feat(editor): Markdown 预览内嵌 HTML 安全渲染 + 目录大纲（TOC）

宿主 MarkdownText 出于聊天安全把 raw HTML 按字面文本渲染，预览 GitHub
风格 README（徽章墙 div、details 折叠块内嵌 markdown、表格单元格内联
标签、video/picture）时全是源码文本。本次在不动渲染器的前提下：

- markdown-html.ts（纯函数）：fence 感知切分器把文档切成 markdown/html
  段（CommonMark type-6 块级标签名单 + 注释段 + 空行终止）；段内标签
  tokenizer 归约 open/close/html parts；全文档引用定义收集（每段追加
  保持 [text][id] 跨段语义）
- MarkdownHtml.tsx：DOMPurify 白名单消毒（显式禁 script/iframe/form
  等；a 强制 _blank+noopener；本地媒体 src 经 /sidebar/file 重写）；
  MarkdownDocument 帧栈状态机让 <details> 跨段嵌套内部 markdown；
  MarkdownSegment 内联替换（MutationObserver 幂等 pass，把表格单元格
  等处标签文本消毒还原为元素，纯散文不误伤）
- md-toc.tsx：零高度 sticky 浮动目录按钮（≥3 标题）+ 弹出大纲，跳转
  平滑滚动 + 自动展开折叠 details + 高亮闪现。关键修复：子组件读父
  ref 在 React layout 阶段恒为 null（子先于父），改为经自身 bar ref
  的 parentElement 定位容器（jsdom 单测传预填 ref 掩盖了该 bug，仅
  真实挂载 e2e 抓到）
- 纯 markdown 文档走原单次解析路径零变化（现有 mermaid e2e 守卫一字
  不动）；新增 readme-style.md 种子 + 探针（消毒渲染/嵌套/内联/TOC
  全链路）；19 语言词典新增 toc 键；dompurify 提升为直接依赖（与
  mermaid 传递依赖去重单版本）

设计文档 docs/plans/2026-08-24-markdown-html-toc-design.md

src/client/markdown-images.ts

@@ -65,28 +65,41 @@ function normalizeLocalPath(path: string): string {
  * so the core rewrite stays pure and unit-testable.
  * @returns The markdown with local image destinations rewritten in place.
  */
+/**
+ * Resolve one media destination against the session's media route: local
+ * (relative or absolute) paths become absolute `/sidebar/file` URLs (prefixed
+ * with the GUI's own origin so the shared MarkdownText http(s) allowlist
+ * accepts them), while remote URLs, `#`-anchors and empty destinations are
+ * returned untouched. Shared by the markdown image rewriter below and by the
+ * preview's raw-HTML sanitizer (`markdown-html.tsx`, which meets the same
+ * allowlist when rendering `<img src="./x.png">` inside HTML blocks).
+ */
+export function resolveLocalMediaDest(
+  dest: string,
+  scope: SessionScope,
+  filePath: string,
+  origin: string,
+): string {
+  const trimmed = dest.trim()
+  if (trimmed === '' || trimmed.startsWith('#')) return dest
+  if (isRemoteUrl(trimmed)) return dest
+  const slash = Math.max(filePath.lastIndexOf('/'), filePath.lastIndexOf('\\'))
+  const directory = slash === -1 ? '/' : filePath.slice(0, slash + 1)
+  const candidate = isAbsolutePath(trimmed) ? trimmed : directory + trimmed
+  // Mirrors api.ts fileUrl/mediaUrl for the /sidebar/file media route, made
+  // absolute so the shared MarkdownText http(s) allowlist accepts it.
+  const params = new URLSearchParams({ sessionId: scope.sessionId, path: normalizeLocalPath(candidate) })
+  if (scope.cwd !== undefined && scope.cwd !== '') params.set('cwd', scope.cwd)
+  return `${origin}/sidebar/file?${params.toString()}`
+}
+
 export function rewriteLocalImageUrls(
   text: string,
   scope: SessionScope,
   filePath: string,
   origin: string,
 ): string {
-  const slash = Math.max(filePath.lastIndexOf('/'), filePath.lastIndexOf('\\'))
-  const directory = slash === -1 ? '/' : filePath.slice(0, slash + 1)
-  const mediaUrl = (candidate: string): string => {
-    // Mirrors api.ts fileUrl/mediaUrl for the /sidebar/file media route, made
-    // absolute so the shared MarkdownText http(s) allowlist accepts it.
-    const params = new URLSearchParams({ sessionId: scope.sessionId, path: candidate })
-    if (scope.cwd !== undefined && scope.cwd !== '') params.set('cwd', scope.cwd)
-    return `${origin}/sidebar/file?${params.toString()}`
-  }
-  const resolve = (dest: string): string => {
-    const trimmed = dest.trim()
-    if (trimmed === '' || trimmed.startsWith('#')) return dest
-    if (isRemoteUrl(trimmed)) return dest
-    const candidate = isAbsolutePath(trimmed) ? trimmed : directory + trimmed
-    return mediaUrl(normalizeLocalPath(candidate))
-  }
+  const resolve = (dest: string): string => resolveLocalMediaDest(dest, scope, filePath, origin)
 
   // Mask fenced code blocks and inline code spans so image-looking text
   // inside documentation examples is never rewritten. The sentinel uses a