amalgm 0.1.166 → 0.1.167

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.166",
+  "version": "0.1.167",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/amalgm-mcp/state/presence.js

@@ -11,8 +11,9 @@
  * a doc byte must outlive everything.
  *
  * Ownership rules the wire shape enforces:
- *  - Identity is stamped HERE from the enrolled account (workspace/identity),
- *    never accepted from the publisher. A blob cannot impersonate.
+ *  - The stable account id is stamped here from enrollment, never accepted
+ *    from the publisher. Cross-account display identity is authenticated and
+ *    added by the gateway, then passed through this state unchanged.
  *  - The blob is opaque. Only the surface bound to the same resource on the
  *    other end knows its coordinate system (text caret, canvas x,y, nothing).
  *  - Absence is the default presence must re-earn: entries live TTL_MS from
@@ -63,6 +64,7 @@ function peersOf(resource) {
   return peers ? Array.from(peers.values(), (peer) => ({
     session: peer.session,
     user: peer.user,
+    ...(peer.identity ? { identity: peer.identity } : {}),
     blob: peer.blob,
     at: peer.at,
     activeAt: peer.activeAt,
@@ -223,6 +225,7 @@ function replaceCloudPresence(input) {
     peers.set(peer.session, {
       session: peer.session,
       user: peer.user,
+      ...(peer.identity && typeof peer.identity === 'object' ? { identity: peer.identity } : {}),
       blob: peer.blob ?? null,
       at: Number(peer.at) || now,
       activeAt: Number(peer.activeAt) || now,

package/runtime/scripts/amalgm-mcp/tests/shared-presence-tunnel.test.js

@@ -77,6 +77,7 @@ test('the runtime tunnel bridges presence in both directions without a durable q
       peers: [{
         session: 'ps_direct',
         user: 'direct-user',
+        identity: { name: 'Direct Person', avatarUrl: 'https://example.com/direct.png' },
         blob: { anchor: 8 },
         at: 20,
         activeAt: 20,
@@ -92,6 +93,7 @@ test('the runtime tunnel bridges presence in both directions without a durable q
       peers: [{
         session: 'ps_direct',
         user: 'direct-user',
+        identity: { name: 'Direct Person', avatarUrl: 'https://example.com/direct.png' },
         blob: { anchor: 8 },
         at: 20,
         activeAt: 20,

package/runtime/scripts/amalgm-mcp/tests/state-presence.test.js

@@ -165,11 +165,22 @@ test('shared presence forwards local facts, merges cloud peers, and clears them
     resource: localResource,
     peers: [
       { session: 'ps_local', user: 'official-local', blob: null, at: 10, activeAt: 10 },
-      { session: 'ps_remote', user: 'remote-user', blob: { anchor: 9 }, at: 11, activeAt: 11 },
+      {
+        session: 'ps_remote',
+        user: 'remote-user',
+        identity: { name: 'Remote Person', avatarUrl: 'https://example.com/remote.png' },
+        blob: { anchor: 9 },
+        at: 11,
+        activeAt: 11,
+      },
     ],
   });
   assert.equal(publishes.length, 1, 'an inbound cloud roster never echoes back upstream');
   assert.deepEqual(frames.at(-1).peers.map((peer) => peer.session).sort(), ['ps_local', 'ps_remote']);
+  assert.deepEqual(
+    frames.at(-1).peers.find((peer) => peer.session === 'ps_remote').identity,
+    { name: 'Remote Person', avatarUrl: 'https://example.com/remote.png' },
+  );
 
   await sharedRest.handleReplicaRevoked(
     { resourceId: cloudResourceId, reason: 'access-removed' },