Everything you want to add can be made as an extension, and pi has many ready extension to be added. For example, Sandbox: `https://github.com/earendil-works/gondolin` The sandbox extension is at https://github.com/earendil-works/pi/tree/main/packages/codi... And the extension at `https://github.com/earendil-works/pi/tree/main/packages/codi...` Which can also be found under `/@earendil-works/pi-coding-agent/examples/extensions/gondolin` at the npm modules

In case of omp, not sure if it's already at the node module package but you can just grab it from the links I shared and set it up.

I tried many of these pi extensions but they have tons of paper cuts. Don't remember which one had which issue but here are some I ran into:

* commands run by me (! prefix) are also sandbox blocked

* agent has no way to _request_ unsandboxed execution (e.g. if `kubectl whatever` is rejected by the sandbox, the model should have the chance to request permission)

* does not understand shell composition patterns (e.g. if `git status` is allowed and `git log` is allowed, then `git status && git log` should be allowed automatically)

* sandbox only supported on mac or linux. not both

All of that can be fixed by yourself. That's certainly the spirit of pi. But if you want strong defaults and batteries included (like omp promises) then that's just annoying.

My workflow is generally like so:

- instruct model to write a markdown file with a phased plan to implement whatever feature or change I want

- start a new context, instruct model to implement one phase of the file

- review changes manually, then start a new context and have it do the next phase

- repeat as needed

I've never seen omp touch a file outside of the directory I start it up in, and the few times where I've been unhappy with a change git has been there to revert.

This could easily be a case of survivor bias but I've not had an issue with letting it go yolo yet.

Sometimes agents create huge half-minified one-off python/bash scripts to do some data processing. I'd prefer to neither review nor yolo these. Sandbox restricts reads/writes to designated directories, so at least there's no `rm -rf /` in there.