fix: escape docx publish hints in workspace templates

user-publish.mjs

@@ -273,7 +273,7 @@ ${renderBrandingBlock(addressName)}
 
 - 若用户要求页面里可下载 Word / docx：必须先 \`load_skill\` → \`docx-generate\`
 - 先生成并确认 \`public/*.docx\` 已存在，再写 \`public/*.html\`
-- HTML 中只能用同目录相对路径链接该文档，禁止只写下载按钮却没有先把 `.docx` 落盘
+- HTML 中只能用同目录相对路径链接该文档，禁止只写下载按钮却没有先把 \`.docx\` 落盘
 `;
 }
 

user-publish.test.mjs

@@ -10,6 +10,7 @@ import {
   buildPublishConstraints,
   buildSandboxSessionConstraints,
   ensureUserPublishLayout,
+  renderWorkspaceHints,
   isPathInsidePublishDir,
   migrateUserPublishDir,
   PUBLISH_ROOT_DIR,
@@ -129,6 +130,17 @@ test('buildSandboxSessionConstraints documents shell and forbids public url brow
   assert.match(text, /\/public\//);
 });
 
+test('renderWorkspaceHints includes docx download guidance for published pages', () => {
+  const text = renderWorkspaceHints({
+    slug: USER_ID,
+    username: 'john',
+    publishDir: `/var/h5/${PUBLISH_ROOT_DIR}/${USER_ID}`,
+    displayName: 'John',
+  });
+  assert.match(text, /docx-generate/);
+  assert.match(text, /public\/\*\.docx/);
+});
+
 test('isPathInsidePublishDir blocks escape', () => {
   const publishDir = `/var/h5/${PUBLISH_ROOT_DIR}/${USER_ID}`;
   assert.equal(isPathInsidePublishDir(publishDir, `/var/h5/${PUBLISH_ROOT_DIR}/${USER_ID}/report.html`), true);