agent-relay-runner 0.129.5 → 0.129.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/package.json +1 -1
  2. package/plugins/claude/.claude-plugin/plugin.json +1 -1
  3. package/plugins/claude/skills/message/SKILL.md +24 -8
  4. package/plugins/claude/skills/reply/SKILL.md +24 -11
  5. package/plugins/claude/skills/send-claimable/SKILL.md +22 -7
  6. package/plugins/codex/skills/message/SKILL.md +24 -8
  7. package/plugins/codex/skills/reply/SKILL.md +24 -11
  8. package/plugins/codex/skills/send-claimable/SKILL.md +23 -8
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "agent-relay-runner",
3
- "version": "0.129.5",
3
+ "version": "0.129.6",
4
4
  "description": "Unified provider lifecycle runner for Agent Relay",
5
5
  "type": "module",
6
6
  "bin": {
package/plugins/claude/.claude-plugin/plugin.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "agent-relay-runner",
3
3
  "description": "Thin Agent Relay runner bridge for Claude Code",
4
- "version": "0.129.5",
4
+ "version": "0.129.6",
5
5
  "agentRelayContracts": {
6
6
  "providerPluginProtocol": 1
7
7
  }
package/plugins/claude/skills/message/SKILL.md CHANGED
@@ -1,24 +1,40 @@
1
1
  ---
2
2
  name: message
3
- description: Send a normal Agent Relay message to another agent, label, tag, capability, or broadcast target. Use when the user invokes /message or asks to send a one-off relay message.
4
- argument-hint: "<target> <message> [--subject TEXT] [--channel NAME]"
3
+ description: Send a normal Agent Relay message to another agent, label, tag, capability, policy, or broadcast target. Use when the user invokes /message or asks to send a one-off relay message.
4
+ argument-hint: "<target> <message|--stdin|--body-file PATH> [--subject TEXT] [--channel NAME]"
5
5
  allowed-tools: [Bash]
6
6
  ---
7
7
 
8
8
  # Agent Relay Message
9
9
 
10
- Run:
10
+ ⚠️ **SECURITY — never inline the message body in the shell command.** A body with
11
+ markdown backticks `` `like this` `` or `$(...)` would be shell-executed (command
12
+ substitution) before `agent-relay` sees it — a command-injection vector (#1262),
13
+ since the body may quote another agent's or a user's text. **Feed the body through
14
+ stdin via a quoted heredoc** (the `'RELAY_EOF'` quotes disable all expansion):
11
15
 
12
16
  ```bash
13
- agent-relay /message $ARGUMENTS
17
+ agent-relay /message <target> --stdin <<'RELAY_EOF'
18
+ Your message text. Backticks `bun run release` and $(anything) are delivered
19
+ verbatim and are NOT executed.
20
+ RELAY_EOF
14
21
  ```
15
22
 
16
- Examples:
23
+ Targets (the `<target>` positional) can be an agent id, `tag:`, `policy:`, `cap:`, or
24
+ `broadcast`:
17
25
 
18
26
  ```bash
19
- agent-relay /message codex "Can you look at that failing action?"
20
- agent-relay /message tag:backend "Does anyone see the regression?"
21
- agent-relay /message broadcast "Standup in five minutes"
27
+ agent-relay /message codex --stdin <<'RELAY_EOF'
28
+ Can you look at that failing action?
29
+ RELAY_EOF
30
+
31
+ agent-relay /message tag:backend --stdin <<'RELAY_EOF'
32
+ Does anyone see the regression?
33
+ RELAY_EOF
22
34
  ```
23
35
 
36
+ For a message you have already staged in a file, use `--body-file PATH` instead.
37
+
38
+ **Do NOT** build `agent-relay /message <target> "…body…"` with the body inside quotes.
39
+
24
40
  Report the sent message id briefly.
package/plugins/claude/skills/reply/SKILL.md CHANGED
@@ -7,25 +7,38 @@ allowed-tools: [Bash]
7
7
 
8
8
  # Agent Relay Reply
9
9
 
10
- Run:
10
+ ⚠️ **SECURITY — never inline the reply body in the shell command.** Your shell runs
11
+ the command you type, so a body containing markdown backticks `` `like this` `` or
12
+ `$(...)` would be executed as a shell command *before* `agent-relay` ever sees it
13
+ (command substitution). This is a real command-injection vector (#1262): the body may
14
+ quote another agent's or a user's text. **Always feed the body through stdin via a
15
+ quoted heredoc**, which disables all shell expansion and delivers the body verbatim.
16
+
17
+ Run (safe — quoted `'RELAY_EOF'` delimiter means no expansion, no substitution):
11
18
 
