fix(collaboration): validate local user fields

[seonghobae]

Closes #297

Scope

• validate userId, displayName, and cursorColor runtime types before normalization
• reject each local source above 1,024 UTF-16 code units before trim or Unicode traversal
• preserve trimmed identifiers, bound names to 80 Unicode code points, reject longer identifiers without array materialization, and lowercase valid colors
• normalize hostile property access to stable payload-redacted Inkspan errors

Dependency boundary

This Draft is stacked on #406 / exact base 02f55466c0111bb53c6886f5d4a95de2068e944a. The #297 delta changes only src/collaboration/awareness.ts and its existing unit test.

Exact-head local evidence

For exact head 7a7093b92616296be6b4c3c7ce990880d12f8271:

• RED on test-only e37b10e: 10 failed / 30 passed
• focused GREEN: 40 / 40 tests passed
• pnpm test: 160 files / 901 tests passed
• pnpm run coverage: 100% statements, branches, functions, and lines
• pnpm run typecheck: passed
• pnpm run build: passed
• pnpm run verify:package: passed

Local and predecessor evidence does not transfer approval or protected-main authority. Keep Draft until #406/#403/#405 integrate or the dependency chain is otherwise resolved, and while #118 owns the protected release boundary.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh exact-head validation for 7a7093b: src/collaboration/awareness.test.ts passed 40/40 tests, covering runtime type checks, 1,024-unit bounds, Unicode identifier limits, color normalization, and payload-redacted errors. pnpm run typecheck passed. The PR remains Draft and stacked on #406/#403/#405; no protected-main or release claim is made.