Merge feat/acp: ACP module (Agent Client Protocol) — Phases D-K

cmd/fake-acp-agent/main.go

@@ -0,0 +1,159 @@
+// cmd/fake-acp-agent 是集成测试用的 fake ACP agent，stdin/stdout 走 JSON-RPC。
+//
+// 行为通过 env 控制：
+//
+//	FAKE_ACP_HANG=true                    永不响应任何请求（测 handshake 超时）
+//	FAKE_ACP_CRASH_AFTER_PROMPTS=N         处理完 N 个 prompt 后 os.Exit(1)
+//	FAKE_ACP_FS_READ=path                  prompt 时发起 fs/read_text_file 请求该路径
+//	FAKE_ACP_FS_WRITE=path:content         prompt 时发起 fs/write_text_file
+//	FAKE_ACP_PROMPT_UPDATES=N              每 prompt 发 N 个 update（默认 3）
+package main
+
+import (
+	"bufio"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"time"
+)
+
+type Message struct {
+	JSONRPC string          `json:"jsonrpc"`
+	ID      json.RawMessage `json:"id,omitempty"`
+	Method  string          `json:"method,omitempty"`
+	Params  json.RawMessage `json:"params,omitempty"`
+	Result  json.RawMessage `json:"result,omitempty"`
+	Error   *RPCError       `json:"error,omitempty"`
+}
+
+type RPCError struct {
+	Code    int    `json:"code"`
+	Message string `json:"message"`
+}
+
+var (
+	promptsHandled atomic.Int32
+	nextServerID   atomic.Int64
+)
+
+func main() {
+	if os.Getenv("FAKE_ACP_HANG") == "true" {
+		select {} // 永不退出
+	}
+
+	in := bufio.NewReader(os.Stdin)
+	out := bufio.NewWriter(os.Stdout)
+	defer out.Flush()
+
+	for {
+		line, err := in.ReadBytes('\n')
+		if err != nil {
+			return
+		}
+		var msg Message
+		if err := json.Unmarshal(line, &msg); err != nil {
+			continue
+		}
+		switch msg.Method {
+		case "initialize":
+			respond(out, msg.ID, map[string]any{
+				"protocolVersion": 1,
+				"agentInfo":       map[string]any{"name": "fake", "version": "0.0.0"},
+			})
+		case "session/new":
+			respond(out, msg.ID, map[string]any{"sessionId": "fake-session-id"})
+		case "session/prompt":
+			handlePrompt(out, msg.ID)
+		case "session/cancel":
+			// ignore
+		}
+	}
+}
+
+func handlePrompt(out *bufio.Writer, id json.RawMessage) {
+	updates := 3
+	if v := os.Getenv("FAKE_ACP_PROMPT_UPDATES"); v != "" {
+		if n, _ := strconv.Atoi(v); n > 0 {
+			updates = n
+		}
+	}
+	for i := 0; i < updates; i++ {
+		notify(out, "session/update", map[string]any{
+			"sessionId": "fake-session-id",
+			"update": map[string]any{
+				"sessionUpdate": "agent_message_chunk",
+				"content":       []map[string]any{{"type": "text", "text": fmt.Sprintf("chunk %d", i)}},
+			},
+		})
+		time.Sleep(10 * time.Millisecond)
+	}
+
+	if path := os.Getenv("FAKE_ACP_FS_READ"); path != "" {
+		_ = doFsRead(out, path)
+	}
+
+	if spec := os.Getenv("FAKE_ACP_FS_WRITE"); spec != "" {
+		parts := strings.SplitN(spec, ":", 2)
+		if len(parts) == 2 {
+			_ = doFsWrite(out, parts[0], parts[1])
+		}
+	}
+
+	respond(out, id, map[string]any{"stopReason": "end_turn"})
+
+	if maxStr := os.Getenv("FAKE_ACP_CRASH_AFTER_PROMPTS"); maxStr != "" {
+		n, _ := strconv.Atoi(maxStr)
+		count := promptsHandled.Add(1)
+		if int(count) >= n {
+			os.Exit(1)
+		}
+	}
+}
+
+func doFsRead(out *bufio.Writer, path string) error {
+	id := nextServerID.Add(1)
+	idJSON, _ := json.Marshal(id)
+	body := mustJSON(Message{
+		JSONRPC: "2.0", ID: idJSON, Method: "fs/read_text_file",
+		Params: mustJSON(map[string]any{"sessionId": "fake-session-id", "path": path}),
+	})
+	_, _ = out.Write(body)
+	_, _ = out.Write([]byte{'\n'})
+	_ = out.Flush()
+	return nil
+}
+
+func doFsWrite(out *bufio.Writer, path, content string) error {
+	id := nextServerID.Add(1)
+	idJSON, _ := json.Marshal(id)
+	body := mustJSON(Message{
+		JSONRPC: "2.0", ID: idJSON, Method: "fs/write_text_file",
+		Params: mustJSON(map[string]any{"sessionId": "fake-session-id", "path": path, "content": content}),
+	})
+	_, _ = out.Write(body)
+	_, _ = out.Write([]byte{'\n'})
+	_ = out.Flush()
+	return nil
+}
+
+func respond(out *bufio.Writer, id json.RawMessage, result any) {
+	body := mustJSON(Message{JSONRPC: "2.0", ID: id, Result: mustJSON(result)})
+	_, _ = out.Write(body)
+	_, _ = out.Write([]byte{'\n'})
+	_ = out.Flush()
+}
+
+func notify(out *bufio.Writer, method string, params any) {
+	body := mustJSON(Message{JSONRPC: "2.0", Method: method, Params: mustJSON(params)})
+	_, _ = out.Write(body)
+	_, _ = out.Write([]byte{'\n'})
+	_ = out.Flush()
+}
+
+func mustJSON(v any) json.RawMessage {
+	b, _ := json.Marshal(v)
+	return b
+}

config.example.yaml

@@ -98,6 +98,10 @@ jobs:
     enabled: true
     interval: 24h
     completed_retention: 168h
+  acp_events_purge:
+    enabled: true
+    interval: 24h
+    retention: 168h          # 7 天
 
 # 通知通道配置
 notify:
@@ -106,4 +110,27 @@ notify:
     url: ""
     secret: ""
     timeout: 10s
+    # 默认空白名单 ⇒ 所有 webhook 投递被丢弃。生产部署需要显式列出要外发的 topics：
     topics: []
+    # 可选 topics：
+    # - workspace.sync_failed
+    # - worktree.prune_pending
+    # - webhook.dead_letter
+    # - acp.session_crashed
+
+# ACP module: agent subprocess pool + WebSocket fanout + event retention
+acp:
+  enabled: true
+  max_active_global: 20
+  max_active_per_user: 3
+  spawn_timeout: 30s
+  kill_grace: 5s
+  stderr_buffer_lines: 100
+  stderr_tail_bytes: 2000
+  ws_ping_interval: 30s
+  ws_pong_timeout: 60s
+  ws_send_buffer: 256
+  event_max_payload_bytes: 65536
+  event_truncate_field_bytes: 4096
+  event_retention_days: 7
+  shutdown_grace: 30s

go.mod

@@ -4,6 +4,7 @@ go 1.25.0
 
 require (
 	github.com/alexedwards/argon2id v1.0.0
+	github.com/coder/websocket v1.8.14
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/golang-migrate/migrate/v4 v4.19.1
 	github.com/google/uuid v1.6.0

go.sum

@@ -24,6 +24,8 @@ github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK3
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/coder/websocket v1.8.14 h1:9L0p0iKiNOibykf283eHkKUHHrpG7f65OE3BhhO7v9g=
+github.com/coder/websocket v1.8.14/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
 github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=

internal/acp/agentkind_service.go

@@ -0,0 +1,182 @@
+package acp
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/google/uuid"
+
+	"github.com/yan1h/agent-coding-workflow/internal/audit"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/crypto"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/errs"
+)
+
+type agentKindService struct {
+	repo  Repository
+	enc   *crypto.Encryptor
+	audit audit.Recorder
+}
+
+// NewAgentKindService 构造 AgentKindService。
+func NewAgentKindService(repo Repository, enc *crypto.Encryptor, rec audit.Recorder) AgentKindService {
+	return &agentKindService{repo: repo, enc: enc, audit: rec}
+}
+
+func (s *agentKindService) Create(ctx context.Context, c Caller, in CreateAgentKindInput) (*AgentKind, error) {
+	if !c.IsAdmin {
+		return nil, errs.New(errs.CodeForbidden, "admin only")
+	}
+	if in.Name == "" || in.DisplayName == "" || in.BinaryPath == "" {
+		return nil, errs.New(errs.CodeInvalidInput, "name / display_name / binary_path required")
+	}
+	encrypted, err := encryptEnv(s.enc, in.Env)
+	if err != nil {
+		return nil, err
+	}
+	args := in.Args
+	if args == nil {
+		args = []string{}
+	}
+	k := &AgentKind{
+		ID: uuid.New(), Name: in.Name, DisplayName: in.DisplayName, Description: in.Description,
+		BinaryPath: in.BinaryPath, Args: args, EncryptedEnv: encrypted, Enabled: in.Enabled,
+		CreatedBy: c.UserID,
+	}
+	out, err := s.repo.CreateAgentKind(ctx, k)
+	if err != nil {
+		if IsUniqueViolation(err) {
+			return nil, errs.New(errs.CodeConflict, "agent kind name already exists")
+		}
+		return nil, err
+	}
+	s.recordAudit(ctx, c, "acp.agent_kind.create", out.ID.String(),
+		map[string]any{"name": out.Name, "binary_path": out.BinaryPath})
+	return out, nil
+}
+
+func (s *agentKindService) List(ctx context.Context, c Caller) ([]*AgentKind, error) {
+	if c.IsAdmin {
+		return s.repo.ListAgentKinds(ctx)
+	}
+	return s.repo.ListEnabledAgentKinds(ctx)
+}
+
+func (s *agentKindService) Get(ctx context.Context, c Caller, id uuid.UUID) (*AgentKind, error) {
+	k, err := s.repo.GetAgentKindByID(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	if !c.IsAdmin && !k.Enabled {
+		return nil, errs.New(errs.CodeAcpAgentKindNotFound, "agent kind not found")
+	}
+	return k, nil
+}
+
+func (s *agentKindService) Update(ctx context.Context, c Caller, id uuid.UUID, in UpdateAgentKindInput) (*AgentKind, error) {
+	if !c.IsAdmin {
+		return nil, errs.New(errs.CodeForbidden, "admin only")
+	}
+	cur, err := s.repo.GetAgentKindByID(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	changed := map[string]any{}
+	if in.DisplayName != nil && *in.DisplayName != cur.DisplayName {
+		cur.DisplayName = *in.DisplayName
+		changed["display_name"] = "<changed>"
+	}
+	if in.Description != nil && *in.Description != cur.Description {
+		cur.Description = *in.Description
+		changed["description"] = "<changed>"
+	}
+	if in.BinaryPath != nil && *in.BinaryPath != cur.BinaryPath {
+		cur.BinaryPath = *in.BinaryPath
+		changed["binary_path"] = "<changed>"
+	}
+	if in.Args != nil {
+		cur.Args = in.Args
+		changed["args"] = "<changed>"
+	}
+	if in.Env != nil {
+		encrypted, eerr := encryptEnv(s.enc, in.Env)
+		if eerr != nil {
+			return nil, eerr
+		}
+		cur.EncryptedEnv = encrypted
+		changed["env"] = "<changed>"
+	}
+	if in.Enabled != nil && *in.Enabled != cur.Enabled {
+		cur.Enabled = *in.Enabled
+		changed["enabled"] = *in.Enabled
+	}
+	if len(changed) == 0 {
+		return cur, nil
+	}
+	out, err := s.repo.UpdateAgentKind(ctx, cur)
+	if err != nil {
+		return nil, err
+	}
+	s.recordAudit(ctx, c, "acp.agent_kind.update", out.ID.String(),
+		map[string]any{"changed_fields": changed})
+	return out, nil
+}
+
+func (s *agentKindService) Delete(ctx context.Context, c Caller, id uuid.UUID) error {
+	if !c.IsAdmin {
+		return errs.New(errs.CodeForbidden, "admin only")
+	}
+	cur, err := s.repo.GetAgentKindByID(ctx, id)
+	if err != nil {
+		return err
+	}
+	if err := s.repo.DeleteAgentKind(ctx, id); err != nil {
+		return err
+	}
+	s.recordAudit(ctx, c, "acp.agent_kind.delete", id.String(),
+		map[string]any{"name": cur.Name})
+	return nil
+}
+
+func (s *agentKindService) recordAudit(ctx context.Context, c Caller, action, targetID string, meta map[string]any) {
+	if s.audit == nil {
+		return
+	}
+	uid := c.UserID
+	_ = s.audit.Record(context.WithoutCancel(ctx), audit.Entry{
+		UserID: &uid, Action: action, TargetType: "acp_agent_kind", TargetID: targetID, Metadata: meta,
+	})
+}
+
+// encryptEnv 把 map[string]string 序列化后加密。nil → 返回 nil（清空）。
+func encryptEnv(enc *crypto.Encryptor, env map[string]string) ([]byte, error) {
+	if env == nil {
+		return nil, nil
+	}
+	if len(env) == 0 {
+		return enc.Encrypt([]byte(`{}`))
+	}
+	b, err := json.Marshal(env)
+	if err != nil {
+		return nil, errs.Wrap(err, errs.CodeInternal, "marshal env")
+	}
+	return enc.Encrypt(b)
+}
+
+// decryptEnv 解密并反序列化 env map。Part 2 的 supervisor.Spawn 用。
+func decryptEnv(enc *crypto.Encryptor, encrypted []byte) (map[string]string, error) {
+	if len(encrypted) == 0 {
+		return map[string]string{}, nil
+	}
+	plain, err := enc.Decrypt(encrypted)
+	if err != nil {
+		return nil, errs.Wrap(err, errs.CodeInternal, "decrypt env")
+	}
+	var m map[string]string
+	if err := json.Unmarshal(plain, &m); err != nil {
+		return nil, errs.Wrap(err, errs.CodeInternal, "unmarshal env")
+	}
+	if m == nil {
+		m = map[string]string{}
+	}
+	return m, nil
+}

internal/acp/agentkind_service_test.go

@@ -0,0 +1,220 @@
+package acp_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/yan1h/agent-coding-workflow/internal/acp"
+	"github.com/yan1h/agent-coding-workflow/internal/audit"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/crypto"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/errs"
+)
+
+// fakeAgentKindRepo 是仅覆盖 AgentKind 方法的 fake；其他方法 panic
+// （隔离单测，不引 testcontainers）。
+type fakeAgentKindRepo struct {
+	store map[uuid.UUID]*acp.AgentKind
+}
+
+func newFakeAgentKindRepo() *fakeAgentKindRepo {
+	return &fakeAgentKindRepo{store: map[uuid.UUID]*acp.AgentKind{}}
+}
+
+func (f *fakeAgentKindRepo) CreateAgentKind(_ context.Context, k *acp.AgentKind) (*acp.AgentKind, error) {
+	cp := *k
+	f.store[k.ID] = &cp
+	return &cp, nil
+}
+func (f *fakeAgentKindRepo) GetAgentKindByID(_ context.Context, id uuid.UUID) (*acp.AgentKind, error) {
+	if k, ok := f.store[id]; ok {
+		cp := *k
+		return &cp, nil
+	}
+	return nil, errs.New(errs.CodeAcpAgentKindNotFound, "not found")
+}
+func (f *fakeAgentKindRepo) GetAgentKindByName(_ context.Context, name string) (*acp.AgentKind, error) {
+	for _, k := range f.store {
+		if k.Name == name {
+			cp := *k
+			return &cp, nil
+		}
+	}
+	return nil, errs.New(errs.CodeAcpAgentKindNotFound, "not found")
+}
+func (f *fakeAgentKindRepo) ListAgentKinds(_ context.Context) ([]*acp.AgentKind, error) {
+	out := make([]*acp.AgentKind, 0, len(f.store))
+	for _, k := range f.store {
+		cp := *k
+		out = append(out, &cp)
+	}
+	return out, nil
+}
+func (f *fakeAgentKindRepo) ListEnabledAgentKinds(_ context.Context) ([]*acp.AgentKind, error) {
+	out := make([]*acp.AgentKind, 0)
+	for _, k := range f.store {
+		if k.Enabled {
+			cp := *k
+			out = append(out, &cp)
+		}
+	}
+	return out, nil
+}
+func (f *fakeAgentKindRepo) UpdateAgentKind(_ context.Context, k *acp.AgentKind) (*acp.AgentKind, error) {
+	if _, ok := f.store[k.ID]; !ok {
+		return nil, errs.New(errs.CodeAcpAgentKindNotFound, "not found")
+	}
+	cp := *k
+	f.store[k.ID] = &cp
+	return &cp, nil
+}
+func (f *fakeAgentKindRepo) DeleteAgentKind(_ context.Context, id uuid.UUID) error {
+	delete(f.store, id)
+	return nil
+}
+func (f *fakeAgentKindRepo) CountAgentKindUsage(_ context.Context, _ uuid.UUID) (int64, error) {
+	return 0, nil
+}
+
+// 其他方法 panic（不该被 AgentKindService 调用）
+func (f *fakeAgentKindRepo) InsertSession(context.Context, *acp.Session) (*acp.Session, error) {
+	panic("n/a")
+}
+func (f *fakeAgentKindRepo) GetSessionByID(context.Context, uuid.UUID) (*acp.Session, error) {
+	panic("n/a")
+}
+func (f *fakeAgentKindRepo) ListSessionsByUser(context.Context, uuid.UUID) ([]*acp.Session, error) {
+	panic("n/a")
+}
+func (f *fakeAgentKindRepo) ListAllSessions(context.Context) ([]*acp.Session, error) {
+	panic("n/a")
+}
+func (f *fakeAgentKindRepo) UpdateSessionRunning(context.Context, uuid.UUID, string, int32) error {
+	panic("n/a")
+}
+func (f *fakeAgentKindRepo) UpdateSessionFinished(context.Context, uuid.UUID, acp.SessionStatus, *int32, *string) error {
+	panic("n/a")
+}
+func (f *fakeAgentKindRepo) CountActiveSessions(context.Context) (int64, error) {
+	panic("n/a")
+}
+func (f *fakeAgentKindRepo) CountActiveSessionsByUser(context.Context, uuid.UUID) (int64, error) {
+	panic("n/a")
+}
+func (f *fakeAgentKindRepo) ResetStuckSessionsOnRestart(context.Context) ([]*acp.Session, error) {
+	panic("n/a")
+}
+func (f *fakeAgentKindRepo) AcquireMainWorktree(context.Context, uuid.UUID, uuid.UUID) (bool, error) {
+	panic("n/a")
+}
+func (f *fakeAgentKindRepo) ReleaseMainWorktree(context.Context, uuid.UUID, uuid.UUID) (bool, error) {
+	panic("n/a")
+}
+func (f *fakeAgentKindRepo) InsertEvent(context.Context, *acp.Event) (*acp.Event, error) {
+	panic("n/a")
+}
+func (f *fakeAgentKindRepo) ListEventsSince(context.Context, uuid.UUID, int64, int32) ([]*acp.Event, error) {
+	panic("n/a")
+}
+func (f *fakeAgentKindRepo) PurgeEventsBefore(context.Context, time.Time) (int64, error) {
+	panic("n/a")
+}
+
+// agentKindRecordingRecorder：accumulate audit entries
+type agentKindRecordingRecorder struct{ entries []audit.Entry }
+
+func (r *agentKindRecordingRecorder) Record(_ context.Context, e audit.Entry) error {
+	r.entries = append(r.entries, e)
+	return nil
+}
+
+// testEncryptor returns a real *crypto.Encryptor with a fixed test key.
+func testEncryptor(t *testing.T) *crypto.Encryptor {
+	t.Helper()
+	key := []byte("0123456789abcdef0123456789abcdef") // 32 bytes
+	enc, err := crypto.NewEncryptor(key)
+	require.NoError(t, err)
+	return enc
+}
+
+func TestAgentKindService_Create(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	repo := newFakeAgentKindRepo()
+	rec := &agentKindRecordingRecorder{}
+	svc := acp.NewAgentKindService(repo, testEncryptor(t), rec)
+
+	admin := acp.Caller{UserID: uuid.New(), IsAdmin: true}
+	k, err := svc.Create(ctx, admin, acp.CreateAgentKindInput{
+		Name: "claude_code", DisplayName: "Claude Code",
+		BinaryPath: "claude-code", Args: []string{"--acp"},
+		Env: map[string]string{"K": "v"}, Enabled: true,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "claude_code", k.Name)
+	assert.NotEmpty(t, k.EncryptedEnv) // env 已加密
+
+	require.Len(t, rec.entries, 1)
+	assert.Equal(t, "acp.agent_kind.create", rec.entries[0].Action)
+}
+
+func TestAgentKindService_Create_NonAdmin(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	svc := acp.NewAgentKindService(newFakeAgentKindRepo(), testEncryptor(t), &agentKindRecordingRecorder{})
+
+	user := acp.Caller{UserID: uuid.New(), IsAdmin: false}
+	_, err := svc.Create(ctx, user, acp.CreateAgentKindInput{
+		Name: "x", DisplayName: "x", BinaryPath: "x", Enabled: true,
+	})
+	ae, ok := errs.As(err)
+	require.True(t, ok)
+	assert.Equal(t, errs.CodeForbidden, ae.Code)
+}
+
+func TestAgentKindService_List_NonAdmin_OnlyEnabled(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	repo := newFakeAgentKindRepo()
+	svc := acp.NewAgentKindService(repo, testEncryptor(t), nil)
+	admin := acp.Caller{UserID: uuid.New(), IsAdmin: true}
+	user := acp.Caller{UserID: uuid.New(), IsAdmin: false}
+
+	_, _ = svc.Create(ctx, admin, acp.CreateAgentKindInput{
+		Name: "k1", DisplayName: "k1", BinaryPath: "x", Enabled: true,
+	})
+	_, _ = svc.Create(ctx, admin, acp.CreateAgentKindInput{
+		Name: "k2", DisplayName: "k2", BinaryPath: "x", Enabled: false,
+	})
+
+	adminList, _ := svc.List(ctx, admin)
+	userList, _ := svc.List(ctx, user)
+	assert.Len(t, adminList, 2)
+	assert.Len(t, userList, 1)
+}
+
+func TestAgentKindService_Update_PatchSemantics(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	repo := newFakeAgentKindRepo()
+	rec := &agentKindRecordingRecorder{}
+	svc := acp.NewAgentKindService(repo, testEncryptor(t), rec)
+	admin := acp.Caller{UserID: uuid.New(), IsAdmin: true}
+
+	k, _ := svc.Create(ctx, admin, acp.CreateAgentKindInput{
+		Name: "k", DisplayName: "K", BinaryPath: "/x", Enabled: true,
+	})
+
+	disp := "Renamed"
+	updated, err := svc.Update(ctx, admin, k.ID, acp.UpdateAgentKindInput{DisplayName: &disp})
+	require.NoError(t, err)
+	assert.Equal(t, "Renamed", updated.DisplayName)
+	assert.Equal(t, "/x", updated.BinaryPath) // 未改
+
+	last := rec.entries[len(rec.entries)-1]
+	assert.Equal(t, "acp.agent_kind.update", last.Action)
+}

internal/acp/domain.go

@@ -0,0 +1,157 @@
+// Package acp 实现 ACP（Agent Client Protocol）Client 模块。
+// 模块结构（spec §13 决策 #12）：单 package + 多文件，与现有 chat/jobs/workspace 一致。
+//
+// 三个聚合根：
+//   - AgentKind：admin 注册的 agent 类型（claude_code/gemini/...），含加密 env
+//   - Session：用户启动的一个 ACP 会话，绑定 workspace + agent kind + (issue/req?)
+//   - Event：JSON-RPC 双向消息流，每条入库
+package acp
+
+import (
+	"context"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// SessionStatus 是 acp_sessions.status 枚举。
+type SessionStatus string
+
+const (
+	SessionStarting SessionStatus = "starting"
+	SessionRunning  SessionStatus = "running"
+	SessionCrashed  SessionStatus = "crashed"
+	SessionExited   SessionStatus = "exited"
+)
+
+// IsActive 判定 session 是否仍占资源（worktree、subprocess、限流计数）。
+func (s SessionStatus) IsActive() bool {
+	return s == SessionStarting || s == SessionRunning
+}
+
+// EventDirection 标识事件流向。in = client→agent，out = agent→client。
+type EventDirection string
+
+const (
+	DirectionIn  EventDirection = "in"
+	DirectionOut EventDirection = "out"
+)
+
+// RPCKind 标识 JSON-RPC 消息类型。
+type RPCKind string
+
+const (
+	RPCRequest      RPCKind = "request"
+	RPCResponse     RPCKind = "response"
+	RPCNotification RPCKind = "notification"
+	RPCError        RPCKind = "error"
+)
+
+// AgentKind 是 admin 注册的 agent 类型记录。EncryptedEnv 是 AES-GCM 密文，
+// 仅 supervisor spawn 时解密为 map 注入子进程。其他场景不解密、不出 API。
+type AgentKind struct {
+	ID            uuid.UUID
+	Name          string
+	DisplayName   string
+	Description   string
+	BinaryPath    string
+	Args          []string
+	EncryptedEnv  []byte
+	Enabled       bool
+	CreatedBy     uuid.UUID
+	CreatedAt     time.Time
+	UpdatedAt     time.Time
+}
+
+// Session 是一次 ACP 会话。AgentSessionID 是 agent 侧的 session 标识（来自
+// session/new response），与本表 ID 不同，仅用于 ACP 协议 method 内填充。
+type Session struct {
+	ID              uuid.UUID
+	WorkspaceID     uuid.UUID
+	ProjectID       uuid.UUID
+	AgentKindID     uuid.UUID
+	UserID          uuid.UUID
+	IssueID         *uuid.UUID
+	RequirementID   *uuid.UUID
+	AgentSessionID  *string
+	Branch          string
+	CwdPath         string
+	IsMainWorktree  bool
+	Status          SessionStatus
+	PID             *int32
+	ExitCode        *int32
+	LastError       *string
+	StartedAt       time.Time
+	EndedAt         *time.Time
+}
+
+// Event 是一条入库的 JSON-RPC 消息。Payload 是 JSON-RPC envelope 完整 JSON
+// 字节（不解析为结构体，便于无损 replay）；超过 64KB 的会按 §3.5 规则裁剪。
+type Event struct {
+	ID          int64
+	SessionID   uuid.UUID
+	Direction   EventDirection
+	RPCKind     RPCKind
+	Method      *string
+	Payload     []byte
+	PayloadSize int32
+	Truncated   bool
+	CreatedAt   time.Time
+}
+
+// Caller 表示发起请求的用户上下文，与 PM 模块的 Caller 同语义。
+type Caller struct {
+	UserID  uuid.UUID
+	IsAdmin bool
+}
+
+// AgentKindService 暴露 AgentKind 的应用服务方法。env 走"完整 map 替换"
+// 语义：每次 PATCH 传完整 env，nil 表示不修改；非 nil 整体加密重写。
+type AgentKindService interface {
+	Create(ctx context.Context, c Caller, in CreateAgentKindInput) (*AgentKind, error)
+	List(ctx context.Context, c Caller) ([]*AgentKind, error)
+	Get(ctx context.Context, c Caller, id uuid.UUID) (*AgentKind, error)
+	Update(ctx context.Context, c Caller, id uuid.UUID, in UpdateAgentKindInput) (*AgentKind, error)
+	Delete(ctx context.Context, c Caller, id uuid.UUID) error
+}
+
+// SessionService 暴露 Session 聚合根的应用服务方法。
+type SessionService interface {
+	Create(ctx context.Context, c Caller, in CreateSessionInput) (*Session, error)
+	Get(ctx context.Context, c Caller, id uuid.UUID) (*Session, error)
+	List(ctx context.Context, c Caller, all bool) ([]*Session, error)
+	Terminate(ctx context.Context, c Caller, id uuid.UUID) error
+}
+
+// CreateSessionInput 是创建 session 的入参。
+// branch / issue_number / requirement_number 三选一或全空（spec §8.1）。
+type CreateSessionInput struct {
+	WorkspaceID       uuid.UUID
+	AgentKindID       uuid.UUID
+	Branch            *string
+	IssueNumber       *int
+	RequirementNumber *int
+	InitialPrompt     *string
+}
+
+// CreateAgentKindInput 携带创建必需字段。Args / Env 可为 nil。
+type CreateAgentKindInput struct {
+	Name        string
+	DisplayName string
+	Description string
+	BinaryPath  string
+	Args        []string
+	Env         map[string]string
+	Enabled     bool
+}
+
+// UpdateAgentKindInput 是 patch 输入。Name 不可改（创建后稳定，引用约束）。
+// Env 三态：nil = 不修改；空 map = 清空全部 env；非空 = 整体替换。
+type UpdateAgentKindInput struct {
+	DisplayName *string
+	Description *string
+	BinaryPath  *string
+	Args        []string             // nil = 不改；非 nil = 替换
+	Env         map[string]string    // nil = 不改；非 nil（含空）= 替换
+	Enabled     *bool
+}

