收紧移动壳网络安全元数据

禁用 Android 默认明文流量

禁用 iOS ATS 任意网络加载

声明当前未使用非豁免自定义加密

更新原生壳方案和团队决策记录

apps/mobile-shell/scripts/check-config.mjs

@@ -221,6 +221,16 @@ if (appConfig.ios?.buildNumber !== '1') {
   throw new Error('mobile shell iOS build number must start at 1');
 }
 
+if (appConfig.ios?.infoPlist?.ITSAppUsesNonExemptEncryption !== false) {
+  throw new Error('mobile shell iOS encryption export flag must be explicit');
+}
+
+if (
+  appConfig.ios?.infoPlist?.NSAppTransportSecurity?.NSAllowsArbitraryLoads !== false
+) {
+  throw new Error('mobile shell iOS ATS must not allow arbitrary network loads');
+}
+
 if (appConfig.android?.package !== 'world.genarrative.mobile') {
   throw new Error('mobile shell Android package must be world.genarrative.mobile');
 }
@@ -229,6 +239,10 @@ if (appConfig.android?.versionCode !== 1) {
   throw new Error('mobile shell Android versionCode must start at 1');
 }
 
+if (appConfig.android?.usesCleartextTraffic !== false) {
+  throw new Error('mobile shell Android package must disable cleartext traffic');
+}
+
 if (
   appConfig.android?.adaptiveIcon?.foregroundImage !== './assets/icon.png' ||
   appConfig.android?.adaptiveIcon?.backgroundColor !== brandBackgroundColor