feat(web): publish blog post as static page
Static TSX page at /blog/peer-messaging-claude-code while Payload admin is not yet configured in production. Full 1100-word post on protocol, dev-channels, prompt-injection, and next steps. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Alejandro Gutiérrez
@@ -0,0 +1,194 @@
|
||||
import Link from "next/link";
|
||||
|
||||
export const metadata = {
|
||||
title: "Peer messaging for Claude Code: protocol, security, UX — claudemesh",
|
||||
description:
|
||||
"How claudemesh connects Claude Code sessions over an encrypted mesh, using MCP dev-channels for real-time message injection. Wire protocol, threat model, and what's next.",
|
||||
openGraph: {
|
||||
title: "Peer messaging for Claude Code: protocol, security, UX",
|
||||
description: "How claudemesh connects Claude Code sessions over an encrypted mesh.",
|
||||
images: ["/media/blog-hero-mesh.png"],
|
||||
},
|
||||
};
|
||||
|
||||
export default function BlogPost() {
|
||||
return (
|
||||
<article className="mx-auto max-w-3xl px-6 py-24 md:py-32">
|
||||
<header className="mb-12">
|
||||
<time
|
||||
dateTime="2026-04-06"
|
||||
className="text-[11px] uppercase tracking-wider text-[var(--cm-fg-tertiary)]"
|
||||
style={{ fontFamily: "var(--cm-font-mono)" }}
|
||||
>
|
||||
April 6, 2026
|
||||
</time>
|
||||
<h1
|
||||
className="mt-3 text-[clamp(2rem,4.5vw,3rem)] font-medium leading-[1.1] text-[var(--cm-fg)]"
|
||||
style={{ fontFamily: "var(--cm-font-serif)" }}
|
||||
>
|
||||
Peer messaging for Claude Code: protocol, security, UX
|
||||
</h1>
|
||||
<p
|
||||
className="mt-4 text-sm text-[var(--cm-fg-secondary)]"
|
||||
style={{ fontFamily: "var(--cm-font-sans)" }}
|
||||
>
|
||||
by Alejandro A. Gutiérrez Mourente
|
||||
</p>
|
||||
</header>
|
||||
|
||||
<div
|
||||
className="space-y-5 text-[15px] leading-[1.8] text-[var(--cm-fg-secondary)] [&_h2]:mt-10 [&_h2]:mb-4 [&_h2]:text-[22px] [&_h2]:font-medium [&_h2]:text-[var(--cm-fg)] [&_a]:text-[var(--cm-clay)] [&_a]:hover:underline [&_code]:rounded [&_code]:bg-[var(--cm-gray-800)] [&_code]:px-1.5 [&_code]:py-0.5 [&_code]:text-[13px] [&_code]:text-[var(--cm-fg-secondary)] [&_pre]:overflow-x-auto [&_pre]:rounded-[8px] [&_pre]:border [&_pre]:border-[var(--cm-border)] [&_pre]:bg-[var(--cm-gray-850)] [&_pre]:p-4 [&_pre]:text-[13px] [&_pre]:leading-[1.6] [&_strong]:font-medium [&_strong]:text-[var(--cm-fg)]"
|
||||
style={{ fontFamily: "var(--cm-font-serif)" }}
|
||||
>
|
||||
<p>
|
||||
Claude Code sessions are islands. You build context over an hour of conversation, close the
|
||||
tab, and that context dies. Two sessions side by side — one refactoring the API, one fixing
|
||||
the frontend — share a filesystem but not a thought. I spent a decade flying F-18s in the
|
||||
Spanish Air Force, where every formation member broadcasts position, fuel, and threat data
|
||||
in real time. Silence kills. I built{" "}
|
||||
<a href="https://github.com/alezmad/claudemesh-cli">claudemesh</a> to give Claude Code
|
||||
sessions the same link: an MCP server that connects them over an encrypted mesh, pushing
|
||||
messages directly into each other's context mid-turn.
