收口原生壳锁文件版本

移动壳配置检查锁定package-lock实际解析版本

桌面壳配置检查锁定package-lock与Cargo.lock解析版本

宿主壳方案文档补充锁文件版本门禁

共享决策日志记录原生壳锁文件依赖边界

apps/mobile-shell/scripts/check-config.mjs

@@ -21,6 +21,8 @@ const packagePath = new URL('../package.json', import.meta.url);
 const packageConfig = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
 const rootPackagePath = new URL('../../../package.json', import.meta.url);
 const rootPackageConfig = JSON.parse(fs.readFileSync(rootPackagePath, 'utf8'));
+const rootPackageLockPath = new URL('../../../package-lock.json', import.meta.url);
+const rootPackageLock = JSON.parse(fs.readFileSync(rootPackageLockPath, 'utf8'));
 const iconPath = new URL('../assets/icon.png', import.meta.url);
 const icon = PNG.sync.read(fs.readFileSync(iconPath));
 const brandBackgroundColor = '#fffdf9';
@@ -212,6 +214,15 @@ function assertPackageDependencyVersion(
   }
 }
 
+function assertPackageLockVersion(dependency, expected) {
+  const actual = rootPackageLock.packages?.[`node_modules/${dependency}`]?.version;
+  if (actual !== expected) {
+    throw new Error(
+      `root package-lock ${dependency} resolved version drifted: expected ${expected} but got ${actual}`,
+    );
+  }
+}
+
 function collectProductionSourceFiles(entry) {
   const stats = fs.statSync(entry);
   if (stats.isDirectory()) {
@@ -352,6 +363,27 @@ for (const [dependency, expected] of Object.entries({
   );
 }
 
+for (const [dependency, expected] of Object.entries({
+  '@expo/metro-runtime': '56.0.15',
+  expo: '56.0.12',
+  'expo-clipboard': '56.0.4',
+  'expo-document-picker': '56.0.4',
+  'expo-file-system': '56.0.8',
+  'expo-haptics': '56.0.3',
+  'expo-image-picker': '56.0.18',
+  'expo-linking': '56.0.14',
+  'expo-network': '56.0.5',
+  'expo-notifications': '56.0.18',
+  'expo-sharing': '56.0.18',
+  'expo-status-bar': '56.0.4',
+  react: '19.2.4',
+  'react-native': '0.86.0',
+  'react-native-safe-area-context': '5.8.0',
+  'react-native-webview': '13.16.1',
+})) {
+  assertPackageLockVersion(dependency, expected);
+}
+
 for (const [dependency, expected] of Object.entries({
   typescript: '~5.8.2',
   vitest: '^0.34.6',
@@ -372,6 +404,13 @@ for (const [dependency, expected] of Object.entries({
   );
 }
 
+for (const [dependency, expected] of Object.entries({
+  typescript: '5.8.3',
+  vitest: '0.34.6',
+})) {
+  assertPackageLockVersion(dependency, expected);
+}
+
 const sharedCapabilities = extractStringArrayExport(
   sharedContractSource,
   'HOST_BRIDGE_CAPABILITIES',