fix: address non-blocking P2s from yujiawei's approval review

@yujiawei approved but flagged 7 P2 hardening suggestions. Take the
three that are mechanical + safe; skip the four that need judgment or
backend coordination.

- Mirror the presence guard `uploadMcpIconReal` already has: reject
  `initResp` with missing `presigned_url`/`object_key` in
  `skillApiReal.uploadIcon` so a malformed 200 response yields a
  normalized Toast error, not an uncaught TypeError inside
  `uploadFile` (P2 #6).
- Soften the `assertSafeUploadURL` / `assertSafeExternalURL` doc
  comments so they no longer overstate the protection: they are
  scheme-level guards only; an `https://` URL pointing at an internal
  or metadata host still passes. Also spell out why the residual blast
  radius stays bounded (P2 #2).
- Document that `VITE_USE_MOCK` swaps only the 8 CRUD endpoints — the
  upload / parse / poll / download pipeline is always bound to the
  real backend because the mock module has no upload surface. Prevents
  the "why is my mock env hitting the real server" surprise (P2 #7).

Skipped:
- P2 #1 (icon <img src> host allowlist): needs a marketplace-side
  allowlist to compare against — not settled here.
- P2 #3 (SECRET_KEY_PATTERN gaps: credential/auth/bearer/…): source
  comment asserts it must stay byte-identical to the backend regex, so
  a frontend-only tighten would desync. Backend PR paired.
- P2 #4 (shell-escape skillId in the install prompt): value is a
  backend UUID today; hardening path is UUID-validate or shell-quote,
  either is a judgment call.
- P2 #5 (request<T> undefined guard): can't distinguish "delete
  returned no data" from "misbehaving backend dropped data" at the
  `request` layer without caller-intent context.

Refs: PR #851 review by @yujiawei (APPROVED verdict, P2 suggestions)

Author: lsc

packages/dmworkmcp/src/api/mcpService.ts

@@ -66,10 +66,17 @@ function delay<T>(value: T, ms = MOCK_DELAY_MS): Promise<T> {
 
 /**
  * Reject presigned upload / download URLs whose scheme is not http(s), or
- * whose http-scheme host is not a loopback (dev proxy). Backend-supplied
- * URLs are still trusted for the exact host they name, but we refuse to
- * PUT / GET against `javascript:`, `data:`, `file:` etc. — defense in
- * depth against a misconfigured or compromised marketplace.
+ * whose http-scheme host is not a loopback (dev proxy). Blocks the obvious
+ * bad schemes — `javascript:`, `data:`, `file:` — before an anchor.href /
+ * axios.put reaches them.
+ *
+ * Scope: this is scheme-level defense-in-depth only. An `https://` URL
+ * pointing at an internal / metadata host (`https://10.x`,
+ * `https://169.254.169.254`) still passes; that class of concern needs a
+ * host allowlist against the known storage origin, which the marketplace
+ * hasn't published yet. Blast radius is bounded either way — the PUT
+ * carries only the user-selected icon bytes with no app credentials (raw
+ * axios, no interceptors).
  */
 function assertSafeUploadURL(raw: string): void {
   let u: URL;

packages/dmworkskillmarket/src/api/skillApi.ts

@@ -8,6 +8,12 @@ const processEnv = typeof process === "undefined" ? undefined : process.env;
 const useMock = env?.VITE_USE_MOCK === "true" || processEnv?.VITE_USE_MOCK === "true";
 const api = useMock ? mockApi : realApi;
 
+// NOTE: `VITE_USE_MOCK` only swaps the 8 CRUD endpoints below. The upload /
+// parse / poll / download pipeline (initUpload / uploadFile / uploadIcon /
+// triggerParse / pollParse / initReupload / getDownloadUrl / downloadSkill)
+// is always bound to the real backend — the mock module has no upload
+// surface. A dev enabling mock mode still hits real network on the upload
+// step; use a real dev backend if you need the full flow.
 export const getCategories = api.getCategories;
 export const getSkills = api.getSkills;
 export const getMySkills = api.getMySkills;

packages/dmworkskillmarket/src/api/skillApiReal.ts

@@ -128,10 +128,14 @@ function wait(ms: number): Promise<void> {
 
 /**
  * Reject presigned upload / download URLs whose scheme is not http(s), or
- * whose http-scheme host is not loopback. Guards against a compromised or
- * misconfigured marketplace returning `javascript:` / `data:` / `file:` /
- * arbitrary internal targets that a browser would otherwise honor
- * (anchor.href / xhr.open both accept unusual schemes).
+ * whose http-scheme host is not loopback. Blocks `javascript:` / `data:` /
+ * `file:` / arbitrary non-web schemes before an anchor.href / xhr.open
+ * accepts them.
+ *
+ * Scope: scheme-level only. `https://10.x` / `https://169.254.169.254`
+ * still passes — internal-host filtering would need a marketplace-side
+ * allowlist not shipped here. Blast radius stays bounded because the PUT
+ * runs with no app credentials (bare XHR / no interceptors).
  */
 function assertSafeExternalURL(raw: string): void {
   let u: URL;
@@ -358,6 +362,12 @@ export async function uploadIcon(blob: Blob): Promise<string> {
       body: JSON.stringify({ file_name: fileName, file_size: blob.size }),
     },
   );
+  // Mirror the presence guard `uploadMcpIconReal` already has — a malformed
+  // response would otherwise dereference `undefined.presigned_url` inside
+  // `uploadFile` as a bare TypeError instead of a normalized Toast error.
+  if (!initResp?.presigned_url || !initResp?.object_key) {
+    throw normalizeError({ code: "invalid_response", message: "上传失败：响应字段缺失" });
+  }
 
   // Step 2: Upload the file to presigned URL
   const file = new File([blob], fileName, { type: "image/png" });