ACP / MCP 完善

internal/acp/session_service.go

@@ -117,6 +117,23 @@ func ResolveBranch(ctx context.Context, ws *workspace.Workspace, sessionID uuid.
 //  9. async supervisor.Spawn（失败回滚 worktree）
 //  10. async initial_prompt 转发（等握手完成）
 func (s *sessionService) Create(ctx context.Context, c Caller, in CreateSessionInput) (*Session, error) {
+	// 0. 互斥校验：branch / issue_number / requirement_number 三选一或全空（spec §8.1）。
+	// service 层统一拦截，HTTP / MCP 入口共用。
+	specified := 0
+	if in.Branch != nil && *in.Branch != "" {
+		specified++
+	}
+	if in.IssueNumber != nil {
+		specified++
+	}
+	if in.RequirementNumber != nil {
+		specified++
+	}
+	if specified > 1 {
+		return nil, errs.New(errs.CodeInvalidInput,
+			"branch / issue_number / requirement_number are mutually exclusive; specify at most one")
+	}
+
 	// 1. workspace + authz
 	wsCaller := workspace.Caller{UserID: c.UserID, IsAdmin: c.IsAdmin}
 	ws, err := s.wsSvc.Get(ctx, wsCaller, in.WorkspaceID)
@@ -251,6 +268,12 @@ func (s *sessionService) Create(ctx context.Context, c Caller, in CreateSessionI
 		spawnCtx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
 		defer cancel()
 		if _, err := s.sup.Spawn(spawnCtx, out, kind, extraEnv); err != nil {
+			// 守卫式标记：Spawn 早期失败（进程未注册、onExit 不会触发）时把
+			// starting 收尾为 crashed；handshake 失败路径 onExit 已写终态，此处 no-op。
+			if _, merr := s.repo.MarkSessionFailedIfActive(spawnCtx, out.ID, err.Error()); merr != nil {
+				s.sup.log.Error("acp.spawn_failed.mark_session",
+					"session_id", out.ID, "err", merr.Error())
+			}
 			_ = s.mcpTokens.RevokeBySession(spawnCtx, out.ID)
 			s.releaseOnFailure(spawnCtx, out, sessCaller, worktreeID)
 		}