internal/acp/dto.go

@@ -0,0 +1,114 @@
+package acp
+
+import (
+	"github.com/google/uuid"
+)
+
+// AgentKindAdminDTO 是 admin 视图的完整字段。EnvKeys 仅返回 key 列表（不返回值）。
+type AgentKindAdminDTO struct {
+	ID          uuid.UUID `json:"id"`
+	Name        string    `json:"name"`
+	DisplayName string    `json:"display_name"`
+	Description string    `json:"description"`
+	BinaryPath  string    `json:"binary_path"`
+	Args        []string  `json:"args"`
+	EnvKeys     []string  `json:"env_keys"`
+	Enabled     bool      `json:"enabled"`
+	CreatedBy   uuid.UUID `json:"created_by"`
+	CreatedAt   string    `json:"created_at"`
+	UpdatedAt   string    `json:"updated_at"`
+}
+
+// AgentKindPublicDTO 是普通用户视图，不暴露 binary_path / args / env_keys。
+type AgentKindPublicDTO struct {
+	ID          uuid.UUID `json:"id"`
+	Name        string    `json:"name"`
+	DisplayName string    `json:"display_name"`
+	Enabled     bool      `json:"enabled"`
+}
+
+// CreateAgentKindReq / UpdateAgentKindReq 是 HTTP 请求体。
+type CreateAgentKindReq struct {
+	Name        string            `json:"name"`
+	DisplayName string            `json:"display_name"`
+	Description string            `json:"description"`
+	BinaryPath  string            `json:"binary_path"`
+	Args        []string          `json:"args"`
+	Env         map[string]string `json:"env"`
+	Enabled     *bool             `json:"enabled"`
+}
+
+type UpdateAgentKindReq struct {
+	DisplayName *string           `json:"display_name,omitempty"`
+	Description *string           `json:"description,omitempty"`
+	BinaryPath  *string           `json:"binary_path,omitempty"`
+	Args        []string          `json:"args,omitempty"`
+	Env         map[string]string `json:"env,omitempty"`
+	Enabled     *bool             `json:"enabled,omitempty"`
+}
+
+// CreateSessionReq is the request body for POST /api/v1/acp/sessions.
+type CreateSessionReq struct {
+	WorkspaceID       string  `json:"workspace_id"`
+	AgentKindID       string  `json:"agent_kind_id"`
+	Branch            *string `json:"branch,omitempty"`
+	IssueNumber       *int    `json:"issue_number,omitempty"`
+	RequirementNumber *int    `json:"requirement_number,omitempty"`
+	InitialPrompt     *string `json:"initial_prompt,omitempty"`
+}
+
+// SessionDTO is the response shape for sessions.
+type SessionDTO struct {
+	ID             string  `json:"id"`
+	WorkspaceID    string  `json:"workspace_id"`
+	ProjectID      string  `json:"project_id"`
+	AgentKindID    string  `json:"agent_kind_id"`
+	UserID         string  `json:"user_id"`
+	IssueID        *string `json:"issue_id"`
+	RequirementID  *string `json:"requirement_id"`
+	AgentSessionID *string `json:"agent_session_id"`
+	Branch         string  `json:"branch"`
+	CwdPath        string  `json:"cwd_path"`
+	IsMainWorktree bool    `json:"is_main_worktree"`
+	Status         string  `json:"status"`
+	PID            *int32  `json:"pid"`
+	ExitCode       *int32  `json:"exit_code"`
+	LastError      *string `json:"last_error"`
+	StartedAt      string  `json:"started_at"`
+	EndedAt        *string `json:"ended_at"`
+}
+
+func sessionToDTO(s *Session) SessionDTO {
+	var issueID, reqID, ended *string
+	if s.IssueID != nil {
+		v := s.IssueID.String()
+		issueID = &v
+	}
+	if s.RequirementID != nil {
+		v := s.RequirementID.String()
+		reqID = &v
+	}
+	if s.EndedAt != nil {
+		v := s.EndedAt.UTC().Format("2006-01-02T15:04:05Z")
+		ended = &v
+	}
+	return SessionDTO{
+		ID:             s.ID.String(),
+		WorkspaceID:    s.WorkspaceID.String(),
+		ProjectID:      s.ProjectID.String(),
+		AgentKindID:    s.AgentKindID.String(),
+		UserID:         s.UserID.String(),
+		IssueID:        issueID,
+		RequirementID:  reqID,
+		AgentSessionID: s.AgentSessionID,
+		Branch:         s.Branch,
+		CwdPath:        s.CwdPath,
+		IsMainWorktree: s.IsMainWorktree,
+		Status:         string(s.Status),
+		PID:            s.PID,
+		ExitCode:       s.ExitCode,
+		LastError:      s.LastError,
+		StartedAt:      s.StartedAt.UTC().Format("2006-01-02T15:04:05Z"),
+		EndedAt:        ended,
+	}
+}

internal/acp/handler.go

@@ -0,0 +1,576 @@
+// Package acp handler.go exposes the ACP module's HTTP / WS endpoints.
+// Part 1: agent_kinds routes. Part 2 (G1/G2): sessions REST endpoints.
+// Part 3 (G3): WebSocket upgrader.
+package acp
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+
+	ws "github.com/coder/websocket"
+	"github.com/coder/websocket/wsjson"
+
+	"github.com/yan1h/agent-coding-workflow/internal/infra/crypto"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/errs"
+	httpx "github.com/yan1h/agent-coding-workflow/internal/transport/http"
+	"github.com/yan1h/agent-coding-workflow/internal/transport/http/middleware"
+)
+
+// AdminLookup resolves whether a user is an admin (mirrors chat/workspace pattern).
+type AdminLookup interface {
+	IsAdmin(ctx context.Context, userID uuid.UUID) (bool, error)
+}
+
+// WSConfig controls WebSocket heartbeat and buffering.
+type WSConfig struct {
+	PingInterval time.Duration
+	PongTimeout  time.Duration
+	SendBuffer   int
+}
+
+// Handler exposes ACP HTTP endpoints.
+type Handler struct {
+	akSvc       AgentKindService
+	sessSvc     SessionService
+	sup         *Supervisor
+	repo        Repository
+	resolver    middleware.SessionResolver
+	adminLookup AdminLookup
+	enc         *crypto.Encryptor
+	cfg         WSConfig
+}
+
+// NewHandler constructs Handler with full dependencies.
+func NewHandler(ak AgentKindService, ss SessionService, sup *Supervisor, repo Repository,
+	resolver middleware.SessionResolver, al AdminLookup, enc *crypto.Encryptor, cfg WSConfig) *Handler {
+	return &Handler{
+		akSvc: ak, sessSvc: ss, sup: sup, repo: repo,
+		resolver: resolver, adminLookup: al, enc: enc, cfg: cfg,
+	}
+}
+
+// Mount registers /api/v1/acp/* routes.
+func (h *Handler) Mount(r chi.Router) {
+	r.Route("/api/v1/acp/agent-kinds", func(r chi.Router) {
+		r.Use(middleware.Auth(h.resolver, middleware.AuthOptions{}))
+		r.Get("/", h.listAgentKinds)
+		r.Post("/", h.createAgentKind)
+		r.Get("/{id}", h.getAgentKind)
+		r.Patch("/{id}", h.updateAgentKind)
+		r.Delete("/{id}", h.deleteAgentKind)
+	})
+	r.Route("/api/v1/acp/sessions", func(r chi.Router) {
+		r.Use(middleware.Auth(h.resolver, middleware.AuthOptions{}))
+		r.Get("/", h.listSessions)
+		r.Post("/", h.createSession)
+		r.Get("/{id}", h.getSession)
+		r.Delete("/{id}", h.terminateSession)
+		r.Get("/{id}/events", h.getEvents)
+		r.Get("/{id}/ws", h.sessionWS)
+	})
+}
+
+func (h *Handler) caller(r *http.Request) (Caller, error) {
+	uid, ok := middleware.UserIDFromContext(r.Context())
+	if !ok {
+		return Caller{}, errs.New(errs.CodeUnauthorized, "not authenticated")
+	}
+	admin, err := h.adminLookup.IsAdmin(r.Context(), uid)
+	if err != nil {
+		return Caller{}, err
+	}
+	return Caller{UserID: uid, IsAdmin: admin}, nil
+}
+
+func (h *Handler) listAgentKinds(w http.ResponseWriter, r *http.Request) {
+	c, err := h.caller(r)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	ks, err := h.akSvc.List(r.Context(), c)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	if c.IsAdmin {
+		out := make([]AgentKindAdminDTO, 0, len(ks))
+		for _, k := range ks {
+			out = append(out, h.agentKindToAdminDTO(k))
+		}
+		httpx.WriteJSON(w, http.StatusOK, out)
+		return
+	}
+	out := make([]AgentKindPublicDTO, 0, len(ks))
+	for _, k := range ks {
+		out = append(out, agentKindToPublicDTO(k))
+	}
+	httpx.WriteJSON(w, http.StatusOK, out)
+}
+
+func (h *Handler) createAgentKind(w http.ResponseWriter, r *http.Request) {
+	c, err := h.caller(r)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	var req CreateAgentKindReq
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeErr(w, r, errs.New(errs.CodeInvalidInput, "bad json"))
+		return
+	}
+	enabled := true
+	if req.Enabled != nil {
+		enabled = *req.Enabled
+	}
+	in := CreateAgentKindInput{
+		Name:        strings.TrimSpace(req.Name),
+		DisplayName: req.DisplayName,
+		Description: req.Description,
+		BinaryPath:  strings.TrimSpace(req.BinaryPath),
+		Args:        req.Args,
+		Env:         req.Env,
+		Enabled:     enabled,
+	}
+	out, err := h.akSvc.Create(r.Context(), c, in)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	httpx.WriteJSON(w, http.StatusCreated, h.agentKindToAdminDTO(out))
+}
+
+func (h *Handler) getAgentKind(w http.ResponseWriter, r *http.Request) {
+	c, err := h.caller(r)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	id, perr := uuid.Parse(chi.URLParam(r, "id"))
+	if perr != nil {
+		writeErr(w, r, errs.New(errs.CodeInvalidInput, "bad id"))
+		return
+	}
+	k, err := h.akSvc.Get(r.Context(), c, id)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	if c.IsAdmin {
+		httpx.WriteJSON(w, http.StatusOK, h.agentKindToAdminDTO(k))
+		return
+	}
+	httpx.WriteJSON(w, http.StatusOK, agentKindToPublicDTO(k))
+}
+
+func (h *Handler) updateAgentKind(w http.ResponseWriter, r *http.Request) {
+	c, err := h.caller(r)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	id, perr := uuid.Parse(chi.URLParam(r, "id"))
+	if perr != nil {
+		writeErr(w, r, errs.New(errs.CodeInvalidInput, "bad id"))
+		return
+	}
+	var req UpdateAgentKindReq
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeErr(w, r, errs.New(errs.CodeInvalidInput, "bad json"))
+		return
+	}
+	in := UpdateAgentKindInput{
+		DisplayName: req.DisplayName,
+		Description: req.Description,
+		BinaryPath:  req.BinaryPath,
+		Args:        req.Args,
+		Env:         req.Env,
+		Enabled:     req.Enabled,
+	}
+	out, err := h.akSvc.Update(r.Context(), c, id, in)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	httpx.WriteJSON(w, http.StatusOK, h.agentKindToAdminDTO(out))
+}
+
+func (h *Handler) deleteAgentKind(w http.ResponseWriter, r *http.Request) {
+	c, err := h.caller(r)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	id, perr := uuid.Parse(chi.URLParam(r, "id"))
+	if perr != nil {
+		writeErr(w, r, errs.New(errs.CodeInvalidInput, "bad id"))
+		return
+	}
+	if err := h.akSvc.Delete(r.Context(), c, id); err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// ===== Session endpoints =====
+
+func (h *Handler) listSessions(w http.ResponseWriter, r *http.Request) {
+	c, err := h.caller(r)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	all := r.URL.Query().Get("all") == "true"
+	list, err := h.sessSvc.List(r.Context(), c, all)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	out := make([]SessionDTO, 0, len(list))
+	for _, s := range list {
+		out = append(out, sessionToDTO(s))
+	}
+	httpx.WriteJSON(w, http.StatusOK, out)
+}
+
+func (h *Handler) createSession(w http.ResponseWriter, r *http.Request) {
+	c, err := h.caller(r)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	var req CreateSessionReq
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeErr(w, r, errs.New(errs.CodeInvalidInput, "bad json"))
+		return
+	}
+	wsID, perr := uuid.Parse(req.WorkspaceID)
+	if perr != nil {
+		writeErr(w, r, errs.New(errs.CodeInvalidInput, "bad workspace_id"))
+		return
+	}
+	akID, perr := uuid.Parse(req.AgentKindID)
+	if perr != nil {
+		writeErr(w, r, errs.New(errs.CodeInvalidInput, "bad agent_kind_id"))
+		return
+	}
+	in := CreateSessionInput{
+		WorkspaceID:       wsID,
+		AgentKindID:       akID,
+		Branch:            req.Branch,
+		IssueNumber:       req.IssueNumber,
+		RequirementNumber: req.RequirementNumber,
+		InitialPrompt:     req.InitialPrompt,
+	}
+	out, err := h.sessSvc.Create(r.Context(), c, in)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	httpx.WriteJSON(w, http.StatusCreated, sessionToDTO(out))
+}
+
+func (h *Handler) getSession(w http.ResponseWriter, r *http.Request) {
+	c, err := h.caller(r)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	id, perr := uuid.Parse(chi.URLParam(r, "id"))
+	if perr != nil {
+		writeErr(w, r, errs.New(errs.CodeInvalidInput, "bad id"))
+		return
+	}
+	s, err := h.sessSvc.Get(r.Context(), c, id)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	httpx.WriteJSON(w, http.StatusOK, sessionToDTO(s))
+}
+
+func (h *Handler) terminateSession(w http.ResponseWriter, r *http.Request) {
+	c, err := h.caller(r)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	id, perr := uuid.Parse(chi.URLParam(r, "id"))
+	if perr != nil {
+		writeErr(w, r, errs.New(errs.CodeInvalidInput, "bad id"))
+		return
+	}
+	if err := h.sessSvc.Terminate(r.Context(), c, id); err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (h *Handler) getEvents(w http.ResponseWriter, r *http.Request) {
+	c, err := h.caller(r)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	id, perr := uuid.Parse(chi.URLParam(r, "id"))
+	if perr != nil {
+		writeErr(w, r, errs.New(errs.CodeInvalidInput, "bad id"))
+		return
+	}
+	if _, err := h.sessSvc.Get(r.Context(), c, id); err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	var since int64
+	if v := r.URL.Query().Get("since"); v != "" {
+		if n, err := strconv.ParseInt(v, 10, 64); err == nil {
+			since = n
+		}
+	}
+	evs, err := h.repo.ListEventsSince(r.Context(), id, since, 1000)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	out := make([]EventEnvelope, 0, len(evs))
+	for _, e := range evs {
+		method := ""
+		if e.Method != nil {
+			method = *e.Method
+		}
+		out = append(out, EventEnvelope{
+			ID:        e.ID,
+			Direction: string(e.Direction),
+			Kind:      string(e.RPCKind),
+			Method:    method,
+			Payload:   e.Payload,
+			Truncated: e.Truncated,
+		})
+	}
+	httpx.WriteJSON(w, http.StatusOK, out)
+}
+
+// ===== WebSocket =====
+
+func (h *Handler) sessionWS(w http.ResponseWriter, r *http.Request) {
+	c, err := h.caller(r)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+	id, perr := uuid.Parse(chi.URLParam(r, "id"))
+	if perr != nil {
+		writeErr(w, r, errs.New(errs.CodeInvalidInput, "bad id"))
+		return
+	}
+
+	sess, err := h.sessSvc.Get(r.Context(), c, id)
+	if err != nil {
+		writeErr(w, r, err)
+		return
+	}
+
+	var since int64
+	if v := r.URL.Query().Get("since"); v != "" {
+		if n, err := strconv.ParseInt(v, 10, 64); err == nil {
+			since = n
+		}
+	}
+
+	conn, err := ws.Accept(w, r, &ws.AcceptOptions{
+		InsecureSkipVerify: false,
+	})
+	if err != nil {
+		return
+	}
+	defer conn.Close(ws.StatusInternalError, "internal")
+
+	ctx, cancel := context.WithCancel(r.Context())
+	defer cancel()
+
+	// 1. State event
+	stateEv := map[string]any{
+		"kind":       "state",
+		"session_id": id.String(),
+		"status":     string(sess.Status),
+		"branch":     sess.Branch,
+		"since":      since,
+	}
+	if err := wsjson.Write(ctx, conn, stateEv); err != nil {
+		return
+	}
+
+	// 2. Push history
+	history, _ := h.repo.ListEventsSince(ctx, id, since, int32(5000))
+	var lastSentID = since
+	for _, e := range history {
+		env := EventEnvelope{
+			ID:        e.ID,
+			Direction: string(e.Direction),
+			Kind:      string(e.RPCKind),
+			Method:    derefStr(e.Method),
+			Payload:   e.Payload,
+			Truncated: e.Truncated,
+		}
+		if err := wsjson.Write(ctx, conn, env); err != nil {
+			return
+		}
+		lastSentID = e.ID
+	}
+
+	// 3. Live: subscribe + heartbeat + client messages
+	relay := h.sup.GetRelay(id)
+	if relay == nil {
+		conn.Close(ws.StatusNormalClosure, "session ended")
+		return
+	}
+	sub := relay.Subscribe(c.UserID)
+	defer relay.Unsubscribe(sub.ID)
+
+	// Heartbeat goroutine
+	pingTicker := time.NewTicker(h.cfg.PingInterval)
+	defer pingTicker.Stop()
+	go func() {
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-pingTicker.C:
+				pingCtx, pcancel := context.WithTimeout(ctx, h.cfg.PongTimeout)
+				err := conn.Ping(pingCtx)
+				pcancel()
+				if err != nil {
+					cancel()
+					return
+				}
+			}
+		}
+	}()
+
+	// Client → server reader (goroutine)
+	clientMsgCh := make(chan *Message, 8)
+	go func() {
+		defer close(clientMsgCh)
+		for {
+			_, data, err := conn.Read(ctx)
+			if err != nil {
+				return
+			}
+			var m Message
+			if err := json.Unmarshal(data, &m); err != nil {
+				_ = wsjson.Write(ctx, conn, map[string]any{
+					"kind":    "client_error",
+					"message": "bad json",
+				})
+				continue
+			}
+			clientMsgCh <- &m
+		}
+	}()
+
+	// Main loop
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case env, ok := <-sub.Send:
+			if !ok {
+				conn.Close(ws.StatusNormalClosure, "relay closed")
+				return
+			}
+			if env.ID <= lastSentID && env.ID != 0 {
+				continue
+			}
+			if err := wsjson.Write(ctx, conn, env); err != nil {
+				return
+			}
+			if env.ID > lastSentID {
+				lastSentID = env.ID
+			}
+		case m, ok := <-clientMsgCh:
+			if !ok {
+				return
+			}
+			if c.UserID != sess.UserID {
+				_ = wsjson.Write(ctx, conn, map[string]any{
+					"kind":    "client_error",
+					"message": "only owner can prompt/cancel",
+				})
+				continue
+			}
+			if m.Method != "session/prompt" && m.Method != "session/cancel" {
+				_ = wsjson.Write(ctx, conn, map[string]any{
+					"kind":    "client_error",
+					"message": "method not allowed",
+				})
+				continue
+			}
+			if err := relay.SendClient(m); err != nil {
+				_ = wsjson.Write(ctx, conn, map[string]any{
+					"kind":    "client_error",
+					"message": err.Error(),
+				})
+			}
+		}
+	}
+}
+
+// ===== DTO converters =====
+
+// agentKindToAdminDTO is a Handler method because env-key extraction needs the encryptor.
+func (h *Handler) agentKindToAdminDTO(k *AgentKind) AgentKindAdminDTO {
+	envKeys := []string{}
+	if len(k.EncryptedEnv) > 0 {
+		if env, err := decryptEnv(h.enc, k.EncryptedEnv); err == nil {
+			for key := range env {
+				envKeys = append(envKeys, key)
+			}
+			sort.Strings(envKeys)
+		}
+	}
+	return AgentKindAdminDTO{
+		ID:          k.ID,
+		Name:        k.Name,
+		DisplayName: k.DisplayName,
+		Description: k.Description,
+		BinaryPath:  k.BinaryPath,
+		Args:        append([]string(nil), k.Args...),
+		EnvKeys:     envKeys,
+		Enabled:     k.Enabled,
+		CreatedBy:   k.CreatedBy,
+		CreatedAt:   k.CreatedAt.UTC().Format("2006-01-02T15:04:05Z"),
+		UpdatedAt:   k.UpdatedAt.UTC().Format("2006-01-02T15:04:05Z"),
+	}
+}
+
+func agentKindToPublicDTO(k *AgentKind) AgentKindPublicDTO {
+	return AgentKindPublicDTO{
+		ID:          k.ID,
+		Name:        k.Name,
+		DisplayName: k.DisplayName,
+		Enabled:     k.Enabled,
+	}
+}
+
+// ===== transport helpers =====
+
+func writeErr(w http.ResponseWriter, r *http.Request, err error) {
+	httpx.WriteError(w, middleware.RequestIDFromContext(r.Context()), err)
+}
+
+func derefStr(p *string) string {
+	if p == nil {
+		return ""
+	}
+	return *p
+}

internal/acp/handler_e2e_test.go

@@ -0,0 +1,270 @@
+//go:build integration
+
+// handler_e2e_test.go drives the ACP handler through one full happy-path
+// session lifecycle:
+//
+//  1. POST /api/v1/acp/sessions → 201
+//  2. wait for supervisor handshake → SessionRunning
+//  3. WS /api/v1/acp/sessions/{id}/ws → expect "state" event
+//  4. DELETE /api/v1/acp/sessions/{id} → 204
+//  5. wait for monitor → SessionExited
+//
+// Build-tagged integration: spins up testcontainer PG + go build fake-acp-agent,
+// so it never runs under -short.
+package acp_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	ws "github.com/coder/websocket"
+	"github.com/coder/websocket/wsjson"
+
+	"github.com/yan1h/agent-coding-workflow/internal/acp"
+	"github.com/yan1h/agent-coding-workflow/internal/audit"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/notify"
+	"github.com/yan1h/agent-coding-workflow/internal/project"
+	"github.com/yan1h/agent-coding-workflow/internal/workspace"
+)
+
+// stubWsService satisfies workspace.WorkspaceService for the e2e test.
+// Only Get is exercised by SessionService.Create; other methods panic.
+type stubWsService struct {
+	wsRow *workspace.Workspace
+}
+
+func (s *stubWsService) Get(_ context.Context, _ workspace.Caller, _ uuid.UUID) (*workspace.Workspace, error) {
+	return s.wsRow, nil
+}
+func (s *stubWsService) Create(context.Context, workspace.Caller, string, workspace.CreateWorkspaceInput) (*workspace.Workspace, error) {
+	panic("stubWsService.Create unused")
+}
+func (s *stubWsService) List(context.Context, workspace.Caller, string) ([]*workspace.Workspace, error) {
+	panic("stubWsService.List unused")
+}
+func (s *stubWsService) Update(context.Context, workspace.Caller, uuid.UUID, workspace.UpdateWorkspaceInput) (*workspace.Workspace, error) {
+	panic("stubWsService.Update unused")
+}
+func (s *stubWsService) Delete(context.Context, workspace.Caller, uuid.UUID) error {
+	panic("stubWsService.Delete unused")
+}
+func (s *stubWsService) Sync(context.Context, workspace.Caller, uuid.UUID) (*workspace.Workspace, error) {
+	panic("stubWsService.Sync unused")
+}
+func (s *stubWsService) UpsertCredential(context.Context, workspace.Caller, uuid.UUID, workspace.UpsertCredentialInput) (*workspace.Credential, error) {
+	panic("stubWsService.UpsertCredential unused")
+}
+func (s *stubWsService) GetCredentialMeta(context.Context, workspace.Caller, uuid.UUID) (*workspace.Credential, error) {
+	panic("stubWsService.GetCredentialMeta unused")
+}
+
+// stubProjectAccess satisfies acp.ProjectAccess for the e2e test.
+// Only GetProjectByWorkspace is exercised; the rest panic.
+type stubProjectAccess struct {
+	pj *project.Project
+}
+
+func (s *stubProjectAccess) GetProjectByWorkspace(_ context.Context, _ uuid.UUID) (*project.Project, error) {
+	return s.pj, nil
+}
+func (s *stubProjectAccess) GetIssueByNumber(context.Context, uuid.UUID, int) (*project.Issue, error) {
+	panic("stubProjectAccess.GetIssueByNumber unused")
+}
+func (s *stubProjectAccess) GetRequirementByNumber(context.Context, uuid.UUID, int) (*project.Requirement, error) {
+	panic("stubProjectAccess.GetRequirementByNumber unused")
+}
+
+// TestHandler_Session_CreateAndWS_E2E covers the happy path from POST /sessions
+// through WS state event to DELETE — the full request → subprocess → relay →
+// shutdown loop, exercising Handler + SessionService + Supervisor end-to-end.
+func TestHandler_Session_CreateAndWS_E2E(t *testing.T) {
+	if testing.Short() {
+		t.Skip("e2e: spawns subprocess + testcontainer pg")
+	}
+	t.Parallel()
+	ctx := context.Background()
+
+	repo, pool := setupRepo(t)
+
+	uid := mustInsertUser(t, ctx, pool, "wsuser-e2e@local", false)
+	pid, wsid := mustInsertProjectWorkspace(t, ctx, pool, uid)
+
+	// mustInsertProjectWorkspace hardcodes main_path='/tmp'. Override to a real
+	// per-test directory so subprocess Spawn can chdir into it.
+	cwd := t.TempDir()
+	_, err := pool.Exec(ctx,
+		`UPDATE workspaces SET main_path = $1 WHERE id = $2`, cwd, wsid)
+	require.NoError(t, err)
+
+	// migrations/0003 sets default_branch DEFAULT 'main', so workspaces row
+	// inserted by the helper already has DefaultBranch='main' — no UPDATE needed.
+
+	bin := fakeAgentBinary(t)
+	enc := testEncryptor(t)
+
+	kind, err := repo.CreateAgentKind(ctx, &acp.AgentKind{
+		ID: uuid.New(), Name: "ws-e2e-fake", DisplayName: "Fake",
+		BinaryPath: bin, Args: []string{}, Enabled: true, CreatedBy: uid,
+	})
+	require.NoError(t, err)
+
+	// Real workspace row → seeded into the wsService stub so SessionService.Get
+	// returns the same ProjectID + DefaultBranch the DB has.
+	wsRow, err := workspace.NewPostgresRepository(pool).GetWorkspaceByID(ctx, wsid)
+	require.NoError(t, err)
+
+	disp := notify.NewDispatcher(notifyRepoStub{}, slogDiscard())
+	sup := acp.NewSupervisor(
+		repo,
+		audit.NewPostgresRecorder(pool),
+		disp,
+		nil, nil, // wtSvc/wsRepo: IsMainWorktree=true path → not called
+		enc,
+		acp.SupervisorConfig{
+			SpawnTimeout:       5 * time.Second,
+			KillGrace:          1 * time.Second,
+			StderrBufferLines:  50,
+			StderrTailBytes:    1000,
+			EventMaxPayload:    65536,
+			EventTruncateField: 4096,
+			ShutdownGrace:      5 * time.Second,
+		},
+		slogDiscard(),
+	)
+	defer sup.ShutdownAll(context.Background())
+
+	wsStub := &stubWsService{wsRow: wsRow}
+	paStub := &stubProjectAccess{pj: &project.Project{ID: pid, Slug: "p-test"}}
+
+	svc := acp.NewSessionService(
+		repo, wsStub, nil, nil, paStub, sup,
+		audit.NewPostgresRecorder(pool),
+		acp.SessionServiceConfig{MaxActiveGlobal: 10, MaxActivePerUser: 5},
+	)
+
+	h := acp.NewHandler(
+		nil, // ak svc — not exercised by sessions endpoints
+		svc, sup, repo,
+		fakeResolver{uid: uid},
+		fakeAdminLookup{admin: map[uuid.UUID]bool{uid: false}},
+		enc,
+		acp.WSConfig{
+			PingInterval: 30 * time.Second,
+			PongTimeout:  10 * time.Second,
+			SendBuffer:   64,
+		},
+	)
+
+	r := chi.NewRouter()
+	h.Mount(r)
+	srv := httptest.NewServer(r)
+	defer srv.Close()
+
+	// 1. POST /api/v1/acp/sessions
+	branch := "main"
+	body, err := json.Marshal(map[string]any{
+		"workspace_id":  wsid.String(),
+		"agent_kind_id": kind.ID.String(),
+		"branch":        branch,
+	})
+	require.NoError(t, err)
+
+	req, err := http.NewRequest("POST", srv.URL+"/api/v1/acp/sessions", bytes.NewReader(body))
+	require.NoError(t, err)
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer valid")
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	var created map[string]any
+	require.NoError(t, json.NewDecoder(resp.Body).Decode(&created))
+	require.Equal(t, http.StatusCreated, resp.StatusCode, "body=%v", created)
+
+	sidStr, _ := created["id"].(string)
+	require.NotEmpty(t, sidStr)
+	sid := uuid.MustParse(sidStr)
+
+	// 2. Wait for handshake → SessionRunning (supervisor.Spawn runs in a goroutine
+	// inside SessionService.Create, so the row starts as 'starting'). 10s budget
+	// covers fake-agent stdin/stdout handshake on slow CI.
+	deadline := time.After(10 * time.Second)
+	for {
+		s, _ := repo.GetSessionByID(ctx, sid)
+		if s != nil && s.Status == acp.SessionRunning {
+			break
+		}
+		select {
+		case <-deadline:
+			t.Fatalf("session never reached SessionRunning")
+		case <-time.After(100 * time.Millisecond):
+		}
+	}
+
+	// 3. WS connect — Authorization header is honored by the Auth middleware.
+	wsURL := strings.Replace(srv.URL, "http", "ws", 1) +
+		"/api/v1/acp/sessions/" + sid.String() + "/ws"
+	wsCtx, wsCancel := context.WithTimeout(ctx, 5*time.Second)
+	defer wsCancel()
+
+	wsConn, _, err := ws.Dial(wsCtx, wsURL, &ws.DialOptions{
+		HTTPHeader: http.Header{"Authorization": []string{"Bearer valid"}},
+	})
+	require.NoError(t, err)
+	defer wsConn.Close(ws.StatusInternalError, "")
+
+	var stateEv map[string]any
+	require.NoError(t, wsjson.Read(wsCtx, wsConn, &stateEv))
+	assert.Equal(t, "state", stateEv["kind"])
+	assert.Equal(t, sid.String(), stateEv["session_id"])
+	assert.Equal(t, "running", stateEv["status"])
+	assert.Equal(t, "main", stateEv["branch"])
+
+	// Close WS before DELETE so the subscriber drains and Kill doesn't race
+	// the WS goroutine.
+	_ = wsConn.Close(ws.StatusNormalClosure, "test done")
+
+	// 4. DELETE /api/v1/acp/sessions/{id}
+	delReq, err := http.NewRequest("DELETE",
+		srv.URL+"/api/v1/acp/sessions/"+sid.String(), nil)
+	require.NoError(t, err)
+	delReq.Header.Set("Authorization", "Bearer valid")
+
+	delResp, err := http.DefaultClient.Do(delReq)
+	require.NoError(t, err)
+	defer delResp.Body.Close()
+	assert.Equal(t, http.StatusNoContent, delResp.StatusCode)
+
+	// 5. Wait for terminal status. Kill blocks on monitor.done internally,
+	// so by the time DELETE returns the row should already be terminal —
+	// poll briefly to guard against scheduler latency.
+	deadline2 := time.After(5 * time.Second)
+	for {
+		s, _ := repo.GetSessionByID(ctx, sid)
+		if s != nil && (s.Status == acp.SessionExited || s.Status == acp.SessionCrashed) {
+			return
+		}
+		select {
+		case <-deadline2:
+			s, _ := repo.GetSessionByID(ctx, sid)
+			lastStatus := acp.SessionStatus("?")
+			if s != nil {
+				lastStatus = s.Status
+			}
+			t.Fatalf("session not terminated, last status=%s", lastStatus)
+		case <-time.After(100 * time.Millisecond):
+		}
+	}
+}

