Claude Code Wsl Sandbox — AI skill for Claude Code

Sandboxed Claude Code on Windows (WSL 2 + ai-jail + Bitwarden SSH signing)

A reproducible setup for running an AI coding agent on Windows inside an OS-level sandbox, while keeping SSH commit signing backed by Bitwarden.

The agent can only read and write the project directory. It cannot reach `~/.ssh`, the Windows filesystem, or any Windows executable. Commits are still signed by the key held in Bitwarden, which never touches disk.

Why I built this

This is my personal setup, documented so I can rebuild it and so others can copy the parts they want.

The motivation is **not** fear of malware. I do not assume Claude Code is compromised or hostile. The problem is a much more ordinary one: an agent that wanders. Left unconstrained it will run `reg.exe` queries, poke at Windows config, read dotfiles, or start "helpfully" fixing things nowhere near the code I asked about. Sometimes it goes far beyond the request, which is scope creep rather than sabotage.

So the goal is containment of *reach*, not defence against an attacker. When I ask for help with a project, the agent should only be able to act on that project. Everything else on the machine is simply not there. As a bonus, the same boundary happens to limit the damage if a repo ever does contain a prompt injection.

Worth being clear about the limit: the sandbox constrains **where** the agent can act, not **how much** it does. For bounding behaviour, see [Security notes](#scope-creep-is-not-a-security-control).

Paths below assume the username `diogo` on both Windows and WSL. Adjust as needed.

What is in this repo

• README.md, this guide
• `.ai-jail`, my per-project sandbox config, and `.ai-jail-global`, which belongs at ~/.ai-jail. See Part 8
• `CLAUDE.md` and `jail.md`, the standing session instructions, see Part 9

They are meant to be copied and adapted, not used verbatim.