收紧原生壳桥接权限边界

移动壳 HostBridge 协议名和版本改为共享契约常量

移动壳配置检查锁定主动导航和 deep link 宿主上下文补写

桌面壳主窗口 capability 移除 Tauri core 默认权限

桌面壳配置检查拒绝 core 默认权限和插件权限外露

更新原生壳方案与共享决策记录

apps/desktop-shell/scripts/check-config.mjs

@@ -1063,9 +1063,40 @@ for (const capability of sdkBackedCapabilities) {
 }
 
 const allowedPermissions = [
-  'core:default',
   'allow-host-bridge-request',
 ];
+const blockedCoreDefaultPermissions = [
+  'core:default',
+  'core:app:default',
+  'core:event:default',
+  'core:image:default',
+  'core:menu:default',
+  'core:path:default',
+  'core:resources:default',
+  'core:tray:default',
+  'core:webview:default',
+  'core:window:default',
+];
+const blockedCorePermissionPrefixes = [
+  'core:app:',
+  'core:event:',
+  'core:image:',
+  'core:menu:',
+  'core:path:',
+  'core:resources:',
+  'core:tray:',
+  'core:webview:',
+  'core:window:',
+];
+const blockedPluginPermissionPrefixes = [
+  'clipboard-manager:',
+  'deep-link:',
+  'dialog:',
+  'fs:',
+  'notification:',
+  'opener:',
+  'window-state:',
+];
 const sharedTauriCommand = extractTsStringConst(
   sharedContractSource,
   'HOST_BRIDGE_TAURI_COMMAND',
@@ -1300,8 +1331,20 @@ assertSameList(
   allowedPermissions,
   'desktop shell capability permissions',
 );
-if ((capability.permissions ?? []).some((permission) => permission.startsWith('notification:'))) {
-  throw new Error('desktop shell must not expose notification plugin commands to H5');
+for (const permission of capability.permissions ?? []) {
+  if (blockedCoreDefaultPermissions.includes(permission)) {
+    throw new Error(`desktop shell must not expose ${permission} to H5`);
+  }
+  if (
+    blockedCorePermissionPrefixes.some((prefix) => permission.startsWith(prefix))
+  ) {
+    throw new Error(`desktop shell must not expose Tauri core permission ${permission} to H5`);
+  }
+  if (
+    blockedPluginPermissionPrefixes.some((prefix) => permission.startsWith(prefix))
+  ) {
+    throw new Error(`desktop shell must not expose plugin permission ${permission} to H5`);
+  }
 }
 assertSameList(
   extractTauriBuildCommands(buildScript),