internal/acp/handler_test.go

@@ -0,0 +1,165 @@
+package acp_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/yan1h/agent-coding-workflow/internal/acp"
+)
+
+// fakeResolver is a stub middleware.SessionResolver that accepts the literal "valid" token.
+type fakeResolver struct{ uid uuid.UUID }
+
+func (f fakeResolver) ResolveSession(_ context.Context, token string) (uuid.UUID, bool, error) {
+	if token == "valid" {
+		return f.uid, true, nil
+	}
+	return uuid.Nil, false, nil
+}
+
+// fakeAdminLookup is a stub AdminLookup keyed by user ID.
+type fakeAdminLookup struct{ admin map[uuid.UUID]bool }
+
+func (f fakeAdminLookup) IsAdmin(_ context.Context, uid uuid.UUID) (bool, error) {
+	return f.admin[uid], nil
+}
+
+// mountHandlerWithRepo lets a test share one fakeAgentKindRepo across multiple
+// mounts (e.g. one as admin, one as non-admin) so the data set is consistent.
+func mountHandlerWithRepo(t *testing.T, callerUID uuid.UUID, isAdmin bool, repo *fakeAgentKindRepo) chi.Router {
+	t.Helper()
+	if repo == nil {
+		repo = newFakeAgentKindRepo()
+	}
+	enc := testEncryptor(t)
+	svc := acp.NewAgentKindService(repo, enc, &agentKindRecordingRecorder{})
+
+	r := chi.NewRouter()
+	h := acp.NewHandler(
+		svc,
+		nil, // sessSvc — not exercised by agent-kinds tests
+		nil, // sup — not exercised by agent-kinds tests
+		nil, // repo — not exercised by agent-kinds tests
+		fakeResolver{uid: callerUID},
+		fakeAdminLookup{admin: map[uuid.UUID]bool{callerUID: isAdmin}},
+		enc,
+		acp.WSConfig{},
+	)
+	h.Mount(r)
+	return r
+}
+
+func doJSON(t *testing.T, r chi.Router, method, path, token string, body any) (*httptest.ResponseRecorder, map[string]any) {
+	t.Helper()
+	var buf bytes.Buffer
+	if body != nil {
+		_ = json.NewEncoder(&buf).Encode(body)
+	}
+	req := httptest.NewRequest(method, path, &buf)
+	if token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+	rr := httptest.NewRecorder()
+	r.ServeHTTP(rr, req)
+	var out map[string]any
+	if rr.Body.Len() > 0 {
+		_ = json.Unmarshal(rr.Body.Bytes(), &out)
+	}
+	return rr, out
+}
+
+func TestHandler_AgentKind_Admin_CreateGetList(t *testing.T) {
+	t.Parallel()
+	uid := uuid.New()
+	r := mountHandlerWithRepo(t, uid, true, nil)
+
+	// Create
+	rr, body := doJSON(t, r, "POST", "/api/v1/acp/agent-kinds", "valid", map[string]any{
+		"name": "claude_code", "display_name": "Claude Code", "binary_path": "claude-code",
+		"args": []string{"--acp"}, "env": map[string]string{"K": "v"}, "enabled": true,
+	})
+	require.Equal(t, http.StatusCreated, rr.Code, "body=%s", rr.Body.String())
+	id := body["id"].(string)
+	assert.Equal(t, "claude_code", body["name"])
+	envKeys := body["env_keys"].([]any)
+	assert.Equal(t, []any{"K"}, envKeys)
+
+	// Get
+	rr, body = doJSON(t, r, "GET", "/api/v1/acp/agent-kinds/"+id, "valid", nil)
+	require.Equal(t, http.StatusOK, rr.Code)
+	assert.Equal(t, "Claude Code", body["display_name"])
+
+	// List
+	rr, _ = doJSON(t, r, "GET", "/api/v1/acp/agent-kinds", "valid", nil)
+	require.Equal(t, http.StatusOK, rr.Code)
+}
+
+func TestHandler_AgentKind_NonAdmin_CannotWrite_FieldsRedacted(t *testing.T) {
+	t.Parallel()
+	uid := uuid.New()
+	repo := newFakeAgentKindRepo()
+
+	// Admin creates one kind via the handler so audit + repo state are consistent.
+	adminR := mountHandlerWithRepo(t, uid, true, repo)
+	rr, _ := doJSON(t, adminR, "POST", "/api/v1/acp/agent-kinds", "valid", map[string]any{
+		"name": "claude_code", "display_name": "Claude Code", "binary_path": "claude-code",
+		"args": []string{"--acp"}, "env": map[string]string{"K": "v"}, "enabled": true,
+	})
+	require.Equal(t, http.StatusCreated, rr.Code)
+
+	// Same UID but treated as non-admin (fakeAdminLookup says false).
+	userR := mountHandlerWithRepo(t, uid, false, repo)
+
+	// List as non-admin: returns AgentKindPublicDTO array (no binary_path / env_keys).
+	rr2 := httptest.NewRecorder()
+	req2 := httptest.NewRequest("GET", "/api/v1/acp/agent-kinds", nil)
+	req2.Header.Set("Authorization", "Bearer valid")
+	userR.ServeHTTP(rr2, req2)
+	require.Equal(t, http.StatusOK, rr2.Code)
+	var arr []map[string]any
+	require.NoError(t, json.Unmarshal(rr2.Body.Bytes(), &arr))
+	require.Len(t, arr, 1)
+	assert.Equal(t, "claude_code", arr[0]["name"])
+	assert.NotContains(t, arr[0], "binary_path")
+	assert.NotContains(t, arr[0], "env_keys")
+	assert.NotContains(t, arr[0], "args")
+
+	// Non-admin POST → 403 Forbidden from the service layer.
+	rr3, _ := doJSON(t, userR, "POST", "/api/v1/acp/agent-kinds", "valid", map[string]any{
+		"name": "x", "display_name": "x", "binary_path": "x",
+	})
+	assert.Equal(t, http.StatusForbidden, rr3.Code)
+}
+
+func TestHandler_AgentKind_Update_PatchSemantics(t *testing.T) {
+	t.Parallel()
+	uid := uuid.New()
+	r := mountHandlerWithRepo(t, uid, true, nil)
+
+	rr, body := doJSON(t, r, "POST", "/api/v1/acp/agent-kinds", "valid", map[string]any{
+		"name": "k", "display_name": "K", "binary_path": "/x",
+	})
+	require.Equal(t, http.StatusCreated, rr.Code, "body=%s", rr.Body.String())
+	id := body["id"].(string)
+
+	// PATCH display_name only — other fields preserved.
+	rr, body = doJSON(t, r, "PATCH", "/api/v1/acp/agent-kinds/"+id, "valid", map[string]any{
+		"display_name": "Renamed",
+	})
+	require.Equal(t, http.StatusOK, rr.Code, "body=%s", rr.Body.String())
+	assert.Equal(t, "Renamed", body["display_name"])
+	assert.Equal(t, "/x", body["binary_path"])
+
+	// DELETE
+	rr, _ = doJSON(t, r, "DELETE", "/api/v1/acp/agent-kinds/"+id, "valid", nil)
+	assert.Equal(t, http.StatusNoContent, rr.Code)
+}

internal/acp/handlers/client_initialize.go

@@ -0,0 +1,44 @@
+package handlers
+
+// Server-initiated initialize call: types per spec §5.4. Supervisor sends this
+// immediately after spawn. clientCapabilities.terminal=false (MVP no terminal).
+
+type InitializeParams struct {
+	ProtocolVersion    int                `json:"protocolVersion"`
+	ClientCapabilities ClientCapabilities `json:"clientCapabilities"`
+	ClientInfo         ClientInfo         `json:"clientInfo"`
+}
+
+type ClientCapabilities struct {
+	Fs       FsCapability `json:"fs"`
+	Terminal bool         `json:"terminal"`
+}
+
+type FsCapability struct {
+	ReadTextFile  bool `json:"readTextFile"`
+	WriteTextFile bool `json:"writeTextFile"`
+}
+
+type ClientInfo struct {
+	Name    string `json:"name"`
+	Version string `json:"version"`
+}
+
+type InitializeResult struct {
+	ProtocolVersion   int            `json:"protocolVersion"`
+	AgentCapabilities map[string]any `json:"agentCapabilities,omitempty"`
+	AgentInfo         map[string]any `json:"agentInfo,omitempty"`
+	AuthMethods       []any          `json:"authMethods,omitempty"`
+}
+
+// BuildInitializeParams returns standard initialize params.
+func BuildInitializeParams(version string) InitializeParams {
+	return InitializeParams{
+		ProtocolVersion: 1,
+		ClientCapabilities: ClientCapabilities{
+			Fs:       FsCapability{ReadTextFile: true, WriteTextFile: true},
+			Terminal: false,
+		},
+		ClientInfo: ClientInfo{Name: "agent-coding-workflow", Version: version},
+	}
+}

internal/acp/handlers/client_session_new.go

@@ -0,0 +1,17 @@
+package handlers
+
+// session/new method types (spec §5.4).
+
+type SessionNewParams struct {
+	Cwd        string   `json:"cwd"`
+	McpServers []string `json:"mcpServers"` // MVP: no MCP, send empty slice
+}
+
+type SessionNewResult struct {
+	SessionID string `json:"sessionId"`
+}
+
+// BuildSessionNewParams returns standard session/new params.
+func BuildSessionNewParams(cwd string) SessionNewParams {
+	return SessionNewParams{Cwd: cwd, McpServers: []string{}}
+}

internal/acp/handlers/handlers.go

@@ -0,0 +1,51 @@
+// Package handlers 实现 ACP method 的服务端处理器。
+//
+// 每个 file 一个具体 method handler，对应 spec §5.5：
+//   - server_fs_read.go    fs/read_text_file
+//   - server_fs_write.go   fs/write_text_file
+//   - server_permission.go session/request_permission（MVP 自动批/拒）
+//
+// client_*.go 是服务端 *发起* 请求的辅助 builder（initialize / session/new），
+// 不需要 Handle 接口，直接被 supervisor / relay 调用 NewClientInitializeRequest 等。
+package handlers
+
+import (
+	"encoding/json"
+
+	"github.com/google/uuid"
+)
+
+// SessionContext 是 handler 可见的 session 上下文（dirent 化 acp.Session 的需要字段）。
+// 避免 handlers 子包 import internal/acp 引发循环。
+type SessionContext struct {
+	SessionID      uuid.UUID
+	WorkspaceID    uuid.UUID
+	UserID         uuid.UUID
+	CwdPath        string
+	AgentSessionID *string // 可能 nil（handshake 未完成时不应触发 fs/* 但兜底）
+}
+
+// FsResult 是 fs/* method 处理后返回给 relay 的结果。要么 OK（带 result），
+// 要么 Err（带 jsonrpc 错误码）。
+type FsResult struct {
+	OK  json.RawMessage
+	Err *FsError
+}
+
+// FsError 是 jsonrpc 错误码（spec §5.4 定义 -32001 = path outside worktree）。
+type FsError struct {
+	Code    int
+	Message string
+}
+
+// FsHandler combines fs/* method handlers so Relay can hold one reference.
+type FsHandler struct {
+	Read  *FsReadHandler
+	Write *FsWriteHandler
+}
+
+// NewFsHandler constructs a composite FsHandler with default sub-handlers.
+func NewFsHandler() *FsHandler {
+	return &FsHandler{Read: NewFsReadHandler(), Write: NewFsWriteHandler()}
+}
+

internal/acp/handlers/server_fs_read.go

@@ -0,0 +1,108 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// FsReadHandler handles fs/read_text_file (spec §5.4).
+type FsReadHandler struct{}
+
+// NewFsReadHandler constructs an FsReadHandler.
+func NewFsReadHandler() *FsReadHandler { return &FsReadHandler{} }
+
+// fsReadParams is the ACP-protocol input for fs/read_text_file.
+type fsReadParams struct {
+	SessionID string `json:"sessionId"`
+	Path      string `json:"path"`
+	Line      *int   `json:"line,omitempty"`
+	Limit     *int   `json:"limit,omitempty"`
+}
+
+type fsReadResult struct {
+	Content string `json:"content"`
+}
+
+// Handle reads a file inside sess.CwdPath, returning content (with optional
+// line/limit slicing). Returns FsError for path-escape or read failure.
+func (h *FsReadHandler) Handle(_ context.Context, sess SessionContext, paramsJSON json.RawMessage) FsResult {
+	var p fsReadParams
+	if err := json.Unmarshal(paramsJSON, &p); err != nil {
+		return FsResult{Err: &FsError{Code: -32602, Message: "invalid params: " + err.Error()}}
+	}
+	abs, err := resolveSafePath(sess.CwdPath, p.Path)
+	if err != nil {
+		return FsResult{Err: &FsError{Code: -32001, Message: err.Error()}}
+	}
+	data, err := os.ReadFile(abs)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return FsResult{Err: &FsError{Code: -32603, Message: "file not found"}}
+		}
+		return FsResult{Err: &FsError{Code: -32603, Message: "read: " + err.Error()}}
+	}
+	content := string(data)
+	if p.Line != nil || p.Limit != nil {
+		content = sliceLines(content, p.Line, p.Limit)
+	}
+	out, _ := json.Marshal(fsReadResult{Content: content})
+	return FsResult{OK: out}
+}
+
+// sliceLines returns lines[line:line+limit] joined by "\n".
+// line is 0-based; limit caps the line count.
+func sliceLines(s string, line, limit *int) string {
+	lines := strings.Split(s, "\n")
+	start := 0
+	if line != nil && *line > 0 {
+		start = *line
+	}
+	if start > len(lines) {
+		start = len(lines)
+	}
+	end := len(lines)
+	if limit != nil && *limit >= 0 {
+		if start+*limit < end {
+			end = start + *limit
+		}
+	}
+	return strings.Join(lines[start:end], "\n")
+}
+
+// resolveSafePath duplicates the logic from internal/acp.ResolveSafePath to
+// avoid an import cycle (handlers is a sub-package and acp imports handlers).
+func resolveSafePath(cwd, requested string) (string, error) {
+	if !filepath.IsAbs(cwd) {
+		return "", fmt.Errorf("cwd must be absolute")
+	}
+	cleanCwd := filepath.Clean(cwd)
+	var abs string
+	if filepath.IsAbs(requested) {
+		abs = filepath.Clean(requested)
+	} else {
+		abs = filepath.Clean(filepath.Join(cleanCwd, requested))
+	}
+	if !hasPathPrefix(abs, cleanCwd) {
+		return "", fmt.Errorf("path outside worktree")
+	}
+	if real, err := filepath.EvalSymlinks(abs); err == nil {
+		if !hasPathPrefix(real, cleanCwd) {
+			return "", fmt.Errorf("path resolves outside worktree via symlink")
+		}
+	}
+	return abs, nil
+}
+
+func hasPathPrefix(abs, base string) bool {
+	if abs == base {
+		return true
+	}
+	sep := string(filepath.Separator)
+	return strings.HasPrefix(abs, base+sep)
+}

internal/acp/handlers/server_fs_read_test.go

@@ -0,0 +1,89 @@
+package handlers_test
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/yan1h/agent-coding-workflow/internal/acp/handlers"
+)
+
+func TestFsRead_HappyPath(t *testing.T) {
+	t.Parallel()
+	tmp := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(tmp, "a.txt"), []byte("hello\n"), 0o644))
+
+	h := handlers.NewFsReadHandler()
+	sess := handlers.SessionContext{SessionID: uuid.New(), CwdPath: tmp}
+	params := mustJSON(t, map[string]any{"sessionId": "x", "path": filepath.Join(tmp, "a.txt")})
+
+	res := h.Handle(context.Background(), sess, params)
+	require.Nil(t, res.Err)
+	require.NotNil(t, res.OK)
+	var out struct {
+		Content string `json:"content"`
+	}
+	require.NoError(t, json.Unmarshal(res.OK, &out))
+	assert.Equal(t, "hello\n", out.Content)
+}
+
+func TestFsRead_PathOutsideWorktree(t *testing.T) {
+	t.Parallel()
+	tmp := t.TempDir()
+	h := handlers.NewFsReadHandler()
+	sess := handlers.SessionContext{CwdPath: tmp}
+	outside := filepath.Join(filepath.VolumeName(tmp)+string(filepath.Separator), "etc", "passwd")
+	params := mustJSON(t, map[string]any{"sessionId": "x", "path": outside})
+
+	res := h.Handle(context.Background(), sess, params)
+	require.NotNil(t, res.Err)
+	assert.Equal(t, -32001, res.Err.Code)
+}
+
+func TestFsRead_FileNotFound(t *testing.T) {
+	t.Parallel()
+	tmp := t.TempDir()
+	h := handlers.NewFsReadHandler()
+	sess := handlers.SessionContext{CwdPath: tmp}
+	params := mustJSON(t, map[string]any{"sessionId": "x", "path": filepath.Join(tmp, "nope.txt")})
+
+	res := h.Handle(context.Background(), sess, params)
+	require.NotNil(t, res.Err)
+	assert.Equal(t, -32603, res.Err.Code)
+}
+
+func TestFsRead_LineLimit(t *testing.T) {
+	t.Parallel()
+	tmp := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(tmp, "f.txt"),
+		[]byte("L0\nL1\nL2\nL3\n"), 0o644))
+
+	h := handlers.NewFsReadHandler()
+	sess := handlers.SessionContext{CwdPath: tmp}
+	line := 1
+	limit := 2
+	params := mustJSON(t, map[string]any{
+		"sessionId": "x", "path": filepath.Join(tmp, "f.txt"),
+		"line": line, "limit": limit,
+	})
+	res := h.Handle(context.Background(), sess, params)
+	require.Nil(t, res.Err)
+	var out struct {
+		Content string `json:"content"`
+	}
+	_ = json.Unmarshal(res.OK, &out)
+	assert.Equal(t, "L1\nL2", out.Content)
+}
+
+func mustJSON(t *testing.T, v any) json.RawMessage {
+	t.Helper()
+	b, err := json.Marshal(v)
+	require.NoError(t, err)
+	return b
+}

internal/acp/handlers/server_fs_write.go

@@ -0,0 +1,40 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+)
+
+// FsWriteHandler handles fs/write_text_file (spec §5.4).
+type FsWriteHandler struct{}
+
+// NewFsWriteHandler constructs an FsWriteHandler.
+func NewFsWriteHandler() *FsWriteHandler { return &FsWriteHandler{} }
+
+type fsWriteParams struct {
+	SessionID string `json:"sessionId"`
+	Path      string `json:"path"`
+	Content   string `json:"content"`
+}
+
+// Handle writes a file inside sess.CwdPath, creating parent dirs as needed.
+// Returns FsError for path-escape or filesystem failure.
+func (h *FsWriteHandler) Handle(_ context.Context, sess SessionContext, paramsJSON json.RawMessage) FsResult {
+	var p fsWriteParams
+	if err := json.Unmarshal(paramsJSON, &p); err != nil {
+		return FsResult{Err: &FsError{Code: -32602, Message: "invalid params: " + err.Error()}}
+	}
+	abs, err := resolveSafePath(sess.CwdPath, p.Path)
+	if err != nil {
+		return FsResult{Err: &FsError{Code: -32001, Message: err.Error()}}
+	}
+	if err := os.MkdirAll(filepath.Dir(abs), 0o755); err != nil {
+		return FsResult{Err: &FsError{Code: -32603, Message: "mkdir: " + err.Error()}}
+	}
+	if err := os.WriteFile(abs, []byte(p.Content), 0o644); err != nil {
+		return FsResult{Err: &FsError{Code: -32603, Message: "write: " + err.Error()}}
+	}
+	return FsResult{OK: json.RawMessage(`{}`)}
+}

internal/acp/handlers/server_fs_write_test.go

@@ -0,0 +1,47 @@
+package handlers_test
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/yan1h/agent-coding-workflow/internal/acp/handlers"
+)
+
+func TestFsWrite_HappyPath(t *testing.T) {
+	t.Parallel()
+	tmp := t.TempDir()
+	h := handlers.NewFsWriteHandler()
+	sess := handlers.SessionContext{SessionID: uuid.New(), CwdPath: tmp}
+
+	target := filepath.Join(tmp, "newdir", "x.txt")
+	params := mustJSON(t, map[string]any{
+		"sessionId": "x", "path": target, "content": "hello",
+	})
+	res := h.Handle(context.Background(), sess, params)
+	require.Nil(t, res.Err)
+
+	got, err := os.ReadFile(target)
+	require.NoError(t, err)
+	assert.Equal(t, "hello", string(got))
+}
+
+func TestFsWrite_OutsideWorktree(t *testing.T) {
+	t.Parallel()
+	tmp := t.TempDir()
+	h := handlers.NewFsWriteHandler()
+	sess := handlers.SessionContext{CwdPath: tmp}
+
+	outside := filepath.Join(filepath.VolumeName(tmp)+string(filepath.Separator), "tmp", "escape.txt")
+	params := mustJSON(t, map[string]any{
+		"sessionId": "x", "path": outside, "content": "evil",
+	})
+	res := h.Handle(context.Background(), sess, params)
+	require.NotNil(t, res.Err)
+	assert.Equal(t, -32001, res.Err.Code)
+}

internal/acp/handlers/server_permission.go

@@ -0,0 +1,67 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+)
+
+// PermissionHandler handles session/request_permission (spec §5.1).
+//
+// MVP behaviour (decision §1 #8 + §10 misc #1): fs.* tool calls are answered
+// directly by the server (so they never reach this handler). Other tool calls
+// default to "reject_once" — fully automated, no human-in-the-loop.
+type PermissionHandler struct{}
+
+// NewPermissionHandler constructs a PermissionHandler.
+func NewPermissionHandler() *PermissionHandler { return &PermissionHandler{} }
+
+type permissionParams struct {
+	SessionID string          `json:"sessionId"`
+	ToolCall  json.RawMessage `json:"toolCall"`
+	Options   []permOption    `json:"options"`
+}
+
+type permOption struct {
+	ID   string `json:"id"`
+	Name string `json:"name,omitempty"`
+}
+
+type permOutcomeSelected struct {
+	ID string `json:"id"`
+}
+
+type permOutcome struct {
+	Selected *permOutcomeSelected `json:"selected,omitempty"`
+}
+
+type permResult struct {
+	Outcome permOutcome `json:"outcome"`
+}
+
+// Handle picks the first option whose ID looks like a "reject" choice; if none
+// matches, falls back to the first option. Aligns with spec §10 misc #4
+// ("default reject").
+func (h *PermissionHandler) Handle(_ context.Context, _ SessionContext, paramsJSON json.RawMessage) FsResult {
+	var p permissionParams
+	if err := json.Unmarshal(paramsJSON, &p); err != nil {
+		return FsResult{Err: &FsError{Code: -32602, Message: "invalid params: " + err.Error()}}
+	}
+	chosen := ""
+	for _, opt := range p.Options {
+		lc := strings.ToLower(opt.ID)
+		if strings.Contains(lc, "reject") || strings.Contains(lc, "deny") || strings.Contains(lc, "no") {
+			chosen = opt.ID
+			break
+		}
+	}
+	if chosen == "" && len(p.Options) > 0 {
+		chosen = p.Options[0].ID
+	}
+	if chosen == "" {
+		out, _ := json.Marshal(permResult{Outcome: permOutcome{}})
+		return FsResult{OK: out}
+	}
+	out, _ := json.Marshal(permResult{Outcome: permOutcome{Selected: &permOutcomeSelected{ID: chosen}}})
+	return FsResult{OK: out}
+}

internal/acp/handlers/server_permission_test.go

@@ -0,0 +1,68 @@
+package handlers_test
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/yan1h/agent-coding-workflow/internal/acp/handlers"
+)
+
+func TestPermission_AutoReject(t *testing.T) {
+	t.Parallel()
+	h := handlers.NewPermissionHandler()
+	params := mustJSON(t, map[string]any{
+		"sessionId": "x",
+		"toolCall":  map[string]any{"name": "shell.exec"},
+		"options": []any{
+			map[string]any{"id": "allow_once"},
+			map[string]any{"id": "reject_once"},
+		},
+	})
+	res := h.Handle(context.Background(), handlers.SessionContext{}, params)
+	require.Nil(t, res.Err)
+
+	var out struct {
+		Outcome struct {
+			Selected struct {
+				ID string `json:"id"`
+			} `json:"selected"`
+		} `json:"outcome"`
+	}
+	require.NoError(t, json.Unmarshal(res.OK, &out))
+	assert.Equal(t, "reject_once", out.Outcome.Selected.ID)
+}
+
+func TestPermission_NoRejectOption_FallbackFirst(t *testing.T) {
+	t.Parallel()
+	h := handlers.NewPermissionHandler()
+	params := mustJSON(t, map[string]any{
+		"sessionId": "x",
+		"options": []any{
+			map[string]any{"id": "allow_once"},
+			map[string]any{"id": "allow_session"},
+		},
+	})
+	res := h.Handle(context.Background(), handlers.SessionContext{}, params)
+	var out struct {
+		Outcome struct {
+			Selected struct {
+				ID string `json:"id"`
+			} `json:"selected"`
+		} `json:"outcome"`
+	}
+	require.NoError(t, json.Unmarshal(res.OK, &out))
+	assert.Equal(t, "allow_once", out.Outcome.Selected.ID)
+}
+
+func TestPermission_NoOptions_EmptyOutcome(t *testing.T) {
+	t.Parallel()
+	h := handlers.NewPermissionHandler()
+	params := mustJSON(t, map[string]any{"sessionId": "x"})
+	res := h.Handle(context.Background(), handlers.SessionContext{}, params)
+	require.Nil(t, res.Err)
+	assert.JSONEq(t, `{"outcome":{}}`, string(res.OK))
+}