12
19
  ```bash
13
- agent-relay /reply $ARGUMENTS
20
+ agent-relay /reply <messageId> --stdin <<'RELAY_EOF'
21
+ Your reply text here. Backticks `bun run release` and $(anything) are delivered
22
+ verbatim and are NOT executed.
23
+ RELAY_EOF
14
24
  ```
15
25
 
16
- The server auto-routes the reply to the original sender and inherits the channel (Telegram, Slack, etc.) if applicable. No target or channel ID needed.
26
+ The server auto-routes the reply to the original sender and inherits the channel
27
+ (Telegram, Slack, etc.) if applicable. No target or channel ID needed.
17
28
 
18
- Examples:
29
+ For a reply you have already staged in a file, use `--body-file` instead:
19
30
 
20
31
  ```bash
21
- agent-relay /reply 206 "Sounds good, I'll take a look"
22
- agent-relay /reply 42 "Done — the fix is in commit abc123"
23
- agent-relay /reply 42 --body-file .agent-relay/sessions/$AGENT_RELAY_ID/tmp/reply.md
24
- agent-relay /reply 42 --body-file response.md
32
+ agent-relay /reply <messageId> --body-file .agent-relay/sessions/$AGENT_RELAY_ID/tmp/reply.md
25
33
  ```
26
34
 
27
- Use `--body-file` for long replies so shell quoting does not mangle the body. Oversized replies are automatically uploaded as an Agent Relay artifact and sent as an attached concise reply.
35
+ The relay creates that per-session scratch dir for you (git-ignored locally), so
36
+ staging there never pollutes the working tree and never collides with other agents.
37
+ No cleanup needed — the dir is reaped when your session ends. Oversized replies are
38
+ automatically uploaded as an Agent Relay artifact and sent as an attached concise reply.
28
39
 
29
- The relay creates this per-session scratch dir for you (it is git-ignored locally), so staging there never pollutes the working tree and never collides with other agents. No cleanup needed — the dir is reaped when your session ends.
40
+ **Do NOT** build `agent-relay /reply <id> "…body…"` with the body inside quotes — the
41
+ heredoc `--stdin` form above is the only safe way to pass free text.
30
42
 
31
- Do not send a separate Relay follow-up that only confirms the reply was sent. The CLI output is enough local confirmation.
43
+ Do not send a separate Relay follow-up that only confirms the reply was sent. The CLI
44
+ output is enough local confirmation.
package/plugins/claude/skills/send-claimable/SKILL.md CHANGED
@@ -1,24 +1,39 @@
1
1
  ---
2
2
  name: send-claimable
3
3
  description: Send a claimable Agent Relay work item so one matching agent can claim and handle it. Use when the user invokes /send-claimable or wants to enqueue work for another agent.
4
- argument-hint: "<target> <message> [--subject TEXT] [--channel NAME]"
4
+ argument-hint: "<target> <message|--stdin|--body-file PATH> [--subject TEXT] [--channel NAME]"
5
5
  allowed-tools: [Bash]
6
6
  ---
7
7
 
8
8
  # Agent Relay Send Claimable
9
9
 
10
- Run:
10
+ ⚠️ **SECURITY — never inline the work-item body in the shell command.** A body with
11
+ markdown backticks `` `like this` `` or `$(...)` would be shell-executed (command
12
+ substitution) before `agent-relay` sees it — a command-injection vector (#1262).
13
+ **Feed the body through stdin via a quoted heredoc** (the `'RELAY_EOF'` quotes disable
14
+ all expansion, delivering the body verbatim):
11
15
 
12
16
  ```bash
13
- agent-relay /send-claimable $ARGUMENTS
17
+ agent-relay /send-claimable <target> --stdin <<'RELAY_EOF'
18
+ Describe the work item here. Backticks `bun run release` and $(anything) are
19
+ delivered verbatim and are NOT executed.
20
+ RELAY_EOF
14
21
  ```
15
22
 
16
- Examples:
23
+ Targets can be an agent id, `tag:`, `cap:`, or `policy:`:
17
24
 
