收口原生能力可信边界

H5 原生能力只信任真实 host.getRuntime 回包

移除桌面壳未声明网络事件白名单

补齐原生壳能力门控测试和共享决策记录

scripts/check-native-shells.mjs

@@ -2096,25 +2096,25 @@ function assertNativeShellCapabilityPlan() {
     'wechat mini program runtime capability profile',
   );
 
+  const desktopEventWhitelist = extractRustStringArray(desktopEventSource, 'HOST_BRIDGE_EVENTS');
+  const sharedDesktopEvents = sharedDesktopCapabilities.filter((capability) =>
+    sharedEvents.includes(capability),
+  );
   assertSameList(
-    extractRustStringArray(desktopEventSource, 'HOST_BRIDGE_EVENTS'),
-    sharedEvents,
+    desktopEventWhitelist,
+    sharedDesktopEvents,
     'desktop shell runtime event whitelist',
   );
-
-  const desktopEventWhitelist = extractRustStringArray(desktopEventSource, 'HOST_BRIDGE_EVENTS');
-  for (const eventName of sharedDesktopCapabilities.filter((capability) =>
-    sharedEvents.includes(capability),
-  )) {
-    if (!desktopEventWhitelist.includes(eventName)) {
-      throw new Error(`desktop HostBridge event must be in Rust event whitelist: ${eventName}`);
-    }
-  }
   if (sharedDesktopCapabilities.includes('network.statusChanged')) {
     throw new Error(
       'desktop shell must not declare network.statusChanged until Rust owns a real event source',
     );
   }
+  if (desktopEventWhitelist.includes('network.statusChanged')) {
+    throw new Error(
+      'desktop shell event whitelist must not include network.statusChanged until Rust owns a real event source',
+    );
+  }
 
   assertSameList(
     desktopCapabilities,