internal/acp/jsonrpc.go

@@ -0,0 +1,201 @@
+// jsonrpc.go 实现 ACP 用到的最小 JSON-RPC 2.0 codec。spec §9.5 选定自写最小
+// 实现，理由：ACP 协议简单，无需引入完整 JSON-RPC 库。
+//
+// 关键设计：
+//   - id 类型同时支持 number(int64) 和 string（spec §5.2 命名空间约定）
+//   - DecodeMessage 返回统一 *Message，调用方按 IsRequest/IsResponse/IsNotification 分发
+//   - 单条消息长度上限：DefaultMaxMessageBytes（防 OOM）
+package acp
+
+import (
+	"bufio"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"sync"
+)
+
+// JSONRPC 错误码（标准 + ACP 自定义）
+const (
+	JSONRPCParseError     = -32700
+	JSONRPCInvalidRequest = -32600
+	JSONRPCMethodNotFound = -32601
+	JSONRPCInvalidParams  = -32602
+	JSONRPCInternalError  = -32603
+
+	// ACP 自定义（-32000 到 -32099 区间为 server 自定义）
+	ACPFsPathOutsideWorktree = -32001
+)
+
+// DefaultMaxMessageBytes 单条 JSON-RPC message 最大字节数（防 OOM）。
+const DefaultMaxMessageBytes = 8 * 1024 * 1024 // 8 MB
+
+// Message 是 JSON-RPC 2.0 envelope 统一表示。Request 含 ID + Method；
+// Notification 含 Method 但 ID = nil；Response 含 ID + (Result 或 Error)。
+type Message struct {
+	JSONRPC string          `json:"jsonrpc"`
+	ID      json.RawMessage `json:"id,omitempty"`
+	Method  string          `json:"method,omitempty"`
+	Params  json.RawMessage `json:"params,omitempty"`
+	Result  json.RawMessage `json:"result,omitempty"`
+	Error   *JSONRPCError   `json:"error,omitempty"`
+}
+
+// JSONRPCError 是 JSON-RPC 错误对象。
+type JSONRPCError struct {
+	Code    int             `json:"code"`
+	Message string          `json:"message"`
+	Data    json.RawMessage `json:"data,omitempty"`
+}
+
+func (e *JSONRPCError) Error() string {
+	return fmt.Sprintf("jsonrpc error %d: %s", e.Code, e.Message)
+}
+
+// IsRequest reports whether m is a request (has ID + Method).
+func (m *Message) IsRequest() bool {
+	return m.Method != "" && len(m.ID) > 0 && m.Result == nil && m.Error == nil
+}
+
+// IsNotification reports whether m is a notification (has Method but no ID).
+func (m *Message) IsNotification() bool {
+	return m.Method != "" && len(m.ID) == 0
+}
+
+// IsResponse reports whether m is a response (has ID, no Method).
+func (m *Message) IsResponse() bool {
+	return m.Method == "" && len(m.ID) > 0
+}
+
+// IDInt64 attempts to extract a numeric ID. Returns (n, true) if it's a JSON
+// number; (0, false) otherwise.
+func (m *Message) IDInt64() (int64, bool) {
+	if len(m.ID) == 0 {
+		return 0, false
+	}
+	var n int64
+	if err := json.Unmarshal(m.ID, &n); err == nil {
+		return n, true
+	}
+	return 0, false
+}
+
+// IDString attempts to extract a string ID.
+func (m *Message) IDString() (string, bool) {
+	if len(m.ID) == 0 {
+		return "", false
+	}
+	var s string
+	if err := json.Unmarshal(m.ID, &s); err == nil {
+		return s, true
+	}
+	return "", false
+}
+
+// Decoder reads newline-delimited JSON-RPC messages from a stream.
+type Decoder struct {
+	r       *bufio.Reader
+	maxSize int
+}
+
+// NewDecoder constructs a Decoder. maxSize <= 0 → DefaultMaxMessageBytes.
+func NewDecoder(r io.Reader, maxSize int) *Decoder {
+	if maxSize <= 0 {
+		maxSize = DefaultMaxMessageBytes
+	}
+	br := bufio.NewReaderSize(r, 64*1024)
+	return &Decoder{r: br, maxSize: maxSize}
+}
+
+// DecodeMessage reads one LF-delimited JSON message.
+func (d *Decoder) DecodeMessage() (*Message, error) {
+	line, err := d.r.ReadBytes('\n')
+	if err != nil {
+		if errors.Is(err, io.EOF) && len(line) == 0 {
+			return nil, io.EOF
+		}
+		if !errors.Is(err, io.EOF) {
+			return nil, err
+		}
+	}
+	if len(line) > d.maxSize {
+		return nil, fmt.Errorf("acp.jsonrpc: message exceeds max size %d", d.maxSize)
+	}
+	var m Message
+	if err := json.Unmarshal(line, &m); err != nil {
+		return nil, fmt.Errorf("acp.jsonrpc: parse: %w", err)
+	}
+	if m.JSONRPC != "2.0" {
+		return nil, fmt.Errorf("acp.jsonrpc: unsupported jsonrpc version %q", m.JSONRPC)
+	}
+	return &m, nil
+}
+
+// Encoder serializes Messages to a writer with LF separator.
+type Encoder struct {
+	w  io.Writer
+	mu sync.Mutex
+}
+
+// NewEncoder constructs an Encoder. Writes are mutex-protected so concurrent
+// callers (e.g. response handler + scheduled prompt) don't interleave bytes.
+func NewEncoder(w io.Writer) *Encoder {
+	return &Encoder{w: w}
+}
+
+// Encode marshals m as JSON and writes it followed by '\n'.
+func (e *Encoder) Encode(m *Message) error {
+	if m.JSONRPC == "" {
+		m.JSONRPC = "2.0"
+	}
+	b, err := json.Marshal(m)
+	if err != nil {
+		return fmt.Errorf("acp.jsonrpc: marshal: %w", err)
+	}
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	if _, err := e.w.Write(b); err != nil {
+		return err
+	}
+	if _, err := e.w.Write([]byte{'\n'}); err != nil {
+		return err
+	}
+	return nil
+}
+
+// NewRequestInt builds a Message with an integer id (server-initiated calls).
+func NewRequestInt(id int64, method string, params any) (*Message, error) {
+	idJSON, err := json.Marshal(id)
+	if err != nil {
+		return nil, err
+	}
+	pb, err := json.Marshal(params)
+	if err != nil {
+		return nil, err
+	}
+	return &Message{JSONRPC: "2.0", ID: idJSON, Method: method, Params: pb}, nil
+}
+
+// NewNotification builds a Message without id.
+func NewNotification(method string, params any) (*Message, error) {
+	pb, err := json.Marshal(params)
+	if err != nil {
+		return nil, err
+	}
+	return &Message{JSONRPC: "2.0", Method: method, Params: pb}, nil
+}
+
+// NewResponseOK builds a success response.
+func NewResponseOK(id json.RawMessage, result any) (*Message, error) {
+	rb, err := json.Marshal(result)
+	if err != nil {
+		return nil, err
+	}
+	return &Message{JSONRPC: "2.0", ID: id, Result: rb}, nil
+}
+
+// NewResponseErr builds an error response.
+func NewResponseErr(id json.RawMessage, code int, msg string) *Message {
+	return &Message{JSONRPC: "2.0", ID: id, Error: &JSONRPCError{Code: code, Message: msg}}
+}

internal/acp/jsonrpc_test.go

@@ -0,0 +1,156 @@
+package acp_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/yan1h/agent-coding-workflow/internal/acp"
+)
+
+func TestJSONRPC_RoundtripRequestNumberID(t *testing.T) {
+	t.Parallel()
+	req, err := acp.NewRequestInt(42, "session/prompt", map[string]any{"text": "hi"})
+	require.NoError(t, err)
+
+	var buf bytes.Buffer
+	require.NoError(t, acp.NewEncoder(&buf).Encode(req))
+
+	dec := acp.NewDecoder(&buf, 0)
+	msg, err := dec.DecodeMessage()
+	require.NoError(t, err)
+
+	assert.True(t, msg.IsRequest())
+	assert.Equal(t, "session/prompt", msg.Method)
+	id, ok := msg.IDInt64()
+	require.True(t, ok)
+	assert.Equal(t, int64(42), id)
+}
+
+func TestJSONRPC_RoundtripStringID(t *testing.T) {
+	t.Parallel()
+	idJSON, _ := json.Marshal("client-abc")
+	req := &acp.Message{JSONRPC: "2.0", ID: idJSON, Method: "session/prompt"}
+
+	var buf bytes.Buffer
+	require.NoError(t, acp.NewEncoder(&buf).Encode(req))
+
+	dec := acp.NewDecoder(&buf, 0)
+	msg, _ := dec.DecodeMessage()
+	s, ok := msg.IDString()
+	require.True(t, ok)
+	assert.Equal(t, "client-abc", s)
+
+	_, ok2 := msg.IDInt64()
+	assert.False(t, ok2)
+}
+
+func TestJSONRPC_Notification_NoID(t *testing.T) {
+	t.Parallel()
+	notif, _ := acp.NewNotification("session/update", map[string]string{"x": "y"})
+
+	var buf bytes.Buffer
+	require.NoError(t, acp.NewEncoder(&buf).Encode(notif))
+
+	msg, _ := acp.NewDecoder(&buf, 0).DecodeMessage()
+	assert.True(t, msg.IsNotification())
+	assert.False(t, msg.IsRequest())
+	assert.False(t, msg.IsResponse())
+}
+
+func TestJSONRPC_Response(t *testing.T) {
+	t.Parallel()
+	idJSON, _ := json.Marshal(int64(7))
+	resp, _ := acp.NewResponseOK(idJSON, map[string]string{"sessionId": "abc"})
+
+	var buf bytes.Buffer
+	require.NoError(t, acp.NewEncoder(&buf).Encode(resp))
+
+	msg, _ := acp.NewDecoder(&buf, 0).DecodeMessage()
+	assert.True(t, msg.IsResponse())
+
+	var result struct {
+		SessionID string `json:"sessionId"`
+	}
+	require.NoError(t, json.Unmarshal(msg.Result, &result))
+	assert.Equal(t, "abc", result.SessionID)
+}
+
+func TestJSONRPC_ErrorResponse(t *testing.T) {
+	t.Parallel()
+	idJSON, _ := json.Marshal("client-1")
+	resp := acp.NewResponseErr(idJSON, acp.JSONRPCMethodNotFound, "no such method")
+
+	var buf bytes.Buffer
+	require.NoError(t, acp.NewEncoder(&buf).Encode(resp))
+
+	msg, _ := acp.NewDecoder(&buf, 0).DecodeMessage()
+	require.NotNil(t, msg.Error)
+	assert.Equal(t, acp.JSONRPCMethodNotFound, msg.Error.Code)
+	assert.Equal(t, "no such method", msg.Error.Message)
+}
+
+func TestJSONRPC_DecoderEOF(t *testing.T) {
+	t.Parallel()
+	dec := acp.NewDecoder(bytes.NewReader(nil), 0)
+	_, err := dec.DecodeMessage()
+	assert.ErrorIs(t, err, io.EOF)
+}
+
+func TestJSONRPC_DecoderMaxSize(t *testing.T) {
+	t.Parallel()
+	huge := make([]byte, 200)
+	for i := range huge {
+		huge[i] = 'a'
+	}
+	body := []byte(`{"jsonrpc":"2.0","method":"x","params":"`)
+	body = append(body, huge...)
+	body = append(body, []byte(`"}`+"\n")...)
+
+	dec := acp.NewDecoder(bytes.NewReader(body), 100)
+	_, err := dec.DecodeMessage()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "exceeds max size")
+}
+
+func TestJSONRPC_DecoderBadJSON(t *testing.T) {
+	t.Parallel()
+	dec := acp.NewDecoder(bytes.NewReader([]byte("not-json\n")), 0)
+	_, err := dec.DecodeMessage()
+	require.Error(t, err)
+}
+
+func TestJSONRPC_EncoderConcurrentSafe(t *testing.T) {
+	t.Parallel()
+	var buf bytes.Buffer
+	enc := acp.NewEncoder(&buf)
+
+	const N = 100
+	done := make(chan struct{}, N)
+	for i := 0; i < N; i++ {
+		go func(id int64) {
+			req, _ := acp.NewRequestInt(id, "m", nil)
+			_ = enc.Encode(req)
+			done <- struct{}{}
+		}(int64(i))
+	}
+	for i := 0; i < N; i++ {
+		<-done
+	}
+
+	dec := acp.NewDecoder(&buf, 0)
+	count := 0
+	for {
+		_, err := dec.DecodeMessage()
+		if err == io.EOF {
+			break
+		}
+		require.NoError(t, err)
+		count++
+	}
+	assert.Equal(t, N, count)
+}

internal/acp/permission.go

@@ -0,0 +1,55 @@
+// permission.go 实现 ACP fs/* method 的路径安全校验。
+//
+// 规则（spec §5.6）：
+//   1. 路径必须以 cwd_path 为前缀（防 ../../etc/passwd）
+//   2. 解析 symlink 后的真实路径必须仍在 cwd_path 下（防 symlink 逃逸）
+//
+// 三重校验：filepath.Abs + strings.HasPrefix + filepath.EvalSymlinks。
+package acp
+
+import (
+	"path/filepath"
+	"strings"
+
+	"github.com/yan1h/agent-coding-workflow/internal/infra/errs"
+)
+
+// ResolveSafePath 校验 requested 是否安全（在 cwd 内）。
+// cwd 必须是绝对路径；requested 可以是绝对或相对（相对时基于 cwd 解析）。
+// 返回校验通过后的绝对路径（含 symlink 解析）；失败返回 CodeAcpFsPathOutsideWorktree。
+func ResolveSafePath(cwd, requested string) (string, error) {
+	if !filepath.IsAbs(cwd) {
+		return "", errs.New(errs.CodeAcpFsPathOutsideWorktree, "cwd must be absolute")
+	}
+	cleanCwd := filepath.Clean(cwd)
+
+	var abs string
+	if filepath.IsAbs(requested) {
+		abs = filepath.Clean(requested)
+	} else {
+		abs = filepath.Clean(filepath.Join(cleanCwd, requested))
+	}
+
+	if !hasPathPrefix(abs, cleanCwd) {
+		return "", errs.New(errs.CodeAcpFsPathOutsideWorktree, "path outside worktree")
+	}
+
+	real, err := filepath.EvalSymlinks(abs)
+	if err == nil {
+		if !hasPathPrefix(real, cleanCwd) {
+			return "", errs.New(errs.CodeAcpFsPathOutsideWorktree, "path resolves outside worktree via symlink")
+		}
+	}
+	return abs, nil
+}
+
+// hasPathPrefix reports whether abs is equal to base or under base. Trailing
+// separator handling is critical: we want "/foo/bar" to be inside "/foo" but
+// NOT inside "/fo".
+func hasPathPrefix(abs, base string) bool {
+	if abs == base {
+		return true
+	}
+	sep := string(filepath.Separator)
+	return strings.HasPrefix(abs, base+sep)
+}

internal/acp/permission_test.go

@@ -0,0 +1,105 @@
+package acp_test
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/yan1h/agent-coding-workflow/internal/acp"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/errs"
+)
+
+func TestResolveSafePath_InsideWorktree(t *testing.T) {
+	t.Parallel()
+	tmp := t.TempDir()
+
+	target := filepath.Join(tmp, "sub", "a.txt")
+	require.NoError(t, os.MkdirAll(filepath.Dir(target), 0o755))
+	require.NoError(t, os.WriteFile(target, []byte("x"), 0o644))
+
+	got, err := acp.ResolveSafePath(tmp, target)
+	require.NoError(t, err)
+	// EvalSymlinks may resolve macOS / temp paths via /private prefix; on
+	// Windows the path may be returned as-is. Compare via filepath.Clean.
+	assert.Equal(t, filepath.Clean(target), got)
+
+	got, err = acp.ResolveSafePath(tmp, "sub/a.txt")
+	require.NoError(t, err)
+	assert.Equal(t, filepath.Clean(target), got)
+}
+
+func TestResolveSafePath_AbsoluteOutside(t *testing.T) {
+	t.Parallel()
+	tmp := t.TempDir()
+
+	// On Windows /etc/passwd is interpreted relative to the current drive;
+	// use a guaranteed-outside path.
+	outsideAbs := filepath.Join(filepath.VolumeName(tmp)+string(filepath.Separator), "etc", "passwd")
+
+	_, err := acp.ResolveSafePath(tmp, outsideAbs)
+	ae, ok := errs.As(err)
+	require.True(t, ok)
+	assert.Equal(t, errs.CodeAcpFsPathOutsideWorktree, ae.Code)
+}
+
+func TestResolveSafePath_RelativeWithDotDot(t *testing.T) {
+	t.Parallel()
+	tmp := t.TempDir()
+
+	_, err := acp.ResolveSafePath(tmp, "../etc/passwd")
+	ae, ok := errs.As(err)
+	require.True(t, ok)
+	assert.Equal(t, errs.CodeAcpFsPathOutsideWorktree, ae.Code)
+}
+
+func TestResolveSafePath_PrefixSiblingTrap(t *testing.T) {
+	t.Parallel()
+	tmp := t.TempDir()
+	sibling := tmp + "_sibling"
+	require.NoError(t, os.MkdirAll(sibling, 0o755))
+	t.Cleanup(func() { _ = os.RemoveAll(sibling) })
+
+	_, err := acp.ResolveSafePath(tmp, sibling+string(filepath.Separator)+"file")
+	ae, ok := errs.As(err)
+	require.True(t, ok)
+	assert.Equal(t, errs.CodeAcpFsPathOutsideWorktree, ae.Code)
+}
+
+func TestResolveSafePath_SymlinkEscape(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("symlink test requires admin on Windows")
+	}
+	t.Parallel()
+	tmp := t.TempDir()
+	outside := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(outside, "secret"), []byte("s"), 0o644))
+
+	link := filepath.Join(tmp, "link-to-secret")
+	require.NoError(t, os.Symlink(filepath.Join(outside, "secret"), link))
+
+	_, err := acp.ResolveSafePath(tmp, link)
+	ae, ok := errs.As(err)
+	require.True(t, ok)
+	assert.Equal(t, errs.CodeAcpFsPathOutsideWorktree, ae.Code)
+}
+
+func TestResolveSafePath_NonexistentInsideOK(t *testing.T) {
+	t.Parallel()
+	tmp := t.TempDir()
+	want := filepath.Join(tmp, "newfile.txt")
+	got, err := acp.ResolveSafePath(tmp, want)
+	require.NoError(t, err)
+	assert.Equal(t, want, got)
+}
+
+func TestResolveSafePath_RelativeCwdRejected(t *testing.T) {
+	t.Parallel()
+	_, err := acp.ResolveSafePath("relative-cwd", "x")
+	ae, ok := errs.As(err)
+	require.True(t, ok)
+	assert.Equal(t, errs.CodeAcpFsPathOutsideWorktree, ae.Code)
+}

internal/acp/queries/agent_kinds.sql

@@ -0,0 +1,50 @@
+-- name: CreateAgentKind :one
+INSERT INTO acp_agent_kinds (
+  id, name, display_name, description, binary_path, args, encrypted_env, enabled, created_by
+) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+RETURNING id, name, display_name, description, binary_path, args, encrypted_env,
+          enabled, created_by, created_at, updated_at;
+
+-- name: GetAgentKindByID :one
+SELECT id, name, display_name, description, binary_path, args, encrypted_env,
+       enabled, created_by, created_at, updated_at
+FROM acp_agent_kinds
+WHERE id = $1;
+
+-- name: GetAgentKindByName :one
+SELECT id, name, display_name, description, binary_path, args, encrypted_env,
+       enabled, created_by, created_at, updated_at
+FROM acp_agent_kinds
+WHERE name = $1;
+
+-- name: ListAgentKinds :many
+SELECT id, name, display_name, description, binary_path, args, encrypted_env,
+       enabled, created_by, created_at, updated_at
+FROM acp_agent_kinds
+ORDER BY created_at DESC;
+
+-- name: ListEnabledAgentKinds :many
+SELECT id, name, display_name, description, binary_path, args, encrypted_env,
+       enabled, created_by, created_at, updated_at
+FROM acp_agent_kinds
+WHERE enabled = TRUE
+ORDER BY name ASC;
+
+-- name: UpdateAgentKind :one
+UPDATE acp_agent_kinds
+SET display_name  = $2,
+    description   = $3,
+    binary_path   = $4,
+    args          = $5,
+    encrypted_env = $6,
+    enabled       = $7,
+    updated_at    = now()
+WHERE id = $1
+RETURNING id, name, display_name, description, binary_path, args, encrypted_env,
+          enabled, created_by, created_at, updated_at;
+
+-- name: DeleteAgentKind :exec
+DELETE FROM acp_agent_kinds WHERE id = $1;
+
+-- name: CountAgentKindUsage :one
+SELECT COUNT(*) FROM acp_sessions WHERE agent_kind_id = $1;

internal/acp/queries/events.sql

@@ -0,0 +1,17 @@
+-- name: InsertEvent :one
+INSERT INTO acp_events (
+  session_id, direction, rpc_kind, method, payload, payload_size, truncated
+) VALUES ($1, $2, $3, $4, $5, $6, $7)
+RETURNING id, session_id, direction, rpc_kind, method, payload,
+          payload_size, truncated, created_at;
+
+-- name: ListEventsSince :many
+SELECT id, session_id, direction, rpc_kind, method, payload,
+       payload_size, truncated, created_at
+FROM acp_events
+WHERE session_id = $1 AND id > $2
+ORDER BY id ASC
+LIMIT $3;
+
+-- name: PurgeEventsBefore :execrows
+DELETE FROM acp_events WHERE created_at < $1;

internal/acp/queries/sessions.sql

@@ -0,0 +1,67 @@
+-- name: InsertSession :one
+INSERT INTO acp_sessions (
+  id, workspace_id, project_id, agent_kind_id, user_id,
+  issue_id, requirement_id, branch, cwd_path, is_main_worktree, status
+) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+RETURNING id, workspace_id, project_id, agent_kind_id, user_id,
+          issue_id, requirement_id, agent_session_id,
+          branch, cwd_path, is_main_worktree, status,
+          pid, exit_code, last_error, started_at, ended_at;
+
+-- name: GetSessionByID :one
+SELECT id, workspace_id, project_id, agent_kind_id, user_id,
+       issue_id, requirement_id, agent_session_id,
+       branch, cwd_path, is_main_worktree, status,
+       pid, exit_code, last_error, started_at, ended_at
+FROM acp_sessions
+WHERE id = $1;
+
+-- name: ListSessionsByUser :many
+SELECT id, workspace_id, project_id, agent_kind_id, user_id,
+       issue_id, requirement_id, agent_session_id,
+       branch, cwd_path, is_main_worktree, status,
+       pid, exit_code, last_error, started_at, ended_at
+FROM acp_sessions
+WHERE user_id = $1
+ORDER BY started_at DESC;
+
+-- name: ListAllSessions :many
+SELECT id, workspace_id, project_id, agent_kind_id, user_id,
+       issue_id, requirement_id, agent_session_id,
+       branch, cwd_path, is_main_worktree, status,
+       pid, exit_code, last_error, started_at, ended_at
+FROM acp_sessions
+ORDER BY started_at DESC;
+
+-- name: UpdateSessionRunning :exec
+UPDATE acp_sessions
+SET status = 'running', agent_session_id = $2, pid = $3
+WHERE id = $1;
+
+-- name: UpdateSessionFinished :exec
+UPDATE acp_sessions
+SET status = $2, exit_code = $3, last_error = $4, ended_at = now()
+WHERE id = $1;
+
+-- name: CountActiveSessions :one
+SELECT COUNT(*) FROM acp_sessions WHERE status IN ('starting', 'running');
+
+-- name: CountActiveSessionsByUser :one
+SELECT COUNT(*) FROM acp_sessions
+WHERE user_id = $1 AND status IN ('starting', 'running');
+
+-- name: ResetStuckSessionsOnRestart :many
+UPDATE acp_sessions
+SET status = 'crashed',
+    last_error = 'process_aborted_on_restart',
+    ended_at = now()
+WHERE status IN ('starting', 'running')
+RETURNING id, workspace_id, user_id, branch, agent_kind_id, is_main_worktree;
+
+-- name: ReleaseMainWorktree :execrows
+UPDATE workspaces SET active_main_session_id = NULL
+WHERE id = $1 AND active_main_session_id = $2;
+
+-- name: AcquireMainWorktree :execrows
+UPDATE workspaces SET active_main_session_id = $1
+WHERE id = $2 AND active_main_session_id IS NULL;

