# JUJU 0.8.2 — cross-platform setup and native capability backends Release date: 2026-09-11 0.8.2 makes local capability preparation a first-class JUJU owner workflow. After installing `juju-mcp`, run `juju setup` to inspect, install and verify the local dependencies JUJU uses instead of manually assembling a different environment on each OS. ## Setup ```bash juju setup # install missing selected defaults and verify them juju setup --check # read-only readiness probes juju setup --plan # read-only plan juju setup --components git,ripgrep,ffmpeg,whisper,model,chromium,lsp,speech,desktop,sandbox ``` `juju setup` covers Git, ripgrep, FFmpeg/ffprobe, whisper.cpp, the pinned multilingual Whisper model, the Playwright-matched Chromium build, Python/HTML/CSS/JSON/YAML/Bash language servers, local speech, desktop support and the OS command sandbox. Existing owner registrations are preserved where applicable. Outbound web access remains a separate owner decision: `juju setup --enable-web` changes only `allowWebFetch`. Desktop application grants remain separate (`juju desktop allow ... --yes`). Setup never turns trusted/bypass mode on, never grants a remote MCP client more OAuth/workspace access and never silently disables a requested sandbox. ## Windows Windows x64 was exercised on a real Windows Server installation using built-in Administrator and Node v24.21.0. The candidate installed into an isolated prefix and state directory; the running 0.8.1 connector was not replaced during acceptance. Verified on that machine: - the 0.8.1 Administrators-owned state ACL fix still permits `doctor`/private state without relaxing the DACL invariants; - managed Git, ripgrep, FFmpeg, whisper.cpp/model, Chromium, six external LSPs, SAPI speech, desktop and command sandbox all pass `juju setup --check`; - Playwright Chromium launches with its Windows browser sandbox enabled. Setup grants only read/execute to the standard AppContainer package SIDs on the exact Playwright Chromium revision when Windows inheritance would otherwise deny startup; - native desktop capture/control uses the unlocked interactive desktop. A real visible window produced a JPEG capture, a foreground focus action and UI Automation evidence without privilege bypass; - the command sandbox uses pinned `@anthropic-ai/sandbox-runtime@0.0.75`, a dedicated `srt-sandbox` account and SID-scoped WFP rules. Setup grants the sandbox runtime group read/execute only on the exact native `srt-win` helper subtree and verifies that no write/delete/ACL authority was introduced; - the native confinement probe passed workspace write, outside write denial, owner-state read denial, direct-network denial and ACL cleanup; - a real MCP STDIO client listed all 74 tools, loaded the Git installed by setup, ran `run_command` with `sandbox:true` as `windows-srt`, wrote inside the workspace and received `EPERM` when it attempted to write `C:\ProgramData`. Windows desktop requires an unlocked interactive user session. Windows setup may request UAC for the one-time sandbox account/WFP provisioning. Local-drive workspaces remain the supported Windows sandbox path; UNC is not claimed here. Windows ARM64 dependency bundles were not native-tested in this release. ## Linux The release candidate was installed fresh in Debian bookworm arm64 / Node 22 in a Linux container. `juju setup` installed the missing dependencies and the subsequent check reported all ten software/backend components ready. The Linux desktop adapter was exercised against a real Xvfb X11 server with X-Resource, XTEST and a same-user D-Bus/AT-SPI session: process identity/app ID discovery, JPEG capture, focus and accessibility enumeration completed. This backend applies to X11 and XWayland-style sessions where `DISPLAY`, XTEST and AT-SPI are available. A pure Wayland portal-only desktop is not claimed as supported by this release. The Linux command sandbox uses bubblewrap and passed the real workspace-write, outside-write-denied, direct-network-denied and cleanup probe. ## macOS The development host is macOS arm64 / Node v22.23.2. Full typecheck/lint/core/packaging gates pass on the 0.8.2 source. Setup deep probes exercise the installed Git/ripgrep/media/Whisper/Chromium/LSP/speech stack, and the system Seatbelt adapter passes the real sandbox confinement probe. macOS desktop continues to use Screen Recording and Accessibility permissions controlled by the owner and the OS. ## Security properties retained - setup downloads are version/integrity pinned where JUJU performs direct downloads; redirects remain limited to reviewed HTTPS publisher hosts; - Windows ZIP extraction rejects traversal, reparse/special entries, ADS/reserved names, case collisions and expansion limits; - managed tool paths stay under private JUJU owner state and are activated process-locally rather than modifying the machine PATH; - Windows sandbox status parses the exact pinned `srt-win` status contract and cross-checks sandbox SID/marker/WFP identity before claiming provisioning; - Windows sandbox scratch launchers use randomized private leaves under `ProgramData` so the dedicated sandbox user can traverse the parent without granting access to the owner's profile; - protected system directories such as `System32` are never modified merely to make a sandboxed command executable; - web permission, desktop app consent, OAuth/workspace ACL, trust mode and schedule approval stay separate from dependency installation. ## Evidence boundary Automated/native evidence is summarized in `docs/TEST_REPORT.md` and stored under `release-evidence/0.8.2/`. Historical 0.8.0/0.8.1 candidate and hotfix evidence is retained unchanged. This release does **not** turn unexecuted manual scenarios into passes. External ChatGPT custom-MCP acceptance, a second-Windows-user privacy test, enabled 8.3-volume aliases, Defender/OneDrive permutations and pure Wayland portal-only desktop behavior remain separate manual/compatibility evidence where documented.