加固原生壳生产入口门禁

桌面壳深链打开失败改为显式日志记录

移动壳生产导出校验共享主站 URL

原生壳方案文档同步生产入口验收规则

apps/mobile-shell/scripts/check-expo-export.mjs

@@ -4,8 +4,43 @@ import fs from 'node:fs';
 
 const shellRoot = new URL('../', import.meta.url);
 const outputRoot = new URL('../.expo-export-smoke/', import.meta.url);
+const hostBridgeContractUrl = new URL(
+  '../../../packages/shared/src/contracts/hostBridge.ts',
+  import.meta.url,
+);
 const npmCommand = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 const platforms = ['android', 'ios'];
+const blockedDevelopmentWebUrlPatterns = [
+  /http:\\?\/\\?\/localhost(?::\d+)?/u,
+  /http:\\?\/\\?\/127\.0\.0\.1(?::\d+)?/u,
+  /http:\\?\/\\?\/\[::1\](?::\d+)?/u,
+];
+
+function readHostBridgePublicWebUrl() {
+  const contractSource = fs.readFileSync(hostBridgeContractUrl, 'utf8');
+  const publicWebUrlMatch = contractSource.match(
+    /HOST_BRIDGE_PUBLIC_WEB_URL\s*=\s*'([^']+)'/u,
+  );
+  const publicWebOriginMatch = contractSource.match(
+    /HOST_BRIDGE_PUBLIC_WEB_ORIGIN\s*=\s*'([^']+)'/u,
+  );
+
+  if (!publicWebUrlMatch || !publicWebOriginMatch) {
+    throw new Error('HostBridge public web URL contract is missing');
+  }
+
+  const publicWebUrl = publicWebUrlMatch[1];
+  const publicWebOrigin = publicWebOriginMatch[1];
+  if (new URL(publicWebUrl).origin !== publicWebOrigin) {
+    throw new Error(
+      'HostBridge public web URL and origin contract must point to the same origin',
+    );
+  }
+
+  return publicWebUrl;
+}
+
+const expectedPublicWebUrl = readHostBridgePublicWebUrl();
 
 function runExpoExport(platform) {
   const outputDir = `.expo-export-smoke/${platform}`;
@@ -80,6 +115,21 @@ function assertBundle(platform, bundlePath) {
   if (!bundlePath.includes(`/static/js/${platform}/AppEntry-`)) {
     throw new Error(`Expo ${platform} bundle path does not target AppEntry`);
   }
+
+  const bundleSource = fs.readFileSync(bundleFile, 'utf8');
+  if (!bundleSource.includes(expectedPublicWebUrl)) {
+    throw new Error(
+      `Expo ${platform} production bundle must include the shared public web URL`,
+    );
+  }
+
+  for (const blockedPattern of blockedDevelopmentWebUrlPatterns) {
+    if (blockedPattern.test(bundleSource)) {
+      throw new Error(
+        `Expo ${platform} production bundle must not include a local development H5 URL`,
+      );
+    }
+  }
 }
 
 fs.rmSync(outputRoot, {recursive: true, force: true});