internal/acp/relay.go

@@ -0,0 +1,414 @@
+// relay.go 实现 ACP 双向 JSON-RPC 中继：
+//   - reader: 子进程 stdout → 解析 JSON-RPC → 落 events → fanout / handler dispatch
+//   - writer: 服务端发起 / WS 客户端透传 → 子进程 stdin
+//   - subscribers: 多 WS tab 共享 reader 的 fanout
+//
+// id 命名空间（spec §5.2 / §7.2）：
+//   - 服务端发起：int64（atomic 递增）
+//   - 客户端 WS 发起：string（前端自生成）
+//   - inflight 仅存 int64 → response chan；string id 的 response 当 event fanout
+package acp
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"sync"
+	"sync/atomic"
+
+	"github.com/google/uuid"
+
+	"github.com/yan1h/agent-coding-workflow/internal/acp/handlers"
+)
+
+// EventEnvelope 是推到 WS 的事件结构（与落库的 Event 字段同步，但带 ID 数值化方便 JSON）。
+type EventEnvelope struct {
+	ID        int64           `json:"id"`
+	Direction string          `json:"direction"`        // 'in' | 'out'
+	Kind      string          `json:"kind"`             // 'request'|'response'|'notification'|'error'|'session_terminated'|'slow_consumer_disconnect'
+	Method    string          `json:"method,omitempty"`
+	Payload   json.RawMessage `json:"payload"`
+	Truncated bool            `json:"truncated"`
+}
+
+// Subscriber 是单个 WS tab 的订阅句柄。
+type Subscriber struct {
+	ID     uuid.UUID
+	UserID uuid.UUID
+	Send   chan *EventEnvelope
+	closed atomic.Bool
+}
+
+// Relay 是单 session 的中继器。每个活跃 session 一个 Relay 实例。
+type Relay struct {
+	sessionID uuid.UUID
+
+	// 协议层
+	enc *Encoder
+	dec *Decoder
+
+	// 服务端发起请求等响应（id=int64）
+	inflight sync.Map // int64 → chan *Message
+	nextID   atomic.Int64
+
+	// WS subscribers（多 tab fanout）
+	subsMu sync.Mutex
+	subs   map[uuid.UUID]*Subscriber
+
+	// 写入路径
+	serverInitiated chan *Message // 服务端发起的 request/notification
+	clientInitiated chan *Message // WS 上行（已校验 method 白名单）
+
+	// 依赖
+	repo        Repository
+	fsHandler   *handlers.FsHandler
+	permHandler *handlers.PermissionHandler
+	log         *slog.Logger
+	cfg         RelayConfig
+
+	// 终止控制
+	closed atomic.Bool
+	done   chan struct{}
+}
+
+// RelayConfig 影响事件入库截断行为。
+type RelayConfig struct {
+	EventMaxPayload    int
+	EventTruncateField int
+	WSSendBuffer       int
+}
+
+// NewRelay 构造一个空 Relay；启动 goroutine 走 Run（D7 实现）。
+func NewRelay(sessionID uuid.UUID, dec *Decoder, enc *Encoder,
+	repo Repository, fs *handlers.FsHandler, perm *handlers.PermissionHandler,
+	cfg RelayConfig, log *slog.Logger) *Relay {
+	if log == nil {
+		log = slog.Default()
+	}
+	return &Relay{
+		sessionID:       sessionID,
+		enc:             enc,
+		dec:             dec,
+		subs:            map[uuid.UUID]*Subscriber{},
+		serverInitiated: make(chan *Message, 32),
+		clientInitiated: make(chan *Message, 32),
+		repo:            repo,
+		fsHandler:       fs,
+		permHandler:     perm,
+		log:             log,
+		cfg:             cfg,
+		done:            make(chan struct{}),
+	}
+}
+
+// Subscribe 注册一个 WS tab 订阅。
+func (r *Relay) Subscribe(userID uuid.UUID) *Subscriber {
+	sub := &Subscriber{
+		ID:     uuid.New(),
+		UserID: userID,
+		Send:   make(chan *EventEnvelope, r.cfg.WSSendBuffer),
+	}
+	r.subsMu.Lock()
+	r.subs[sub.ID] = sub
+	r.subsMu.Unlock()
+	return sub
+}
+
+// Unsubscribe 移除订阅；幂等。
+func (r *Relay) Unsubscribe(subID uuid.UUID) {
+	r.subsMu.Lock()
+	defer r.subsMu.Unlock()
+	if sub, ok := r.subs[subID]; ok {
+		if sub.closed.CompareAndSwap(false, true) {
+			close(sub.Send)
+		}
+		delete(r.subs, subID)
+	}
+}
+
+// fanout 把一条 envelope 推给所有 subscribers。慢消费者按 §7.6 自动断开。
+func (r *Relay) fanout(env *EventEnvelope) {
+	r.subsMu.Lock()
+	defer r.subsMu.Unlock()
+	for id, sub := range r.subs {
+		select {
+		case sub.Send <- env:
+		default:
+			// buffer 满 → 慢消费者，标 closed + 通知 + close channel
+			if sub.closed.CompareAndSwap(false, true) {
+				disc := &EventEnvelope{Kind: "slow_consumer_disconnect"}
+				select {
+				case sub.Send <- disc:
+				default:
+				}
+				close(sub.Send)
+				delete(r.subs, id)
+				r.log.Warn("acp.relay.slow_subscriber_dropped",
+					"session_id", r.sessionID, "sub_id", id)
+			}
+		}
+	}
+}
+
+// Close 优雅关闭：先广播 final event，再关 channel，再标 closed。
+// supervisor.onExit 调用，确保所有 WS 看到 session_terminated。
+func (r *Relay) Close(status string, exitCode *int32) {
+	if !r.closed.CompareAndSwap(false, true) {
+		return
+	}
+	final := &EventEnvelope{
+		Kind: "session_terminated",
+		Payload: mustJSON(map[string]any{
+			"status":    status,
+			"exit_code": exitCode,
+		}),
+	}
+	r.fanout(final)
+
+	r.subsMu.Lock()
+	for id, sub := range r.subs {
+		if sub.closed.CompareAndSwap(false, true) {
+			close(sub.Send)
+		}
+		delete(r.subs, id)
+	}
+	r.subsMu.Unlock()
+
+	close(r.done)
+}
+
+// Done returns a channel closed when Relay is terminated.
+func (r *Relay) Done() <-chan struct{} { return r.done }
+
+func mustJSON(v any) json.RawMessage {
+	b, err := json.Marshal(v)
+	if err != nil {
+		return json.RawMessage(fmt.Sprintf(`{"_marshal_err":%q}`, err.Error()))
+	}
+	return b
+}
+
+// Run is the relay main loop; supervisor.Spawn calls it in a goroutine.
+// It launches the reader and writer goroutines and waits for both.
+func (r *Relay) Run(ctx context.Context, sess handlers.SessionContext) {
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() { defer wg.Done(); r.reader(ctx, sess) }()
+	go func() { defer wg.Done(); r.writer(ctx) }()
+	wg.Wait()
+}
+
+func (r *Relay) reader(ctx context.Context, sess handlers.SessionContext) {
+	for {
+		msg, err := r.dec.DecodeMessage()
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				r.log.Info("acp.relay.eof", "session_id", r.sessionID)
+				return
+			}
+			r.log.Error("acp.relay.decode", "session_id", r.sessionID, "err", err.Error())
+			return
+		}
+
+		envelope := r.persistAndEnvelope(ctx, msg, "out")
+		if envelope != nil {
+			r.fanout(envelope)
+		}
+
+		switch {
+		case msg.IsResponse():
+			if id, ok := msg.IDInt64(); ok {
+				if ch, hit := r.inflight.LoadAndDelete(id); hit {
+					ch.(chan *Message) <- msg
+				} else {
+					r.log.Warn("acp.relay.orphan_response", "session_id", r.sessionID, "id", id)
+				}
+			}
+			// String IDs go to clients via fanout (handled above); no server action.
+		case msg.IsNotification():
+			// Already persisted + fanout'd. No reply.
+		case msg.IsRequest():
+			go r.handleAgentRequest(ctx, sess, msg)
+		}
+	}
+}
+
+// handleAgentRequest dispatches an agent → server request to the appropriate handler.
+func (r *Relay) handleAgentRequest(ctx context.Context, sess handlers.SessionContext, req *Message) {
+	var resp *Message
+	switch req.Method {
+	case "fs/read_text_file":
+		out := r.fsHandler.Read.Handle(ctx, sess, req.Params)
+		resp = r.fsResultToResponse(req.ID, out)
+	case "fs/write_text_file":
+		out := r.fsHandler.Write.Handle(ctx, sess, req.Params)
+		resp = r.fsResultToResponse(req.ID, out)
+	case "session/request_permission":
+		out := r.permHandler.Handle(ctx, sess, req.Params)
+		resp = r.fsResultToResponse(req.ID, out)
+	default:
+		resp = NewResponseErr(req.ID, JSONRPCMethodNotFound, "method not implemented: "+req.Method)
+	}
+	select {
+	case r.serverInitiated <- resp:
+	case <-ctx.Done():
+	}
+}
+
+func (r *Relay) fsResultToResponse(id json.RawMessage, res handlers.FsResult) *Message {
+	if res.Err != nil {
+		return NewResponseErr(id, res.Err.Code, res.Err.Message)
+	}
+	return &Message{JSONRPC: "2.0", ID: id, Result: res.OK}
+}
+
+func (r *Relay) writer(ctx context.Context) {
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-r.done:
+			return
+		case msg := <-r.serverInitiated:
+			r.persistAndEnvelope(ctx, msg, "in")
+			if err := r.enc.Encode(msg); err != nil {
+				r.log.Error("acp.relay.encode", "session_id", r.sessionID, "err", err.Error())
+				return
+			}
+		case msg := <-r.clientInitiated:
+			r.persistAndEnvelope(ctx, msg, "in")
+			if err := r.enc.Encode(msg); err != nil {
+				r.log.Error("acp.relay.encode", "session_id", r.sessionID, "err", err.Error())
+				return
+			}
+		}
+	}
+}
+
+// SendClient is the WS handler entry point for forwarding prompt/cancel from a tab.
+func (r *Relay) SendClient(msg *Message) error {
+	if r.closed.Load() {
+		return fmt.Errorf("relay closed")
+	}
+	select {
+	case r.clientInitiated <- msg:
+		return nil
+	default:
+		return fmt.Errorf("relay client channel full")
+	}
+}
+
+// Call performs a server-initiated request and waits for the response (e.g.
+// initialize / session/new). Used by supervisor during handshake.
+func (r *Relay) Call(ctx context.Context, method string, params any) (*Message, error) {
+	id := r.nextID.Add(1)
+	req, err := NewRequestInt(id, method, params)
+	if err != nil {
+		return nil, err
+	}
+	ch := make(chan *Message, 1)
+	r.inflight.Store(id, ch)
+	defer r.inflight.Delete(id)
+
+	select {
+	case r.serverInitiated <- req:
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+
+	select {
+	case resp := <-ch:
+		if resp.Error != nil {
+			return resp, resp.Error
+		}
+		return resp, nil
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
+
+// persistAndEnvelope writes one event to the repo and returns the envelope for
+// fanout. Returns nil if the write fails (logged).
+func (r *Relay) persistAndEnvelope(ctx context.Context, msg *Message, direction string) *EventEnvelope {
+	rpcKind := classifyKind(msg)
+	method := msg.Method
+	payload, _ := json.Marshal(msg)
+
+	origSize := len(payload)
+	truncated := false
+	if origSize > r.cfg.EventMaxPayload {
+		payload, truncated = truncateLargeFields(msg, r.cfg.EventTruncateField, r.cfg.EventMaxPayload)
+	}
+
+	ev, err := r.repo.InsertEvent(ctx, &Event{
+		SessionID:   r.sessionID,
+		Direction:   EventDirection(direction),
+		RPCKind:     RPCKind(rpcKind),
+		Method:      ptrIfNotEmpty(method),
+		Payload:     payload,
+		PayloadSize: int32(origSize),
+		Truncated:   truncated,
+	})
+	if err != nil {
+		r.log.Error("acp.relay.persist_event", "session_id", r.sessionID, "err", err.Error())
+		return nil
+	}
+	return &EventEnvelope{
+		ID:        ev.ID,
+		Direction: direction,
+		Kind:      rpcKind,
+		Method:    method,
+		Payload:   payload,
+		Truncated: truncated,
+	}
+}
+
+func classifyKind(m *Message) string {
+	switch {
+	case m.IsRequest():
+		return string(RPCRequest)
+	case m.IsNotification():
+		return string(RPCNotification)
+	case m.IsResponse():
+		if m.Error != nil {
+			return string(RPCError)
+		}
+		return string(RPCResponse)
+	}
+	return "unknown"
+}
+
+func ptrIfNotEmpty(s string) *string {
+	if s == "" {
+		return nil
+	}
+	return &s
+}
+
+// truncateLargeFields replaces an oversize payload with a placeholder summary.
+// Spec §3.5. MVP: full-payload truncate (don't try to be clever about which
+// field is large — agents may put data in many places).
+func truncateLargeFields(m *Message, fieldMax, totalMax int) ([]byte, bool) {
+	original, _ := json.Marshal(m)
+	if len(original) <= totalMax {
+		return original, false
+	}
+	hash := simpleSHA256Hex(original)
+	placeholder := fmt.Sprintf("%s... [TRUNCATED size=%d sha256=%s]",
+		string(original[:fieldMax]), len(original), hash)
+	out, _ := json.Marshal(map[string]any{
+		"_truncated_payload": placeholder,
+		"_method":            m.Method,
+	})
+	return out, true
+}
+
+func simpleSHA256Hex(b []byte) string {
+	h := sha256.Sum256(b)
+	return hex.EncodeToString(h[:])
+}

internal/acp/relay_test.go

@@ -0,0 +1,428 @@
+// relay_test.go: integration tests for relay.go using io.Pipe pairs to
+// simulate the agent subprocess (no real exec). Tests cover:
+//   - Server-initiated Call round-trip (int id) + event persistence
+//   - Notification fanout to subscribers
+//   - Agent-initiated fs/read_text_file dispatched to real FsHandler
+//   - Slow subscriber gets disconnected with final envelope
+package acp_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/yan1h/agent-coding-workflow/internal/acp"
+	"github.com/yan1h/agent-coding-workflow/internal/acp/handlers"
+)
+
+// fakeEventRepo only implements InsertEvent meaningfully; everything else
+// panics. Sufficient for relay tests, which only exercise event persistence.
+type fakeEventRepo struct {
+	mu     sync.Mutex
+	events []*acp.Event
+}
+
+func (f *fakeEventRepo) InsertEvent(_ context.Context, e *acp.Event) (*acp.Event, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	cp := *e
+	cp.ID = int64(len(f.events) + 1)
+	cp.CreatedAt = time.Now()
+	f.events = append(f.events, &cp)
+	out := cp
+	return &out, nil
+}
+
+func (f *fakeEventRepo) snapshot() []*acp.Event {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	out := make([]*acp.Event, len(f.events))
+	copy(out, f.events)
+	return out
+}
+
+// All other Repository methods panic — relay tests must not exercise them.
+func (f *fakeEventRepo) CreateAgentKind(context.Context, *acp.AgentKind) (*acp.AgentKind, error) {
+	panic("n/a")
+}
+func (f *fakeEventRepo) GetAgentKindByID(context.Context, uuid.UUID) (*acp.AgentKind, error) {
+	panic("n/a")
+}
+func (f *fakeEventRepo) GetAgentKindByName(context.Context, string) (*acp.AgentKind, error) {
+	panic("n/a")
+}
+func (f *fakeEventRepo) ListAgentKinds(context.Context) ([]*acp.AgentKind, error) {
+	panic("n/a")
+}
+func (f *fakeEventRepo) ListEnabledAgentKinds(context.Context) ([]*acp.AgentKind, error) {
+	panic("n/a")
+}
+func (f *fakeEventRepo) UpdateAgentKind(context.Context, *acp.AgentKind) (*acp.AgentKind, error) {
+	panic("n/a")
+}
+func (f *fakeEventRepo) DeleteAgentKind(context.Context, uuid.UUID) error          { panic("n/a") }
+func (f *fakeEventRepo) CountAgentKindUsage(context.Context, uuid.UUID) (int64, error) {
+	panic("n/a")
+}
+func (f *fakeEventRepo) InsertSession(context.Context, *acp.Session) (*acp.Session, error) {
+	panic("n/a")
+}
+func (f *fakeEventRepo) GetSessionByID(context.Context, uuid.UUID) (*acp.Session, error) {
+	panic("n/a")
+}
+func (f *fakeEventRepo) ListSessionsByUser(context.Context, uuid.UUID) ([]*acp.Session, error) {
+	panic("n/a")
+}
+func (f *fakeEventRepo) ListAllSessions(context.Context) ([]*acp.Session, error) {
+	panic("n/a")
+}
+func (f *fakeEventRepo) UpdateSessionRunning(context.Context, uuid.UUID, string, int32) error {
+	panic("n/a")
+}
+func (f *fakeEventRepo) UpdateSessionFinished(context.Context, uuid.UUID, acp.SessionStatus, *int32, *string) error {
+	panic("n/a")
+}
+func (f *fakeEventRepo) CountActiveSessions(context.Context) (int64, error) { panic("n/a") }
+func (f *fakeEventRepo) CountActiveSessionsByUser(context.Context, uuid.UUID) (int64, error) {
+	panic("n/a")
+}
+func (f *fakeEventRepo) ResetStuckSessionsOnRestart(context.Context) ([]*acp.Session, error) {
+	panic("n/a")
+}
+func (f *fakeEventRepo) AcquireMainWorktree(context.Context, uuid.UUID, uuid.UUID) (bool, error) {
+	panic("n/a")
+}
+func (f *fakeEventRepo) ReleaseMainWorktree(context.Context, uuid.UUID, uuid.UUID) (bool, error) {
+	panic("n/a")
+}
+func (f *fakeEventRepo) ListEventsSince(context.Context, uuid.UUID, int64, int32) ([]*acp.Event, error) {
+	panic("n/a")
+}
+func (f *fakeEventRepo) PurgeEventsBefore(context.Context, time.Time) (int64, error) {
+	panic("n/a")
+}
+
+// relayTestRig wires up a Relay with two io.Pipe pairs that simulate the agent
+// subprocess. Returns:
+//   - r:           the relay under test
+//   - agentWriter: an io.WriteCloser the test "agent" writes to (relay reads from)
+//   - agentReader: an io.ReadCloser the test "agent" reads from (relay writes to)
+//   - repo:        the shared event store
+//   - sess:        a SessionContext suitable for fs/perm dispatch
+type relayTestRig struct {
+	r           *acp.Relay
+	agentWriter io.WriteCloser
+	agentReader io.ReadCloser
+	repo        *fakeEventRepo
+	sess        handlers.SessionContext
+	// keep references so the helper test can close them
+	relayStdinR io.ReadCloser
+	relayStdinW io.WriteCloser
+}
+
+func newRelayTestRig(t *testing.T) *relayTestRig {
+	t.Helper()
+
+	// relay → agent: relay encodes to relayStdinW, agent reads from relayStdinR
+	relayStdinR, relayStdinW := io.Pipe()
+	// agent → relay: agent writes to agentStdoutW, relay decodes from agentStdoutR
+	agentStdoutR, agentStdoutW := io.Pipe()
+
+	repo := &fakeEventRepo{}
+	fs := handlers.NewFsHandler()
+	perm := handlers.NewPermissionHandler()
+
+	cwd := t.TempDir()
+	sess := handlers.SessionContext{
+		SessionID:   uuid.New(),
+		WorkspaceID: uuid.New(),
+		UserID:      uuid.New(),
+		CwdPath:     cwd,
+	}
+
+	r := acp.NewRelay(
+		sess.SessionID,
+		acp.NewDecoder(agentStdoutR, 0),
+		acp.NewEncoder(relayStdinW),
+		repo, fs, perm,
+		acp.RelayConfig{EventMaxPayload: 65536, EventTruncateField: 4096, WSSendBuffer: 16},
+		nil,
+	)
+	return &relayTestRig{
+		r:           r,
+		agentWriter: agentStdoutW,
+		agentReader: relayStdinR,
+		repo:        repo,
+		sess:        sess,
+		relayStdinR: relayStdinR,
+		relayStdinW: relayStdinW,
+	}
+}
+
+// runRelay starts r.Run in a goroutine and returns a cancel func + done chan.
+// The caller must invoke cancel() and wait on doneCh in test cleanup.
+func (rig *relayTestRig) runRelay(t *testing.T) (cancel context.CancelFunc, doneCh <-chan struct{}) {
+	t.Helper()
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() {
+		rig.r.Run(ctx, rig.sess)
+		close(done)
+	}()
+	return cancel, done
+}
+
+// shutdown closes the agent-side pipes (causing relay reader to EOF) and waits
+// for Run to return. Called via t.Cleanup.
+func (rig *relayTestRig) shutdown(t *testing.T, cancel context.CancelFunc, doneCh <-chan struct{}) {
+	t.Helper()
+	// Close agent → relay so reader sees EOF.
+	_ = rig.agentWriter.Close()
+	cancel()
+	// Drain the relay → agent pipe so writer never blocks.
+	_ = rig.agentReader.Close()
+	select {
+	case <-doneCh:
+	case <-time.After(3 * time.Second):
+		t.Log("relay.Run did not return within 3s of shutdown")
+	}
+}
+
+// ---------- Test 1 ----------
+
+func TestRelay_Call_RoundTripIntID(t *testing.T) {
+	t.Parallel()
+	rig := newRelayTestRig(t)
+	cancel, doneCh := rig.runRelay(t)
+	t.Cleanup(func() { rig.shutdown(t, cancel, doneCh) })
+
+	// Goroutine "agent": decode the request from relay's writer side, emit a
+	// matching response.
+	agentDec := acp.NewDecoder(rig.agentReader, 0)
+	agentEnc := acp.NewEncoder(rig.agentWriter)
+	agentDone := make(chan error, 1)
+	go func() {
+		req, err := agentDec.DecodeMessage()
+		if err != nil {
+			agentDone <- err
+			return
+		}
+		if !req.IsRequest() || req.Method != "initialize" {
+			agentDone <- errors.New("expected initialize request")
+			return
+		}
+		resp, err := acp.NewResponseOK(req.ID, map[string]any{"protocolVersion": 1})
+		if err != nil {
+			agentDone <- err
+			return
+		}
+		agentDone <- agentEnc.Encode(resp)
+	}()
+
+	ctx, cancelCall := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancelCall()
+	resp, err := rig.r.Call(ctx, "initialize", map[string]any{"protocolVersion": 1})
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.True(t, resp.IsResponse())
+
+	var result struct {
+		ProtocolVersion int `json:"protocolVersion"`
+	}
+	require.NoError(t, json.Unmarshal(resp.Result, &result))
+	assert.Equal(t, 1, result.ProtocolVersion)
+
+	// Confirm agent goroutine finished cleanly.
+	select {
+	case err := <-agentDone:
+		require.NoError(t, err)
+	case <-time.After(2 * time.Second):
+		t.Fatal("agent goroutine did not finish in time")
+	}
+
+	// Both directions must have been persisted: outgoing request + incoming
+	// response. Check repo accumulator.
+	require.Eventually(t, func() bool {
+		return len(rig.repo.snapshot()) >= 2
+	}, 2*time.Second, 10*time.Millisecond, "expected at least 2 events persisted")
+
+	events := rig.repo.snapshot()
+	var sawReqIn, sawRespOut bool
+	for _, ev := range events {
+		switch {
+		case ev.Direction == acp.DirectionIn && ev.RPCKind == acp.RPCRequest:
+			sawReqIn = true
+		case ev.Direction == acp.DirectionOut && ev.RPCKind == acp.RPCResponse:
+			sawRespOut = true
+		}
+	}
+	assert.True(t, sawReqIn, "expected request event with direction=in")
+	assert.True(t, sawRespOut, "expected response event with direction=out")
+}
+
+// ---------- Test 2 ----------
+
+func TestRelay_FanoutToSubscribers(t *testing.T) {
+	t.Parallel()
+	rig := newRelayTestRig(t)
+	cancel, doneCh := rig.runRelay(t)
+	t.Cleanup(func() { rig.shutdown(t, cancel, doneCh) })
+
+	sub := rig.r.Subscribe(rig.sess.UserID)
+	require.NotNil(t, sub)
+	t.Cleanup(func() { rig.r.Unsubscribe(sub.ID) })
+
+	agentEnc := acp.NewEncoder(rig.agentWriter)
+	notif, err := acp.NewNotification("session/update", map[string]any{
+		"sessionId": "agent-sess-1",
+		"update":    map[string]any{"kind": "agent_message_chunk"},
+	})
+	require.NoError(t, err)
+	require.NoError(t, agentEnc.Encode(notif))
+
+	select {
+	case env, ok := <-sub.Send:
+		require.True(t, ok, "subscriber channel closed unexpectedly")
+		require.NotNil(t, env)
+		assert.Equal(t, "out", env.Direction)
+		assert.Equal(t, "session/update", env.Method)
+		assert.Equal(t, string(acp.RPCNotification), env.Kind)
+	case <-time.After(3 * time.Second):
+		t.Fatal("did not receive notification envelope within 3s")
+	}
+}
+
+// ---------- Test 3 ----------
+
+func TestRelay_AgentFsRequest_Echoed(t *testing.T) {
+	t.Parallel()
+	rig := newRelayTestRig(t)
+	cancel, doneCh := rig.runRelay(t)
+	t.Cleanup(func() { rig.shutdown(t, cancel, doneCh) })
+
+	// Seed file inside the session cwd.
+	fpath := filepath.Join(rig.sess.CwdPath, "x.txt")
+	require.NoError(t, os.WriteFile(fpath, []byte("x"), 0o644))
+
+	// Agent encoder/decoder for the subprocess side.
+	agentDec := acp.NewDecoder(rig.agentReader, 0)
+	agentEnc := acp.NewEncoder(rig.agentWriter)
+
+	// Agent sends fs/read_text_file with int ID.
+	req, err := acp.NewRequestInt(101, "fs/read_text_file", map[string]any{
+		"path":      "x.txt",
+		"sessionId": "agent-sess-1",
+	})
+	require.NoError(t, err)
+	require.NoError(t, agentEnc.Encode(req))
+
+	// Read the relay's response from the agent-side reader.
+	respCh := make(chan *acp.Message, 1)
+	errCh := make(chan error, 1)
+	go func() {
+		m, err := agentDec.DecodeMessage()
+		if err != nil {
+			errCh <- err
+			return
+		}
+		respCh <- m
+	}()
+
+	select {
+	case resp := <-respCh:
+		require.True(t, resp.IsResponse(), "expected response from relay")
+		require.Nil(t, resp.Error, "expected non-error response, got %+v", resp.Error)
+
+		var result struct {
+			Content string `json:"content"`
+		}
+		require.NoError(t, json.Unmarshal(resp.Result, &result))
+		assert.Equal(t, "x", result.Content)
+	case err := <-errCh:
+		if !errors.Is(err, io.EOF) {
+			t.Fatalf("agent decoder error: %v", err)
+		}
+		t.Fatal("agent saw EOF before relay responded")
+	case <-time.After(3 * time.Second):
+		t.Fatal("relay did not respond to fs/read_text_file within 3s")
+	}
+}
+
+// ---------- Test 4 ----------
+
+func TestRelay_SlowSubscriberDropped(t *testing.T) {
+	t.Parallel()
+	rig := newRelayTestRig(t)
+	cancel, doneCh := rig.runRelay(t)
+	t.Cleanup(func() { rig.shutdown(t, cancel, doneCh) })
+
+	sub := rig.r.Subscribe(rig.sess.UserID)
+	require.NotNil(t, sub)
+
+	// Flood ~100 notifications from agent without reading sub.Send. The fanout
+	// loop will eventually see sub.Send full (cap = WSSendBuffer = 16), enter
+	// the slow-consumer branch, attempt to push a slow_consumer_disconnect
+	// envelope (best-effort: select-default may drop it if buffer is still
+	// full), and close the channel. Either outcome (final disc envelope or
+	// closed channel) signals "subscriber dropped".
+	agentEnc := acp.NewEncoder(rig.agentWriter)
+	floodDone := make(chan struct{})
+	go func() {
+		defer close(floodDone)
+		for i := 0; i < 100; i++ {
+			notif, err := acp.NewNotification("session/update", map[string]any{
+				"seq": i,
+			})
+			if err != nil {
+				return
+			}
+			if err := agentEnc.Encode(notif); err != nil {
+				return
+			}
+		}
+	}()
+
+	// Wait for the flood to complete (relay drains the pipe) before draining
+	// sub.Send, otherwise the test would race and prevent the buffer from
+	// filling up.
+	select {
+	case <-floodDone:
+	case <-time.After(3 * time.Second):
+		t.Fatal("flood did not complete within 3s; relay reader stalled?")
+	}
+
+	// Now drain sub.Send. Either we see slow_consumer_disconnect, or the
+	// channel was closed. We must observe at least one of these within 3s.
+	deadline := time.NewTimer(3 * time.Second)
+	defer deadline.Stop()
+
+	var sawSlowDisc, sawClose bool
+drain:
+	for {
+		select {
+		case env, ok := <-sub.Send:
+			if !ok {
+				sawClose = true
+				break drain
+			}
+			if env != nil && env.Kind == "slow_consumer_disconnect" {
+				sawSlowDisc = true
+				// Keep draining until close (or we'll hit the deadline).
+			}
+		case <-deadline.C:
+			t.Fatal("subscriber not dropped within 3s")
+		}
+	}
+	assert.True(t, sawSlowDisc || sawClose,
+		"expected slow_consumer_disconnect envelope or closed channel after flood")
+}

