fix(app): restrict postMessage origin in archyBridge

Change default allowedOrigin from '*' to null. Derive from
window.location.origin when init() is called without explicit origin.
Always validate event.origin — reject messages when origin is not set.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/src/services/archyBridge.ts

@@ -36,7 +36,7 @@ const themeCallbacks: ThemeCallback[] = []
 let currentPermissions: AIContextCategory[] = []
 let currentTheme: ThemeInfo | null = null
 let initialized = false
-let allowedOrigin = '*'
+let allowedOrigin: string | null = null
 
 function generateId(): string {
   return `aiui-${++requestId}-${Date.now()}`
@@ -44,12 +44,13 @@ function generateId(): string {
 
 function postToParent(msg: unknown) {
   if (window.parent === window) return // Not in iframe
+  if (!allowedOrigin) return // Origin not configured
   window.parent.postMessage(msg, allowedOrigin)
 }
 
 function handleMessage(event: MessageEvent) {
-  // Validate origin when configured
-  if (allowedOrigin !== '*' && event.origin !== allowedOrigin) return
+  // Always validate origin — reject if not configured or mismatched
+  if (!allowedOrigin || event.origin !== allowedOrigin) return
 
   const msg = event.data
   if (!msg || typeof msg.type !== 'string') return
@@ -98,7 +99,8 @@ export const archyBridge = {
   init(origin?: string) {
     if (initialized) return
     initialized = true
-    if (origin) allowedOrigin = origin
+    // Use explicit origin or derive from current location (self-only)
+    allowedOrigin = origin ?? window.location.origin
     window.addEventListener('message', handleMessage)
     postToParent({ type: 'ready' })
   },