Subscribe to host messages. Currently scoped to theme delivery and host
focus requests; Phase 5 extends the same channel with permission-checked RPC.
Source check: we only accept messages whose source === window.parent.
That's stronger than an origin allowlist here because the host's origin
differs across dev/prod (http://localhost vs file://) — the iframe always
has exactly one parent in the browser process model.
Subscribe to host messages. Currently scoped to theme delivery and host focus requests; Phase 5 extends the same channel with permission-checked RPC.
Source check: we only accept messages whose
source === window.parent. That's stronger than an origin allowlist here because the host's origin differs across dev/prod (http://localhost vs file://) — the iframe always has exactly one parent in the browser process model.