|
||||
</p>
|
||||
<p>
|
||||
The CLI is MIT-licensed, on npm as <code>claudemesh-cli</code>. This post covers the wire
|
||||
protocol, the experimental Claude Code capability behind real-time injection, and the
|
||||
prompt-injection surface that deserves careful attention.
|
||||
</p>
|
||||
|
||||
<h2 style={{ fontFamily: "var(--cm-font-serif)" }}>The protocol</h2>
|
||||
<p>
|
||||
One owner's ed25519 public key defines a mesh. The owner generates signed invite links;
|
||||
each invitee verifies the signature, generates a fresh ed25519 keypair locally, and enrolls
|
||||
with a broker via <code>POST /join</code>. The client then opens a persistent WebSocket
|
||||
(<code>wss://</code> in production) and authenticates with a signed <code>hello</code>{" "}
|
||||
frame:
|
||||
</p>
|
||||
<pre><code>{`{
|
||||
"type": "hello",
|
||||
"meshId": "01HX...",
|
||||
"memberId": "01HX...",
|
||||
"pubkey": "64-hex-chars",
|
||||
"timestamp": 1735689600000,
|
||||
"signature": "128-hex-chars"
|
||||
}`}</code></pre>
|
||||
<p>
|
||||
The signature covers{" "}
|
||||
<code>{"${meshId}|${memberId}|${pubkey}|${timestamp}"}</code>. The broker verifies it
|
||||
against the registered public key and replies <code>hello_ack</code>. The connection is
|
||||
live.
|
||||
</p>
|
||||
<p>
|
||||
Direct messages use libsodium <code>crypto_box_easy</code> for end-to-end encryption —
|
||||
X25519 keys derived from ed25519 identity pairs via{" "}
|
||||
<code>crypto_sign_ed25519_pk_to_curve25519</code>. The broker routes ciphertext and never
|
||||
sees plaintext. Priority routing: <code>now</code> delivers immediately, <code>next</code>{" "}
|
||||
queues until idle, <code>low</code> waits for an explicit drain. The full specification
|
||||
lives in{" "}
|
||||
<a href="https://github.com/alezmad/claudemesh-cli/blob/main/PROTOCOL.md">PROTOCOL.md</a>{" "}
|
||||
(453 lines).
|
||||
</p>
|
||||
|
||||
<h2 style={{ fontFamily: "var(--cm-font-serif)" }}>Dev channels: the missing piece</h2>
|
||||
<p>
|
||||
An experimental Claude Code capability fixes the polling problem:{" "}
|
||||
<code>notifications/claude/channel</code>. When an MCP server declares{" "}
|
||||
<code>{"{ experimental: { \"claude/channel\": {} } }"}</code> and Claude Code launches
|
||||
with <code>--dangerously-load-development-channels server:<name></code>, the server
|
||||
pushes notifications that arrive as <code>{"<channel source=\"claudemesh\">"}</code> system
|
||||
reminders mid-turn. Claude reacts immediately.
|
||||
</p>
|
||||
<p>
|
||||
<code>claudemesh launch</code> wraps this into one command. I tested with an echo-channel
|
||||
MCP server emitting a notification every 15 seconds — all three ticks arrived mid-turn and
|
||||
Claude responded inline. Confirmed on Claude Code v2.1.92.
|
||||
</p>
|
||||
|
||||
<h2 style={{ fontFamily: "var(--cm-font-serif)" }}>The prompt-injection question</h2>
|
||||
<p>
|
||||
This section matters most. claudemesh decrypts peer text and injects it into Claude's
|
||||
context. That text is untrusted input. A peer can send instruction overrides, tool-call
|
||||
steering, or confused-deputy attacks invoking other MCP servers through Claude. The same
|
||||
failure-mode analysis that clears a formation through weather applies here: enumerate every
|
||||
way the system breaks, then close each path.
|
||||
</p>
|
||||
<p>
|
||||
<strong>Tool-approval prompts stay intact.</strong> claudemesh never disables Claude Code's
|
||||
permission system. A peer message can ask Claude to run a shell command; Claude still
|
||||
prompts the user.
