I have already written about why I built agent-sandbox and why I use pi-subagents to plan and validate work.
Recently, both changed. Not because I had more features planned, but because I kept using them.
Building solves the problems you started with. Using what you built reveals the ones you missed.
The first /build workflow in pi-subagents ran its checks sequentially. It was simple and worked well for smaller tasks, but as I started using it on more complex work, the cost became obvious: independent checks were waiting for each other for no reason.
So I made them concurrent.
That made builds faster and immediately exposed the next problem. Several agents were now working at once, but from one terminal I could not see what each was doing.
So I made the concurrency visible. When Pi runs inside Herdr, each subagent gets its own named pane. Pi still owns the workflow; Herdr only exposes what is happening inside it.
Something similar happened with agent-sandbox.
Testing it with a new project exposed a boundary I had missed. The source code needed to be shared between macOS and the Linux sandbox, but node_modules did not. Architecture-specific dependencies installed on the host could fail inside Linux, so the project's tests could not run inside the sandbox.
The source belongs to the project. The dependencies belong to the environment. So agent-sandbox now keeps sandbox dependencies isolated while the source and lockfile remain shared.
None of these changes came from trying to anticipate every possible requirement. I could have designed all of this upfront. I probably would have designed more than I needed.
Every design decision introduces trade-offs. The right ones become clearer when the constraints are real.
Don't optimize for predicting what comes next. Optimize for learning and adapting.
Source
agent-sandbox and pi-subagents are open source.