@volter/supercode-teams 0.2.126 → 0.2.127

package/machine.mjs

@@ -534,11 +534,16 @@ export class TeamsMachine extends MachineCore {
     // Who typed it is noted before it is typed: a capture can read the session's new line before the door confirms
     // it (a loaded machine confirmed a frozen-then-resumed line after the line was captured, and it went up unnamed).
     // A refusal withdraws the note; an unconfirmed turn keeps it, as the line may well be in the session.
-    const note = { harness, session, text: request.text, at: Date.now(), source: { via: 'room', from: { principalId: principal ?? null, name: entry.name ?? null } } };
+    // Room context comes only from the server-authenticated claim. JSON quotes names as data,
+    // so a display name cannot introduce another header or masquerade as an instruction.
+    const text = entry.roomContext
+      ? `[Room ${JSON.stringify(entry.roomContext.name)} (${JSON.stringify(entry.roomContext.id)}); sender ${JSON.stringify(entry.name ?? entry.roomContext.sender)} (${JSON.stringify(entry.roomContext.sender)})]\n${request.text}`
+      : request.text;
+    const note = { harness, session, text, at: Date.now(), source: { via: 'room', from: { principalId: principal ?? null, name: entry.name ?? null } } };
     try { this.onTurn?.(note); } catch { /* naming is best-effort; the turn goes either way */ }
     this.#serveRequest('harness.v1.sessions.message', {
       locator: { harness, session_id: session, storage: { kind: 'file', path: '' } },
-      text: request.text,
+      text,
       from_name: entry.name ?? principal ?? 'a Room member',
       as_user: true,
     }, TURN_CONFIRM_MS).then((result) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.126",
+  "version": "0.2.127",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",