internal/acp/repository.go

@@ -0,0 +1,436 @@
+package acp
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgerrcode"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"github.com/jackc/pgx/v5/pgtype"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	acpsqlc "github.com/yan1h/agent-coding-workflow/internal/acp/sqlc"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/errs"
+)
+
+// Repository 是 acp 模块对 PG 的全部依赖。Service 单测通过手写 fakeRepo 满足。
+type Repository interface {
+	// AgentKind
+	CreateAgentKind(ctx context.Context, k *AgentKind) (*AgentKind, error)
+	GetAgentKindByID(ctx context.Context, id uuid.UUID) (*AgentKind, error)
+	GetAgentKindByName(ctx context.Context, name string) (*AgentKind, error)
+	ListAgentKinds(ctx context.Context) ([]*AgentKind, error)
+	ListEnabledAgentKinds(ctx context.Context) ([]*AgentKind, error)
+	UpdateAgentKind(ctx context.Context, k *AgentKind) (*AgentKind, error)
+	DeleteAgentKind(ctx context.Context, id uuid.UUID) error
+	CountAgentKindUsage(ctx context.Context, id uuid.UUID) (int64, error)
+
+	// Session
+	InsertSession(ctx context.Context, s *Session) (*Session, error)
+	GetSessionByID(ctx context.Context, id uuid.UUID) (*Session, error)
+	ListSessionsByUser(ctx context.Context, userID uuid.UUID) ([]*Session, error)
+	ListAllSessions(ctx context.Context) ([]*Session, error)
+	UpdateSessionRunning(ctx context.Context, id uuid.UUID, agentSessionID string, pid int32) error
+	UpdateSessionFinished(ctx context.Context, id uuid.UUID, status SessionStatus, exitCode *int32, lastErr *string) error
+	CountActiveSessions(ctx context.Context) (int64, error)
+	CountActiveSessionsByUser(ctx context.Context, userID uuid.UUID) (int64, error)
+	ResetStuckSessionsOnRestart(ctx context.Context) ([]*Session, error)
+
+	// Worktree mutex（main worktree 专用）
+	AcquireMainWorktree(ctx context.Context, sessionID, workspaceID uuid.UUID) (bool, error)
+	ReleaseMainWorktree(ctx context.Context, workspaceID, sessionID uuid.UUID) (bool, error)
+
+	// Event
+	InsertEvent(ctx context.Context, e *Event) (*Event, error)
+	ListEventsSince(ctx context.Context, sessionID uuid.UUID, sinceID int64, limit int32) ([]*Event, error)
+	PurgeEventsBefore(ctx context.Context, before time.Time) (int64, error)
+}
+
+// IsUniqueViolation reports whether err is a PG unique constraint violation
+// (used by service layer to translate to a 409 if needed).
+func IsUniqueViolation(err error) bool {
+	var pg *pgconn.PgError
+	return errors.As(err, &pg) && pg.Code == pgerrcode.UniqueViolation
+}
+
+// IsForeignKeyViolation reports whether err is a PG FK violation. ACP uses
+// this when delete is rejected because acp_sessions still references the
+// agent_kind (ON DELETE RESTRICT triggers).
+func IsForeignKeyViolation(err error) bool {
+	var pg *pgconn.PgError
+	return errors.As(err, &pg) && pg.Code == pgerrcode.ForeignKeyViolation
+}
+
+type pgRepo struct {
+	pool *pgxpool.Pool
+	q    *acpsqlc.Queries
+}
+
+// NewPostgresRepository 用 pgxpool 构造 Repository。
+func NewPostgresRepository(pool *pgxpool.Pool) Repository {
+	return &pgRepo{pool: pool, q: acpsqlc.New(pool)}
+}
+
+// ===== 类型转换 helper =====
+
+func toPgUUID(u uuid.UUID) pgtype.UUID { return pgtype.UUID{Bytes: u, Valid: true} }
+func toPgUUIDPtr(u *uuid.UUID) pgtype.UUID {
+	if u == nil {
+		return pgtype.UUID{}
+	}
+	return pgtype.UUID{Bytes: *u, Valid: true}
+}
+func fromPgUUID(p pgtype.UUID) uuid.UUID {
+	if !p.Valid {
+		return uuid.Nil
+	}
+	return uuid.UUID(p.Bytes)
+}
+func fromPgUUIDPtr(p pgtype.UUID) *uuid.UUID {
+	if !p.Valid {
+		return nil
+	}
+	id := uuid.UUID(p.Bytes)
+	return &id
+}
+
+// pgxNoRowsToErrNotFound 把 pgx.ErrNoRows 翻译为 errs.AppError(NotFound)。
+func pgxNoRowsToErrNotFound(err error, code errs.Code, msg string) error {
+	if errors.Is(err, pgx.ErrNoRows) {
+		return errs.New(code, msg)
+	}
+	return errs.Wrap(err, errs.CodeInternal, msg)
+}
+
+// ===== AgentKind =====
+
+func (r *pgRepo) CreateAgentKind(ctx context.Context, k *AgentKind) (*AgentKind, error) {
+	row, err := r.q.CreateAgentKind(ctx, acpsqlc.CreateAgentKindParams{
+		ID:           toPgUUID(k.ID),
+		Name:         k.Name,
+		DisplayName:  k.DisplayName,
+		Description:  k.Description,
+		BinaryPath:   k.BinaryPath,
+		Args:         k.Args,
+		EncryptedEnv: k.EncryptedEnv,
+		Enabled:      k.Enabled,
+		CreatedBy:    toPgUUID(k.CreatedBy),
+	})
+	if err != nil {
+		return nil, errs.Wrap(err, errs.CodeInternal, "create agent kind")
+	}
+	return rowToAgentKind(row), nil
+}
+
+func (r *pgRepo) GetAgentKindByID(ctx context.Context, id uuid.UUID) (*AgentKind, error) {
+	row, err := r.q.GetAgentKindByID(ctx, toPgUUID(id))
+	if err != nil {
+		return nil, pgxNoRowsToErrNotFound(err, errs.CodeAcpAgentKindNotFound, "agent kind not found")
+	}
+	return rowToAgentKind(row), nil
+}
+
+func (r *pgRepo) GetAgentKindByName(ctx context.Context, name string) (*AgentKind, error) {
+	row, err := r.q.GetAgentKindByName(ctx, name)
+	if err != nil {
+		return nil, pgxNoRowsToErrNotFound(err, errs.CodeAcpAgentKindNotFound, "agent kind not found")
+	}
+	return rowToAgentKind(row), nil
+}
+
+func (r *pgRepo) ListAgentKinds(ctx context.Context) ([]*AgentKind, error) {
+	rows, err := r.q.ListAgentKinds(ctx)
+	if err != nil {
+		return nil, errs.Wrap(err, errs.CodeInternal, "list agent kinds")
+	}
+	out := make([]*AgentKind, 0, len(rows))
+	for _, row := range rows {
+		out = append(out, rowToAgentKind(row))
+	}
+	return out, nil
+}
+
+func (r *pgRepo) ListEnabledAgentKinds(ctx context.Context) ([]*AgentKind, error) {
+	rows, err := r.q.ListEnabledAgentKinds(ctx)
+	if err != nil {
+		return nil, errs.Wrap(err, errs.CodeInternal, "list enabled agent kinds")
+	}
+	out := make([]*AgentKind, 0, len(rows))
+	for _, row := range rows {
+		out = append(out, rowToAgentKind(row))
+	}
+	return out, nil
+}
+
+func (r *pgRepo) UpdateAgentKind(ctx context.Context, k *AgentKind) (*AgentKind, error) {
+	row, err := r.q.UpdateAgentKind(ctx, acpsqlc.UpdateAgentKindParams{
+		ID:           toPgUUID(k.ID),
+		DisplayName:  k.DisplayName,
+		Description:  k.Description,
+		BinaryPath:   k.BinaryPath,
+		Args:         k.Args,
+		EncryptedEnv: k.EncryptedEnv,
+		Enabled:      k.Enabled,
+	})
+	if err != nil {
+		return nil, pgxNoRowsToErrNotFound(err, errs.CodeAcpAgentKindNotFound, "agent kind not found")
+	}
+	return rowToAgentKind(row), nil
+}
+
+func (r *pgRepo) DeleteAgentKind(ctx context.Context, id uuid.UUID) error {
+	if err := r.q.DeleteAgentKind(ctx, toPgUUID(id)); err != nil {
+		if IsForeignKeyViolation(err) {
+			return errs.New(errs.CodeAcpAgentKindInUse, "agent kind has active sessions")
+		}
+		return errs.Wrap(err, errs.CodeInternal, "delete agent kind")
+	}
+	return nil
+}
+
+func (r *pgRepo) CountAgentKindUsage(ctx context.Context, id uuid.UUID) (int64, error) {
+	n, err := r.q.CountAgentKindUsage(ctx, toPgUUID(id))
+	if err != nil {
+		return 0, errs.Wrap(err, errs.CodeInternal, "count agent kind usage")
+	}
+	return n, nil
+}
+
+// ===== row → domain converters =====
+
+func rowToAgentKind(row acpsqlc.AcpAgentKind) *AgentKind {
+	return &AgentKind{
+		ID:           fromPgUUID(row.ID),
+		Name:         row.Name,
+		DisplayName:  row.DisplayName,
+		Description:  row.Description,
+		BinaryPath:   row.BinaryPath,
+		Args:         row.Args,
+		EncryptedEnv: row.EncryptedEnv,
+		Enabled:      row.Enabled,
+		CreatedBy:    fromPgUUID(row.CreatedBy),
+		CreatedAt:    row.CreatedAt.Time,
+		UpdatedAt:    row.UpdatedAt.Time,
+	}
+}
+
+// ===== Session =====
+
+func (r *pgRepo) InsertSession(ctx context.Context, s *Session) (*Session, error) {
+	row, err := r.q.InsertSession(ctx, acpsqlc.InsertSessionParams{
+		ID:             toPgUUID(s.ID),
+		WorkspaceID:    toPgUUID(s.WorkspaceID),
+		ProjectID:      toPgUUID(s.ProjectID),
+		AgentKindID:    toPgUUID(s.AgentKindID),
+		UserID:         toPgUUID(s.UserID),
+		IssueID:        toPgUUIDPtr(s.IssueID),
+		RequirementID:  toPgUUIDPtr(s.RequirementID),
+		Branch:         s.Branch,
+		CwdPath:        s.CwdPath,
+		IsMainWorktree: s.IsMainWorktree,
+		Status:         string(s.Status),
+	})
+	if err != nil {
+		return nil, errs.Wrap(err, errs.CodeInternal, "insert session")
+	}
+	return rowToSession(row), nil
+}
+
+func (r *pgRepo) GetSessionByID(ctx context.Context, id uuid.UUID) (*Session, error) {
+	row, err := r.q.GetSessionByID(ctx, toPgUUID(id))
+	if err != nil {
+		return nil, pgxNoRowsToErrNotFound(err, errs.CodeAcpSessionNotFound, "session not found")
+	}
+	return rowToSession(row), nil
+}
+
+func (r *pgRepo) ListSessionsByUser(ctx context.Context, userID uuid.UUID) ([]*Session, error) {
+	rows, err := r.q.ListSessionsByUser(ctx, toPgUUID(userID))
+	if err != nil {
+		return nil, errs.Wrap(err, errs.CodeInternal, "list sessions by user")
+	}
+	out := make([]*Session, 0, len(rows))
+	for _, row := range rows {
+		out = append(out, rowToSession(row))
+	}
+	return out, nil
+}
+
+func (r *pgRepo) ListAllSessions(ctx context.Context) ([]*Session, error) {
+	rows, err := r.q.ListAllSessions(ctx)
+	if err != nil {
+		return nil, errs.Wrap(err, errs.CodeInternal, "list all sessions")
+	}
+	out := make([]*Session, 0, len(rows))
+	for _, row := range rows {
+		out = append(out, rowToSession(row))
+	}
+	return out, nil
+}
+
+func (r *pgRepo) UpdateSessionRunning(ctx context.Context, id uuid.UUID, agentSessionID string, pid int32) error {
+	if err := r.q.UpdateSessionRunning(ctx, acpsqlc.UpdateSessionRunningParams{
+		ID:             toPgUUID(id),
+		AgentSessionID: &agentSessionID,
+		Pid:            &pid,
+	}); err != nil {
+		return errs.Wrap(err, errs.CodeInternal, "update session running")
+	}
+	return nil
+}
+
+func (r *pgRepo) UpdateSessionFinished(ctx context.Context, id uuid.UUID, status SessionStatus, exitCode *int32, lastErr *string) error {
+	if err := r.q.UpdateSessionFinished(ctx, acpsqlc.UpdateSessionFinishedParams{
+		ID:        toPgUUID(id),
+		Status:    string(status),
+		ExitCode:  exitCode,
+		LastError: lastErr,
+	}); err != nil {
+		return errs.Wrap(err, errs.CodeInternal, "update session finished")
+	}
+	return nil
+}
+
+func (r *pgRepo) CountActiveSessions(ctx context.Context) (int64, error) {
+	n, err := r.q.CountActiveSessions(ctx)
+	if err != nil {
+		return 0, errs.Wrap(err, errs.CodeInternal, "count active sessions")
+	}
+	return n, nil
+}
+
+func (r *pgRepo) CountActiveSessionsByUser(ctx context.Context, userID uuid.UUID) (int64, error) {
+	n, err := r.q.CountActiveSessionsByUser(ctx, toPgUUID(userID))
+	if err != nil {
+		return 0, errs.Wrap(err, errs.CodeInternal, "count active sessions by user")
+	}
+	return n, nil
+}
+
+func (r *pgRepo) ResetStuckSessionsOnRestart(ctx context.Context) ([]*Session, error) {
+	rows, err := r.q.ResetStuckSessionsOnRestart(ctx)
+	if err != nil {
+		return nil, errs.Wrap(err, errs.CodeInternal, "reset stuck sessions on restart")
+	}
+	out := make([]*Session, 0, len(rows))
+	for _, row := range rows {
+		out = append(out, &Session{
+			ID:             fromPgUUID(row.ID),
+			WorkspaceID:    fromPgUUID(row.WorkspaceID),
+			UserID:         fromPgUUID(row.UserID),
+			Branch:         row.Branch,
+			AgentKindID:    fromPgUUID(row.AgentKindID),
+			IsMainWorktree: row.IsMainWorktree,
+			Status:         SessionCrashed,
+		})
+	}
+	return out, nil
+}
+
+func (r *pgRepo) AcquireMainWorktree(ctx context.Context, sessionID, workspaceID uuid.UUID) (bool, error) {
+	n, err := r.q.AcquireMainWorktree(ctx, acpsqlc.AcquireMainWorktreeParams{
+		ActiveMainSessionID: toPgUUIDPtr(&sessionID),
+		ID:                  toPgUUID(workspaceID),
+	})
+	if err != nil {
+		return false, errs.Wrap(err, errs.CodeInternal, "acquire main worktree")
+	}
+	return n > 0, nil
+}
+
+func (r *pgRepo) ReleaseMainWorktree(ctx context.Context, workspaceID, sessionID uuid.UUID) (bool, error) {
+	n, err := r.q.ReleaseMainWorktree(ctx, acpsqlc.ReleaseMainWorktreeParams{
+		ID:                  toPgUUID(workspaceID),
+		ActiveMainSessionID: toPgUUIDPtr(&sessionID),
+	})
+	if err != nil {
+		return false, errs.Wrap(err, errs.CodeInternal, "release main worktree")
+	}
+	return n > 0, nil
+}
+
+func rowToSession(row acpsqlc.AcpSession) *Session {
+	var endedAt *time.Time
+	if row.EndedAt.Valid {
+		t := row.EndedAt.Time
+		endedAt = &t
+	}
+	return &Session{
+		ID:             fromPgUUID(row.ID),
+		WorkspaceID:    fromPgUUID(row.WorkspaceID),
+		ProjectID:      fromPgUUID(row.ProjectID),
+		AgentKindID:    fromPgUUID(row.AgentKindID),
+		UserID:         fromPgUUID(row.UserID),
+		IssueID:        fromPgUUIDPtr(row.IssueID),
+		RequirementID:  fromPgUUIDPtr(row.RequirementID),
+		AgentSessionID: row.AgentSessionID,
+		Branch:         row.Branch,
+		CwdPath:        row.CwdPath,
+		IsMainWorktree: row.IsMainWorktree,
+		Status:         SessionStatus(row.Status),
+		PID:            row.Pid,
+		ExitCode:       row.ExitCode,
+		LastError:      row.LastError,
+		StartedAt:      row.StartedAt.Time,
+		EndedAt:        endedAt,
+	}
+}
+
+// ===== Event =====
+
+func (r *pgRepo) InsertEvent(ctx context.Context, e *Event) (*Event, error) {
+	row, err := r.q.InsertEvent(ctx, acpsqlc.InsertEventParams{
+		SessionID:   toPgUUID(e.SessionID),
+		Direction:   string(e.Direction),
+		RpcKind:     string(e.RPCKind),
+		Method:      e.Method,
+		Payload:     e.Payload,
+		PayloadSize: e.PayloadSize,
+		Truncated:   e.Truncated,
+	})
+	if err != nil {
+		return nil, errs.Wrap(err, errs.CodeInternal, "insert acp event")
+	}
+	return rowToEvent(row), nil
+}
+
+func (r *pgRepo) ListEventsSince(ctx context.Context, sessionID uuid.UUID, sinceID int64, limit int32) ([]*Event, error) {
+	rows, err := r.q.ListEventsSince(ctx, acpsqlc.ListEventsSinceParams{
+		SessionID: toPgUUID(sessionID),
+		ID:        sinceID,
+		Limit:     limit,
+	})
+	if err != nil {
+		return nil, errs.Wrap(err, errs.CodeInternal, "list events since")
+	}
+	out := make([]*Event, 0, len(rows))
+	for _, row := range rows {
+		out = append(out, rowToEvent(row))
+	}
+	return out, nil
+}
+
+func (r *pgRepo) PurgeEventsBefore(ctx context.Context, before time.Time) (int64, error) {
+	n, err := r.q.PurgeEventsBefore(ctx, pgtype.Timestamptz{Time: before, Valid: true})
+	if err != nil {
+		return 0, errs.Wrap(err, errs.CodeInternal, "purge acp events")
+	}
+	return n, nil
+}
+
+func rowToEvent(row acpsqlc.AcpEvent) *Event {
+	return &Event{
+		ID:          row.ID,
+		SessionID:   fromPgUUID(row.SessionID),
+		Direction:   EventDirection(row.Direction),
+		RPCKind:     RPCKind(row.RpcKind),
+		Method:      row.Method,
+		Payload:     row.Payload,
+		PayloadSize: row.PayloadSize,
+		Truncated:   row.Truncated,
+		CreatedAt:   row.CreatedAt.Time,
+	}
+}

internal/acp/repository_test.go

@@ -0,0 +1,261 @@
+//go:build integration
+
+package acp_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	tcpg "github.com/testcontainers/testcontainers-go/modules/postgres"
+
+	"github.com/yan1h/agent-coding-workflow/internal/acp"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/db"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/errs"
+)
+
+func setupRepo(t *testing.T) (acp.Repository, *pgxpool.Pool) {
+	t.Helper()
+	ctx := context.Background()
+	container, err := tcpg.Run(ctx, "postgres:16-alpine",
+		tcpg.WithDatabase("acw"),
+		tcpg.WithUsername("acw"),
+		tcpg.WithPassword("acw"),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = container.Terminate(ctx) })
+
+	dsn, err := container.ConnectionString(ctx, "sslmode=disable")
+	require.NoError(t, err)
+	require.NoError(t, db.Migrate(ctx, dsn, "file://../../migrations"))
+
+	pool, err := db.NewPool(ctx, dsn)
+	require.NoError(t, err)
+	t.Cleanup(pool.Close)
+
+	return acp.NewPostgresRepository(pool), pool
+}
+
+func TestPgRepo_AgentKind_CRUD(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	repo, pool := setupRepo(t)
+
+	uid := mustInsertUser(t, ctx, pool, "admin@local", true)
+
+	// Create
+	k, err := repo.CreateAgentKind(ctx, &acp.AgentKind{
+		ID: uuid.New(), Name: "claude_code", DisplayName: "Claude Code",
+		BinaryPath: "claude-code", Args: []string{"--acp"},
+		EncryptedEnv: []byte("ciphertext"), Enabled: true, CreatedBy: uid,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "claude_code", k.Name)
+
+	// Get by ID
+	got, err := repo.GetAgentKindByID(ctx, k.ID)
+	require.NoError(t, err)
+	assert.Equal(t, k.Name, got.Name)
+
+	// Get by Name
+	got2, err := repo.GetAgentKindByName(ctx, "claude_code")
+	require.NoError(t, err)
+	assert.Equal(t, k.ID, got2.ID)
+
+	// List enabled
+	enabled, err := repo.ListEnabledAgentKinds(ctx)
+	require.NoError(t, err)
+	require.Len(t, enabled, 1)
+
+	// Update（enabled=false）
+	k.DisplayName = "Claude Code v2"
+	k.Enabled = false
+	updated, err := repo.UpdateAgentKind(ctx, k)
+	require.NoError(t, err)
+	assert.Equal(t, "Claude Code v2", updated.DisplayName)
+	assert.False(t, updated.Enabled)
+
+	enabled, _ = repo.ListEnabledAgentKinds(ctx)
+	assert.Empty(t, enabled)
+
+	// Delete
+	require.NoError(t, repo.DeleteAgentKind(ctx, k.ID))
+	_, err = repo.GetAgentKindByID(ctx, k.ID)
+	ae, ok := errs.As(err)
+	require.True(t, ok)
+	assert.Equal(t, errs.CodeAcpAgentKindNotFound, ae.Code)
+}
+
+func TestPgRepo_AgentKind_DeleteInUse(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	repo, pool := setupRepo(t)
+
+	uid := mustInsertUser(t, ctx, pool, "admin2@local", true)
+	pid, wsid := mustInsertProjectWorkspace(t, ctx, pool, uid)
+
+	k, err := repo.CreateAgentKind(ctx, &acp.AgentKind{
+		ID: uuid.New(), Name: "kind-in-use", DisplayName: "x",
+		BinaryPath: "x", Enabled: true, CreatedBy: uid,
+	})
+	require.NoError(t, err)
+
+	_, err = repo.InsertSession(ctx, &acp.Session{
+		ID: uuid.New(), WorkspaceID: wsid, ProjectID: pid,
+		AgentKindID: k.ID, UserID: uid,
+		Branch: "main", CwdPath: "/tmp", IsMainWorktree: true, Status: acp.SessionRunning,
+	})
+	require.NoError(t, err)
+
+	err = repo.DeleteAgentKind(ctx, k.ID)
+	ae, ok := errs.As(err)
+	require.True(t, ok)
+	assert.Equal(t, errs.CodeAcpAgentKindInUse, ae.Code)
+}
+
+func TestPgRepo_Session_Lifecycle(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	repo, pool := setupRepo(t)
+
+	uid := mustInsertUser(t, ctx, pool, "u3@local", false)
+	pid, wsid := mustInsertProjectWorkspace(t, ctx, pool, uid)
+	k, _ := repo.CreateAgentKind(ctx, &acp.AgentKind{
+		ID: uuid.New(), Name: "kind3", DisplayName: "x",
+		BinaryPath: "x", Enabled: true, CreatedBy: uid,
+	})
+
+	sess, err := repo.InsertSession(ctx, &acp.Session{
+		ID: uuid.New(), WorkspaceID: wsid, ProjectID: pid,
+		AgentKindID: k.ID, UserID: uid,
+		Branch: "feat-x", CwdPath: "/tmp", IsMainWorktree: false, Status: acp.SessionStarting,
+	})
+	require.NoError(t, err)
+
+	// Count active
+	n, _ := repo.CountActiveSessions(ctx)
+	assert.Equal(t, int64(1), n)
+	n2, _ := repo.CountActiveSessionsByUser(ctx, uid)
+	assert.Equal(t, int64(1), n2)
+
+	// Update running
+	require.NoError(t, repo.UpdateSessionRunning(ctx, sess.ID, "agent-sid-abc", 12345))
+	got, _ := repo.GetSessionByID(ctx, sess.ID)
+	assert.Equal(t, acp.SessionRunning, got.Status)
+	require.NotNil(t, got.AgentSessionID)
+	assert.Equal(t, "agent-sid-abc", *got.AgentSessionID)
+	require.NotNil(t, got.PID)
+	assert.Equal(t, int32(12345), *got.PID)
+
+	// Update finished
+	ec := int32(0)
+	require.NoError(t, repo.UpdateSessionFinished(ctx, sess.ID, acp.SessionExited, &ec, nil))
+	got, _ = repo.GetSessionByID(ctx, sess.ID)
+	assert.Equal(t, acp.SessionExited, got.Status)
+	assert.False(t, got.Status.IsActive())
+
+	// Reset stuck（应无影响：本 session 已 exited）
+	rows, _ := repo.ResetStuckSessionsOnRestart(ctx)
+	assert.Empty(t, rows)
+}
+
+func TestPgRepo_Session_ResetStuck(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	repo, pool := setupRepo(t)
+
+	uid := mustInsertUser(t, ctx, pool, "u4@local", false)
+	pid, wsid := mustInsertProjectWorkspace(t, ctx, pool, uid)
+	k, _ := repo.CreateAgentKind(ctx, &acp.AgentKind{
+		ID: uuid.New(), Name: "kind4", DisplayName: "x",
+		BinaryPath: "x", Enabled: true, CreatedBy: uid,
+	})
+
+	for i := 0; i < 2; i++ {
+		_, _ = repo.InsertSession(ctx, &acp.Session{
+			ID: uuid.New(), WorkspaceID: wsid, ProjectID: pid,
+			AgentKindID: k.ID, UserID: uid,
+			Branch: "stuck", CwdPath: "/tmp", IsMainWorktree: false, Status: acp.SessionRunning,
+		})
+	}
+
+	rows, err := repo.ResetStuckSessionsOnRestart(ctx)
+	require.NoError(t, err)
+	assert.Len(t, rows, 2)
+	for _, s := range rows {
+		assert.Equal(t, acp.SessionCrashed, s.Status)
+	}
+	rows2, _ := repo.ResetStuckSessionsOnRestart(ctx)
+	assert.Empty(t, rows2)
+}
+
+func TestPgRepo_Event_OrderAndPurge(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	repo, pool := setupRepo(t)
+
+	uid := mustInsertUser(t, ctx, pool, "u5@local", false)
+	pid, wsid := mustInsertProjectWorkspace(t, ctx, pool, uid)
+	k, _ := repo.CreateAgentKind(ctx, &acp.AgentKind{
+		ID: uuid.New(), Name: "kind5", DisplayName: "x",
+		BinaryPath: "x", Enabled: true, CreatedBy: uid,
+	})
+	sess, _ := repo.InsertSession(ctx, &acp.Session{
+		ID: uuid.New(), WorkspaceID: wsid, ProjectID: pid,
+		AgentKindID: k.ID, UserID: uid,
+		Branch: "main", CwdPath: "/tmp", IsMainWorktree: true, Status: acp.SessionRunning,
+	})
+
+	for i := 0; i < 3; i++ {
+		method := "session/update"
+		_, err := repo.InsertEvent(ctx, &acp.Event{
+			SessionID: sess.ID, Direction: acp.DirectionOut, RPCKind: acp.RPCNotification,
+			Method: &method, Payload: []byte(`{"foo":"bar"}`), PayloadSize: 13, Truncated: false,
+		})
+		require.NoError(t, err)
+	}
+
+	// ListSince 0 → 全部 3 条
+	all, err := repo.ListEventsSince(ctx, sess.ID, 0, 100)
+	require.NoError(t, err)
+	require.Len(t, all, 3)
+	assert.True(t, all[0].ID < all[1].ID && all[1].ID < all[2].ID)
+
+	// Since 第 1 条 ID → 仅 2 条
+	rest, _ := repo.ListEventsSince(ctx, sess.ID, all[0].ID, 100)
+	assert.Len(t, rest, 2)
+
+	// Purge before now+1m → 全删
+	n, _ := repo.PurgeEventsBefore(ctx, time.Now().Add(time.Minute))
+	assert.Equal(t, int64(3), n)
+}
+
+// ===== test helpers =====
+
+func mustInsertUser(t *testing.T, ctx context.Context, pool *pgxpool.Pool, email string, admin bool) uuid.UUID {
+	t.Helper()
+	id := uuid.New()
+	_, err := pool.Exec(ctx, `INSERT INTO users (id, email, password_hash, display_name, is_admin)
+		VALUES ($1, $2, 'h', 'n', $3)`, id, email, admin)
+	require.NoError(t, err)
+	return id
+}
+
+func mustInsertProjectWorkspace(t *testing.T, ctx context.Context, pool *pgxpool.Pool, owner uuid.UUID) (uuid.UUID, uuid.UUID) {
+	t.Helper()
+	pid := uuid.New()
+	wsid := uuid.New()
+	slug := "p-" + pid.String()[:8]
+	wsslug := "ws-" + wsid.String()[:8]
+	_, err := pool.Exec(ctx, `INSERT INTO projects (id, slug, name, owner_id) VALUES ($1, $2, 'p', $3)`,
+		pid, slug, owner)
+	require.NoError(t, err)
+	_, err = pool.Exec(ctx, `INSERT INTO workspaces (id, project_id, slug, name, git_remote_url, main_path)
+		VALUES ($1, $2, $3, 'w', 'git@x:y.git', '/tmp')`, wsid, pid, wsslug)
+	require.NoError(t, err)
+	return pid, wsid
+}

