Guide
Sandboxing and Watching the Pi Coding Agent on Windows
There is no 'pulse' feature for watching Pi, and no Pi-specific Windows sandbox. There is Windows Sandbox, WSL2, and AppContainer, and each covers something different.
Pi, the open source coding agent from Earendil, installs on Windows (its installer offers a PowerShell path alongside the macOS and Linux ones), but it ships with no built-in permission system and no live activity feature to monitor, which means there is nothing called a 'pulse' to watch and no Windows-specific sandbox to turn on. Pi's own documentation names three containerization patterns, Gondolin, Docker, and OpenShell, and all three assume a Linux-style environment underneath. On Windows that leaves three real building blocks: Windows Sandbox, a disposable virtual machine built into Windows Pro, Enterprise, and Education (not Home), that wipes itself on close; WSL2, a real Linux kernel in a lightweight managed VM, which is the natural home for Pi's own Linux-first patterns; and AppContainer, the low-level isolation Windows itself uses for apps like Microsoft Edge, which is a developer API rather than a one-command wrapper you can point at Pi. For watching Pi work, Task Manager's per-process view is the closest Windows equivalent to a pulse, showing CPU and activity, nothing more. Forkbench, which has its own pulse signal for exactly this, does not run on Windows yet.
Clearing up what this query is actually asking
Two different things get folded into this search, and neither one is a shipped feature. 'Pulse' is not a feature Pi has, and not a Windows API either; it is Forkbench's own name for a live, per-tab activity signal, and the phrase has leaked into searches about watching any agent work. 'Pi coding agent sandbox for Windows' is not a product either, because Pi does not ship a sandbox at all, for any operating system.
What is real: Pi is a real, MIT-licensed coding agent built by Earendil, and it genuinely installs on Windows. Its own installation instructions offer a PowerShell command for Windows alongside the curl-based one for macOS and Linux. What is also real: once installed, Pi's README states plainly that it has no built-in permission system restricting filesystem, process, network, or credential access, on any platform, Windows included. So the honest version of this page is two separate answers: how do you box Pi in on Windows, and how do you watch it while it runs.
- 'Pulse' is Forkbench's own term for a live activity signal, not a feature Pi or Windows has.
- Pi installs on Windows through its own PowerShell installer.
- Pi has no built-in sandbox on any platform, Windows included.
What Pi's own documentation recommends, and why it points away from Windows
Pi's README describes three containerization patterns under a section called Permissions and Containerization. The Gondolin extension keeps Pi and its provider credentials on the host while routing tool calls and shell commands into 'a local Linux micro-VM.' Plain Docker runs the whole Pi process in a container. OpenShell runs the whole process inside what the documentation calls a policy-controlled sandbox.
All three assume a Linux layer is already there. On macOS and Linux, that layer either exists natively or comes from Docker Desktop. On Windows, none of the three works the way it does on Linux without something underneath supplying that same Linux environment first, which is exactly what the next section's three options are for.
- Gondolin: Pi stays on the host; tools and shell commands run in a local Linux micro-VM.
- Docker: the whole Pi process runs in a container.
- OpenShell: the whole process runs in a policy-controlled sandbox.
- All three need a Linux-style environment underneath, which Windows does not provide natively.
Option 1: Windows Sandbox, a disposable VM you already have
Windows Sandbox is built into Windows and, per Microsoft's own documentation, offers 'a lightweight, isolated desktop environment for safely running applications,' isolated from the host through hardware-based virtualization. It ships with Windows Pro, Enterprise, and Education, not Home, and Microsoft's licensing table confirms it is not available on the Home edition at all.
The catch for running Pi specifically is what Microsoft calls disposable: 'closing it deletes all software, files, and state,' and 'host-installed software isn't available in the sandbox,' so Pi and Node have to be installed fresh every time you open it, unless you script that install into a startup command in the sandbox's configuration file. Networking is on by default inside Windows Sandbox, so it is not a network boundary on its own; Microsoft's documentation notes this explicitly and lets you disable it in the configuration file if you want Pi to have no network access while it works.
- Built into Windows Pro, Enterprise, and Education. Not available on Windows Home.
- Hardware-based virtualization, a disposable VM: closing it wipes everything.
- Host software is not available inside it, so Pi needs reinstalling each launch unless you script it.
- Networking is on by default and has to be turned off deliberately if you want it closed.
Option 2: WSL2, the natural home for Pi's own patterns
WSL2 is where Pi's own Linux-first recommendations actually fit. Microsoft's documentation describes it as running 'a Linux kernel inside of a lightweight utility virtual machine,' with full system call compatibility, which is why Docker and other Linux-native tools work inside it the same way they do on a real Linux machine. That makes WSL2 a practical place to run Pi's own Docker or OpenShell pattern directly, rather than improvising something Windows-specific.
