Sterister
d47774ef1c
Two follow-ups to the V4.8.2 duplicate-fan-out fixes Prism filed. 1. `Inbox.acceptBridgeFrame(blob)` + shared 4096-entry msgId LRU. The relay durably stores blobs and pushes them to every active delivery channel; without a cross-channel ack the bridge frame ran first and the next inbox-poll re-dispatched the same blob ~30 s later, tripping on consumed prekeys. Bridge consumers now plumb pushed frames through `acceptBridgeFrame`, which shares the dedup gate + ack path with `pollOnce`. Whichever channel delivers first wins; the other acks-and-skips. Inbox records the msgId before the ack so a parallel poll can't observe an in-flight ack window. 2. `Shade.aliasSession(oldLabel, newLabel)`. First-contact forces the receiver to label the new session by the relay's sender fingerprint hint (`fp:<senderfp>`); the post-decrypt plaintext typically announces the peer's real address. Aliasing moves session, trusted identity, peer-verification, and identity- version under the canonical label. Holds the per-peer mutex on both labels (lexicographic order) so concurrent crypto ops can't observe a half-moved state. Refuses to overwrite an existing session at the new label. Wire change: `IncomingMessage.expiresAt?` now surfaces the relay's expiry so receivers can pass bridge frames straight to `acceptBridgeFrame` without inventing a TTL. Tests cover bridge-then-poll, poll-then-bridge, aliasSession happy path, refuse-to-overwrite, and same-label no-op. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@shade/widgets
Embeddable React widgets for live Shade observability. Drop them into any React dashboard (Nova, Orchestrator, your own apps) to show what's happening in your Shade deployment.
Install
bun add @shade/widgets react react-dom
Quick start
import { ShadeProvider, IdentityCard, SessionList, RecentActivity } from '@shade/widgets';
function MyDashboard() {
return (
<ShadeProvider
observerUrl="https://shade.example.com/shade-observer"
token={process.env.SHADE_TOKEN!}
>
<IdentityCard />
<SessionList />
<RecentActivity />
</ShadeProvider>
);
}
You need a running @shade/observer endpoint for the widgets to talk to.
Components
| Component | Description |
|---|---|
<IdentityCard /> |
Your fingerprint, registration ID, init/rotation timestamps |
<SessionList /> |
Active Shade sessions with per-session message counts and DH ratchet steps |
<PrekeyStock lowThreshold={5} /> |
Gauge of remaining one-time prekeys with low-stock warning |
<RecentActivity limit={50} /> |
Live SSE feed of events flowing through the system |
<ServerStatus /> |
Prekey server stats (registered identities, fetches, replenishes, rate limits) |
<FingerprintCompare /> |
Paste a safety number to verify it matches your identity |
<WidgetCatalog /> |
Meta-widget letting users pick which widgets to display |
Letting users pick widgets
<ShadeProvider observerUrl="..." token="...">
<WidgetCatalog
available={['identity', 'sessions', 'prekeys', 'activity', 'server']}
defaultLayout={['identity', 'sessions', 'activity']}
/>
</ShadeProvider>
User selections persist to localStorage. Pass onLayoutChange to override with your own persistence.
Theming
<ShadeProvider observerUrl="..." token="..." themeMode="auto">
Modes: dark (default), light, auto (matches prefers-color-scheme).
Each widget renders self-contained CSS via inline styles — no Tailwind, no external CSS file, no conflicts with your host app.
Hooks
For custom layouts, use the underlying hooks directly:
import { useShadeState, useShadeEvents } from '@shade/widgets';
function CustomWidget() {
const { state, loading } = useShadeState();
const { events, connected } = useShadeEvents();
// ... render whatever you want
}
Polling interval
Default poll for /api/state is 5 seconds. Override:
<ShadeProvider observerUrl="..." token="..." pollIntervalMs={2000}>
The SSE event stream updates instantly regardless of poll interval.