I tried many of these pi extensions but they have tons of paper cuts. Don't remember which one had which issue but here are some I ran into:

* commands run by me (! prefix) are also sandbox blocked

* agent has no way to _request_ unsandboxed execution (e.g. if `kubectl whatever` is rejected by the sandbox, the model should have the chance to request permission)

* does not understand shell composition patterns (e.g. if `git status` is allowed and `git log` is allowed, then `git status && git log` should be allowed automatically)

* sandbox only supported on mac or linux. not both

All of that can be fixed by yourself. That's certainly the spirit of pi. But if you want strong defaults and batteries included (like omp promises) then that's just annoying.