锁定移动壳注入消息来源字段

补充移动壳 HostBridge 注入 source 与 origin 断言

更新移动壳配置门禁反查注入来源测试

apps/mobile-shell/src/shell/ShellApp.test.tsx

@@ -245,6 +245,11 @@ function extractInjectedHostBridgeMessage(script: string) {
   return JSON.parse(JSON.parse(encodedMessage)) as unknown;
 }
 
+function expectInjectedHostBridgeMessageSource(script: string) {
+  expect(script).toContain('origin: window.location.origin');
+  expect(script).toContain('source: window');
+}
+
 function hostBridgeMessages() {
   return shellHarness.injectedScripts.map(extractInjectedHostBridgeMessage);
 }
@@ -322,6 +327,7 @@ describe('ShellApp QR scanner HostBridge flow', () => {
     const responseScript = shellHarness.injectedScripts.find((script) =>
       script.includes('scan-request-1'),
     );
+    expectInjectedHostBridgeMessageSource(responseScript ?? '');
     const response = extractInjectedHostBridgeMessage(responseScript ?? '');
 
     expect(response).toMatchObject({
@@ -446,6 +452,7 @@ describe('ShellApp HostBridge event injection', () => {
     shellHarness.appStateListeners[0]?.('background');
 
     const event = hostBridgeEvent('app.lifecycle');
+    expectInjectedHostBridgeMessageSource(shellHarness.injectedScripts[0] ?? '');
     expect(event).toMatchObject({
       event: 'app.lifecycle',
       payload: {