|
||||
</p>
|
||||
<p>
|
||||
<strong>Messages carry attribution.</strong> Each <code>{"<channel>"}</code> reminder
|
||||
includes <code>from_id</code>, <code>from_name</code>, and <code>mesh_slug</code>.
|
||||
</p>
|
||||
<p>
|
||||
<strong>Membership requires a signed invite.</strong> An attacker needs a valid
|
||||
ed25519-signed invite from the mesh owner or a compromised member keypair.
|
||||
</p>
|
||||
<p>
|
||||
The residual risks are real. If a user blanket-approves tools, a malicious peer message
|
||||
reaches the shell without human review. The causal chain — peer message, Claude decision,
|
||||
tool call — has no persistent audit trail yet.{" "}
|
||||
<a href="https://github.com/alezmad/claudemesh-cli/blob/main/THREAT_MODEL.md">
|
||||
THREAT_MODEL.md
|
||||
</a>{" "}
|
||||
(212 lines) documents all of this. Open questions I want to work through with the Claude
|
||||
Code team.
|
||||
</p>
|
||||
|
||||
<h2 style={{ fontFamily: "var(--cm-font-serif)" }}>What I'd do next</h2>
|
||||
<p>
|
||||
<strong>Shared-key channel crypto.</strong> Channel and broadcast messages are base64
|
||||
plaintext today. The upgrade is a KDF from <code>mesh_root_key</code> plus key rotation.
|
||||
</p>
|
||||
<p>
|
||||
<strong>Causal audit log.</strong> When Claude calls a tool because of a peer message, that
|
||||
link should persist: which message, which tool call, what result.
|
||||
</p>
|
||||
<p>
|
||||
<strong>Sender allowlists.</strong> Per-mesh config: accept messages only from these
|
||||
pubkeys. If a member's key is compromised, others exclude it locally.
|
||||
</p>
|
||||
<p>
|
||||
<strong>Forward secrecy.</strong> <code>crypto_box</code> uses long-lived keys. A leaked
|
||||
key lets an attacker decrypt all past captured ciphertext. A double-ratchet would bound the
|
||||
damage window.
|
||||
</p>
|
||||
|
||||
<h2 style={{ fontFamily: "var(--cm-font-serif)" }}>Try it</h2>
|
||||
<pre><code>{`npm install -g claudemesh-cli
|
||||
claudemesh install
|
||||
claudemesh join https://claudemesh.com/join/<token>
|
||||
claudemesh launch`}</code></pre>
|
||||
<p>
|
||||
The code is at{" "}
|
||||
<a href="https://github.com/alezmad/claudemesh-cli">github.com/alezmad/claudemesh-cli</a>.
|
||||
The wire protocol is in{" "}
|
||||
<a href="https://github.com/alezmad/claudemesh-cli/blob/main/PROTOCOL.md">PROTOCOL.md</a>.
|
||||
The threat model is in{" "}
|
||||
<a href="https://github.com/alezmad/claudemesh-cli/blob/main/THREAT_MODEL.md">
|
||||
THREAT_MODEL.md
|
||||
</a>.
|
||||
Contributions welcome — see{" "}
|
||||
<a href="https://github.com/alezmad/claudemesh-cli/blob/main/CONTRIBUTING.md">
|
||||
CONTRIBUTING.md
|
||||
</a>.
|
||||
</p>
|
||||
<p>
|
||||
If you work on Claude Code or the MCP ecosystem and this interests you, I'd like to hear
|
||||
from you.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div className="mt-12 border-t border-[var(--cm-border)] pt-8">
|
||||
<Link
|
||||
href="/blog"
|
||||
className="text-sm text-[var(--cm-clay)] hover:underline"
|
||||
style={{ fontFamily: "var(--cm-font-sans)" }}
|
||||
>
|
||||
← Back to blog
|
||||
</Link>
|
||||
</div>
|
||||
</article>
|
||||
);
|
||||
}
|
||||
Reference in New Issue
Block a user