release: 发布 v0.5.0

新增共享 Preview Engine，统一 Web 连续预览、快速分页、Playwright PDF 与 Electron PDF；实现稳定前缀复用和修改位置后的增量分页，保留媒体块按文档顺序串行回填与单次重排。

完善跨端链接与桌面文档工作流：Web 受控处理锚点和 HTTP/HTTPS 外链；Desktop 支持本地路径、file URI、系统协议、多窗口、同文件单例、Markdown 当前或新窗口打开，以及聚焦时外部文件变化提示。

统一四套内置主题名称并默认使用 Typora Github；修复连续预览双滚动条、ECharts 尺寸、PDF 本地链接、围栏代码块 Typora DOM 与重复行内样式；桌面发行链强制完整重建内嵌 Web，避免安装包携带陈旧资源。

发布 Web/Compose 与 Windows NSIS/ZIP：镜像 yixiong/md-to-pdf:v0.5.0 已健康部署；NSIS SHA-256 为 60992D1FDCA513F46346C78478537EB4159D8C0E76B41ECF3CDC25BE77707D92，ZIP SHA-256 为 D74F82293FB67126E583546CBA894569EFC9A0B1B6343FAC648CCC95F1D188D8，本机安装版已升级至 v0.5.0。

验证：全项目 238 项测试通过，类型检查、生产构建和 git diff --check 通过；Web 快速/连续/精确预览、Compose、Desktop 多窗口、窗口状态、文件关联、链接与代码块均完成真实环境验收。

packages/renderer/src/render-markdown.ts

@@ -7,6 +7,10 @@ import type {
   RenderedMarkdownDocument,
   ThemeFeature
 } from "@md-to-pdf/core";
+import {
+  classifyDocumentLink,
+  isSafeDocumentLink
+} from "@md-to-pdf/core";
 import {
   markdownItECharts,
   type MarkdownItEChartsErrorContext
@@ -85,6 +89,11 @@ const markdown = new MarkdownIt(markdownOptions)
     trust: false
   });
 
+const defaultValidateLink = markdown.validateLink.bind(markdown);
+markdown.validateLink = (href) =>
+  defaultValidateLink(href) ||
+  classifyDocumentLink(href).scheme === "file";
+
 const defaultFenceRenderer = markdown.renderer.rules.fence;
 const defaultImageRenderer = markdown.renderer.rules.image;
 const defaultParagraphOpenRenderer =
@@ -178,13 +187,21 @@ markdown.renderer.rules.fence = (
   }
 
   if (defaultFenceRenderer) {
-    return defaultFenceRenderer(
+    const renderedFence = defaultFenceRenderer(
       tokens,
       index,
       options,
       environment,
       renderer
     );
+    const languageAttribute = language
+      ? ` lang="${escapeAttribute(language)}"`
+      : "";
+
+    return renderedFence.replace(
+      /^<pre>/u,
+      `<pre class="md-fences"${languageAttribute}>`
+    );
   }
 
   return renderFallbackFence(tokens, index, renderer);
@@ -270,7 +287,7 @@ const safeHtmlOptions: sanitizeHtml.IOptions = {
     input: ["type", "checked", "disabled", "class"],
     li: ["class", "value"],
     ol: ["class", "start"],
-    pre: ["class", "hidden"],
+    pre: ["class", "hidden", "lang"],
     span: ["class", "style"],
     td: ["colspan", "rowspan", "style"],
     th: ["colspan", "rowspan", "scope", "style"]
@@ -279,6 +296,7 @@ const safeHtmlOptions: sanitizeHtml.IOptions = {
   allowedSchemesByTag: {
     img: ["http", "https", "data"]
   },
+  allowedSchemesAppliedToAttributes: ["src", "cite"],
   allowedStyles: {
     span: {
       height: [lengthStylePattern],
@@ -299,9 +317,19 @@ const safeHtmlOptions: sanitizeHtml.IOptions = {
     }
   },
   transformTags: {
-    a: sanitizeHtml.simpleTransform("a", {
-      rel: "noopener noreferrer"
-    })
+    a(tagName, attributes) {
+      const href = attributes.href;
+      if (href && !isSafeDocumentLink(href)) {
+        delete attributes.href;
+      }
+      return {
+        tagName,
+        attribs: {
+          ...attributes,
+          rel: "noopener noreferrer"
+        }
+      };
+    }
   }
 };