Sonder-runtime

Control independent agent conversations with scoped parent authority.

Show, enable, or revoke process-local hosted/cloud model consent.

Offload a self-contained subtask to a local or Ollama-cloud model.

Extract fields from text you supply, with each one citing its source span.

Ask through Sonder Runtime and show observable activity for the response.

Feed a real-world outcome back into sonder's learning loop.

Validate non-code artifacts with deterministic checks.

Compile and execute many snippets concurrently.

Generate several Python code candidates in parallel, then compile/run each.

Generate, compile, and execute many candidates across multiple languages.

Run a bounded self-improvement campaign across multiple languages.

Repair planted bugs in scratch projects, verified by their own tests.

Report what sonder has learned so far.

Show outcome coverage, positive signals, lesson provenance, and memory hygiene.

Show context budget, live turns, summaries, and memory as text meters.

Show active and most recent observable response activity.

Show requested virtual context and actual Ollama native num_ctx.

Select Sonder's requested virtual context size, up to 1m by default.

List slash commands/tools by name, category, risk, or summary text.

Create a visible task/todo row the model, console, and app can inspect.

List visible task/todo rows, pending and active by default.

Update task status/details. task_id may be an unambiguous id prefix.

Show one task and its recent visible event history.

Delete a task and all its children, events, and dependencies.

Batch-create a work plan: a parent task with ordered steps.

Show a compact progress summary of all tasks (or filtered by project).

Show a deterministic, digest-bound task ledger for one work plan.

Add or remove a dependency between tasks. task_id depends on depends_on.

Preview when/how Sonder should summarize or split context.

Show the effective permission decision: the rule, the mode, and which wins.

Preflight the direct-MCP permission gate for one registered tool without running it.

Set a local permission rule. Developer token or explicit env opt-in required.

Approve exactly one refused call once (by call id, or tool + arguments JSON), or revoke one.

List calls refused unattended (approvable by call id) and the one-shot approvals issued.

Audit lesson quality: duplicates, long/vague rows, embeddings, and FTS health.

Prune exact duplicate lessons; dry-run unless apply=True.

List redacted path/credential-like lessons without revealing raw values.

Delete only explicitly selected, currently privacy-flagged lessons; dry-run by default.

Refresh missing, legacy, or incompatible vectors with the local model.

Refresh raw interaction task vectors with the local embedding model.

Show which tiers currently feed the learning loop.

Suggest the next concrete improvements for learning quality and runtime health.

Run a master pass inline or with hardware-scheduled delegated agents.

Show live master/subagent activity, token estimates, and recent actions.

Show default or explicit per-run bounded orchestration capacity.

Cooperatively cancel one active agent/master prefix or all active agents.

Explicitly rerun one interrupted/failed/cancelled persisted master task.

Register a local hosted account. The first account becomes admin.

Login and return a bearer token for admin/debug commands and hosted API use.

Show the account attached to a session token.

List hosted accounts. Admin token required.

Update role/tier/dev flags/ban state. Admin token required.

Show hosted/admin safety state. Developer token recommended, local-safe without token.

Developer/admin inspection bundle without hidden chain-of-thought.

Refuse private chain-of-thought exposure unless the operator opted in twice.

Create a persistent parent task with ordered checklist items.

Show a checklist with Codex-style pending/active/done markers.

Update one checklist item by 1-based index or id prefix.

Show what actually went into a recent turn: prompt, lessons, tier, model.

Show the reasoning the model emitted for the current/last turn, if enabled.

Measured reliability, split by population and never averaged.

Show or set how much Sonder does without asking.

Turn Sonder's privilege axis on or off for this session, or show it.

Show guarded filesystem roots and bypass state.

Find files under allowed roots; ignored paths require developer authentication.

Build a bounded read-only declaration index inside one guarded repository.

Read a UTF-8-ish text file inside allowed roots.

Read several guarded text files into one deterministic bounded pack.

Create a guarded transactional ZIP/TAR from explicit workspace inputs.

Preview or atomically create a deterministic structured-data conversion.

Inspect one guarded text log without execution or caller expressions.

Compare two guarded files/directories by path, type, size, and SHA-256.

Inventory guarded project manifests and evidence-backed command candidates.

Stream a guarded regular file into a fixed SHA-256 content digest.

Build a guarded deterministic SHA-256 file manifest and tree Merkle.

Prevalidate and list a bounded ZIP/TAR without extracting it.

Transactionally extract a prevalidated ZIP/TAR to a new directory.

Structured, read-only preview of a data file inside allowed roots.

Run a bounded read-only SQLite or structured text data query.

Preview-rollback or atomically apply one parameterized SQLite DML statement.

Create, overwrite, or append a text file inside allowed roots.

Copy one bounded binary-safe file inside allowed roots.

Move one bounded binary-safe file inside allowed roots.

Transactionally create/overwrite a bounded JSON list of project files.

Preview or atomically apply a bounded RFC 6902 subset to one JSON file.

Strictly preview or transactionally apply a bounded unified text diff.

Replace text in a file inside allowed roots.

Delete a file or directory. Dry-run by default; confirm must match returned string.

Inspect bounded read-only Git branch and worktree status at a repo root.

Inspect a bounded read-only unstaged or staged Git diff at a repo root.

Summarize a guarded workspace; ignored paths require developer authentication.

Parse bounded dependency manifests and lockfiles without execution/network.

List a bounded guarded tree; ignored paths require developer authentication.

Create a guarded directory and optional parent directories.

Read a bounded 1-based line range from a guarded text file.

Search guarded files; ignored paths require developer authentication.

Find guarded scripts; ignored paths require developer authentication.

Search PATH and Windows App Paths for installed programs.

Run a program as a bounded argv list; no shell command strings.

Discover tests in a project — detects the test framework (pytest, jest, vitest, cargo, go, dotnet) and lists test files and counts.