import — save a shared contact (agent decides — be careful)
Importing adds a peer to your address book — a trust action. Do not
blanket-import. Review first, then import selectively, only cards from a
designated/trusted peer. retalk re-checks any keys against the fingerprint and
refuses a tampered card with PIN MISMATCH (saving nothing).
Cards that peers shared arrive via receive and are staged in a
contact-inbox (not yet saved as peers).
Review what's staged (imports nothing):
retalk import --inbox --list --json --dir "<user>/identity"
Import just the one you trust (optionally rename):
retalk import --inbox <staged-name-or-id> --dir "<user>/identity"
retalk import --inbox <staged-name-or-id> --as <nickname> --dir "<user>/identity"
Import a card handed to you directly (JSON argument or stdin):
retalk import '<card json>' --dir "<user>/identity"
Avoid retalk import --inbox with no name (it imports all staged cards)
unless you've reviewed them. A keyless card imports as unverified (verified on
first contact).
After a contact is shared to you: confirm your fingerprint off-band
Always prepare a ready-to-paste reply that confirms your own fingerprint,
and send it back over a channel the relay doesn't control (Slack, email, in
person) — every time someone shares a contact with you. The relay is untrusted,
so an out-of-band fingerprint is what lets the other side pin your keys and
trust it's really you; sharing only over the relay leaves that half open.
retalk id --invite-message --as <name-they-save-you-as> --dir "<user>/identity"
(Or just your card: retalk id --card --dir "<user>/identity".) For a peer who's
already set up, the part that matters is your fingerprint + "add me as <name>" so
they can verify/pin you. Do this even after you've imported them.
<user> = this session's user directory (absolute path; resolved at init).
Next
- verify — pin the imported keys.
- send — message the imported peer.
- contacts — review saved peers.