QwenLM
diff --git a/‎docs/users/qwen-serve.md‎
Lines changed: 2 additions & 0 deletions b/‎docs/users/qwen-serve.md‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎packages/cli/src/commands/channel/daemon-worker.test.ts‎
Lines changed: 58 additions & 9 deletions b/‎packages/cli/src/commands/channel/daemon-worker.test.ts‎
Lines changed: 58 additions & 9 deletions
diff --git a/‎packages/cli/src/commands/channel/daemon-worker.ts‎
Lines changed: 5 additions & 2 deletions b/‎packages/cli/src/commands/channel/daemon-worker.ts‎
Lines changed: 5 additions & 2 deletions
diff --git a/‎packages/cli/src/serve/channel-worker-group.test.ts‎
Lines changed: 34 additions & 0 deletions b/‎packages/cli/src/serve/channel-worker-group.test.ts‎
Lines changed: 34 additions & 0 deletions
diff --git a/‎packages/cli/src/serve/channel-worker-group.ts‎
Lines changed: 4 additions & 0 deletions b/‎packages/cli/src/serve/channel-worker-group.ts‎
Lines changed: 4 additions & 0 deletions
@@ -396,6 +396,8 @@ Notes:
 - **Both flags or neither** — boot fails if only one is given (a cert with no key can't start an HTTPS listener).
 - **TLS is orthogonal to auth** — HTTPS encrypts the transport; the bearer token still gates every API route. Non-loopback binds require a token with or without TLS.
 - **Scope is TLS termination only** — no auto-generation, no ACME / Let's Encrypt. This is a LAN / dev convenience; for internet-facing deployments terminate TLS at a reverse proxy (see the threat model below).
+- **Channel workers dial the daemon back over `https://`** — so they need to trust the serving certificate too. A self-signed cert (or a fullchain that carries its own root) needs nothing: the daemon injects it into each worker's `NODE_EXTRA_CA_CERTS`. The mkcert flow above is **CA-issued**, so the leaf alone cannot anchor the chain — export `NODE_EXTRA_CA_CERTS="$(mkcert -CAROOT)/rootCA.pem"` in the daemon's launch environment before starting with `--channel`. An operator-set value is _merged_ with the daemon cert, not replaced. Without it the daemon boots green while every channel worker restart-loops on `UNABLE_TO_VERIFY_LEAF_SIGNATURE`; the daemon log names the gap at boot.
+- **Rotating `--tls-cert` in place needs a daemon restart** — the daemon serves the bytes it read at boot, so until it restarts, respawned workers can load newer contents than the daemon presents and their handshakes fail.
 
 ## CLI flags
 
 
@@ -1332,20 +1332,69 @@ describe('runChannelDaemonWorker', () => {
     ).rejects.toThrow('Channel "missing" not found in settings.');
   });
 
-  it('rejects daemon URLs that are not http loopback URLs', async () => {
+  it('rejects daemon URLs that are not http(s) loopback URLs', async () => {
     const sdk = createSdk();
 
-    await expect(
-      runChannelDaemonWorker({
-        daemonUrl: 'http://attacker.example:4170',
-        workspace: '/workspace',
-        selection: { mode: 'names', names: ['telegram'] },
-        loadDaemonSdk: async () => sdk,
-      }),
-    ).rejects.toThrow('QWEN_DAEMON_URL must use an http loopback URL.');
+    for (const daemonUrl of [
+      'http://attacker.example:4170',
+      'https://attacker.example:4170',
+    ]) {
+      await expect(
+        runChannelDaemonWorker({
+          daemonUrl,
+          workspace: '/workspace',
+          selection: { mode: 'names', names: ['telegram'] },
+          loadDaemonSdk: async () => sdk,
+        }),
+      ).rejects.toThrow('QWEN_DAEMON_URL must use an http(s) loopback URL.');
+    }
     expect(sdk.DaemonClient).not.toHaveBeenCalled();
   });
 
+  it('accepts https loopback daemon URLs for TLS daemons', async () => {
+    const sdk = createSdk();
+    mockLoadChannelsConfig.mockReturnValueOnce({
+      telegram: { type: 'telegram' },
+    });
+    mockParseConfiguredChannels.mockResolvedValueOnce([parsedTelegram]);
+
+    await runChannelDaemonWorker({
+      daemonUrl: 'https://127.0.0.1:4170',
+      workspace: '/workspace',
+      selection: { mode: 'all' },
+      loadDaemonSdk: async () => sdk,
+    });
+
+    expect(sdk.DaemonClient).toHaveBeenCalledWith({
+      baseUrl: 'https://127.0.0.1:4170',
+    });
+  });
+
+  it('accepts an IPv6 loopback daemon URL for a ::1-bound TLS daemon', async () => {
+    // R2-14: formatChannelWorkerDaemonUrl emits `https://[::1]:<port>` for a
+    // `::1` TLS bind, and this side accepts it only because `'[::1]'` sits in
+    // LOOPBACK_BINDS. Nothing else pins that entry, so dropping it as
+    // redundant keeps every test green while every ::1-bound TLS daemon's
+    // workers reject their own URL at boot and restart-loop — the exact
+    // failure this PR exists to remove, regressing on IPv6 alone.
+    const sdk = createSdk();
+    mockLoadChannelsConfig.mockReturnValueOnce({
+      telegram: { type: 'telegram' },
+    });
+    mockParseConfiguredChannels.mockResolvedValueOnce([parsedTelegram]);
+
+    await runChannelDaemonWorker({
+      daemonUrl: 'https://[::1]:4170',
+      workspace: '/workspace',
+      selection: { mode: 'all' },
+      loadDaemonSdk: async () => sdk,
+    });
+
+    expect(sdk.DaemonClient).toHaveBeenCalledWith({
+      baseUrl: 'https://[::1]:4170',
+    });
+  });
+
   it('fails fast when no channels are configured', async () => {
     const sdk = createSdk();
     mockLoadChannelsConfig.mockReturnValueOnce({});
 
