fix(app): add postMessage origin validation to archyBridge

Configurable origin replaces wildcard '*' for both sending and receiving.
Origin check filters incoming messages when a specific origin is set.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/src/services/archyBridge.ts

@@ -36,6 +36,7 @@ const themeCallbacks: ThemeCallback[] = []
 let currentPermissions: AIContextCategory[] = []
 let currentTheme: ThemeInfo | null = null
 let initialized = false
+let allowedOrigin = '*'
 
 function generateId(): string {
   return `aiui-${++requestId}-${Date.now()}`
@@ -43,10 +44,13 @@ function generateId(): string {
 
 function postToParent(msg: unknown) {
   if (window.parent === window) return // Not in iframe
-  window.parent.postMessage(msg, '*')
+  window.parent.postMessage(msg, allowedOrigin)
 }
 
 function handleMessage(event: MessageEvent) {
+  // Validate origin when configured
+  if (allowedOrigin !== '*' && event.origin !== allowedOrigin) return
+
   const msg = event.data
   if (!msg || typeof msg.type !== 'string') return
 
@@ -91,9 +95,10 @@ export const archyBridge = {
    * Initialize the bridge. Call once on app mount.
    * Sends 'ready' to Archy so it knows the iframe is loaded.
    */
-  init() {
+  init(origin?: string) {
     if (initialized) return
     initialized = true
+    if (origin) allowedOrigin = origin
     window.addEventListener('message', handleMessage)
     postToParent({ type: 'ready' })
   },