So I wrote a wrapper around Gondolin which allows me to do that and a few other things: https://github.com/codethief/tuor
(Warning: Still very much experimental / underdocumented.)
It seems with gondoling i need to explain the agent to run commands in the sandbox, but then where does the agent run itself?
Their example implementation with pi uses a pi extension so that pi runs on the host but the read/write/bash/etc tools run in the guest. Doesn’t have to be that way though.