It is not a hardened security boundary by default, though. Files on the Windows side and the Linux side are each reachable from the other, and WSL2's networking uses NAT with its own IP address rather than being bridged to or fully separated from the host. Treat WSL2 as the environment that lets Pi's existing patterns work on Windows, and still apply one of those patterns, Docker or OpenShell, inside it rather than running Pi loose in the WSL2 shell.
- A real Linux kernel in a managed, lightweight VM, with full system call compatibility.
- The natural place to run Pi's own Docker or OpenShell containerization pattern on Windows.
- Not a hardened boundary by itself: Windows and Linux files cross-mount, and networking is NAT, not isolated.
Option 3: AppContainer, the primitive Windows apps use
AppContainer is real and it is strong, but it is not a tool you point at an arbitrary command the way sandbox-exec works on a Mac. Microsoft's own documentation describes it as isolating an application across credentials, devices, files and the registry, the network, and other processes, used by Windows itself for things like parts of Microsoft Edge. Each of those isolation types is granted or denied through capability permissions the containerized app declares.
The gap for a tool like Pi is that AppContainer is a developer API, built with calls such as CreateAppContainerProfile, not an end-user command line wrapper. There is no equivalent of running `appcontainer-exec pi` the way you would run `sandbox-exec` on macOS. Using it for Pi means writing a small launcher that creates the profile and starts Pi inside it, which is a real option for a team with the engineering time, not a five-minute setup for an individual developer.
- AppContainer isolates credentials, devices, files, network, and processes, with capabilities granted individually.
- It is the mechanism behind parts of Windows itself, such as Microsoft Edge's own sandboxing.
- It is a developer API, not a command you can run against Pi directly; using it means writing a small launcher first.
Watching Pi work, with no Windows 'pulse' feature to reach for
Windows has no feature called a pulse, and neither does Pi. The closest real equivalent to watching an agent's activity on Windows is the same thing you would use for any process: Task Manager or Resource Monitor's per-process view, which shows CPU and disk activity for Pi's process the same way Activity Monitor does on a Mac or htop does on Linux. It tells you Pi is doing something. It does not tell you what.
Pi's own terminal output is still the most specific signal you have, whichever of the three boxes above you are running it in: every file it opens and every command it runs streams past in that same window. If you are running Pi inside WSL2, htop inside the Linux side works exactly as it would on a native Linux machine.
- No Windows feature is called a 'pulse,' and Pi does not ship one either.
- Task Manager or Resource Monitor's per-process view is the closest equivalent: activity, not detail.
- Pi's own terminal output remains the most specific signal, inside any of the three options above.
Where Forkbench fits, which is not here yet
Forkbench is the product that actually ships a pulse, a live per-tab signal driven by CPU and output rate with a flag when an agent is blocked, plus a Vault that lets a command use a key without the value reaching the prompt, and a folder lock built on the macOS kernel sandbox. All of that only exists on macOS today. Forkbench does not run on Windows, and there is no date yet for when Windows support arrives, so none of the mechanisms above come from Forkbench if you are on Windows right now.
If your work moves between a Windows machine and a Mac, the honest plan is to use Windows Sandbox or WSL2 for Pi on Windows as described above, and treat Forkbench as the tool for the Mac side of that same workflow once you are there, not as a Windows solution in waiting.
- Forkbench's pulse, Vault, and folder lock are macOS features today.
- Windows and Linux support for Forkbench is in development, with no release date.
- On Windows today, Windows Sandbox or WSL2, not Forkbench, is the real option for boxing in Pi.
Related: Top tools for sandboxing the Pi coding agent, How to watch a vibe coding agent in real time, Managing AI agent keys securely on Windows, Download Forkbench for Mac
Frequently asked
Does Pi have a 'pulse' or any built-in monitoring on Windows?
No. Pulse is not a feature Pi ships, on Windows or any other platform. The closest thing to watching Pi's activity on Windows is Task Manager's per-process view, plus Pi's own terminal output.
Can I run Pi inside Windows Sandbox?
Yes, but Windows Sandbox is disposable: closing it wipes Pi and everything else you installed, so you either reinstall it each time or script the install into the sandbox's startup configuration. It also allows network access by default unless you turn that off.
Is WSL2 a security sandbox for Pi?
Not by itself. WSL2 gives you a real Linux kernel, which is useful because it is where Pi's own Docker and OpenShell patterns actually work on Windows, but Windows and Linux files cross-mount by default and networking uses NAT rather than a hard boundary.
Can I use AppContainer to sandbox Pi on Windows?
In principle, yes, since AppContainer isolates files, the registry, the network, and processes. In practice it is a developer API that an app has to be built or launched into, not a one-line command, so using it for Pi means writing a small launcher rather than running a single tool.
Does Forkbench support running Pi on Windows?
No. Forkbench is a Mac app today, and its Vault, folder lock, and pulse features are all macOS only. Windows and Linux support is in development, with no release date set.