关闭移动壳网页下载路径

移动壳 WebView 注入下载阻断脚本并丢弃 iOS 文件下载事件。

移动壳 Android 包配置阻断外部存储和请求安装包权限。

移动壳配置检查和 Expo public config smoke 锁定下载边界。

新增移动壳 WebView 下载阻断策略测试。

更新宿主壳方案和共享决策日志记录移动端下载只能走 HostBridge 导出。

apps/mobile-shell/scripts/check-config.mjs

@@ -72,10 +72,14 @@ const blockedMobileChannelSnippets = [
   'posthog.init',
 ];
 const blockedAndroidPermissions = [
+  'android.permission.MANAGE_EXTERNAL_STORAGE',
+  'android.permission.READ_EXTERNAL_STORAGE',
   'android.permission.RECORD_AUDIO',
   'android.permission.RECEIVE_BOOT_COMPLETED',
+  'android.permission.REQUEST_INSTALL_PACKAGES',
   'android.permission.SCHEDULE_EXACT_ALARM',
   'android.permission.USE_EXACT_ALARM',
+  'android.permission.WRITE_EXTERNAL_STORAGE',
 ];
 
 function extractStringArrayExport(source, exportName) {
@@ -425,6 +429,7 @@ for (const snippet of [
   'subscribeMobileNetworkStatus',
   'navigation.canGoBack',
   'buildHostBridgeMessageScript',
+  'BLOCK_WEBVIEW_DOWNLOAD_SCRIPT',
   'SafeAreaProvider',
   'SafeAreaView',
   'MOBILE_SHELL_SAFE_AREA_EDGES',
@@ -440,6 +445,8 @@ for (const snippet of [
   'thirdPartyCookiesEnabled={false}',
   'sharedCookiesEnabled={false}',
   'webviewDebuggingEnabled={false}',
+  'injectedJavaScriptBeforeContentLoaded={BLOCK_WEBVIEW_DOWNLOAD_SCRIPT}',
+  'onFileDownload={() => undefined}',
   'setSupportMultipleWindows={false}',
 ]) {
   if (!appSource.includes(snippet)) {

apps/mobile-shell/scripts/check-expo-config.mjs

@@ -135,11 +135,31 @@ assertEqual(
   'resize',
   'Android software keyboard layout mode',
 );
+assertIncludes(
+  expoConfig.android?.blockedPermissions,
+  'android.permission.MANAGE_EXTERNAL_STORAGE',
+  'Android external download blocked permissions',
+);
+assertIncludes(
+  expoConfig.android?.blockedPermissions,
+  'android.permission.READ_EXTERNAL_STORAGE',
+  'Android external download blocked permissions',
+);
 assertIncludes(
   expoConfig.android?.blockedPermissions,
   'android.permission.RECORD_AUDIO',
   'Android blocked permissions',
 );
+assertIncludes(
+  expoConfig.android?.blockedPermissions,
+  'android.permission.REQUEST_INSTALL_PACKAGES',
+  'Android external install blocked permissions',
+);
+assertIncludes(
+  expoConfig.android?.blockedPermissions,
+  'android.permission.WRITE_EXTERNAL_STORAGE',
+  'Android external download blocked permissions',
+);
 for (const permission of [
   'android.permission.RECEIVE_BOOT_COMPLETED',
   'android.permission.SCHEDULE_EXACT_ALARM',