Migrate off the deprecated @daytonaio/sdk

CHANGELOG.md

@@ -13,6 +13,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `agentworkforce --version` tells you when a newer release is published and
   prints the command that installs it.
 
+### Changed
+
+- `@agentworkforce/deploy` and `@agentworkforce/daytona-runner` migrated off the
+  deprecated `@daytonaio/sdk` to its replacement `@daytona/sdk` (same API, no
+  breaking changes upstream). Installing workforce no longer prints a
+  deprecation warning for it.
+- `@agentworkforce/deploy` tracks `@agent-relay/cloud` ^10.1.0, matching
+  `@agentworkforce/cli`, so an install resolves one copy instead of two.
+
 ## [4.1.39] - 2026-08-11
 
 ### Added

package.json

@@ -13,13 +13,6 @@
       "hono": ">=4.12.21",
       "ws": ">=8.20.1",
       "qs": ">=6.15.2"
-    },
-    "packageExtensions": {
-      "@daytonaio/sdk@*": {
-        "dependencies": {
-          "ws": ">=8.20.1"
-        }
-      }
     }
   },
   "devDependencies": {

packages/daytona-runner/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Peer dependency moved from the deprecated `@daytonaio/sdk` to `@daytona/sdk`
+  (same API, no breaking changes upstream) and widened to `>=0.185.0`.
+  Consumers install `@daytona/sdk` instead.
+
 ## [4.1.50] - 2026-08-24
 
 ### Released

packages/daytona-runner/README.md

@@ -5,15 +5,15 @@ Daytona-backed `WorkflowRuntime` adapter for AgentWorkforce deploy workflows. Th
 ## Install
 
 ```sh
-npm install @agentworkforce/daytona-runner @daytonaio/sdk
+npm install @agentworkforce/daytona-runner @daytona/sdk
 ```
 
-`@daytonaio/sdk` is a peer dependency — consumers bring their own version (^0.148.0).
+`@daytona/sdk` is a peer dependency — consumers bring their own version (>=0.185.0).
 
 ## Usage
 
 ```ts
-import { Daytona } from '@daytonaio/sdk';
+import { Daytona } from '@daytona/sdk';
 import {
   DaytonaRuntime,
   resolveDaytonaAuthCredentials,

packages/daytona-runner/package.json

@@ -34,9 +34,9 @@
   },
   "dependencies": {},
   "peerDependencies": {
-    "@daytonaio/sdk": "^0.185.0"
+    "@daytona/sdk": ">=0.185.0"
   },
   "devDependencies": {
-    "@daytonaio/sdk": "^0.185.0"
+    "@daytona/sdk": "^0.205.0"
   }
 }

packages/daytona-runner/src/runtime.test.ts

@@ -1,6 +1,6 @@
 import { after, before, describe, it } from 'node:test';
 import assert from 'node:assert/strict';
-import { Daytona } from '@daytonaio/sdk';
+import { Daytona } from '@daytona/sdk';
 
 import * as pkg from './index.js';
 import { DaytonaRuntime, applyDaytonaAuthEnv, resolveDaytonaAuthCredentials } from './index.js';

packages/daytona-runner/src/runtime.ts

@@ -1,4 +1,4 @@
-import type { Daytona, Sandbox } from '@daytonaio/sdk';
+import type { Daytona, Sandbox } from '@daytona/sdk';
 import type {
   ExecOptions,
   ExecResult,

packages/deploy/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Migrated from the deprecated `@daytonaio/sdk` to `@daytona/sdk` (same API, no
+  breaking changes upstream).
+- Bumped `@agent-relay/cloud` to ^10.1.0 to match `@agentworkforce/cli` and
+  deduplicate the installed tree.
+
 ## [4.1.50] - 2026-08-24
 
 ### Released

packages/deploy/package.json

@@ -32,10 +32,10 @@
     "lint": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@agent-relay/cloud": "^8.7.0",
+    "@agent-relay/cloud": "^10.1.0",
     "@agentworkforce/persona-kit": "workspace:*",
     "@agentworkforce/runtime": "workspace:*",
-    "@daytonaio/sdk": "^0.185.0",
+    "@daytona/sdk": "^0.205.0",
     "esbuild": "^0.25.0",
     "semver": "^7.8.5",
     "validate-npm-package-name": "^5.0.1"

packages/deploy/src/modes/sandbox-client.test.ts

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
-import { createProxySandboxClient, SANDBOX_BUNDLE_DIR } from './sandbox-client.js';
+import { createByoSandboxClient, createProxySandboxClient, SANDBOX_BUNDLE_DIR } from './sandbox-client.js';
 import type { BundleResult } from '../types.js';
 
 interface RecordedCall {
@@ -255,3 +255,33 @@ test('proxy client throws when npm install in the sandbox fails', async () => {
     await rm(dir, { recursive: true, force: true });
   }
 });
+
+test('createByoSandboxClient builds a client from Daytona credentials', () => {
+  const client = createByoSandboxClient({ apiKey: 'sk_byo' });
+
+  assert.equal(typeof client.mint, 'function');
+  assert.equal(typeof client.exec, 'function');
+});
+
+test('createByoSandboxClient rejects missing Daytona credentials up front', () => {
+  assert.throws(
+    () => createByoSandboxClient({}),
+    /BYO sandbox client requires DAYTONA_API_KEY/
+  );
+});
+
+// A JWT token is only usable with an organization id. The SDK enforces that in
+// its constructor, which runs eagerly here — so an incomplete JWT config fails
+// while building the client rather than at the first mint().
+test('createByoSandboxClient rejects a JWT token with no organization id', () => {
+  assert.throws(
+    () => createByoSandboxClient({ jwtToken: 'jwt_probe' }),
+    /DAYTONA_ORGANIZATION_ID is required/
+  );
+});
+
+test('createByoSandboxClient accepts a JWT token paired with an organization id', () => {
+  const client = createByoSandboxClient({ jwtToken: 'jwt_probe', organizationId: 'org_1' });
+
+  assert.equal(typeof client.mint, 'function');
+});

packages/deploy/src/modes/sandbox-client.ts

@@ -1,5 +1,5 @@
 import { readFile } from 'node:fs/promises';
-import { Daytona, type Sandbox as DaytonaSandbox } from '@daytonaio/sdk';
+import { Daytona, type Sandbox as DaytonaSandbox } from '@daytona/sdk';
 import type { PersonaSpec } from '@agentworkforce/persona-kit';
 import type { BundleResult } from '../types.js';
 

packages/deploy/src/modes/sandbox.ts

@@ -19,7 +19,7 @@ const DEFAULT_CLOUD_URL = 'https://cloud.agentworkforce.com';
  *
  *   - **BYO** — `DAYTONA_API_KEY` (or `DAYTONA_JWT_TOKEN` +
  *     `DAYTONA_ORGANIZATION_ID`) is present in env. The launcher talks
- *     directly to Daytona via `@daytonaio/sdk`. Zero workforce-cloud
+ *     directly to Daytona via `@daytona/sdk`. Zero workforce-cloud
  *     round-trips; useful in CI or for power users with their own
  *     Daytona accounts.
  *   - **Workforce-managed** — `DAYTONA_API_KEY` is absent but