fix(apps): limit simple chat apps to published or owned

messages/zh-CN/chatSessions.json

@@ -28,7 +28,7 @@
   "sessionId": "会话ID",
   "user": "用户",
   "department": "部门",
-  "appName": "数字员工名称",
+  "appName": "数字员工",
   "createdAt": "创建时间",
   "updatedAt": "更新时间",
   "sessionSummary": "会话摘要",

pages/api/apps/simple.ts

@@ -51,12 +51,21 @@ export default async function handler(req: NextApiRequest, res: NextApiResponse)
     });
 
     // Python 后端返回格式: { total: number, items: [...] }
-    const apps: SimpleApp[] = Array.isArray(response.data?.items)
+    // is_simple 时后端已按「已发布 | 自己创建」收窄；这里再滤一道，避免旧后端漏网。
+    const rawApps: Array<SimpleApp & { status?: string; user_id?: number }> = Array.isArray(
+      response.data?.items
+    )
       ? response.data.items
       : Array.isArray(response.data)
         ? response.data
         : [];
 
+    const apps: SimpleApp[] = rawApps.filter((app) => {
+      const status = app.status || "published";
+      if (status === "published") return true;
+      return Number(app.user_id) === Number(userId);
+    });
+
     // 返回格式与原来保持一致
     return res.status(200).json({
       items: apps,

test/appsSimpleChatFilter.test.ts

@@ -0,0 +1,20 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "path";
+import { test } from "node:test";
+
+const REPO = path.resolve(import.meta.dirname, "..");
+const SIMPLE = "pages/api/apps/simple.ts";
+
+/**
+ * 聊天底部数字员工列表（/api/apps/simple）对未发布应用的收窄（2026-09-16）。
+ *
+ * 后端 is_simple 已按「已发布 | 自己创建」过滤；这里再滤一道，避免旧后端漏网。
+ * 超管也看不到别人的草稿——管理与审核走完整 /api/v1/apps，不走这条。
+ */
+test("simple 列表对未发布应用只放行创建者", () => {
+  const src = fs.readFileSync(path.join(REPO, SIMPLE), "utf8");
+  assert.match(src, /status === ["']published["']/);
+  assert.match(src, /Number\(app\.user_id\) === Number\(userId\)/);
+  assert.match(src, /is_simple/, "请求仍须带 is_simple，让后端先收窄");
+});