatTokens } from "@/common/utils/tokens/tokenMeterUtils";
 import { hasWorkspaceRepository } from "@/browser/utils/workspaceCapabilities";
 import { isMultiProject } from "@/common/utils/multiProject";
@@ -138,7 +138,7 @@
   );
 }
 
-type DevcontainerChip = ReturnType<typeof getDevcontainerStatusChip>;
+type DevcontainerChip = ReturnType<typeof getRuntimeStatusChip>;
 
 function WorkspaceBranchControls(props: {
   workspaceId: string;
@@ -425,12 +425,14 @@
   const { canInterrupt, isStarting, awaitingUserQuestion } = useWorkspaceSidebarState(
     props.workspaceId
   );
   const isWorking = (canInterrupt || isStarting) && !awaitingUserQuestion;
 
   const runtimeStatus = useRuntimeStatus(props.workspaceId);
   const devcontainerChip = isDevcontainerRuntime(props.runtimeConfig)
-    ? getDevcontainerStatusChip(runtimeStatus)
-    : null;
+    ? getRuntimeStatusChip(runtimeStatus, "Devcontainer")
+    : isSSHRuntime(props.runtimeConfig) && props.runtimeConfig.daytona != null
+      ? getRuntimeStatusChip(runtimeStatus, "Sandbox")
+      : null;
   // One JS source for the phone layout, so the hidden drift label and the tap-to-toggle diff
   // numbers can never disagree about the width.
   const isNarrow = useNarrowViewport();

src/browser/components/RuntimeBadge/RuntimeBadge.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from "bun:test";
+import { getSshRuntimeInfo } from "./RuntimeBadge";
+
+describe("getSshRuntimeInfo", () => {
+  it("shows a Coder workspace by name, or by host before it has one", () => {
+    const named = getSshRuntimeInfo({
+      type: "ssh",
+      host: "coder-host",
+      srcBaseDir: "~/src",
+      coder: { workspaceName: "my-ws" },
+    });
+    expect(named.type).toBe("coder");
+    expect(named.label).toContain("my-ws");
+    const unnamed = getSshRuntimeInfo({
+      type: "ssh",
+      host: "coder-host",
+      srcBaseDir: "~/src",
+      coder: {},
+    });
+    expect(unnamed.label).toContain("coder-host");
+  });
+
+  it("shows a Daytona sandbox by id, or by host before it has one", () => {
+    const created = getSshRuntimeInfo({
+      type: "ssh",
+      host: "sb-1.xum--daytona",
+      srcBaseDir: "~/src",
+      daytona: { sandboxName: "sb-1" },
+    });
+    expect(created.type).toBe("daytona");
+    expect(created.label).toContain("sb-1");
+    const pending = getSshRuntimeInfo({
+      type: "ssh",
+      host: "daytona-placeholder",
+      srcBaseDir: "~/src",
+      daytona: {},
+    });
+    expect(pending.type).toBe("daytona");
+    expect(pending.label).toContain("daytona-placeholder");
+  });
+
+  it("shows a plain SSH host without its user", () => {
+    const info = getSshRuntimeInfo({ type: "ssh", host: "me@box.example", srcBaseDir: "~/src" });
+    expect(info.type).toBe("ssh");
+    expect(info.label).toContain("box.example");
+    expect(info.label).not.toContain("me@");
+  });
+});

src/browser/components/RuntimeBadge/RuntimeBadge.tsx

@@ -70,20 +70,33 @@
 
 type RuntimeType = keyof typeof RUNTIME_BADGE_UI;
 
+/** SSH runtimes split by their managed backend (Coder, Daytona) or plain host. */
+export function getSshRuntimeInfo(runtimeConfig: Extract<RuntimeConfig, { type: "ssh" }>): {
+  type: RuntimeType;
+  label: string;
+} {
+  if (runtimeConfig.coder) {
+    const coderWorkspaceName = runtimeConfig.coder.workspaceName;
+    return {
+      type: "coder",
+      label: `Coder Workspace: ${coderWorkspaceName ?? runtimeConfig.host}`,
+    };
+  }
+  if (runtimeConfig.daytona) {
+    return {
+      type: "daytona",
+      label: `Daytona sandbox: ${runtimeConfig.daytona.sandboxName ?? runtimeConfig.host}`,
+    };
+  }
+  const hostname = extractSshHostname(runtimeConfig);
+  return { type: "ssh", label: `SSH: ${hostname ?? runtimeConfig.host}` };
+}
+
 function getRuntimeInfo(
   runtimeConfig?: RuntimeConfig
 ): { type: RuntimeType; label: string } | null {
   if (isSSHRuntime(runtimeConfig)) {
-    // Coder-backed SSH runtime gets special treatment
-    if (runtimeConfig.coder) {
-      const coderWorkspaceName = runtimeConfig.coder.workspaceName;
-      return {
-        type: "coder",
-        label: `Coder Workspace: ${coderWorkspaceName ?? runtimeConfig.host}`,
-      };
-    }
-    const hostname = extractSshHostname(runtimeConfig);
-    return { type: "ssh", label: `SSH: ${hostname ?? runtimeConfig.host}` };
+    return getSshRuntimeInfo(runtimeConfig);
   }
   if (isWorktreeRuntime(runtimeConfig)) {
     return { type: "worktree", label: "Worktree: isolated git worktree" };

src/browser/components/icons/RuntimeIcons/RuntimeIcons.tsx

@@ -92,6 +92,26 @@ export function CoderIcon({ size = 10, className }: IconProps) {
   );
 }
 
+/** Cloud icon for the Daytona-backed SSH runtime (a managed cloud sandbox) */
+export function DaytonaIcon({ size = 10, className }: IconProps) {
+  return (
+    <svg
+      width={size}
+      height={size}
+      viewBox="0 0 16 16"
+      fill="none"
+      stroke="currentColor"
+      strokeWidth="1.5"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+      aria-label="Daytona Runtime"
+      className={className}
+    >
+      <path d="M4.5 12.5 A3 3 0 0 1 4.2 6.5 A4 4 0 0 1 11.8 6 A3.25 3.25 0 0 1 11.5 12.5 Z" />
+    </svg>
+  );
+}
+
 /** Container icon for Docker runtime */
 export function DockerIcon({ size = 10, className }: IconProps) {
   return (