Show persistent operations queue

ops-portal/test/server.test.mjs

@@ -43,7 +43,7 @@ test('password hashing uses random salts and checks a supplied password', () =>
 
 test('anonymous users can see health/login shell but cannot read private reports or ledger', async t => {
   const { request } = await fixture(t);
-  for (const endpoint of ['/api/dashboard', '/api/evolution', '/api/reports/2026-W45', '/api/reports/2026-W45/download', '/api/ledger']) {
+  for (const endpoint of ['/api/dashboard', '/api/evolution', '/api/workqueue', '/api/reports/2026-W45', '/api/reports/2026-W45/download', '/api/ledger']) {
     const r = await request(endpoint); assert.equal(r.status, 401); assert.equal(r.headers.get('cache-control'), 'no-store');
     assert.doesNotMatch(await r.text(), /PRIVATE|entries|cash_usd/);
   }
@@ -52,6 +52,19 @@ test('anonymous users can see health/login shell but cannot read private reports
   assert.equal((await request('/reports/2026-W45.json')).status, 404);
 });
 
+test('work queue exposes only safe progress fields behind login', async t => {
+  const { directory, request, login } = await fixture(t);
+  await writeFile(path.join(directory, 'workqueue.json'), JSON.stringify({ schema: 1, tasks: [
+    {id:'interaction-private-a', title:'PRIVATE MESSAGE CONTENT', status:'pending', details:'PRIVATE MESSAGE', checkpoint:'PRIVATE CONTENT', attempts:1},
+    {id:'pilot',title:'动画试镜',status:'running',details:'SECRET',attempts:2,updated_at:'2026-11-04T01:00:00Z'}
+  ] }));
+  assert.equal((await request('/api/workqueue')).status, 401);
+  const auth = await login(); const cookie = auth.headers.get('set-cookie').split(';')[0];
+  const response = await request('/api/workqueue', { headers: { cookie } });
+  const body = await response.text(); assert.doesNotMatch(body, /PRIVATE|SECRET/);
+  const data = JSON.parse(body); assert.equal(data.tasks[0].title, '核查新互动'); assert.equal(data.tasks[1].status, 'running');
+});
+
 test('login protects API and download, preserves unknown money, logout revokes copied cookie', async t => {
   const { request, login } = await fixture(t);
   const response = await login(); assert.equal(response.status, 200);