18
25
  ```bash
19
- agent-relay /send-claimable codex "Claim this and inspect the failing action"
20
- agent-relay /send-claimable tag:backend "Fix the failing API test"
21
- agent-relay /send-claimable cap:review "Review the migration patch"
26
+ agent-relay /send-claimable tag:backend --stdin <<'RELAY_EOF'
27
+ Fix the failing API test
28
+ RELAY_EOF
29
+
30
+ agent-relay /send-claimable cap:review --stdin <<'RELAY_EOF'
31
+ Review the migration patch
32
+ RELAY_EOF
22
33
  ```
23
34
 
35
+ For a work item you have already staged in a file, use `--body-file PATH` instead.
36
+
37
+ **Do NOT** build `agent-relay /send-claimable <target> "…body…"` with the body inside quotes.
38
+
24
39
  Report the sent claimable message id briefly.
package/plugins/codex/skills/message/SKILL.md CHANGED
@@ -1,24 +1,40 @@
1
1
  ---
2
2
  name: message
3
3
  description: Send a normal Agent Relay message to another agent, label, tag, capability, policy, or broadcast target. Use when the user invokes /message or asks to send a one-off relay message.
4
- argument-hint: "<target> <message> [--subject TEXT] [--channel NAME]"
4
+ argument-hint: "<target> <message|--stdin|--body-file PATH> [--subject TEXT] [--channel NAME]"
5
+ allowed-tools: [Bash]
5
6
  ---
6
7
 
7
8
  # Agent Relay Message
8
9
 
9
- Run:
10
+ ⚠️ **SECURITY — never inline the message body in the shell command.** A body with
11
+ markdown backticks `` `like this` `` or `$(...)` would be shell-executed (command
12
+ substitution) before `agent-relay` sees it — a command-injection vector (#1262),
13
+ since the body may quote another agent's or a user's text. **Feed the body through
14
+ stdin via a quoted heredoc** (the `'RELAY_EOF'` quotes disable all expansion):
10
15
 
11
16
  ```bash
12
- agent-relay /message $ARGUMENTS
17
+ agent-relay /message <target> --stdin <<'RELAY_EOF'
18
+ Your message text. Backticks `bun run release` and $(anything) are delivered
19
+ verbatim and are NOT executed.
20
+ RELAY_EOF
13
21
  ```
14
22
 
15
- Examples:
23
+ Targets (the `<target>` positional) can be an agent id, `tag:`, `policy:`, `cap:`, or
24
+ `broadcast`:
16
25
 
17
26
  ```bash
18
- agent-relay /message codex "Can you look at that failing action?"
19
- agent-relay /message tag:backend "Does anyone see the regression?"
20
- agent-relay /message policy:reviewer "Review this when you come online"
21
- agent-relay /message broadcast "Standup in five minutes"
27
+ agent-relay /message codex --stdin <<'RELAY_EOF'
28
+ Can you look at that failing action?
29
+ RELAY_EOF
30
+
31
+ agent-relay /message tag:backend --stdin <<'RELAY_EOF'
32
+ Does anyone see the regression?
33
+ RELAY_EOF
22
34
  ```
23
35
 
36
+ For a message you have already staged in a file, use `--body-file PATH` instead.
37
+
38
+ **Do NOT** build `agent-relay /message <target> "…body…"` with the body inside quotes.
39
+
24
40
  Report the sent message id briefly.
package/plugins/codex/skills/reply/SKILL.md CHANGED
@@ -7,25 +7,38 @@ allowed-tools: [Bash]
7
7
 
8
8
  # Agent Relay Reply
9
9
 
10
- Run:
10
+ ⚠️ **SECURITY — never inline the reply body in the shell command.** Your shell runs
11
+ the command you type, so a body containing markdown backticks `` `like this` `` or
12
+ `$(...)` would be executed as a shell command *before* `agent-relay` ever sees it
13
+ (command substitution). This is a real command-injection vector (#1262): the body may
14
+ quote another agent's or a user's text. **Always feed the body through stdin via a
15
+ quoted heredoc**, which disables all shell expansion and delivers the body verbatim.
16
+
17
+ Run (safe — quoted `'RELAY_EOF'` delimiter means no expansion, no substitution):
11
18
 
12
19
  ```bash
13
- agent-relay /reply $ARGUMENTS
20
+ agent-relay /reply <messageId> --stdin <<'RELAY_EOF'
21
+ Your reply text here. Backticks `bun run release` and $(anything) are delivered
22
+ verbatim and are NOT executed.
23
+ RELAY_EOF
14
24
  ```
15
25
 
16
- The server auto-routes the reply to the original sender and inherits the channel (Telegram, Slack, etc.) if applicable. No target or channel ID needed.
26
+ The server auto-routes the reply to the original sender and inherits the channel
27
+ (Telegram, Slack, etc.) if applicable. No target or channel ID needed.
17
28
 
