* web-api: refuse calls beyond an in-flight limit, and say who can call window.<app>
At most 64 calls (PageApi::with_max_in_flight) may wait for the app at once. A call made while that many wait rejects at once with a busy error and never reaches the app, so a page script that calls in a loop without awaiting cannot grow the app queue without bound, as the desktop control server already answers busy when its queue is full. The README also says the API is a property of the page global with no key: any script in the page origin has the same command control as the desktop control server.
* web-api: turn a busy call away before converting its params, and say a same-origin parent or opener can call window.<app>
A call over the in-flight limit used to stringify and convert its params before the busy check, so a large payload still cost the work it was being refused for. The params are now built by a closure the call runs only once it holds a slot.
The README said a parent, a child or an opener cannot reach window.<app>. That holds across origins only: a same-origin parent, child or opener with a window reference calls it directly, and the craft-web-host origin and source checks do not apply to that call.
---------
Co-authored-by: Helen Kwok <107752876+helenkwok@users.noreply.github.com>
Helen Kwok
2bfc45c493