锁定移动壳注入消息来源字段

补充移动壳 HostBridge 注入 source 与 origin 断言

更新移动壳配置门禁反查注入来源测试

apps/mobile-shell/scripts/check-config.mjs

@@ -2612,6 +2612,9 @@ for (const snippet of [
   'mobile HostBridge message injection failed',
   "test('drops delayed HostBridge responses after shell unmount'",
   "id: 'network-request-1'",
+  'expectInjectedHostBridgeMessageSource',
+  "expect(script).toContain('origin: window.location.origin')",
+  "expect(script).toContain('source: window')",
   "type: 'genarrative.mobile.historyState'",
   'mobile host event failed for network.statusChanged',
   'external WebView navigation native failures stay outside the WebView',

apps/mobile-shell/src/shell/ShellApp.test.tsx

@@ -245,6 +245,11 @@ function extractInjectedHostBridgeMessage(script: string) {
   return JSON.parse(JSON.parse(encodedMessage)) as unknown;
 }
 
+function expectInjectedHostBridgeMessageSource(script: string) {
+  expect(script).toContain('origin: window.location.origin');
+  expect(script).toContain('source: window');
+}
+
 function hostBridgeMessages() {
   return shellHarness.injectedScripts.map(extractInjectedHostBridgeMessage);
 }
@@ -322,6 +327,7 @@ describe('ShellApp QR scanner HostBridge flow', () => {
     const responseScript = shellHarness.injectedScripts.find((script) =>
       script.includes('scan-request-1'),
     );
+    expectInjectedHostBridgeMessageSource(responseScript ?? '');
     const response = extractInjectedHostBridgeMessage(responseScript ?? '');
 
     expect(response).toMatchObject({
@@ -446,6 +452,7 @@ describe('ShellApp HostBridge event injection', () => {
     shellHarness.appStateListeners[0]?.('background');
 
     const event = hostBridgeEvent('app.lifecycle');
+    expectInjectedHostBridgeMessageSource(shellHarness.injectedScripts[0] ?? '');
     expect(event).toMatchObject({
       event: 'app.lifecycle',
       payload: {