[ananthsub]

Summary

Follow-up to #1377 addressing the config-usability feedback (thread): the inline sandbox_provider: block welded provider connection/lifecycle config (and its secret) into the agent config, making it hard to swap providers.

This decouples the two. A sandbox is now a named block — <name>: { <provider>: {config} } — defined in its own provider config file, and an agent points at it by name (sandbox_provider: sandbox). The framework only ever resolves a name → one provider config.

• Single (default): ship a sandbox block; the agent defaults to sandbox_provider: sandbox.
• Swap providers (no agent edit): every shipped provider config binds the same name sandbox, so swapping providers is swapping one +config_paths entry.
• Multiple / mixed / same-type: give blocks distinct instance names and reference each explicitly — no framework change.

Changes

• Add nemo_gym.sandbox.resolve_provider_config — resolves a sandbox name (from the merged config) or an inline single-key mapping to a single {provider: config} dict for create_provider.
• Add nemo_gym/sandbox/providers/opensandbox/configs/opensandbox.yaml defining the named sandbox block.
• Make responses_api_agents/mini_swe_agent_2 provider-neutral: sandbox_provider accepts a name (default) or inline mapping; the reference is resolved at runtime. Renamed mini_swe_agent_opensandbox.yaml → mini_swe_agent_2.yaml.
• README documents the single concept plus single / swap / multi-sandbox usage.
• Unit tests for the resolver and the named-reference agent path.

Bottom of a 2-PR stack; the follow-up adds provider-contributed default sandbox metadata.

Refs #1377

Test plan

• uv run pytest tests/unit_tests/test_sandbox.py tests/unit_tests/test_opensandbox_provider.py responses_api_agents/mini_swe_agent_2/tests/
• uv run ruff check + ruff format --check clean
• End-to-end config composition verified through GlobalConfigDictParser

[hemildesai]

should this be sandbox_provider: opensandbox?

[ananthsub]

no this is intentional.

sandbox here is a provider-agnostic instance name, which acts as the handle that the agent references. it's not the provider type. the provider type is the inner key inside of the provider config

this is structured closer to the other gym configs

sandbox:            # instance name the agent references
  opensandbox:      # provider registry key
    connection: ...

if we ship every provider config under the same canonical name sandbox, then for the common use cases, users can swap sandbox providers without any edits to the agent config

[hemildesai]

Hmm, I think it may be confusing to infer which sandbox provider was used if the agent config doesn't reference it explicitly right?

Wouldn't it be better to just switch using cli like --sandbox_provider opensandbox or --sandbox_provider daytona etc to keep it explicit?

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.