QwenPaw

QwenPaw: Files, the browser, and memory

This is page 3 of 8. After the first job, QwenPaw is set to STRICT with the command and browser tools off, and this page tries files, the web, and memory with one small exercise each.

These steps match the QwenPaw docs and the v2.3.0 code as checked on 14 November 2026, and they are the same on Windows and on a Mac. Keep STRICT on for this whole page, and keep the command tool, execute_shell_command, switched off.

Files

QwenPaw works on your real computer, so its file reach is wider than a container's. Each agent has its own workspace, and the default one is ~/.qwenpaw/workspaces/default, the same folder you opened after the first job.

The built-in file tools are read_file, write_file, edit_file, and append_file, plus grep_search and glob_search for finding files. When the command tool runs, it also starts in the workspace by default, but starting there is not the same as being held there.

Here is what limits those tools today:

This guide could not confirm that the file tools themselves are held to the workspace. The security docs also say File Guard "does not provide OS-level isolation against arbitrary code running as the same user," so treat any folder your account can open as within reach.

You can hand QwenPaw a file by attaching it in the chat. The Console says you can attach documents, images, and audio or video, with a size cap for each file. This guide could not confirm where QwenPaw stores an attached file, so attach only copies of files you would be fine losing or sharing.

QwenPaw can also send a file back to you with its send_file_to_user tool. For Office files and PDFs it has built-in skills called docx, xlsx, pptx, and pdf, which come from Anthropic's public skills collection, and file_reader handles plain text such as .txt, .md, .json, and .csv files.

Try it: sort a list you attach

Make a harmless file first. Open Notepad on Windows or TextEdit on a Mac, type six grocery items, one per line, and save it as groceries.txt in your Documents folder, where QwenPaw can read it only because you attach it.

Open Chat, click New Chat, attach groceries.txt, and paste:

I attached groceries.txt. Sort the items into three groups called produce, dairy, and other. Save the result as a new file called groceries-sorted.md in your own workspace folder. Do not run commands, open a browser, or touch any other folder.

Approve only steps that read the attachment or write groceries-sorted.md in the workspace, and reject anything else.

What you should see groceries-sorted.md in ~/.qwenpaw/workspaces/default with your items in three groups, and the original groceries.txt unchanged in Documents.

The web

QwenPaw has two separate ways to use the web, and each is its own tool on the Workspace → Tools page.

Search and fetch. The web_search tool searches the web through AnySearch by default, which works without a key, and you can pick Tavily or Firecrawl on the tool's card instead. The web_fetch tool reads one page and turns it into text. Your search words go to whichever search company you picked, so keep private details out of them.

A real browser. The browser tool drives a real browser that can open pages, click, type, and read what is on the screen, and the docs mark it Beta. The agent controls it by writing short Python programs, and the v2.1.0 release notes say this "is not protected by a host-level sandbox." The v2.3.0 code says real system-level walls for it are still "planned."

Which browser it uses depends on a setting called identity:

Do not install the Chrome plugin for now, so the browser stays a guest with no logins. When a site asks for a sign-in, a CAPTCHA, or a two-factor code, the docs say the agent stops and hands that step back to you. For this guide, the safe answer is to stop the job rather than sign in.

Every page the agent reads can carry a prompt injection, which is why the safety steps keep you logged out of email, your bank, and online stores.

Try it: save three facts from one public page

Go to Workspace → Tools and turn the browser tool back on. Leave execute_shell_command off.

Open a new chat and paste:

Use the browser to open https://en.wikipedia.org/wiki/Picnic and read the page. Save three short facts from it, plus the page address, in a new file called picnic-facts.md in your own workspace folder. Do not sign in, do not fill in any form, do not open any other website, and do not run commands.

Approve the browser steps that open that one address, and the step that writes picnic-facts.md. Reject anything that goes to another site or asks to sign in.

What you should see STRICT asking before each browser step, then picnic-facts.md in the workspace with three facts and the Wikipedia address.

When you finish, turn the browser tool off again until a job needs it.

Memory

QwenPaw remembers between chats, and it keeps that memory as ordinary text files in the agent's workspace, so you can read, change, and delete them. These are the main ones:

Two background jobs fill these folders. Auto-Memory runs after every five of your messages by default and saves what looks worth keeping, and Auto-Dream runs every night at 23:00 by default and sorts the day's notes into digest/. Both use the agent's own model, so they cost tokens on a paid key and use up free-tier allowance, and both report to the Inbox when they change something.

To see and edit memory, go to Workspace → Files and click MEMORY.md. If there are daily notes, click the ▶ arrow to expand the dates, then click a date to read or edit that day. Change the text and click Save, or Reset to throw away your edits.

To delete a memory for good, remove it from MEMORY.md and from the dated notes, and delete the matching files in memory/, digest/, and mem_session/ in the workspace folder. This guide could not confirm a single delete button for one memory.

To control what gets saved, use the chat commands. /new starts a fresh chat and saves the old one to memory in the background. /clear clears the chat without saving it, and the docs warn that /clear "is irreversible!"

To turn long-term memory off, go to Workspace → Configuration, find the Long-term memory card, choose disabled memory, and click Save. The docs say saving this reloads the agent.

Try it: save one preference and find it

In a chat, send:

Remember that I want prices in dollars and answers in short sentences. Save this preference in MEMORY.md in your workspace. Do not change any other file.

Approve only the step that writes MEMORY.md. Then click New Chat and ask, "How much is a typical cup of coffee?"

This guide could not confirm whether QwenPaw always writes a preference to MEMORY.md right away, which is why the prompt asks for it by name. If it does not, Auto-Memory should file it in a dated note after five messages.

What you should see a reply in the new chat in short sentences with a dollar price, and your preference in MEMORY.md on Workspace → Files, where you can edit or delete it.

Sources

Checked 14 November 2026.

Next

Continue to Phone and schedules.

Checked 14 November 2026 · prices, limits, and versions change