internal/acp/session_service.go

@@ -0,0 +1,336 @@
+// session_service.go 实现 SessionService。Create 走完整事务（worktree
+// acquire + supervisor.Spawn）；Get/List/Terminate 是配套的简单读写。
+package acp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/yan1h/agent-coding-workflow/internal/audit"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/errs"
+	"github.com/yan1h/agent-coding-workflow/internal/project"
+	"github.com/yan1h/agent-coding-workflow/internal/workspace"
+)
+
+// SessionServiceConfig 是 service 的限流配置（从 AcpConfig 派生）。
+type SessionServiceConfig struct {
+	MaxActiveGlobal  int
+	MaxActivePerUser int
+}
+
+// ProjectAccess 是 acp 模块对 project 模块的窄接口；adapter 在 app.go 实现。
+type ProjectAccess interface {
+	GetProjectByWorkspace(ctx context.Context, wsID uuid.UUID) (*project.Project, error)
+	GetIssueByNumber(ctx context.Context, projectID uuid.UUID, number int) (*project.Issue, error)
+	GetRequirementByNumber(ctx context.Context, projectID uuid.UUID, number int) (*project.Requirement, error)
+}
+
+type sessionService struct {
+	repo   Repository
+	wsSvc  workspace.WorkspaceService
+	wtSvc  workspace.WorktreeService
+	wsRepo workspace.Repository
+	pa     ProjectAccess
+	sup    *Supervisor
+	audit  audit.Recorder
+	cfg    SessionServiceConfig
+}
+
+// NewSessionService 构造 SessionService。
+func NewSessionService(repo Repository, wsSvc workspace.WorkspaceService,
+	wtSvc workspace.WorktreeService, wsRepo workspace.Repository,
+	pa ProjectAccess, sup *Supervisor, rec audit.Recorder,
+	cfg SessionServiceConfig) SessionService {
+	return &sessionService{
+		repo: repo, wsSvc: wsSvc, wtSvc: wtSvc, wsRepo: wsRepo,
+		pa: pa, sup: sup, audit: rec, cfg: cfg,
+	}
+}
+
+// ResolveBranch 是 spec §8.1 的纯函数实现：根据 CreateSessionInput 决定
+// (branch, isMainWorktree)。允许独立单测，不依赖 service 状态。
+//
+// 规则（按优先级）：
+//  1. in.Branch 显式：直接用；isMain = (== ws.DefaultBranch)
+//  2. in.IssueNumber：拉 issue，校验 workspace 关联，命名 "issue/<slug>-<num>"
+//  3. in.RequirementNumber：拉 requirement，校验 workspace，命名 "req/<slug>-<num>"
+//  4. 都没给：fallback "acp-auto/<8-hex>"，isMain = false
+func ResolveBranch(ctx context.Context, ws *workspace.Workspace, sessionID uuid.UUID,
+	in CreateSessionInput, projectSlug string, pa ProjectAccess) (string, bool, error) {
+
+	if in.Branch != nil && *in.Branch != "" {
+		br := *in.Branch
+		return br, br == ws.DefaultBranch, nil
+	}
+
+	if in.IssueNumber != nil {
+		iss, err := pa.GetIssueByNumber(ctx, ws.ProjectID, *in.IssueNumber)
+		if err != nil {
+			return "", false, err
+		}
+		if iss.WorkspaceID != nil && *iss.WorkspaceID != ws.ID {
+			return "", false, errs.New(errs.CodeInvalidInput,
+				fmt.Sprintf("issue #%d already linked to other workspace", *in.IssueNumber))
+		}
+		return fmt.Sprintf("issue/%s-%d", projectSlug, iss.Number), false, nil
+	}
+
+	if in.RequirementNumber != nil {
+		req, err := pa.GetRequirementByNumber(ctx, ws.ProjectID, *in.RequirementNumber)
+		if err != nil {
+			return "", false, err
+		}
+		if req.WorkspaceID != nil && *req.WorkspaceID != ws.ID {
+			return "", false, errs.New(errs.CodeInvalidInput,
+				fmt.Sprintf("requirement #%d already linked to other workspace", *in.RequirementNumber))
+		}
+		return fmt.Sprintf("req/%s-%d", projectSlug, req.Number), false, nil
+	}
+
+	short := strings.ReplaceAll(sessionID.String(), "-", "")
+	if len(short) > 8 {
+		short = short[:8]
+	}
+	return fmt.Sprintf("acp-auto/%s", short), false, nil
+}
+
+// Create 执行完整 session 创建事务：
+//  1. workspace 鉴权（wsSvc.Get）
+//  2. agent kind 校验（enabled?）
+//  3. 全局 + 单用户限流
+//  4. 分支解析（ResolveBranch + project 查询）
+//  5. worktree 占用（main → repo.AcquireMainWorktree；
+//     子分支 → wtSvc.List 找已存在或 Create + Acquire，holder = "session:<sid>"）
+//  6. issueID/requirementID 反查（best-effort）
+//  7. INSERT acp_sessions
+//  8. audit.Record
+//  9. async supervisor.Spawn（失败回滚 worktree）
+//  10. async initial_prompt 转发（等握手完成）
+func (s *sessionService) Create(ctx context.Context, c Caller, in CreateSessionInput) (*Session, error) {
+	// 1. workspace + authz
+	wsCaller := workspace.Caller{UserID: c.UserID, IsAdmin: c.IsAdmin}
+	ws, err := s.wsSvc.Get(ctx, wsCaller, in.WorkspaceID)
+	if err != nil {
+		return nil, err
+	}
+
+	// 2. agent kind
+	kind, err := s.repo.GetAgentKindByID(ctx, in.AgentKindID)
+	if err != nil {
+		return nil, err
+	}
+	if !kind.Enabled {
+		return nil, errs.New(errs.CodeAcpAgentKindDisabled, "agent kind disabled")
+	}
+
+	// 3. 限流
+	nGlobal, _ := s.repo.CountActiveSessions(ctx)
+	if int(nGlobal) >= s.cfg.MaxActiveGlobal {
+		return nil, errs.New(errs.CodeAcpSessionQuotaExceeded, "global session quota exceeded")
+	}
+	nUser, _ := s.repo.CountActiveSessionsByUser(ctx, c.UserID)
+	if int(nUser) >= s.cfg.MaxActivePerUser {
+		return nil, errs.New(errs.CodeAcpSessionQuotaExceeded, "per-user session quota exceeded")
+	}
+
+	// 4. 分支解析
+	pj, err := s.pa.GetProjectByWorkspace(ctx, ws.ID)
+	if err != nil {
+		return nil, err
+	}
+	sessionID := uuid.New()
+	branch, isMain, err := ResolveBranch(ctx, ws, sessionID, in, pj.Slug, s.pa)
+	if err != nil {
+		return nil, err
+	}
+
+	// 5. worktree 占用
+	var (
+		cwdPath    string
+		worktreeID *uuid.UUID
+	)
+	sessCaller := workspace.Caller{UserID: c.UserID, IsAdmin: c.IsAdmin, SessionID: &sessionID}
+	if isMain {
+		ok, err := s.repo.AcquireMainWorktree(ctx, sessionID, ws.ID)
+		if err != nil {
+			return nil, err
+		}
+		if !ok {
+			return nil, errs.New(errs.CodeAcpSessionBranchConflict, "main worktree already in use")
+		}
+		cwdPath = ws.MainPath
+	} else {
+		wt, err := s.findOrCreateWorktree(ctx, sessCaller, ws.ID, branch)
+		if err != nil {
+			return nil, err
+		}
+		if _, err := s.wtSvc.Acquire(ctx, sessCaller, wt.ID); err != nil {
+			return nil, err
+		}
+		cwdPath = wt.Path
+		wid := wt.ID
+		worktreeID = &wid
+	}
+
+	// 6. PM 关联（best-effort：拿不到 ID 不阻塞 session 创建）
+	var issueID, reqID *uuid.UUID
+	if in.IssueNumber != nil {
+		if iss, _ := s.pa.GetIssueByNumber(ctx, ws.ProjectID, *in.IssueNumber); iss != nil {
+			id := iss.ID
+			issueID = &id
+		}
+	}
+	if in.RequirementNumber != nil {
+		if req, _ := s.pa.GetRequirementByNumber(ctx, ws.ProjectID, *in.RequirementNumber); req != nil {
+			id := req.ID
+			reqID = &id
+		}
+	}
+
+	// 7. INSERT
+	sess := &Session{
+		ID: sessionID, WorkspaceID: ws.ID, ProjectID: ws.ProjectID,
+		AgentKindID: kind.ID, UserID: c.UserID,
+		IssueID: issueID, RequirementID: reqID,
+		Branch: branch, CwdPath: cwdPath, IsMainWorktree: isMain,
+		Status: SessionStarting,
+	}
+	out, err := s.repo.InsertSession(ctx, sess)
+	if err != nil {
+		s.releaseOnFailure(ctx, sess, sessCaller, worktreeID)
+		return nil, err
+	}
+
+	// 8. audit
+	s.recordAudit(ctx, c, "acp.session.create", out.ID.String(), map[string]any{
+		"agent_kind":     kind.Name,
+		"branch":         branch,
+		"cwd_path":       cwdPath,
+		"issue_id":       issueID,
+		"requirement_id": reqID,
+	})
+
+	// 9. async spawn（失败时回滚 worktree）
+	go func() {
+		spawnCtx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+		defer cancel()
+		if _, err := s.sup.Spawn(spawnCtx, out, kind); err != nil {
+			s.releaseOnFailure(spawnCtx, out, sessCaller, worktreeID)
+		}
+	}()
+
+	// 10. initial prompt：握手成功后异步转发
+	if in.InitialPrompt != nil && *in.InitialPrompt != "" {
+		go s.sendInitialPrompt(out.ID, *in.InitialPrompt)
+	}
+
+	return out, nil
+}
+
+// findOrCreateWorktree 在指定 workspace 内查找 branch 同名 worktree，
+// 不存在则创建。caller 已通过 wsSvc.Get 完成鉴权。
+func (s *sessionService) findOrCreateWorktree(ctx context.Context, c workspace.Caller, wsID uuid.UUID, branch string) (*workspace.Worktree, error) {
+	wts, err := s.wtSvc.List(ctx, c, wsID)
+	if err != nil {
+		return nil, err
+	}
+	for _, wt := range wts {
+		if wt.Branch == branch {
+			return wt, nil
+		}
+	}
+	return s.wtSvc.Create(ctx, c, wsID, workspace.CreateWorktreeInput{Branch: branch})
+}
+
+// releaseOnFailure 在 INSERT / Spawn 失败时回滚 worktree 占用。幂等且静默。
+func (s *sessionService) releaseOnFailure(ctx context.Context, sess *Session, c workspace.Caller, worktreeID *uuid.UUID) {
+	if sess.IsMainWorktree {
+		_, _ = s.repo.ReleaseMainWorktree(ctx, sess.WorkspaceID, sess.ID)
+		return
+	}
+	if worktreeID != nil {
+		_, _ = s.wtSvc.Release(ctx, c, *worktreeID)
+	}
+}
+
+// sendInitialPrompt 等待 supervisor 完成 handshake（最多 30s），随后转发一条
+// session/prompt 给 agent。轮询 200ms 一次拉 relay + agent_session_id；任一缺失
+// 继续等待。超时后静默放弃。
+func (s *sessionService) sendInitialPrompt(sid uuid.UUID, text string) {
+	deadline := time.After(30 * time.Second)
+	tick := time.NewTicker(200 * time.Millisecond)
+	defer tick.Stop()
+	for {
+		select {
+		case <-deadline:
+			return
+		case <-tick.C:
+		}
+		relay := s.sup.GetRelay(sid)
+		if relay == nil {
+			continue
+		}
+		sess, _ := s.repo.GetSessionByID(context.Background(), sid)
+		if sess == nil || sess.AgentSessionID == nil {
+			continue
+		}
+		idJSON, _ := json.Marshal("client-init")
+		params, _ := json.Marshal(map[string]any{
+			"sessionId": *sess.AgentSessionID,
+			"prompt":    []map[string]any{{"type": "text", "text": text}},
+		})
+		msg := &Message{
+			JSONRPC: "2.0", ID: idJSON, Method: "session/prompt", Params: params,
+		}
+		_ = relay.SendClient(msg)
+		return
+	}
+}
+
+func (s *sessionService) Get(ctx context.Context, c Caller, id uuid.UUID) (*Session, error) {
+	sess, err := s.repo.GetSessionByID(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	if !c.IsAdmin && sess.UserID != c.UserID {
+		return nil, errs.New(errs.CodeAcpSessionNotFound, "session not found")
+	}
+	return sess, nil
+}
+
+func (s *sessionService) List(ctx context.Context, c Caller, all bool) ([]*Session, error) {
+	if all && !c.IsAdmin {
+		return nil, errs.New(errs.CodeForbidden, "admin only")
+	}
+	if all {
+		return s.repo.ListAllSessions(ctx)
+	}
+	return s.repo.ListSessionsByUser(ctx, c.UserID)
+}
+
+func (s *sessionService) Terminate(ctx context.Context, c Caller, id uuid.UUID) error {
+	sess, err := s.Get(ctx, c, id)
+	if err != nil {
+		return err
+	}
+	if !sess.Status.IsActive() {
+		return nil
+	}
+	s.sup.Kill(ctx, id, 5*time.Second)
+	return nil
+}
+
+func (s *sessionService) recordAudit(ctx context.Context, c Caller, action, targetID string, meta map[string]any) {
+	if s.audit == nil {
+		return
+	}
+	uid := c.UserID
+	_ = s.audit.Record(context.WithoutCancel(ctx), audit.Entry{
+		UserID: &uid, Action: action, TargetType: "acp_session", TargetID: targetID, Metadata: meta,
+	})
+}

internal/acp/session_service_test.go

@@ -0,0 +1,106 @@
+package acp_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/yan1h/agent-coding-workflow/internal/acp"
+	"github.com/yan1h/agent-coding-workflow/internal/project"
+	"github.com/yan1h/agent-coding-workflow/internal/workspace"
+)
+
+// fakeProjectAccess 满足 acp.ProjectAccess 接口；测试时按需返回。
+type fakeProjectAccess struct {
+	pj    *project.Project
+	issue *project.Issue
+	req   *project.Requirement
+	err   error
+}
+
+func (f fakeProjectAccess) GetProjectByWorkspace(_ context.Context, _ uuid.UUID) (*project.Project, error) {
+	return f.pj, f.err
+}
+func (f fakeProjectAccess) GetIssueByNumber(_ context.Context, _ uuid.UUID, _ int) (*project.Issue, error) {
+	if f.issue == nil {
+		return nil, f.err
+	}
+	return f.issue, nil
+}
+func (f fakeProjectAccess) GetRequirementByNumber(_ context.Context, _ uuid.UUID, _ int) (*project.Requirement, error) {
+	if f.req == nil {
+		return nil, f.err
+	}
+	return f.req, nil
+}
+
+func TestResolveBranch_Explicit(t *testing.T) {
+	t.Parallel()
+	ws := &workspace.Workspace{ID: uuid.New(), DefaultBranch: "main"}
+	br := "feat/x"
+	got, isMain, err := acp.ResolveBranch(context.Background(), ws, uuid.New(),
+		acp.CreateSessionInput{Branch: &br}, "demo", fakeProjectAccess{})
+	require.NoError(t, err)
+	assert.Equal(t, "feat/x", got)
+	assert.False(t, isMain)
+}
+
+func TestResolveBranch_ExplicitMain(t *testing.T) {
+	t.Parallel()
+	ws := &workspace.Workspace{ID: uuid.New(), DefaultBranch: "main"}
+	br := "main"
+	got, isMain, err := acp.ResolveBranch(context.Background(), ws, uuid.New(),
+		acp.CreateSessionInput{Branch: &br}, "demo", fakeProjectAccess{})
+	require.NoError(t, err)
+	assert.Equal(t, "main", got)
+	assert.True(t, isMain)
+}
+
+func TestResolveBranch_FromIssue(t *testing.T) {
+	t.Parallel()
+	ws := &workspace.Workspace{ID: uuid.New(), ProjectID: uuid.New(), DefaultBranch: "main"}
+	issueNum := 42
+	pa := fakeProjectAccess{issue: &project.Issue{Number: 42, WorkspaceID: nil}}
+	got, isMain, err := acp.ResolveBranch(context.Background(), ws, uuid.New(),
+		acp.CreateSessionInput{IssueNumber: &issueNum}, "demo", pa)
+	require.NoError(t, err)
+	assert.Equal(t, "issue/demo-42", got)
+	assert.False(t, isMain)
+}
+
+func TestResolveBranch_IssueLinkedToOtherWorkspace(t *testing.T) {
+	t.Parallel()
+	ws := &workspace.Workspace{ID: uuid.New(), ProjectID: uuid.New(), DefaultBranch: "main"}
+	other := uuid.New()
+	pa := fakeProjectAccess{issue: &project.Issue{Number: 42, WorkspaceID: &other}}
+	num := 42
+	_, _, err := acp.ResolveBranch(context.Background(), ws, uuid.New(),
+		acp.CreateSessionInput{IssueNumber: &num}, "demo", pa)
+	require.Error(t, err)
+}
+
+func TestResolveBranch_FromRequirement(t *testing.T) {
+	t.Parallel()
+	ws := &workspace.Workspace{ID: uuid.New(), ProjectID: uuid.New(), DefaultBranch: "main"}
+	num := 7
+	pa := fakeProjectAccess{req: &project.Requirement{Number: 7, WorkspaceID: nil}}
+	got, isMain, err := acp.ResolveBranch(context.Background(), ws, uuid.New(),
+		acp.CreateSessionInput{RequirementNumber: &num}, "demo", pa)
+	require.NoError(t, err)
+	assert.Equal(t, "req/demo-7", got)
+	assert.False(t, isMain)
+}
+
+func TestResolveBranch_AutoFallback(t *testing.T) {
+	t.Parallel()
+	ws := &workspace.Workspace{ID: uuid.New(), ProjectID: uuid.New(), DefaultBranch: "main"}
+	sid := uuid.New()
+	got, isMain, err := acp.ResolveBranch(context.Background(), ws, sid,
+		acp.CreateSessionInput{}, "demo", fakeProjectAccess{})
+	require.NoError(t, err)
+	assert.Contains(t, got, "acp-auto/")
+	assert.False(t, isMain)
+}

internal/acp/sqlc/agent_kinds.sql.go

@@ -0,0 +1,263 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: agent_kinds.sql
+
+package acpsqlc
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+const countAgentKindUsage = `-- name: CountAgentKindUsage :one
+SELECT COUNT(*) FROM acp_sessions WHERE agent_kind_id = $1
+`
+
+func (q *Queries) CountAgentKindUsage(ctx context.Context, agentKindID pgtype.UUID) (int64, error) {
+	row := q.db.QueryRow(ctx, countAgentKindUsage, agentKindID)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const createAgentKind = `-- name: CreateAgentKind :one
+INSERT INTO acp_agent_kinds (
+  id, name, display_name, description, binary_path, args, encrypted_env, enabled, created_by
+) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+RETURNING id, name, display_name, description, binary_path, args, encrypted_env,
+          enabled, created_by, created_at, updated_at
+`
+
+type CreateAgentKindParams struct {
+	ID           pgtype.UUID `json:"id"`
+	Name         string      `json:"name"`
+	DisplayName  string      `json:"display_name"`
+	Description  string      `json:"description"`
+	BinaryPath   string      `json:"binary_path"`
+	Args         []string    `json:"args"`
+	EncryptedEnv []byte      `json:"encrypted_env"`
+	Enabled      bool        `json:"enabled"`
+	CreatedBy    pgtype.UUID `json:"created_by"`
+}
+
+func (q *Queries) CreateAgentKind(ctx context.Context, arg CreateAgentKindParams) (AcpAgentKind, error) {
+	row := q.db.QueryRow(ctx, createAgentKind,
+		arg.ID,
+		arg.Name,
+		arg.DisplayName,
+		arg.Description,
+		arg.BinaryPath,
+		arg.Args,
+		arg.EncryptedEnv,
+		arg.Enabled,
+		arg.CreatedBy,
+	)
+	var i AcpAgentKind
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.DisplayName,
+		&i.Description,
+		&i.BinaryPath,
+		&i.Args,
+		&i.EncryptedEnv,
+		&i.Enabled,
+		&i.CreatedBy,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const deleteAgentKind = `-- name: DeleteAgentKind :exec
+DELETE FROM acp_agent_kinds WHERE id = $1
+`
+
+func (q *Queries) DeleteAgentKind(ctx context.Context, id pgtype.UUID) error {
+	_, err := q.db.Exec(ctx, deleteAgentKind, id)
+	return err
+}
+
+const getAgentKindByID = `-- name: GetAgentKindByID :one
+SELECT id, name, display_name, description, binary_path, args, encrypted_env,
+       enabled, created_by, created_at, updated_at
+FROM acp_agent_kinds
+WHERE id = $1
+`
+
+func (q *Queries) GetAgentKindByID(ctx context.Context, id pgtype.UUID) (AcpAgentKind, error) {
+	row := q.db.QueryRow(ctx, getAgentKindByID, id)
+	var i AcpAgentKind
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.DisplayName,
+		&i.Description,
+		&i.BinaryPath,
+		&i.Args,
+		&i.EncryptedEnv,
+		&i.Enabled,
+		&i.CreatedBy,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getAgentKindByName = `-- name: GetAgentKindByName :one
+SELECT id, name, display_name, description, binary_path, args, encrypted_env,
+       enabled, created_by, created_at, updated_at
+FROM acp_agent_kinds
+WHERE name = $1
+`
+
+func (q *Queries) GetAgentKindByName(ctx context.Context, name string) (AcpAgentKind, error) {
+	row := q.db.QueryRow(ctx, getAgentKindByName, name)
+	var i AcpAgentKind
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.DisplayName,
+		&i.Description,
+		&i.BinaryPath,
+		&i.Args,
+		&i.EncryptedEnv,
+		&i.Enabled,
+		&i.CreatedBy,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const listAgentKinds = `-- name: ListAgentKinds :many
+SELECT id, name, display_name, description, binary_path, args, encrypted_env,
+       enabled, created_by, created_at, updated_at
+FROM acp_agent_kinds
+ORDER BY created_at DESC
+`
+
+func (q *Queries) ListAgentKinds(ctx context.Context) ([]AcpAgentKind, error) {
+	rows, err := q.db.Query(ctx, listAgentKinds)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []AcpAgentKind
+	for rows.Next() {
+		var i AcpAgentKind
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.DisplayName,
+			&i.Description,
+			&i.BinaryPath,
+			&i.Args,
+			&i.EncryptedEnv,
+			&i.Enabled,
+			&i.CreatedBy,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listEnabledAgentKinds = `-- name: ListEnabledAgentKinds :many
+SELECT id, name, display_name, description, binary_path, args, encrypted_env,
+       enabled, created_by, created_at, updated_at
+FROM acp_agent_kinds
+WHERE enabled = TRUE
+ORDER BY name ASC
+`
+
+func (q *Queries) ListEnabledAgentKinds(ctx context.Context) ([]AcpAgentKind, error) {
+	rows, err := q.db.Query(ctx, listEnabledAgentKinds)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []AcpAgentKind
+	for rows.Next() {
+		var i AcpAgentKind
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.DisplayName,
+			&i.Description,
+			&i.BinaryPath,
+			&i.Args,
+			&i.EncryptedEnv,
+			&i.Enabled,
+			&i.CreatedBy,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const updateAgentKind = `-- name: UpdateAgentKind :one
+UPDATE acp_agent_kinds
+SET display_name  = $2,
+    description   = $3,
+    binary_path   = $4,
+    args          = $5,
+    encrypted_env = $6,
+    enabled       = $7,
+    updated_at    = now()
+WHERE id = $1
+RETURNING id, name, display_name, description, binary_path, args, encrypted_env,
+          enabled, created_by, created_at, updated_at
+`
+
+type UpdateAgentKindParams struct {
+	ID           pgtype.UUID `json:"id"`
+	DisplayName  string      `json:"display_name"`
+	Description  string      `json:"description"`
+	BinaryPath   string      `json:"binary_path"`
+	Args         []string    `json:"args"`
+	EncryptedEnv []byte      `json:"encrypted_env"`
+	Enabled      bool        `json:"enabled"`
+}
+
+func (q *Queries) UpdateAgentKind(ctx context.Context, arg UpdateAgentKindParams) (AcpAgentKind, error) {
+	row := q.db.QueryRow(ctx, updateAgentKind,
+		arg.ID,
+		arg.DisplayName,
+		arg.Description,
+		arg.BinaryPath,
+		arg.Args,
+		arg.EncryptedEnv,
+		arg.Enabled,
+	)
+	var i AcpAgentKind
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.DisplayName,
+		&i.Description,
+		&i.BinaryPath,
+		&i.Args,
+		&i.EncryptedEnv,
+		&i.Enabled,
+		&i.CreatedBy,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}

internal/acp/sqlc/db.go

@@ -0,0 +1,32 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+
+package acpsqlc
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+)
+
+type DBTX interface {
+	Exec(context.Context, string, ...interface{}) (pgconn.CommandTag, error)
+	Query(context.Context, string, ...interface{}) (pgx.Rows, error)
+	QueryRow(context.Context, string, ...interface{}) pgx.Row
+}
+
+func New(db DBTX) *Queries {
+	return &Queries{db: db}
+}
+
+type Queries struct {
+	db DBTX
+}
+
+func (q *Queries) WithTx(tx pgx.Tx) *Queries {
+	return &Queries{
+		db: tx,
+	}
+}

internal/acp/sqlc/events.sql.go

@@ -0,0 +1,112 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: events.sql
+
+package acpsqlc
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+const insertEvent = `-- name: InsertEvent :one
+INSERT INTO acp_events (
+  session_id, direction, rpc_kind, method, payload, payload_size, truncated
+) VALUES ($1, $2, $3, $4, $5, $6, $7)
+RETURNING id, session_id, direction, rpc_kind, method, payload,
+          payload_size, truncated, created_at
+`
+
+type InsertEventParams struct {
+	SessionID   pgtype.UUID `json:"session_id"`
+	Direction   string      `json:"direction"`
+	RpcKind     string      `json:"rpc_kind"`
+	Method      *string     `json:"method"`
+	Payload     []byte      `json:"payload"`
+	PayloadSize int32       `json:"payload_size"`
+	Truncated   bool        `json:"truncated"`
+}
+
+func (q *Queries) InsertEvent(ctx context.Context, arg InsertEventParams) (AcpEvent, error) {
+	row := q.db.QueryRow(ctx, insertEvent,
+		arg.SessionID,
+		arg.Direction,
+		arg.RpcKind,
+		arg.Method,
+		arg.Payload,
+		arg.PayloadSize,
+		arg.Truncated,
+	)
+	var i AcpEvent
+	err := row.Scan(
+		&i.ID,
+		&i.SessionID,
+		&i.Direction,
+		&i.RpcKind,
+		&i.Method,
+		&i.Payload,
+		&i.PayloadSize,
+		&i.Truncated,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const listEventsSince = `-- name: ListEventsSince :many
+SELECT id, session_id, direction, rpc_kind, method, payload,
+       payload_size, truncated, created_at
+FROM acp_events
+WHERE session_id = $1 AND id > $2
+ORDER BY id ASC
+LIMIT $3
+`
+
+type ListEventsSinceParams struct {
+	SessionID pgtype.UUID `json:"session_id"`
+	ID        int64       `json:"id"`
+	Limit     int32       `json:"limit"`
+}
+
+func (q *Queries) ListEventsSince(ctx context.Context, arg ListEventsSinceParams) ([]AcpEvent, error) {
+	rows, err := q.db.Query(ctx, listEventsSince, arg.SessionID, arg.ID, arg.Limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []AcpEvent
+	for rows.Next() {
+		var i AcpEvent
+		if err := rows.Scan(
+			&i.ID,
+			&i.SessionID,
+			&i.Direction,
+			&i.RpcKind,
+			&i.Method,
+			&i.Payload,
+			&i.PayloadSize,
+			&i.Truncated,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const purgeEventsBefore = `-- name: PurgeEventsBefore :execrows
+DELETE FROM acp_events WHERE created_at < $1
+`
+
+func (q *Queries) PurgeEventsBefore(ctx context.Context, createdAt pgtype.Timestamptz) (int64, error) {
+	result, err := q.db.Exec(ctx, purgeEventsBefore, createdAt)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}

