QwenPaw: Phone and schedules

This is page 4 of 8. It covers chat apps and schedules, which let QwenPaw take jobs while you are away from the computer, and then the trade-offs behind each safety setting from the earlier pages.

Later: chat apps and schedules

Only do this after the first job went right.

Chat apps

Chat apps are under Control → Channels, and the docs call DingTalk the recommended one. Each app has its own setup steps in the channels guide.

A chat bot that can touch files is a remote control for those files, so know these points from the docs before you turn one on:

• Every chat app starts open to anyone. The settings dm_policy (private messages) and group_policy (group chats) both start as "open". Change both to "allowlist" and put only your own user ID in allow_from. This guide could not confirm that every chat app's card in the Console shows these settings.
• WeChat (personal accounts) is in a limited test, and the docs say you have to apply before you can use it.
• QQ needs your computer's internet address on QQ's allow list.
• iMessage works only on a Mac. It needs a separate tool installed with Homebrew, and it needs Full Disk Access for Messages and for the app that runs QwenPaw. Full Disk Access lets that app read almost everything on your Mac, so think hard before you give it.

This guide could not confirm where approval requests show up when you send a job from a chat app.

What you should see one chat app on, set to your own user ID only.

Schedules

QwenPaw can run a job on a timer. The Console calls this Control → Cron Jobs, and some pages call it Scheduled tasks. There is also Control → Heartbeat, a regular check-in, which the docs say starts off.

The security docs warn that a run with nobody there to answer may log a danger and keep going. So before you schedule anything:

1. Go to Settings → Security → Tool Guard.
2. Add the command tool, execute_shell_command, to the denied tools list. A denied tool is blocked no matter what.
3. Send the results to the Inbox, so you can read them before anything else happens.

This guide could not confirm whether a schedule runs while QwenPaw is closed or the computer is asleep, so plan on leaving QwenPaw open and the computer on.

What you should see the command tool on the denied list, and one scheduled job that sends its results to the Inbox.

Trade-offs: safety versus capability

QwenPaw runs on your real computer behind walls that each have gaps, so these choices decide how much a mistake or a tricked agent can reach.

Tool Guard approval level and its seven extra checks. The approval level on your agent's card is STRICT, SMART, AUTO, or OFF, and the seven shell evasion checks on the Tool Guard tab add rules that catch commands hidden inside other text.

• You gain: AUTO, the default, stops only what its rules flag, and SMART lets low-risk steps through. Both finish a long job with far fewer stops than STRICT, which asks before every tool.
• You risk: under AUTO or SMART, anything the rules do not flag runs without asking, and the seven evasion checks all start off. OFF goes further and disables Tool Guard entirely, so its rules stop nothing.
• Makes sense when: you are in your first weeks with QwenPaw, which calls for STRICT with all seven checks on, because even the sandbox lets commands read your whole disk. SMART makes sense for a watched job on a backed-up folder once STRICT feels routine, but OFF does not make sense for a beginner on any job.

The sandbox. Enable Sandbox Execution, which starts off in v2.3.0, decides whether commands run inside the sandbox at all. Where your system supports it and the switch is on, the sandbox lets commands write only in the agent's workspace, but by default those commands can still read every file your account can read and connect anywhere on the internet.

• You gain: with the switch off, or with the sandbox's wide defaults, the agent can read and change files anywhere your account can and reach any website without you setting anything up. On Windows, running as an administrator would get you the full sandbox instead of the weaker version.
• You risk: with the switch off, a command can write anywhere your account can, not just in the workspace. Even with it on, a tricked agent can read private files outside ~/.ssh and the other blocked folders, and with the network open, nothing stops it from sending them out. Running as an administrator for the full Windows sandbox turns every yes you click into an administrator-level yes.
• Makes sense when: a job truly needs commands, and then only with Enable Sandbox Execution on. This guide could not find an on-screen switch for the "whole disk is readable" default, so your main control is the command tool itself: keep execute_shell_command off for jobs that do not need it, and do not run QwenPaw as an administrator for the stronger Windows sandbox.

Who can message the bot. Each chat app's dm_policy and group_policy start as "open". Setting both to "allowlist", with only your own user ID in allow_from, limits who can give your agent orders.

• You gain: you can send jobs from DingTalk, Telegram, iMessage, and the other chat apps while you are away from the computer.
• You risk: on "open", anyone who finds the bot can give your agent orders, and a chat bot that can touch files is a remote control for those files. iMessage also needs Full Disk Access, which lets that app read almost everything on your Mac.
• Makes sense when: the first job went right and one chat app is set to "allowlist" with just your own user ID. "open" does not make sense for anyone, and Full Disk Access for iMessage is a big step for a beginner.

Built-in local model or a cloud key. QwenPaw Local runs a QwenPaw-Flash model on your computer, while a key such as a free Google Gemini key sends the work to a cloud model.

• You gain: the local model costs nothing per use, needs no key, and has no bill to cap. A Gemini key gives you a stronger agent on a small computer.
• You risk: on 8 GB or 16 GB of memory, the local model is weak at multi-step work, QwenPaw Local is still being tested, and Intel Macs may not run it. With a free Gemini key, Google may use free-tier prompts to improve its products, and a paid key has no dollar limit inside QwenPaw.
• Makes sense when: you want simple chat on any computer, or longer jobs on one with about 24 GB or more, which suits the local model. A free Gemini key suits a smaller computer for jobs with nothing private in them, and for any paid key, save a monthly limit at the provider first.

Schedules and Heartbeat. Control → Cron Jobs runs a job on a timer, and Control → Heartbeat, which starts off, adds a regular check-in. Both run with nobody watching.

• You gain: jobs get done while you are away, and their results can wait for you in the Inbox.
• You risk: the security docs warn that a run with nobody there to answer may log a danger and keep going, so a step you would have rejected can go ahead anyway.
• Makes sense when: the job has already run safely by hand, execute_shell_command is on the denied tools list, and the results go to the Inbox for you to read. Leave Heartbeat off until a scheduled job has behaved for a while.

Before you loosen any of these, check the job against the three questions in Safety versus capability.

Sources

Checked 14 November 2026.

• QwenPaw research notes.
• Local models by hardware.
• First-hour safety checklist.
• QwenPaw channels, for open-by-default access settings, WeChat, QQ, iMessage.
• QwenPaw cron and heartbeat.
• QwenPaw Console, for menu names, Inbox results.
• QwenPaw security, for Tool Guard levels, shell evasion checks, denied tools, unattended runs, sandbox defaults, Windows administrator note.
• QwenPaw v2.3.0 config source and Console text, for Enable Sandbox Execution starts off.
• QwenPaw models, for QwenPaw Local.

Next

Continue to the playbook of eight jobs.