@@ -324,8 +324,11 @@ function validateDaemonWorkerUrl(daemonUrl: string): void {
   } catch {
     throw new Error(`${QWEN_DAEMON_URL_ENV} must be a valid URL.`);
   }
-  if (parsed.protocol !== 'http:' || !isLoopbackBind(parsed.hostname)) {
-    throw new Error(`${QWEN_DAEMON_URL_ENV} must use an http loopback URL.`);
+  if (
+    (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') ||
+    !isLoopbackBind(parsed.hostname)
+  ) {
+    throw new Error(`${QWEN_DAEMON_URL_ENV} must use an http(s) loopback URL.`);
   }
 }
 
 
@@ -141,6 +141,40 @@ const deliveryRequest: ChannelDeliveryRequest = {
 };
 
 describe('createChannelWorkerGroup', () => {
+  it('passes workerTlsCaCertPath through to every supervisor', () => {
+    const registry = fakeRegistry([fakeRuntime(PRIMARY, true)]);
+    const { createSupervisor, recorded } = makeCreateSupervisor(() =>
+      snapshot({}),
+    );
+    createChannelWorkerGroup({
+      groups: [
+        { workspaceCwd: PRIMARY, selection: { mode: 'names', names: ['b'] } },
+      ],
+      registry,
+      createSupervisor,
+      shared: { ...shared, workerTlsCaCertPath: '/certs/daemon.pem' },
+    });
+
+    expect(recorded[0]!.opts.tlsCaCertPath).toBe('/certs/daemon.pem');
+  });
+
+  it('omits tlsCaCertPath when the daemon does not serve TLS', () => {
+    const registry = fakeRegistry([fakeRuntime(PRIMARY, true)]);
+    const { createSupervisor, recorded } = makeCreateSupervisor(() =>
+      snapshot({}),
+    );
+    createChannelWorkerGroup({
+      groups: [
+        { workspaceCwd: PRIMARY, selection: { mode: 'names', names: ['b'] } },
+      ],
+      registry,
+      createSupervisor,
+      shared,
+    });
+
+    expect(recorded[0]!.opts.tlsCaCertPath).toBeUndefined();
+  });
+
   it('wires loop MCP to the exact workspace session with owner-safe cleanup', async () => {
     const addSessionRuntimeMcpServer = vi.fn(async () => ({ toolCount: 3 }));
     const removeSessionRuntimeMcpServer = vi.fn(async () => ({}));
 
@@ -103,6 +103,7 @@ export interface ChannelWorkerGroupSharedOptions {
   cliEntryPath: string;
   daemonUrl: string;
   daemonToken?: string;
+  workerTlsCaCertPath?: string;
   restartPolicy?: ChannelWorkerRestartPolicy;
   startupTimeoutMs?: number;
   heartbeatTimeoutMs?: number;
@@ -231,6 +232,9 @@ export function createChannelWorkerGroup(
       ...(opts.shared.daemonToken
         ? { daemonToken: opts.shared.daemonToken }
         : {}),
+      ...(opts.shared.workerTlsCaCertPath
+        ? { tlsCaCertPath: opts.shared.workerTlsCaCertPath }
+        : {}),
       workspace: runtime.workspaceCwd,
       selection: group.selection,
       // Multi-workspace runtimes expose a per-workspace env overlay; a
Original file line number	Diff line number	Diff line change
`@@ -324,8 +324,11 @@ function validateDaemonWorkerUrl(daemonUrl: string): void {`
`324`	`324`	`} catch {`
`325`	`325`	throw new Error(`${QWEN_DAEMON_URL_ENV} must be a valid URL.`);
`326`	`326`	`}`
`327`		`- if (parsed.protocol !== 'http:' \|\| !isLoopbackBind(parsed.hostname)) {`
`328`		- throw new Error(`${QWEN_DAEMON_URL_ENV} must use an http loopback URL.`);
	`327`	`+ if (`
	`328`	`+ (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') \|\|`
	`329`	`+ !isLoopbackBind(parsed.hostname)`
	`330`	`+ ) {`
	`331`	+ throw new Error(`${QWEN_DAEMON_URL_ENV} must use an http(s) loopback URL.`);
`329`	`332`	`}`
`330`	`333`	`}`
`331`	`334`