A Unix socket path can tell a process where to knock. It does not say who is allowed through the door. Qwen Code’s new cross-session inbox change makes that distinction concrete: each session publishes a token beside its socket address, the receiver checks that token before reading a frame, and delivery receipts carry a credential for the return path. The public commit also credits Claude Fable 5 as a co-author. That is useful Builder Work evidence, but the real lesson is in the design work around the token—not in the credit line.
The credential is deliberately not treated as ordinary session data. Qwen Code’s public documentation explains that a connection presents the per-session token on its first line, before any message is read; its session-list output strips the token. The same docs show a hook using a socket address and token together, while the frame and inbox tests cover malformed or wrong tokens and ensure that one refusal does not brick the next connection.
The dangerous case was not the inbox constructor
The sharp engineering judgment appears in the paths that do not look like messaging. A parent session can export its socket-and-token pair for its own child hook. If a child does not bind a new inbox but inherits that pair, a later child or package script could still authenticate to the ancestor session. Qwen Code now scrubs both variables before any CLI route can spawn. The commit’s focused tests reach the managed update, serve, and mcp fast paths precisely because those paths can skip the obvious startup constructor.
That is more than a defensive delete. The implementation pairs it with fresh publication when a session actually owns a new inbox, authenticated return receipts, registry handling, output redaction, and tests that cover an inherited pair, a fresh pair, and the failure paths in between. The change even documents a compatibility cost: an older sender’s frames to a new token-protected inbox are dropped. A boundary that changes nothing is often not a boundary.
The transferable building skill: make capability pairs travel together
Builders can reuse this pattern anywhere an agent passes a location plus a secret: a localhost port and bearer token, a queue URL and signing key, a workspace handle and lease, or a socket and token. Model them as one capability. At every spawn boundary, remove the pair before a child can execute; after the child binds an endpoint of its own, issue a fresh pair from that owner. Then write tests for the branches that bypass normal construction—updates, repair commands, background workers, fast paths, retries, and teardown—not only the happy path. The job is not to hide a token. It is to prevent an old identity from surviving into a new process.
The limit is still a release boundary
The sources establish Qwen Code’s intended main-branch behavior, documentation, and focused test coverage. They do not prove a disclosed vulnerability, a secure local installation, or that this exact work has reached a tagged package: the public package record at the time of reporting identifies an older git head. Operators should test a disposable nested-child setup before relying on the behavior, and watch for a release plus cross-platform coverage of the permissionless transport the commit is designed to support.