收口宿主事件白名单

新增共享 HostBridge event 白名单与类型守卫

让 H5、Expo 和 Tauri 只分发白名单宿主事件

补齐移动端、桌面端和根级原生壳门禁

更新宿主壳方案文档和项目决策记录

apps/mobile-shell/src/shell/ShellApp.tsx

@@ -16,6 +16,7 @@ import type { WebViewMessageEvent } from 'react-native-webview';
 import { WebView } from 'react-native-webview';
 
 import {
+  type HostBridgeEventName,
   HOST_BRIDGE_PROTOCOL,
   HOST_BRIDGE_VERSION,
 } from '../../../../packages/shared/src/contracts/hostBridge';
@@ -98,16 +99,19 @@ export default function ShellApp() {
   const reloadCurrentWebView = useCallback(() => {
     webViewRef.current?.reload();
   }, []);
-  const injectHostBridgeEvent = useCallback((event: string, payload: unknown) => {
-    webViewRef.current?.injectJavaScript(
-      buildHostBridgeMessageScript({
-        bridge: HOST_BRIDGE_PROTOCOL,
-        version: HOST_BRIDGE_VERSION,
-        event,
-        payload,
-      }),
-    );
-  }, []);
+  const injectHostBridgeEvent = useCallback(
+    (event: HostBridgeEventName, payload: unknown) => {
+      webViewRef.current?.injectJavaScript(
+        buildHostBridgeMessageScript({
+          bridge: HOST_BRIDGE_PROTOCOL,
+          version: HOST_BRIDGE_VERSION,
+          event,
+          payload,
+        }),
+      );
+    },
+    [],
+  );
   const injectLifecycleEvent = useCallback(
     (state: AppStateStatus) => {
       injectHostBridgeEvent('app.lifecycle', lifecyclePayloadFromAppState(state));