Engine: macros can't open, hide or show windows

The policy denies window.* commands, but the View tab's window commands
are view.*: a macro could run view.newWindow, which adds a window that
the run's rollback doesn't remove, or view.hideWindow and
view.unhideWindow, which change the session's hidden windows.

The policy now denies those three. Arrange All changes nothing in the
engine and Switch Windows only lists windows, so both stay allowed.

crates/engine/src/macros/policy.rs

@@ -30,8 +30,13 @@ const DENIED_PREFIXES: &[(&str, &str)] = &[
 ];
 
 /// Single commands that never run in a macro.
-const DENIED: &[(&str, &str)] =
-    &[("edit.undo", "a macro is undone as one step after it runs"), ("edit.redo", "a macro is undone as one step after it runs")];
+const DENIED: &[(&str, &str)] = &[
+    ("edit.undo", "a macro is undone as one step after it runs"),
+    ("edit.redo", "a macro is undone as one step after it runs"),
+    ("view.newWindow", "macros don't open, hide or show windows"),
+    ("view.hideWindow", "macros don't open, hide or show windows"),
+    ("view.unhideWindow", "macros don't open, hide or show windows"),
+];
 
 /// Commands under a denied prefix that only change the workbook.
 const ALLOWED: &[&str] = &["file.properties"];
@@ -97,6 +102,9 @@ mod tests {
             "macro.record",
             "edit.undo",
             "edit.redo",
+            "view.newWindow",
+            "view.hideWindow",
+            "view.unhideWindow",
         ] {
             assert!(matches!(macro_policy(id, &none, Trust::Local), Policy::Deny(_)), "{id}");
             assert!(matches!(macro_policy(id, &path, Trust::FromFile), Policy::Deny(_)), "{id}");

crates/engine/src/tests/macros.rs

@@ -419,6 +419,8 @@ fn the_policy_keeps_macros_away_from_files_and_the_app() {
         ("automate.runScript", json!({"name": "Script 1"})),
         ("edit.undo", json!({})),
         ("macro.run", json!({"name": "Self"})),
+        ("view.newWindow", json!({})),
+        ("view.hideWindow", json!({})),
     ] {
         put(
             &mut s,

docs/macros.md

@@ -75,8 +75,8 @@ called Output, even when a token or input has that name.
 
 `macro.run {name, inputs?, onConflict?, overwrite?, approve?, timeLimit?}`:
 
-1. **Policy.** File, app, window, automate and macro commands, and Undo and Redo, never run in a
-   macro. Reading or writing a file (`data.getData`, `data.fromTextCsv`, `insert.picture` or
+1. **Policy.** File, app, window (including New Window, Hide and Unhide), automate and macro
+   commands, and Undo and Redo, never run in a macro. Reading or writing a file (`data.getData`, `data.fromTextCsv`, `insert.picture` or
    `pageLayout.background` with a `path`, or an export or print with a `path`) needs the command
    in the macro's `permissions`. Any `path` other than `null` counts, including a blank one and a
    token, and the policy is checked again on the parameters as they are when the step runs. A macro that touches files, or that came with a workbook opened