Release Somnia v12.2.0-alpha.3 · philppplik/somnia

Somnia v12.2.0-alpha.3

Private alpha. Windows and Linux installers (macOS build intentionally skipped for alpha).

Native ACP client and panel: launch local stdio agents (name, executable, JSON args), session list across dock switches, new/resume, prompt, cancel/close. Transcript view with consent origin labels. Limits are visible in the UI (4 agents, 100k chars, 500 events). Panel docks into the Studio review next to Review Extensions and fails closed with an unavailable banner when the bridge is missing.
Consent broker bridge: all ACP consent flows run through the runtime consent broker (main-window gated, single request object). Deny / Allow once / Allow for this session; session grants are digest-bound and revocable from a new grants view.
Process isolation for agents: Linux spawns under bwrap (read-only /usr /bin /lib* /etc; agent binaries must be installed system-wide - home installs fail visibly), Windows spawns as long-lived AppContainer sessions (zero capabilities, kill-tree via job object). Elevated sessions stay forbidden.
Computer-use PREP only: risk review, fail-closed session/action policy and consent UI land in this build, but computer use stays unavailable everywhere (no OS adapter, no global hooks, no clipboard). Nothing here can move a mouse or read a screen yet.

MCP server processes now spawn through the consent broker with process isolation. Servers run with a fixed environment and a visible filesystem; every server start without a covering program grant asks first.
MCP HTTP now goes through the domain proxy (https only) and needs an Allow-for-session domain grant. Loopback HTTP transport was removed.
Per-call MCP approval is now tri-state (Deny / Allow once / Allow for this session) with schema-pinned grants: a tool definition change drops the grant, revoke takes effect immediately.
cfg.env in MCP server configs is rejected (mcp_env_unsupported).

Installers and SHA256SUMS below. Built from the green CI run on the tagged commit.