fix: complete html escape and use code arg in auto-submit callback

src/components/PromptPanel.vue

@@ -60,7 +60,7 @@ function send() {
 const renderer = new Renderer()
 renderer.code = function ({ text, lang }: { text: string; lang?: string }) {
   const escape = (s: string) =>
-    s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")
+    s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;")
   const label = lang ? `查看代码（${escape(lang)}）` : "查看代码"
   return `<details class="code-block"><summary>${label}</summary><pre><code class="hljs${lang ? ` language-${escape(lang)}` : ""}">${escape(text)}</code></pre></details>`
 }

src/pages/ChallengeHome.vue

@@ -84,13 +84,13 @@ async function loadChallenge() {
   challengeTitle.value = `#${data.display} ${data.title}`
   challengeContent.value = await marked.parse(data.content, { async: true })
   connectPrompt(data.task_ptr)
-  onCodeComplete = async () => {
+  onCodeComplete = async (code) => {
     if (!conversationId.value) return
     try {
       await Submission.create(taskId.value, {
-        html: html.value,
-        css: css.value,
-        js: js.value,
+        html: code.html ?? "",
+        css: code.css ?? "",
+        js: code.js ?? "",
         conversationId: conversationId.value,
       })
     } catch {