From 65e8a3a5a83752aaead63d1ad339f86878a2f012 Mon Sep 17 00:00:00 2001
From: john <cynell@139.com>
Date: Wed, 1 Jul 2026 12:13:26 +0800
Subject: [PATCH] fix: escape docx publish hints in workspace templates

---
 user-publish.mjs      |  2 +-
 user-publish.test.mjs | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/user-publish.mjs b/user-publish.mjs
index 4a24323..28ca6e1 100644
--- a/user-publish.mjs
+++ b/user-publish.mjs
@@ -273,7 +273,7 @@ ${renderBrandingBlock(addressName)}
 
 - 若用户要求页面里可下载 Word / docx：必须先 \`load_skill\` → \`docx-generate\`
 - 先生成并确认 \`public/*.docx\` 已存在，再写 \`public/*.html\`
-- HTML 中只能用同目录相对路径链接该文档，禁止只写下载按钮却没有先把 `.docx` 落盘
+- HTML 中只能用同目录相对路径链接该文档，禁止只写下载按钮却没有先把 \`.docx\` 落盘
 `;
 }
 
diff --git a/user-publish.test.mjs b/user-publish.test.mjs
index dc3b0e0..863535a 100644
--- a/user-publish.test.mjs
+++ b/user-publish.test.mjs
@@ -10,6 +10,7 @@ import {
   buildPublishConstraints,
   buildSandboxSessionConstraints,
   ensureUserPublishLayout,
+  renderWorkspaceHints,
   isPathInsidePublishDir,
   migrateUserPublishDir,
   PUBLISH_ROOT_DIR,
@@ -129,6 +130,17 @@ test('buildSandboxSessionConstraints documents shell and forbids public url brow
   assert.match(text, /\/public\//);
 });
 
+test('renderWorkspaceHints includes docx download guidance for published pages', () => {
+  const text = renderWorkspaceHints({
+    slug: USER_ID,
+    username: 'john',
+    publishDir: `/var/h5/${PUBLISH_ROOT_DIR}/${USER_ID}`,
+    displayName: 'John',
+  });
+  assert.match(text, /docx-generate/);
+  assert.match(text, /public\/\*\.docx/);
+});
+
 test('isPathInsidePublishDir blocks escape', () => {
   const publishDir = `/var/h5/${PUBLISH_ROOT_DIR}/${USER_ID}`;
   assert.equal(isPathInsidePublishDir(publishDir, `/var/h5/${PUBLISH_ROOT_DIR}/${USER_ID}/report.html`), true);