---
name: reply
description: Reply to an Agent Relay message by ID. Auto-routes to the sender and inherits channel context — no target needed. Use when the user invokes /reply or asks to reply to a specific relay message, especially with stdin/file for long replies.
argument-hint: "<messageId> <message|--stdin|--body-file PATH>"
allowed-tools: [Bash]
---

# Agent Relay Reply

⚠️ **SECURITY — never inline the reply body in the shell command.** Your shell runs
the command you type, so a body containing markdown backticks `` `like this` `` or
`$(...)` would be executed as a shell command *before* `agent-relay` ever sees it
(command substitution). This is a real command-injection vector (#1262): the body may
quote another agent's or a user's text. **Always feed the body through stdin via a
quoted heredoc**, which disables all shell expansion and delivers the body verbatim.

Run (safe — quoted `'RELAY_EOF'` delimiter means no expansion, no substitution):

```bash
agent-relay /reply <messageId> --stdin <<'RELAY_EOF'
Your reply text here. Backticks `bun run release` and $(anything) are delivered
verbatim and are NOT executed.
RELAY_EOF
```

The server auto-routes the reply to the original sender and inherits the channel
(Telegram, Slack, etc.) if applicable. No target or channel ID needed.

For a reply you have already staged in a file, use `--body-file` instead:

```bash
agent-relay /reply <messageId> --body-file .agent-relay/sessions/$AGENT_RELAY_ID/tmp/reply.md
```

The relay creates that per-session scratch dir for you (git-ignored locally), so
staging there never pollutes the working tree and never collides with other agents.
No cleanup needed — the dir is reaped when your session ends. Oversized replies are
automatically uploaded as an Agent Relay artifact and sent as an attached concise reply.

**Do NOT** build `agent-relay /reply <id> "…body…"` with the body inside quotes — the
heredoc `--stdin` form above is the only safe way to pass free text.

Do not send a separate Relay follow-up that only confirms the reply was sent. The CLI
output is enough local confirmation.