A computer-use agent that never leaves your Mac

6 July 2026 · from the dev log

A few weeks ago Quenderin's agent learned to organize a folder. Today it can drive most of your Mac — and it does the whole thing on your machine, with no screen, no files, and no intent ever streamed to anyone's datacenter. If you've looked at cloud computer-use agents like Cowork and wanted the capability without handing a remote company a live feed of your desktop, this is that.

What it can do now

From the terminal, quenderin do "<anything>":

• Files. Grant a folder with --workspace ~/Downloads and it can list, read, move, rename, create, and trash-to-a-visible-folder — never overwriting, never really deleting.
• Apps it can script. Calendar, Reminders, Notes, Mail (drafts only — it never hits send), Clipboard, opening apps and URLs.
• Your Apple Shortcuts. mac.shortcuts.run invokes any shortcut you've built, by name — so your entire existing automation library becomes something you can ask for in plain language.
• Any app at all. With --gui it reads the frontmost app through the accessibility layer and clicks buttons, picks menu items (File › Export), types, and navigates — not just AppleScript-friendly apps. This is the part that matches what a cloud agent does, done locally.

The part a cloud agent can't copy

Capability isn't the interesting bit — control is. Every mutating step is governed by the same boring spine, and it buys you four things a remote agent structurally can't offer:

• Stop, instantly. The kill switch is checked on your machine between every step. Ctrl-C and the next step never runs — no round-trip to a server that already fired the action.
• Review, per task. quenderin history is a plain, local log of everything it did and refused, grouped under the task that caused it. A cloud service hands you an opaque chat transcript; this is a file you own.
• Undo the whole task — even later. quenderin undo reverses what a run changed, newest-first, and it works from a fresh session an hour afterwards. Transactional undo of your local machine is not something a datacenter can do for you.
• Rehearse it first. --dry-run executes the read-only steps for real — so the plan is grounded in your actual folder — but only previews anything that would change. See exactly what it would do, touching nothing.

And underneath all of it: no AI middleman. The model that reasons about your screen and files runs on your CPU. The apps you use still see what you hand them, but no AI company ever gets a copy. For anyone in law, medicine, or finance, that's the line between "can use an agent" and "can't." More on the trade-offs: why a local agent beats a cloud one.

Built to fail safely on a small model

On-device models are smaller than frontier ones, so the honest engineering question isn't "can it be brilliant" — it's "does it fail gracefully." Two guards make it usable in practice: if the model gets stuck repeating the same step, it's nudged once and then stops cleanly instead of looping; if it emits malformed output, it's shown the format and given another try rather than dying. And every step streams to your terminal as it happens, so you watch it work and can pull the plug the moment something looks off.

The honest boundaries

The full computer-driving surface is macOS-first and behind an explicit --gui opt-in that needs the system Accessibility permission — it's the most powerful thing here, so it's off by default. A small local model will sometimes pick the wrong step; that's exactly why nothing runs without your per-run yes, why app control still asks even under --yes, and why undo exists. Any credentials that pass through are masked before they reach the on-disk log. Nothing here is autonomous by surprise.

Try it

It ships with the source today — quenderin capabilities lists the whole toolkit, and the download page has the one-line install. It's free and open-source, as the chat apps and the model library always will be. Where this is all going, stage by stage: the roadmap.