收紧原生壳桥接权限边界

移动壳 HostBridge 协议名和版本改为共享契约常量

移动壳配置检查锁定主动导航和 deep link 宿主上下文补写

桌面壳主窗口 capability 移除 Tauri core 默认权限

桌面壳配置检查拒绝 core 默认权限和插件权限外露

更新原生壳方案与共享决策记录

apps/mobile-shell/src/shell/ShellApp.tsx

@@ -15,6 +15,10 @@ import { SafeAreaProvider, SafeAreaView } from 'react-native-safe-area-context';
 import type { WebViewMessageEvent } from 'react-native-webview';
 import { WebView } from 'react-native-webview';
 
+import {
+  HOST_BRIDGE_PROTOCOL,
+  HOST_BRIDGE_VERSION,
+} from '../../../../packages/shared/src/contracts/hostBridge';
 import {
   configureMobileHostBridgeNavigation,
   handleMobileHostBridgeMessage,
@@ -97,8 +101,8 @@ export default function ShellApp() {
   const injectHostBridgeEvent = useCallback((event: string, payload: unknown) => {
     webViewRef.current?.injectJavaScript(
       buildHostBridgeMessageScript({
-        bridge: 'GenarrativeHostBridge',
-        version: 1,
+        bridge: HOST_BRIDGE_PROTOCOL,
+        version: HOST_BRIDGE_VERSION,
         event,
         payload,
       }),

apps/mobile-shell/src/shell/url.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from 'vitest';
 
+import { HOST_BRIDGE_VERSION } from '../../../../packages/shared/src/contracts/hostBridge';
 import {
   DEFAULT_MOBILE_SHELL_WEB_URL,
   buildMobileShellUrl,
@@ -25,7 +26,9 @@ describe('buildMobileShellUrl', () => {
     expect(url.searchParams.get('hostShell')).toBe('expo_mobile');
     expect(url.searchParams.get('hostPlatform')).toBe('ios');
     expect(url.searchParams.get('hostVersion')).toBe('0.1.0');
-    expect(url.searchParams.get('bridgeVersion')).toBe('1');
+    expect(url.searchParams.get('bridgeVersion')).toBe(
+      HOST_BRIDGE_VERSION.toString(),
+    );
     expect(url.searchParams.get('hostCapabilities')).toBe(
       'host.getRuntime,share.open',
     );

apps/mobile-shell/src/shell/url.ts

@@ -1,6 +1,7 @@
-import type {
-  HostBridgeCapability,
-  NativeHostPlatform,
+import {
+  HOST_BRIDGE_VERSION,
+  type HostBridgeCapability,
+  type NativeHostPlatform,
 } from '../../../../packages/shared/src/contracts/hostBridge';
 
 export type MobileShellUrlOptions = {
@@ -58,7 +59,7 @@ export function buildMobileShellUrl(
   url.searchParams.set('hostShell', 'expo_mobile');
   url.searchParams.set('hostPlatform', options.platform);
   url.searchParams.set('hostVersion', options.hostVersion);
-  url.searchParams.set('bridgeVersion', '1');
+  url.searchParams.set('bridgeVersion', HOST_BRIDGE_VERSION.toString());
   url.searchParams.set('hostCapabilities', options.capabilities.join(','));
   return url.toString();
 }

apps/mobile-shell/src/shell/webViewHistory.test.ts

@@ -1,5 +1,9 @@
 import { describe, expect, test } from 'vitest';
 
+import {
+  HOST_BRIDGE_PROTOCOL,
+  HOST_BRIDGE_VERSION,
+} from '../../../../packages/shared/src/contracts/hostBridge';
 import { parseMobileWebViewHistoryStateMessage } from './webViewHistory';
 
 describe('parseMobileWebViewHistoryStateMessage', () => {
@@ -31,8 +35,8 @@ describe('parseMobileWebViewHistoryStateMessage', () => {
     expect(
       parseMobileWebViewHistoryStateMessage(
         JSON.stringify({
-          bridge: 'GenarrativeHostBridge',
-          version: 1,
+          bridge: HOST_BRIDGE_PROTOCOL,
+          version: HOST_BRIDGE_VERSION,
           method: 'host.getRuntime',
         }),
       ),