Unpin huggingface_hub in HF sandbox examples

[sergiopaniego]

Summary

Replaces the huggingface_hub git-commit pin in the two HF sandbox examples with a packaged version floor (>=1.22.0), now that the released huggingface_hub exports the sandbox proxy API. This is the follow-up promised in PR #841.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• New environment
• Refactoring

Alignment Checklist

Before submitting, verify:

• I have read .claude/docs/PRINCIPLES.md and this PR aligns with our principles
• I have checked .claude/docs/INVARIANTS.md and no invariants are violated
• I have run /pre-submit-pr (or bash .claude/hooks/lint.sh and tests) and addressed all issues

RFC Status

• Not required (bug fix, docs, minor refactoring)

Test Plan

Context: in PR #841, the two standalone HF sandbox examples pinned huggingface_hub to git commit 5b643062ac4efa4d940d7d614a4dfc8ccaf910b5 because no PyPI release exported SandboxPool yet. The last review comment noted: "Once Hub releases that API, we can replace the git pin with the packaged version floor."

That release is now out. Verified against the packaged huggingface_hub 1.22.0 wheel from PyPI:

• huggingface_hub/__init__.py exports Sandbox, SandboxPool, SandboxProcess, SandboxCommandResult.
• The API surface the provider uses is present: SandboxPool.create, Sandbox.proxy_url_for, Sandbox.proxy_headers.
• The SandboxPool(image=..., flavor=..., name=...) constructor kwargs in hf_sandbox_provider.py match the released SandboxPool.__init__ signature, so there is no drift between the pinned commit and 1.22.0.

Scope is limited to the two example header dependency blocks; no source or core dependency changes. The core floor in pyproject.toml stays at huggingface_hub>=0.20.0 on purpose, since HFSandboxProvider already guards the import with a clear RuntimeError for older versions and we don't want to force the new version on users who don't use the sandbox provider.

Claude Code Review

N/A

---

Note

Low Risk
Example-only dependency metadata; no runtime or core package constraint changes.

Overview
Swaps the git-commit pin on huggingface_hub in the two standalone HF sandbox example scripts (browsergym_trl_hf_sandbox.py, hf_sandbox_coding_env.py) for a PyPI floor of huggingface_hub>=1.22.0, now that the released package exports the sandbox proxy API (SandboxPool, etc.) those examples need.

No changes to library source or root pyproject.toml dependency floors—only the /// script dependency blocks in those examples.

^{Reviewed by Cursor Bugbot for commit 3094333. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[burtenshaw]

Example-only dependency metadata update; refreshed from main and required checks are green.

[cursor]

Alignment Review Report

Scope: 2 files, +2/-2 — swaps a pinned git-commit install of huggingface_hub for the released huggingface_hub>=1.22.0 inside the PEP 723 # /// script metadata of two example scripts.

Automated Checks

• Lint: PASS (for this diff). bash .claude/hooks/lint.sh exits non-zero, but only on ~20 pre-existing envs/ files (chat_env, coding_tools_env, jupyter_env, opencode_env, repl_env, terminus_env, textarena_env, agent_world_model_env) that this PR does not touch. The hook lints src/ tests/ envs/ and does not scan examples/, so both changed files are out of scope. No lint issue is attributable to this PR.
• Debug code: CLEAN (for this diff). check-debug.sh scans only src/; every hit is a pre-existing docstring print(...) example or CLI TODO. The changed examples/ files add no debug code.

Open RFCs Context

Open RFCs (000-project-phases, 001-abstractions, 002-env-spec, 003-mcp-support, 005-agentic-harnesses = In Review; 004-rubrics; 010 = Draft) all concern env abstractions, MCP/WS boundaries, and rewards/rubrics. None govern packaging, dependency management, or example scripts. No relevant open RFC.

Verification performed

• ✅ huggingface_hub==1.22.0 is on PyPI (released 2026-07-03, not yanked, current latest).
• ✅ Installed 1.22.0 in a clean venv and confirmed from huggingface_hub import SandboxPool resolves (huggingface_hub._sandbox.SandboxPool), and that Sandbox.proxy_url_for, Sandbox.proxy_headers, and SandboxPool.create all exist — exactly the API HFSandboxProvider uses (src/openenv/core/containers/runtime/hf_sandbox_provider.py, lines 75/90/277/279-292). The PR premise ("SandboxPool ships in 1.22.0") is correct and the >=1.22.0 floor is sufficient.
• ✅ The old commit ref 5b643062… appears only in these two files — the unpin is complete, no stragglers.

Tier 1: Fixes Required

None. The diff is limited to a valid PEP 508 dependency specifier; no Python logic changed.

Tier 2: Alignment Discussion

Principle Conflicts: None identified. Replacing an unpinned third-party git commit with a released, hash-verifiable PyPI version aligns with the "Cutting-edge for stability" trade-off (PRINCIPLES.md) and improves reproducibility/supply-chain hygiene.

RFC Conflicts: None identified.

Non-blocking observation (outside this diff)

HFSandboxProvider lives in the core library, yet core pyproject.toml still declares huggingface_hub>=0.20.0 (line 26) while the provider actually requires SandboxPool (>=1.22.0). The examples now express the real floor, but core metadata does not — so a core consumer of HFSandboxProvider who hasn't copied the example pin could resolve an old huggingface_hub (guarded gracefully by a clear RuntimeError). Pre-existing (from #841), out of scope for this PR, and not a blocker — but the team may want a hf-sandbox extra or a floor bump. cc @burtenshaw (authored the provider + examples in #841).

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review (1 optional, non-blocking core-metadata observation)
• 0 RFC conflicts

Clean, correct, well-motivated unpin — verified end-to-end.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Verified ✅ — I installed the released huggingface_hub==1.22.0 and confirmed from huggingface_hub import SandboxPool resolves, plus Sandbox.proxy_url_for / Sandbox.proxy_headers and SandboxPool.create, which is exactly what HFSandboxProvider uses. This >=1.22.0 floor is correct and sufficient, and it drops the unpinned git-commit install. Same change applies to examples/browsergym_trl_hf_sandbox.py:21.