The agent grows hands — locally
5 July 2026 · from the dev log
Until today, Quenderin's agent could compute: math, unit conversions, dates. Useful, deliberately harmless. Today it can do things to your computer — the first real slice of the mission on our roadmap: you say what you want, and an AI running entirely on your machine does it.
What it looks like
On the Agent screen, grant a workspace folder (a folder picker — the agent can never reach outside it). Then:
You: put the PDF reports into an Archive folder
Agent proposes this plan:
1. Move "report-q3.pdf" into "Archive/" (inside the workspace; undoable).
2. Move "report-q4.pdf" into "Archive/" (inside the workspace; undoable).
[ Allow this action ] [ Don't allow ]One approval, and it's done — with an Undo last move button if you change
your mind, and every action (including the refused ones) written to a plain-text ledger you
can open from Settings. It can also rename files and move them to a visible
Trash/ folder — never a hidden delete.
Why this is different from cloud agents
Products like computer-use agents from the big labs do this too — by streaming your screen and files to a datacenter. Quenderin's promise is structural: the model, the plan, and your files never leave the machine. That's not a policy we ask you to trust; there is no server to send anything to.
Why you can trust a small local model with your files
You shouldn't trust it to be smart. You should trust the architecture — that's our whole bet. A local model is weaker than a cloud frontier model, so the harness carries the safety, and every property below is enforced by code and pinned by tests, not by the model behaving:
- It names files; it can never mint paths. Inputs are plain names inside
the workspace —
../and absolute paths are rejected on shape. - Nothing writes without your yes — for that specific run. A standing Settings toggle isn't enough; every plan that changes files shows you the steps and waits. A surface that can't ask, can't write (fail-closed). Dismissing the dialog means no.
- Nothing is ever overwritten or deleted. Collisions are refused; "trash" is a visible folder; every change records its inverse for undo.
- Everything is on the record. A local, append-only ledger shows what the agent did and what it tried — refused actions included.
- A plan with one bad step is a bad plan. Blocklisted or unparseable steps refuse the whole plan before you're even asked.
The safety vocabulary itself (the list of actions the agent must never take autonomously — payments, deletion, credentials) is now one canonical file, enforced identical across macOS, Android, and the desktop by CI.
The honest boundaries
This is a first slice, and small models will sometimes call tools clumsily — the worst case is a refused action in the ledger, never a surprise on your disk. The agent works in one granted folder at a time, on purpose. Attachments now include PDFs on Mac/iOS (text extraction — scanned PDFs are refused honestly; no OCR yet). Android's core logic is at full parity, machine-enforced; its UI is catching up. Everything we know can go wrong is, as always, in the ledger of failure modes.