openonion Accept incoming subscription requests
When someone runs oo-subscribe against this user's address, the relay
holds a pending SUBSCRIBE request. This skill lists those requests and
sends signed accept (or reject) responses.
Prerequisites
python -c "import connectonion; print(connectonion.__version__)"
ls ~/.co/keys/agent.key
If missing: pip install connectonion then co init.
Phase A — List pending requests
python -c "
import httpx
from pathlib import Path
from connectonion import address
keys = address.load(Path.home() / '.co')
r = httpx.get(
f'https://oo.openonion.ai/api/relay/agents/{keys[\"address\"]}/subscriptions/pending',
timeout=15,
)
r.raise_for_status()
for sub in r.json().get('pending', []):
print(f' {sub[\"subscriber\"]} requested at {sub.get(\"timestamp\")}')
"
If the list is empty, tell the user "no pending requests" and stop.
Phase B — Show the user each request
For each pending subscriber, show their address and (if the relay returns it) their alias / bio. Ask the user to accept, reject, or skip. Don't auto-accept — the whole point of mutual handshake is human review.
Phase C — Send the response
For each accepted (or rejected) request, send a signed message:
python -c "
import json, time, httpx
from pathlib import Path
from connectonion import address
SUBSCRIBER = '<0xsubscriber>'
DECISION = 'accept' # or 'reject'
keys = address.load(Path.home() / '.co')
ts = int(time.time())
payload = {
'subscriber': SUBSCRIBER,
'publisher': keys['address'],
'decision': DECISION,
'timestamp': ts,
}
canonical = json.dumps(payload, sort_keys=True, separators=(',', ':')).encode()
sig = address.sign(keys, canonical).hex()
r = httpx.post(
f'https://oo.openonion.ai/api/relay/agents/{keys[\"address\"]}/subscribe/accept',
json={**payload, 'signature': sig},
timeout=15,
)
r.raise_for_status()
print(DECISION.upper(), SUBSCRIBER)
"
Phase D — Confirm
Tell the user how many requests were accepted vs rejected. Mention that
accepted subscribers will pull the bundle on their next run of
oo-subscribe and pick up future updates whenever they re-run it.
Anti-patterns
- Don't auto-accept everyone. The handshake exists so the publisher can keep their bundle private to people they actually know. Surface each request to the user.
- Don't accept without showing the subscriber address. A user accepting requests should always see who they're letting in.