DEV Community

Ahab
Ahab

Posted on • Originally published at indieseek.co

Qwen Code 0.21.9 Local Control: Pair a Phone Without Exposing Your Agent

#ai #qwen #security #productivity

Qwen Code 0.21.9 Local Control: pair a phone without exposing your agent

Quick answer

Qwen Code 0.21.9 adds Local Control to the CLI and Desktop app. Run qwen serve --local-control, or choose Control → Local Control… in Desktop, and Qwen shows a QR code that opens the active local session from a phone on the same network. Files, credentials, tools, and execution stay on the host computer.

The important boundary is easy to miss: Local Control uses a fresh 256-bit bearer token and strict browser origins, but its LAN connection is unencrypted HTTP. Use it only on a trusted private network. Never expose it through router port forwarding, a public address, or an anonymous tunnel. Treat the QR code as a temporary secret, supervise permissions as if you were at the host, and prove that turning the mode off revokes both the listener and token.

Who this is for

This guide is for developers who start a long Qwen Code task and want to watch progress, answer a permission prompt, or continue from a phone without moving the workspace to a cloud runner.

Local Control does not replace workspace trust or tool permissions. Keep the project boundary from the Qwen Code workspace-trust checklist and the action boundary from the agent permission regression checklist.

What shipped in 0.21.9

The stable August 10 release turns a manual LAN recipe into an explicit mode. The CLI binds its Web Shell to the IPv4 LAN, generates a token with 32 random bytes, prints QR codes for usable LAN addresses, and keeps the host awake. Protected HTTP and WebSocket routes retain bearer authentication and exact browser origins.

Desktop's normal daemon remains authenticated and loopback-only. Enabling Local Control starts a temporary LAN gateway, substitutes a pairing credential, and opens the session active when pairing began. Turning it off closes connections and invalidates the token.

The transport remains intentionally limited to same-network access. The official implementation says internet control needs an account-authenticated outbound relay and must not be approximated with port forwarding or an unauthenticated tunnel.

The boundary matrix

Boundary CLI Desktop Acceptance rule
Enablement Explicit --local-control Explicit menu toggle No LAN listener before opt-in
Host runtime Web Shell binds to IPv4 LAN Private daemon stays on loopback; temporary gateway faces LAN Existing session and daemon identity remain stable
Credential Fresh 256-bit token per run Separate short-lived pairing token Old token fails after disable/re-enable
Browser access Exact advertised origins plus loopback self-origin Gateway validates public Host and Origin Wrong origin or token is rejected
Transport HTTP on the trusted LAN HTTP on the trusted LAN No public Wi-Fi, forwarding, or anonymous tunnel
Stop action Ctrl+C Turn off Local Control or close its window Listener, connections, token, and sleep inhibition end

The URL fragment keeps the token out of the initial request, access log, and referrer; it does not add TLS. A QR screenshot or full link can still grant control, so do not share it.

A six-canary rollout

1. Establish the host boundary

Upgrade to stable 0.21.9 or later. Confirm the workspace, session, model, MCP servers, hooks, and approval policy. Phone access carries the host session's authority; it does not create a safer permission profile.

2. Establish the network boundary

Use a private network you control, without port forwarding or tunnel software. Desktop fails closed unless it verifies a private or link-local physical IPv4 address. Support here is IPv4-focused; do not infer an IPv6 or internet guarantee.

3. Pair through the supported entry point

For CLI:

qwen serve --local-control
Enter fullscreen mode Exit fullscreen mode

Do not combine it with custom --hostname, --token, --allow-origin, --no-web, or port 0; the command rejects these conflicts. In Desktop, open Control → Local Control… and keep the network warning visible.

4. Prove session continuity without a write

Scan from the same private network. Confirm Desktop opens the session active at enable time. Start with a read-only prompt for the session title and repository root. After switching Desktop sessions, toggle Local Control to generate a new link.

5. Prove authentication and origin denial

Try a credential-free browser profile or altered token; protected capabilities must not load. Keep the test payload-free and real credentials out of URLs, screenshots, history, and logs.

6. Prove revocation

Stop CLI with Ctrl+C, or turn off Desktop Local Control. The phone page and WebSocket should lose access; the old link must fail. Re-enable and confirm a new credential, then verify normal host sleep returns.

Common mistakes

  • Calling the mode “encrypted” because the token is strong. Authentication strength and transport encryption are different controls.
  • Using hotel, airport, coworking guest, or other untrusted Wi-Fi for an HTTP control session.
  • Publishing the listener through router forwarding, Cloudflare Tunnel, ngrok, or a similar public relay. That is outside the supported threat model.
  • Leaving Local Control on after the phone task ends, or assuming closing the phone tab revokes host access.
  • Sharing the QR screenshot in a bug report. Redact the entire code and URL.
  • Treating phone supervision as permission bypass. Keep destructive actions and credential access behind the same human approval gates used at the host.

For durable internet control, use authenticated outbound relay, reconnectable sessions, device identity, and transport encryption. A LAN gateway is not a substitute for the self-hosted agent trust boundary.

Copyable acceptance record 

qwen_version:
host_os / private_ipv4:
workspace / session_id:
entry_point: cli | desktop
lan_listener_absent_before_enable: pass | fail
phone_opens_expected_session: pass | fail
wrong_token_denied: pass | fail
unexpected_origin_denied: pass | fail
old_link_revoked_after_disable: pass | fail
new_token_after_reenable: pass | fail
sleep_inhibitor_released: pass | fail
public_forwarding_or_tunnel: none
owner / expiry_time / decision:
Enter fullscreen mode Exit fullscreen mode

FAQ

Does Local Control upload my repository to Qwen?

It exposes the host's Web Shell on the LAN; files, credentials, tools, and execution remain there. The model provider's data path is unchanged.

Is the pairing link safe to use over the internet?

No. The official scope is a trusted same-network connection over unencrypted HTTP. Internet remote control is explicitly outside this mode.

Does Local Control keep the computer awake?

Yes, while the mode is active. Stopping Local Control releases the sleep inhibitor; include that in the revocation test.

Sources

Top comments (0)