Claudemessaging — Development skill for Claude Code

Claude Code Cross-Session Messaging — Research & Tooling

Overview

Claude Code allows sessions on the same machine to communicate over per-session named pipes (Windows) or Unix sockets (Linux/macOS). This repository documents the messaging protocol, provides tooling to interact with it, and records observations about how the system's trust model behaves in practice.

The design relies on a layered defense model. This research maps each layer, tests what it does and does not enforce, and provides tools for operators to verify the behavior on their own systems.

Observations

#	Observation	Layer	Behavior
F-1	An approved message from an unidentified sender is framed to the model as "trusted teammate"	Delivery framing	The hold prompt accurately says "unidentified," but the delivered wrapper does not distinguish identified from unidentified senders
F-2	Pipe DACL includes Everyone / ANONYMOUS LOGON with read access (Windows)	Transport ACL	Read-only — cannot send messages; wider than necessary for a per-user IPC endpoint
F-3	from-mode attestation is self-declared — controls the hold gate decision	Inbound gate	By design: the hold gate trusts the sender's declared permission mode. A local process with the session key can declare from-mode="bypass" to match the receiver and skip the hold prompt
F-4	Host: Private firewall profile disabled, SMB/445 exposed on tailnet	Host config	Local configuration, not a Claude Code issue
F-5	message.role field is ignored by the receiver	Input validation	Positive: the receiver always enqueues as user-role regardless of what the sender declares

How the Trust Model Works

Claude Code's cross-session messaging has four defense layers. Each serves a purpose, and the system is designed so that no single layer failing results in unrestricted access:

Layer	Mechanism	What it enforces