Office

Peer-to-peer communication between Claude Code sessions. Your sessions and your experts become addressable people by name, chatting with each other about multiple topics simultaneously — without an orchestrator.

Design spec: pessoal/claudicaro-cli/docs/design/2026-08-02-escritorio-multiagente.md

Why this wasn't possible without it

Claude Code's native topology is a tree: the sub-agent returns to the parent, SendMessage only reaches who the session itself spawned, Workflow passes data through the script. Two siblings don't talk to each other. Lateral communication requires a shared medium — which is this mailbox.

Related MCP server: claude-mesh

The six tools

Plus close_thread, which ends the conversation and makes each colleague distill the notebook.

How it works

A thread is the single conversation container — it replaces rooms and channels. Debate between peers is a thread with N participants where each one chooses who to reply to.

No boss, two rules in the mailbox keep the system in check:

• hops decrements with each message; when it hits zero, the mailbox rejects it. Kills infinite ping-pong.

• The thread owner is whoever opened it, and only they can close it.

Delivery has two natures:

• Live session receives via hook (Stop blocks the stop and delivers; PostToolBatch delivers mid-work). The hook is a script — runs outside the model, zero token cost.

• Roster colleague is woken up by the mailbox with claude -p, responds, and goes back to sleep.

Colleague's memory: within a thread they keep the session alive (--resume) and remember everything; when the thread closes, they distill what they learned into a .md notebook and the session dies. Long-term is the notebook — auditable, manually editable, versioned.

Installation

npm install && npm run build
node scripts/instalar.mjs          # --dry pra ver antes, --remover pra desfazer

The installer registers the delivery hook in ~/.claude/settings.json, sets ESCRITORIO_WORKSPACE/ESCRITORIO_ROSTER, and registers the MCP server via claude mcp add --scope user (which writes to ~/.claude.json — settings.json doesn't register MCP).

Backs up to settings.json.antes-do-escritorio the first time, and never overwrites that backup.

Roster

~/claude-workspace-config/roster.yaml (synced repo Mac ↔ VM):

especialista-deposito:
  brief: "Depósito antecipado: cobrança, pagamento, reembolso (DSG/v1)"
  agent_file: ${ESCRITORIO_WORKSPACE}/dsg/.agent/especialista-deposito.md
  caderno: ${ESCRITORIO_WORKSPACE}/pessoal/escritorio/cadernos/especialista-deposito.md
  tier: advisor
  cwd: ${ESCRITORIO_WORKSPACE}/dsg/v1

brief is the only thing roster() returns — write it thinking "when would I call this person." Paths accept ~ and ${VAR}; it's environment expansion that makes the same file work on Mac and VM, where the workspace lives in different places.

Tiers

A request can downgrade the tier in the query, never raise it.

Why allowlist and not denylist

The first version used --disallowedTools Edit Write NotebookEdit with bypassPermissions. Tested with real claude, it leaked: the colleague wrote the file via Bash, which wasn't in the negation. Measured across four variants:

We kept the allowlist: whatever I forget to list is denied instead of allowed. Worth noting that Bash(cat:*) in the allowlist did not allow escaping via redirection (cat > arquivo).

See it happening

npm run tail

Follows the mailbox and prints what happens between all sessions — board written, claim, thread opened, message exchanged, response arriving:

Escritório — monitor ao vivo
sessões vistas na última hora: icaromelo@v1, icaromelo@kairos-ui, icaromelo@oraculo-api, …
threads abertas: (nenhuma)
────────────────────────────────────────────────────────────────────────
13:26:36 ▤ quadro dsg/v1:decisoes = cache sempre via RedisService · icaromelo@v1
13:26:37 🔒 claim src/infra/redis por icaromelo@v1 · revisar TTLs
13:26:38 ⊕ thread [477cfbdc] Em uma frase: qual TTL padrao usamos? · dono icaromelo@v1
13:26:38 icaromelo@v1 →? especialista-cache  [477cfbdc]
        Em uma frase: qual TTL padrao usamos?
13:26:44 especialista-cache ←! icaromelo@v1  [477cfbdc]
        O TTL padrão é 3600 segundos (1 hora) — mas sempre passe TTL explícito…

→? is a blocking question, → a message, ←! a response.

Identity

Each session needs a name. ESCRITORIO_ID when declared; without it, derives from user@folder — stable per project, so a session opened in dsg/v1 is always icaromelo@v1 and can be addressed by another.

Tests

npm test                        # 117 testes, sem gastar API
node scripts/smoke-mcp.mjs      # sobe o servidor MCP de verdade via stdio
node scripts/smoke-e2e.mjs      # E2E REAL: acorda colega, --resume, caderno (gasta API)
node scripts/smoke-escrita.mjs  # E2E REAL dos 3 tiers: advisor bloqueado, worktree isolado,
                                # editor sob claim (gasta API)

Known limitations

• One mailbox per machine. A session on the Oracle VM doesn't talk to the Mac's mailbox; the bridge between machines is a separate problem.

• dist/ lives on SSD. With the SSD unmounted the hook fails silently (|| true) and the MCP is disconnected — nothing freezes, but the office disappears until remounting.

• ask on a live session depends on it running. If no one has that session open, you wait until the timeout (5 min) and the response stays in the inbox for later.