18
- Examples:
29
+ For a reply you have already staged in a file, use `--body-file` instead:
19
30
 
20
31
  ```bash
21
- agent-relay /reply 206 "Sounds good, I'll take a look"
22
- agent-relay /reply 42 "Done — the fix is in commit abc123"
23
- agent-relay /reply 42 --body-file .agent-relay/sessions/$AGENT_RELAY_ID/tmp/reply.md
24
- agent-relay /reply 42 --body-file response.md
32
+ agent-relay /reply <messageId> --body-file .agent-relay/sessions/$AGENT_RELAY_ID/tmp/reply.md
25
33
  ```
26
34
 
27
- Use `--body-file` for long replies so shell quoting does not mangle the body. Oversized replies are automatically uploaded as an Agent Relay artifact and sent as an attached concise reply.
35
+ The relay creates that per-session scratch dir for you (git-ignored locally), so
36
+ staging there never pollutes the working tree and never collides with other agents.
37
+ No cleanup needed — the dir is reaped when your session ends. Oversized replies are
38
+ automatically uploaded as an Agent Relay artifact and sent as an attached concise reply.
28
39
 
29
- The relay creates this per-session scratch dir for you (it is git-ignored locally), so staging there never pollutes the working tree and never collides with other agents. No cleanup needed — the dir is reaped when your session ends.
40
+ **Do NOT** build `agent-relay /reply <id> "…body…"` with the body inside quotes — the
41
+ heredoc `--stdin` form above is the only safe way to pass free text.
30
42
 
31
- Do not send a separate Relay follow-up that only confirms the reply was sent. The CLI output is enough local confirmation.
43
+ Do not send a separate Relay follow-up that only confirms the reply was sent. The CLI
44
+ output is enough local confirmation.
package/plugins/codex/skills/send-claimable/SKILL.md CHANGED
@@ -1,24 +1,39 @@
1
1
  ---
2
2
  name: send-claimable
3
3
  description: Send a claimable Agent Relay work item so one matching agent can claim and handle it. Use when the user invokes /send-claimable or wants to enqueue work for another agent.
4
- argument-hint: "<target> <message> [--subject TEXT] [--channel NAME]"
4
+ argument-hint: "<target> <message|--stdin|--body-file PATH> [--subject TEXT] [--channel NAME]"
5
+ allowed-tools: [Bash]
5
6
  ---
6
7
 
7
8
  # Agent Relay Send Claimable
8
9
 
9
- Run:
10
+ ⚠️ **SECURITY — never inline the work-item body in the shell command.** A body with
11
+ markdown backticks `` `like this` `` or `$(...)` would be shell-executed (command
12
+ substitution) before `agent-relay` sees it — a command-injection vector (#1262).
13
+ **Feed the body through stdin via a quoted heredoc** (the `'RELAY_EOF'` quotes disable
14
+ all expansion, delivering the body verbatim):
10
15
 
11
16
  ```bash
12
- agent-relay /send-claimable $ARGUMENTS
17
+ agent-relay /send-claimable <target> --stdin <<'RELAY_EOF'
18
+ Describe the work item here. Backticks `bun run release` and $(anything) are
19
+ delivered verbatim and are NOT executed.
20
+ RELAY_EOF
13
21
  ```
14
22
 
15
- Examples:
23
+ Targets can be an agent id, `tag:`, `cap:`, or `policy:`:
16
24
 
17
25
  ```bash
18
- agent-relay /send-claimable codex "Claim this and inspect the failing action"
19
- agent-relay /send-claimable tag:backend "Fix the failing API test"
20
- agent-relay /send-claimable cap:review "Review the migration patch"
21
- agent-relay /send-claimable policy:reviewer "Review this when the managed reviewer starts"
26
+ agent-relay /send-claimable tag:backend --stdin <<'RELAY_EOF'
27
+ Fix the failing API test
28
+ RELAY_EOF
29
+
30
+ agent-relay /send-claimable cap:review --stdin <<'RELAY_EOF'
31
+ Review the migration patch
32
+ RELAY_EOF
22
33
  ```
23
34
 
35
+ For a work item you have already staged in a file, use `--body-file PATH` instead.
36
+
37
+ **Do NOT** build `agent-relay /send-claimable <target> "…body…"` with the body inside quotes.
38
+
24
39
  Report the sent claimable message id briefly.