As i understand if you connect to a room that contains entities (players) each player receives updates to the other player.
How would one implement some deliberate hiding of information from certain clients?

I suppose it will be easy to create something like maphack if you receive the position of all the opponents.

Not that is going to happen on a indie javascript game made for fun, but still i'm thinking like a developer and its interesting to me if it is possible with this network engine.

Each "room" is that player's perspective on the world - so it only contains what the player is aware of, plus the "demanded action" for the player (move left/right, shoot, etc).

A shared room would be used for overall game state that is shared across all users - such as current time.

To summarize: in the current state of the framework, you'd be better off sending data manually to each client (thorugh room's send method), and not use the state for the world.

Hopefully this will be improved eventually when colyseus/schema gets stable!