internal/acp/sqlc/models.go

@@ -0,0 +1,296 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+
+package acpsqlc
+
+import (
+	"net/netip"
+
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+type AcpAgentKind struct {
+	ID           pgtype.UUID        `json:"id"`
+	Name         string             `json:"name"`
+	DisplayName  string             `json:"display_name"`
+	Description  string             `json:"description"`
+	BinaryPath   string             `json:"binary_path"`
+	Args         []string           `json:"args"`
+	EncryptedEnv []byte             `json:"encrypted_env"`
+	Enabled      bool               `json:"enabled"`
+	CreatedBy    pgtype.UUID        `json:"created_by"`
+	CreatedAt    pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt    pgtype.Timestamptz `json:"updated_at"`
+}
+
+type AcpEvent struct {
+	ID          int64              `json:"id"`
+	SessionID   pgtype.UUID        `json:"session_id"`
+	Direction   string             `json:"direction"`
+	RpcKind     string             `json:"rpc_kind"`
+	Method      *string            `json:"method"`
+	Payload     []byte             `json:"payload"`
+	PayloadSize int32              `json:"payload_size"`
+	Truncated   bool               `json:"truncated"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+}
+
+type AcpSession struct {
+	ID             pgtype.UUID        `json:"id"`
+	WorkspaceID    pgtype.UUID        `json:"workspace_id"`
+	ProjectID      pgtype.UUID        `json:"project_id"`
+	AgentKindID    pgtype.UUID        `json:"agent_kind_id"`
+	UserID         pgtype.UUID        `json:"user_id"`
+	IssueID        pgtype.UUID        `json:"issue_id"`
+	RequirementID  pgtype.UUID        `json:"requirement_id"`
+	AgentSessionID *string            `json:"agent_session_id"`
+	Branch         string             `json:"branch"`
+	CwdPath        string             `json:"cwd_path"`
+	IsMainWorktree bool               `json:"is_main_worktree"`
+	Status         string             `json:"status"`
+	Pid            *int32             `json:"pid"`
+	ExitCode       *int32             `json:"exit_code"`
+	LastError      *string            `json:"last_error"`
+	StartedAt      pgtype.Timestamptz `json:"started_at"`
+	EndedAt        pgtype.Timestamptz `json:"ended_at"`
+}
+
+type AuditLog struct {
+	ID         int64              `json:"id"`
+	UserID     pgtype.UUID        `json:"user_id"`
+	Action     string             `json:"action"`
+	TargetType *string            `json:"target_type"`
+	TargetID   *string            `json:"target_id"`
+	Ip         *netip.Addr        `json:"ip"`
+	Metadata   []byte             `json:"metadata"`
+	CreatedAt  pgtype.Timestamptz `json:"created_at"`
+}
+
+type Conversation struct {
+	ID               pgtype.UUID        `json:"id"`
+	UserID           pgtype.UUID        `json:"user_id"`
+	ProjectID        pgtype.UUID        `json:"project_id"`
+	WorkspaceID      pgtype.UUID        `json:"workspace_id"`
+	IssueID          pgtype.UUID        `json:"issue_id"`
+	ModelID          pgtype.UUID        `json:"model_id"`
+	SystemPrompt     string             `json:"system_prompt"`
+	Title            *string            `json:"title"`
+	TitleGeneratedAt pgtype.Timestamptz `json:"title_generated_at"`
+	CreatedAt        pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt        pgtype.Timestamptz `json:"updated_at"`
+	DeletedAt        pgtype.Timestamptz `json:"deleted_at"`
+}
+
+type GitCredential struct {
+	ID              pgtype.UUID        `json:"id"`
+	WorkspaceID     pgtype.UUID        `json:"workspace_id"`
+	Kind            string             `json:"kind"`
+	Username        *string            `json:"username"`
+	EncryptedSecret []byte             `json:"encrypted_secret"`
+	Fingerprint     *string            `json:"fingerprint"`
+	CreatedAt       pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt       pgtype.Timestamptz `json:"updated_at"`
+}
+
+type Issue struct {
+	ID            pgtype.UUID        `json:"id"`
+	ProjectID     pgtype.UUID        `json:"project_id"`
+	RequirementID pgtype.UUID        `json:"requirement_id"`
+	Number        int32              `json:"number"`
+	Title         string             `json:"title"`
+	Description   string             `json:"description"`
+	Status        string             `json:"status"`
+	AssigneeID    pgtype.UUID        `json:"assignee_id"`
+	CreatedBy     pgtype.UUID        `json:"created_by"`
+	ClosedAt      pgtype.Timestamptz `json:"closed_at"`
+	CreatedAt     pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt     pgtype.Timestamptz `json:"updated_at"`
+	WorkspaceID   pgtype.UUID        `json:"workspace_id"`
+}
+
+type Job struct {
+	ID          pgtype.UUID        `json:"id"`
+	Type        string             `json:"type"`
+	Payload     []byte             `json:"payload"`
+	Status      string             `json:"status"`
+	ScheduledAt pgtype.Timestamptz `json:"scheduled_at"`
+	Attempts    int32              `json:"attempts"`
+	MaxAttempts int32              `json:"max_attempts"`
+	LeasedAt    pgtype.Timestamptz `json:"leased_at"`
+	LeasedBy    *string            `json:"leased_by"`
+	LastError   *string            `json:"last_error"`
+	CompletedAt pgtype.Timestamptz `json:"completed_at"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt   pgtype.Timestamptz `json:"updated_at"`
+}
+
+type LlmEndpoint struct {
+	ID              pgtype.UUID        `json:"id"`
+	Provider        string             `json:"provider"`
+	DisplayName     string             `json:"display_name"`
+	BaseUrl         string             `json:"base_url"`
+	ApiKeyEncrypted []byte             `json:"api_key_encrypted"`
+	CreatedBy       pgtype.UUID        `json:"created_by"`
+	CreatedAt       pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt       pgtype.Timestamptz `json:"updated_at"`
+}
+
+type LlmModel struct {
+	ID                           pgtype.UUID        `json:"id"`
+	EndpointID                   pgtype.UUID        `json:"endpoint_id"`
+	ModelID                      string             `json:"model_id"`
+	DisplayName                  string             `json:"display_name"`
+	Capabilities                 []byte             `json:"capabilities"`
+	ContextWindow                int32              `json:"context_window"`
+	MaxOutputTokens              int32              `json:"max_output_tokens"`
+	PromptPricePerMillionUsd     pgtype.Numeric     `json:"prompt_price_per_million_usd"`
+	CompletionPricePerMillionUsd pgtype.Numeric     `json:"completion_price_per_million_usd"`
+	ThinkingPricePerMillionUsd   pgtype.Numeric     `json:"thinking_price_per_million_usd"`
+	IsTitleGenerator             bool               `json:"is_title_generator"`
+	Enabled                      bool               `json:"enabled"`
+	SortOrder                    int32              `json:"sort_order"`
+	CreatedAt                    pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt                    pgtype.Timestamptz `json:"updated_at"`
+}
+
+type LlmUsage struct {
+	ID               int64              `json:"id"`
+	ConversationID   pgtype.UUID        `json:"conversation_id"`
+	MessageID        int64              `json:"message_id"`
+	UserID           pgtype.UUID        `json:"user_id"`
+	EndpointID       pgtype.UUID        `json:"endpoint_id"`
+	ModelID          pgtype.UUID        `json:"model_id"`
+	PromptTokens     int32              `json:"prompt_tokens"`
+	CompletionTokens int32              `json:"completion_tokens"`
+	ThinkingTokens   int32              `json:"thinking_tokens"`
+	CostUsd          pgtype.Numeric     `json:"cost_usd"`
+	CreatedAt        pgtype.Timestamptz `json:"created_at"`
+}
+
+type Message struct {
+	ID               int64              `json:"id"`
+	ConversationID   pgtype.UUID        `json:"conversation_id"`
+	Role             string             `json:"role"`
+	Content          string             `json:"content"`
+	Thinking         *string            `json:"thinking"`
+	ToolCalls        []byte             `json:"tool_calls"`
+	Status           string             `json:"status"`
+	ErrorMessage     *string            `json:"error_message"`
+	PromptTokens     *int32             `json:"prompt_tokens"`
+	CompletionTokens *int32             `json:"completion_tokens"`
+	ThinkingTokens   *int32             `json:"thinking_tokens"`
+	CreatedAt        pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt        pgtype.Timestamptz `json:"updated_at"`
+}
+
+type MessageAttachment struct {
+	ID          pgtype.UUID        `json:"id"`
+	UserID      pgtype.UUID        `json:"user_id"`
+	MessageID   *int64             `json:"message_id"`
+	Filename    string             `json:"filename"`
+	MimeType    string             `json:"mime_type"`
+	SizeBytes   int64              `json:"size_bytes"`
+	Sha256      string             `json:"sha256"`
+	StoragePath string             `json:"storage_path"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+}
+
+type Notification struct {
+	ID        pgtype.UUID        `json:"id"`
+	UserID    pgtype.UUID        `json:"user_id"`
+	Topic     string             `json:"topic"`
+	Severity  string             `json:"severity"`
+	Title     string             `json:"title"`
+	Body      string             `json:"body"`
+	Link      *string            `json:"link"`
+	Metadata  []byte             `json:"metadata"`
+	ReadAt    pgtype.Timestamptz `json:"read_at"`
+	CreatedAt pgtype.Timestamptz `json:"created_at"`
+}
+
+type Project struct {
+	ID          pgtype.UUID        `json:"id"`
+	Slug        string             `json:"slug"`
+	Name        string             `json:"name"`
+	Description string             `json:"description"`
+	Visibility  string             `json:"visibility"`
+	OwnerID     pgtype.UUID        `json:"owner_id"`
+	ArchivedAt  pgtype.Timestamptz `json:"archived_at"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt   pgtype.Timestamptz `json:"updated_at"`
+}
+
+type PromptTemplate struct {
+	ID        pgtype.UUID        `json:"id"`
+	Name      string             `json:"name"`
+	Content   string             `json:"content"`
+	Scope     string             `json:"scope"`
+	OwnerID   pgtype.UUID        `json:"owner_id"`
+	CreatedAt pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt pgtype.Timestamptz `json:"updated_at"`
+}
+
+type Requirement struct {
+	ID          pgtype.UUID        `json:"id"`
+	ProjectID   pgtype.UUID        `json:"project_id"`
+	Number      int32              `json:"number"`
+	Title       string             `json:"title"`
+	Description string             `json:"description"`
+	Phase       string             `json:"phase"`
+	Status      string             `json:"status"`
+	OwnerID     pgtype.UUID        `json:"owner_id"`
+	ClosedAt    pgtype.Timestamptz `json:"closed_at"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt   pgtype.Timestamptz `json:"updated_at"`
+	WorkspaceID pgtype.UUID        `json:"workspace_id"`
+}
+
+type User struct {
+	ID           pgtype.UUID        `json:"id"`
+	Email        string             `json:"email"`
+	PasswordHash string             `json:"password_hash"`
+	DisplayName  string             `json:"display_name"`
+	IsAdmin      bool               `json:"is_admin"`
+	CreatedAt    pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt    pgtype.Timestamptz `json:"updated_at"`
+}
+
+type UserSession struct {
+	ID         pgtype.UUID        `json:"id"`
+	UserID     pgtype.UUID        `json:"user_id"`
+	TokenHash  []byte             `json:"token_hash"`
+	ExpiresAt  pgtype.Timestamptz `json:"expires_at"`
+	LastSeenAt pgtype.Timestamptz `json:"last_seen_at"`
+	CreatedAt  pgtype.Timestamptz `json:"created_at"`
+}
+
+type Workspace struct {
+	ID                  pgtype.UUID        `json:"id"`
+	ProjectID           pgtype.UUID        `json:"project_id"`
+	Slug                string             `json:"slug"`
+	Name                string             `json:"name"`
+	Description         string             `json:"description"`
+	GitRemoteUrl        string             `json:"git_remote_url"`
+	DefaultBranch       string             `json:"default_branch"`
+	MainPath            string             `json:"main_path"`
+	SyncStatus          string             `json:"sync_status"`
+	LastSyncedAt        pgtype.Timestamptz `json:"last_synced_at"`
+	LastSyncError       *string            `json:"last_sync_error"`
+	CreatedAt           pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt           pgtype.Timestamptz `json:"updated_at"`
+	ActiveMainSessionID pgtype.UUID        `json:"active_main_session_id"`
+}
+
+type WorkspaceWorktree struct {
+	ID             pgtype.UUID        `json:"id"`
+	WorkspaceID    pgtype.UUID        `json:"workspace_id"`
+	Branch         string             `json:"branch"`
+	Path           string             `json:"path"`
+	Status         string             `json:"status"`
+	ActiveHolder   *string            `json:"active_holder"`
+	AcquiredAt     pgtype.Timestamptz `json:"acquired_at"`
+	LastUsedAt     pgtype.Timestamptz `json:"last_used_at"`
+	CreatedAt      pgtype.Timestamptz `json:"created_at"`
+	PruneWarningAt pgtype.Timestamptz `json:"prune_warning_at"`
+}

internal/acp/sqlc/sessions.sql.go

@@ -0,0 +1,347 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: sessions.sql
+
+package acpsqlc
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+const acquireMainWorktree = `-- name: AcquireMainWorktree :execrows
+UPDATE workspaces SET active_main_session_id = $1
+WHERE id = $2 AND active_main_session_id IS NULL
+`
+
+type AcquireMainWorktreeParams struct {
+	ActiveMainSessionID pgtype.UUID `json:"active_main_session_id"`
+	ID                  pgtype.UUID `json:"id"`
+}
+
+func (q *Queries) AcquireMainWorktree(ctx context.Context, arg AcquireMainWorktreeParams) (int64, error) {
+	result, err := q.db.Exec(ctx, acquireMainWorktree, arg.ActiveMainSessionID, arg.ID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
+const countActiveSessions = `-- name: CountActiveSessions :one
+SELECT COUNT(*) FROM acp_sessions WHERE status IN ('starting', 'running')
+`
+
+func (q *Queries) CountActiveSessions(ctx context.Context) (int64, error) {
+	row := q.db.QueryRow(ctx, countActiveSessions)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const countActiveSessionsByUser = `-- name: CountActiveSessionsByUser :one
+SELECT COUNT(*) FROM acp_sessions
+WHERE user_id = $1 AND status IN ('starting', 'running')
+`
+
+func (q *Queries) CountActiveSessionsByUser(ctx context.Context, userID pgtype.UUID) (int64, error) {
+	row := q.db.QueryRow(ctx, countActiveSessionsByUser, userID)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const getSessionByID = `-- name: GetSessionByID :one
+SELECT id, workspace_id, project_id, agent_kind_id, user_id,
+       issue_id, requirement_id, agent_session_id,
+       branch, cwd_path, is_main_worktree, status,
+       pid, exit_code, last_error, started_at, ended_at
+FROM acp_sessions
+WHERE id = $1
+`
+
+func (q *Queries) GetSessionByID(ctx context.Context, id pgtype.UUID) (AcpSession, error) {
+	row := q.db.QueryRow(ctx, getSessionByID, id)
+	var i AcpSession
+	err := row.Scan(
+		&i.ID,
+		&i.WorkspaceID,
+		&i.ProjectID,
+		&i.AgentKindID,
+		&i.UserID,
+		&i.IssueID,
+		&i.RequirementID,
+		&i.AgentSessionID,
+		&i.Branch,
+		&i.CwdPath,
+		&i.IsMainWorktree,
+		&i.Status,
+		&i.Pid,
+		&i.ExitCode,
+		&i.LastError,
+		&i.StartedAt,
+		&i.EndedAt,
+	)
+	return i, err
+}
+
+const insertSession = `-- name: InsertSession :one
+INSERT INTO acp_sessions (
+  id, workspace_id, project_id, agent_kind_id, user_id,
+  issue_id, requirement_id, branch, cwd_path, is_main_worktree, status
+) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+RETURNING id, workspace_id, project_id, agent_kind_id, user_id,
+          issue_id, requirement_id, agent_session_id,
+          branch, cwd_path, is_main_worktree, status,
+          pid, exit_code, last_error, started_at, ended_at
+`
+
+type InsertSessionParams struct {
+	ID             pgtype.UUID `json:"id"`
+	WorkspaceID    pgtype.UUID `json:"workspace_id"`
+	ProjectID      pgtype.UUID `json:"project_id"`
+	AgentKindID    pgtype.UUID `json:"agent_kind_id"`
+	UserID         pgtype.UUID `json:"user_id"`
+	IssueID        pgtype.UUID `json:"issue_id"`
+	RequirementID  pgtype.UUID `json:"requirement_id"`
+	Branch         string      `json:"branch"`
+	CwdPath        string      `json:"cwd_path"`
+	IsMainWorktree bool        `json:"is_main_worktree"`
+	Status         string      `json:"status"`
+}
+
+func (q *Queries) InsertSession(ctx context.Context, arg InsertSessionParams) (AcpSession, error) {
+	row := q.db.QueryRow(ctx, insertSession,
+		arg.ID,
+		arg.WorkspaceID,
+		arg.ProjectID,
+		arg.AgentKindID,
+		arg.UserID,
+		arg.IssueID,
+		arg.RequirementID,
+		arg.Branch,
+		arg.CwdPath,
+		arg.IsMainWorktree,
+		arg.Status,
+	)
+	var i AcpSession
+	err := row.Scan(
+		&i.ID,
+		&i.WorkspaceID,
+		&i.ProjectID,
+		&i.AgentKindID,
+		&i.UserID,
+		&i.IssueID,
+		&i.RequirementID,
+		&i.AgentSessionID,
+		&i.Branch,
+		&i.CwdPath,
+		&i.IsMainWorktree,
+		&i.Status,
+		&i.Pid,
+		&i.ExitCode,
+		&i.LastError,
+		&i.StartedAt,
+		&i.EndedAt,
+	)
+	return i, err
+}
+
+const listAllSessions = `-- name: ListAllSessions :many
+SELECT id, workspace_id, project_id, agent_kind_id, user_id,
+       issue_id, requirement_id, agent_session_id,
+       branch, cwd_path, is_main_worktree, status,
+       pid, exit_code, last_error, started_at, ended_at
+FROM acp_sessions
+ORDER BY started_at DESC
+`
+
+func (q *Queries) ListAllSessions(ctx context.Context) ([]AcpSession, error) {
+	rows, err := q.db.Query(ctx, listAllSessions)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []AcpSession
+	for rows.Next() {
+		var i AcpSession
+		if err := rows.Scan(
+			&i.ID,
+			&i.WorkspaceID,
+			&i.ProjectID,
+			&i.AgentKindID,
+			&i.UserID,
+			&i.IssueID,
+			&i.RequirementID,
+			&i.AgentSessionID,
+			&i.Branch,
+			&i.CwdPath,
+			&i.IsMainWorktree,
+			&i.Status,
+			&i.Pid,
+			&i.ExitCode,
+			&i.LastError,
+			&i.StartedAt,
+			&i.EndedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listSessionsByUser = `-- name: ListSessionsByUser :many
+SELECT id, workspace_id, project_id, agent_kind_id, user_id,
+       issue_id, requirement_id, agent_session_id,
+       branch, cwd_path, is_main_worktree, status,
+       pid, exit_code, last_error, started_at, ended_at
+FROM acp_sessions
+WHERE user_id = $1
+ORDER BY started_at DESC
+`
+
+func (q *Queries) ListSessionsByUser(ctx context.Context, userID pgtype.UUID) ([]AcpSession, error) {
+	rows, err := q.db.Query(ctx, listSessionsByUser, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []AcpSession
+	for rows.Next() {
+		var i AcpSession
+		if err := rows.Scan(
+			&i.ID,
+			&i.WorkspaceID,
+			&i.ProjectID,
+			&i.AgentKindID,
+			&i.UserID,
+			&i.IssueID,
+			&i.RequirementID,
+			&i.AgentSessionID,
+			&i.Branch,
+			&i.CwdPath,
+			&i.IsMainWorktree,
+			&i.Status,
+			&i.Pid,
+			&i.ExitCode,
+			&i.LastError,
+			&i.StartedAt,
+			&i.EndedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const releaseMainWorktree = `-- name: ReleaseMainWorktree :execrows
+UPDATE workspaces SET active_main_session_id = NULL
+WHERE id = $1 AND active_main_session_id = $2
+`
+
+type ReleaseMainWorktreeParams struct {
+	ID                  pgtype.UUID `json:"id"`
+	ActiveMainSessionID pgtype.UUID `json:"active_main_session_id"`
+}
+
+func (q *Queries) ReleaseMainWorktree(ctx context.Context, arg ReleaseMainWorktreeParams) (int64, error) {
+	result, err := q.db.Exec(ctx, releaseMainWorktree, arg.ID, arg.ActiveMainSessionID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
+const resetStuckSessionsOnRestart = `-- name: ResetStuckSessionsOnRestart :many
+UPDATE acp_sessions
+SET status = 'crashed',
+    last_error = 'process_aborted_on_restart',
+    ended_at = now()
+WHERE status IN ('starting', 'running')
+RETURNING id, workspace_id, user_id, branch, agent_kind_id, is_main_worktree
+`
+
+type ResetStuckSessionsOnRestartRow struct {
+	ID             pgtype.UUID `json:"id"`
+	WorkspaceID    pgtype.UUID `json:"workspace_id"`
+	UserID         pgtype.UUID `json:"user_id"`
+	Branch         string      `json:"branch"`
+	AgentKindID    pgtype.UUID `json:"agent_kind_id"`
+	IsMainWorktree bool        `json:"is_main_worktree"`
+}
+
+func (q *Queries) ResetStuckSessionsOnRestart(ctx context.Context) ([]ResetStuckSessionsOnRestartRow, error) {
+	rows, err := q.db.Query(ctx, resetStuckSessionsOnRestart)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []ResetStuckSessionsOnRestartRow
+	for rows.Next() {
+		var i ResetStuckSessionsOnRestartRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.WorkspaceID,
+			&i.UserID,
+			&i.Branch,
+			&i.AgentKindID,
+			&i.IsMainWorktree,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const updateSessionFinished = `-- name: UpdateSessionFinished :exec
+UPDATE acp_sessions
+SET status = $2, exit_code = $3, last_error = $4, ended_at = now()
+WHERE id = $1
+`
+
+type UpdateSessionFinishedParams struct {
+	ID        pgtype.UUID `json:"id"`
+	Status    string      `json:"status"`
+	ExitCode  *int32      `json:"exit_code"`
+	LastError *string     `json:"last_error"`
+}
+
+func (q *Queries) UpdateSessionFinished(ctx context.Context, arg UpdateSessionFinishedParams) error {
+	_, err := q.db.Exec(ctx, updateSessionFinished,
+		arg.ID,
+		arg.Status,
+		arg.ExitCode,
+		arg.LastError,
+	)
+	return err
+}
+
+const updateSessionRunning = `-- name: UpdateSessionRunning :exec
+UPDATE acp_sessions
+SET status = 'running', agent_session_id = $2, pid = $3
+WHERE id = $1
+`
+
+type UpdateSessionRunningParams struct {
+	ID             pgtype.UUID `json:"id"`
+	AgentSessionID *string     `json:"agent_session_id"`
+	Pid            *int32      `json:"pid"`
+}
+
+func (q *Queries) UpdateSessionRunning(ctx context.Context, arg UpdateSessionRunningParams) error {
+	_, err := q.db.Exec(ctx, updateSessionRunning, arg.ID, arg.AgentSessionID, arg.Pid)
+	return err
+}

internal/acp/supervisor.go

@@ -0,0 +1,422 @@
+// supervisor.go 管理 ACP agent 子进程池。每 session 一个 Process，spawn / kill /
+// monitor 三类操作通过 mu 保护 procs map。
+//
+// 生命周期 invariants（spec §6.8）：
+//   - procs 写锁仅在 spawn / Kill / monitorProcess delete 时持有
+//   - done channel 严格 close-once（monitor 唯一持有）
+//   - KilledByUs atomic 防 race（Kill / monitor 并发）
+//   - onExit 不能再 Lock supervisor.mu（避免死锁）
+package acp
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"os"
+	"os/exec"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/yan1h/agent-coding-workflow/internal/acp/handlers"
+	"github.com/yan1h/agent-coding-workflow/internal/audit"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/crypto"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/notify"
+	"github.com/yan1h/agent-coding-workflow/internal/workspace"
+)
+
+// SupervisorConfig 是从 config.AcpConfig 派生的 supervisor 子集。
+type SupervisorConfig struct {
+	SpawnTimeout       time.Duration
+	KillGrace          time.Duration
+	StderrBufferLines  int
+	StderrTailBytes    int
+	EventMaxPayload    int
+	EventTruncateField int
+	ShutdownGrace      time.Duration
+}
+
+// Supervisor 是 ACP 子进程总管。
+type Supervisor struct {
+	mu    sync.RWMutex
+	procs map[uuid.UUID]*Process
+
+	repo   Repository
+	audit  audit.Recorder
+	notify *notify.Dispatcher
+	wtSvc  workspace.WorktreeService
+	wsRepo workspace.Repository
+	crypto *crypto.Encryptor
+	cfg    SupervisorConfig
+	log    *slog.Logger
+}
+
+// NewSupervisor 构造空 Supervisor。Start 不需要 — supervisor 是被动的（spawn 时
+// 起 goroutine，无主循环）。Stop 在 ShutdownAll 中实现。
+func NewSupervisor(repo Repository, rec audit.Recorder, disp *notify.Dispatcher,
+	wtSvc workspace.WorktreeService, wsRepo workspace.Repository,
+	enc *crypto.Encryptor, cfg SupervisorConfig, log *slog.Logger) *Supervisor {
+	if log == nil {
+		log = slog.Default()
+	}
+	return &Supervisor{
+		procs:  map[uuid.UUID]*Process{},
+		repo:   repo,
+		audit:  rec,
+		notify: disp,
+		wtSvc:  wtSvc,
+		wsRepo: wsRepo,
+		crypto: enc,
+		cfg:    cfg,
+		log:    log,
+	}
+}
+
+// Process 是单个 agent 子进程的运行时句柄。
+type Process struct {
+	SessionID   uuid.UUID
+	WorkspaceID uuid.UUID
+	UserID      uuid.UUID
+	IsMain      bool       // 主 worktree 占用 → release 走不同路径
+	WorktreeID  *uuid.UUID // 子 worktree 时填，用于 release
+
+	Cmd    *exec.Cmd
+	Stdin  io.WriteCloser
+	Stdout io.ReadCloser
+	Stderr io.ReadCloser
+	Relay  *Relay
+
+	StderrBuf  *stderrRing  // 排障 ring buffer
+	StartedAt  time.Time
+	KilledByUs atomic.Bool   // true → exited，false → crashed
+	done       chan struct{} // monitor 退出时 close
+}
+
+// stderrRing 是固定行数 ring buffer，monitor 退出时取 tail 写 last_error。
+type stderrRing struct {
+	mu    sync.Mutex
+	lines []string
+	cap   int
+}
+
+func newStderrRing(cap int) *stderrRing { return &stderrRing{cap: cap} }
+
+func (r *stderrRing) Append(line string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if len(r.lines) >= r.cap {
+		r.lines = r.lines[1:]
+	}
+	r.lines = append(r.lines, line)
+}
+
+func (r *stderrRing) Tail(maxBytes int) string {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	out := ""
+	for i := len(r.lines) - 1; i >= 0 && len(out) < maxBytes; i-- {
+		out = r.lines[i] + "\n" + out
+	}
+	if len(out) > maxBytes {
+		out = out[len(out)-maxBytes:]
+	}
+	return out
+}
+
+// GetRelay returns the relay for an active session, or nil if not running.
+// WS handler 用此判断是否进 live 模式。
+func (s *Supervisor) GetRelay(sid uuid.UUID) *Relay {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	p, ok := s.procs[sid]
+	if !ok {
+		return nil
+	}
+	return p.Relay
+}
+
+// Spawn 启动一个子进程并完成 ACP handshake。返回的 *Process 已注册到 procs map；
+// handshake 失败时调用 Kill 回滚并返回错误。调用方（SessionService）负责前置的
+// worktree 占用与 acp_sessions 行 INSERT；本方法仅负责 OS 层资源与协议层握手。
+func (s *Supervisor) Spawn(ctx context.Context, sess *Session, kind *AgentKind) (*Process, error) {
+	envMap, err := decryptEnv(s.crypto, kind.EncryptedEnv)
+	if err != nil {
+		return nil, err
+	}
+
+	// strip env：只保留 PATH + 解密 overrides，避免泄漏 master key、git 凭据等。
+	osEnv := []string{"PATH=" + os.Getenv("PATH")}
+	for k, v := range envMap {
+		osEnv = append(osEnv, fmt.Sprintf("%s=%s", k, v))
+	}
+
+	cmd := exec.Command(kind.BinaryPath, kind.Args...)
+	cmd.Dir = sess.CwdPath
+	cmd.Env = osEnv
+
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		return nil, fmt.Errorf("stdin pipe: %w", err)
+	}
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, fmt.Errorf("stdout pipe: %w", err)
+	}
+	stderr, err := cmd.StderrPipe()
+	if err != nil {
+		return nil, fmt.Errorf("stderr pipe: %w", err)
+	}
+
+	if err := cmd.Start(); err != nil {
+		return nil, fmt.Errorf("start: %w", err)
+	}
+
+	relay := NewRelay(
+		sess.ID,
+		NewDecoder(stdout, s.cfg.EventMaxPayload),
+		NewEncoder(stdin),
+		s.repo,
+		handlers.NewFsHandler(),
+		handlers.NewPermissionHandler(),
+		RelayConfig{
+			EventMaxPayload:    s.cfg.EventMaxPayload,
+			EventTruncateField: s.cfg.EventTruncateField,
+			WSSendBuffer:       256,
+		},
+		s.log,
+	)
+
+	proc := &Process{
+		SessionID:   sess.ID,
+		WorkspaceID: sess.WorkspaceID,
+		UserID:      sess.UserID,
+		IsMain:      sess.IsMainWorktree,
+		Cmd:         cmd,
+		Stdin:       stdin,
+		Stdout:      stdout,
+		Stderr:      stderr,
+		Relay:       relay,
+		StderrBuf:   newStderrRing(s.cfg.StderrBufferLines),
+		StartedAt:   time.Now(),
+		done:        make(chan struct{}),
+	}
+
+	s.mu.Lock()
+	s.procs[sess.ID] = proc
+	s.mu.Unlock()
+
+	go s.drainStderr(proc)
+	go s.monitorProcess(proc)
+	go relay.Run(ctx, handlers.SessionContext{
+		SessionID:      sess.ID,
+		WorkspaceID:    sess.WorkspaceID,
+		UserID:         sess.UserID,
+		CwdPath:        sess.CwdPath,
+		AgentSessionID: sess.AgentSessionID,
+	})
+
+	if err := s.handshake(ctx, sess, relay, proc); err != nil {
+		s.log.Error("acp.handshake_failed", "session_id", sess.ID, "err", err.Error())
+		s.Kill(ctx, sess.ID, s.cfg.KillGrace)
+		return nil, err
+	}
+	return proc, nil
+}
+
+// handshake 发送 initialize → session/new，并把返回的 agent session id + pid
+// 持久化到 acp_sessions 行（status → running）。SpawnTimeout 是整个握手的硬上限。
+func (s *Supervisor) handshake(ctx context.Context, sess *Session, relay *Relay, proc *Process) error {
+	hsCtx, cancel := context.WithTimeout(ctx, s.cfg.SpawnTimeout)
+	defer cancel()
+
+	if _, err := relay.Call(hsCtx, "initialize", handlers.BuildInitializeParams("dev")); err != nil {
+		return fmt.Errorf("initialize: %w", err)
+	}
+	resp, err := relay.Call(hsCtx, "session/new", handlers.BuildSessionNewParams(sess.CwdPath))
+	if err != nil {
+		return fmt.Errorf("session/new: %w", err)
+	}
+	var snr handlers.SessionNewResult
+	if err := json.Unmarshal(resp.Result, &snr); err != nil {
+		return fmt.Errorf("parse session/new result: %w", err)
+	}
+	if snr.SessionID == "" {
+		return fmt.Errorf("agent did not return sessionId")
+	}
+	pid := int32(proc.Cmd.Process.Pid)
+	if err := s.repo.UpdateSessionRunning(ctx, sess.ID, snr.SessionID, pid); err != nil {
+		return fmt.Errorf("update session running: %w", err)
+	}
+	sess.AgentSessionID = &snr.SessionID
+	sess.PID = &pid
+	sess.Status = SessionRunning
+	return nil
+}
+
+// Kill 终止指定 session 的子进程。在 Unix 平台上先发 SIGTERM 等待 grace 时间，
+// 仍未退出再 Process.Kill；Windows 没有可靠 SIGTERM 实现，直接 Process.Kill。
+// 始终阻塞直到 monitorProcess 关闭 done channel。Kill 是幂等的——目标 session
+// 不存在时立即返回。
+func (s *Supervisor) Kill(ctx context.Context, sid uuid.UUID, grace time.Duration) {
+	s.mu.RLock()
+	proc, ok := s.procs[sid]
+	s.mu.RUnlock()
+	if !ok {
+		return
+	}
+
+	proc.KilledByUs.Store(true)
+
+	// 平台差异：Unix 走 SIGTERM + grace + 强 Kill；Windows 直接 Kill。
+	// 实现见 supervisor_unix.go / supervisor_windows.go。
+	s.unixGracefulTerm(proc, grace)
+
+	select {
+	case <-proc.done:
+	case <-ctx.Done():
+	}
+}
+
+// ShutdownAll 并行 Kill 所有正在运行的子进程。bounded by cfg.ShutdownGrace。
+func (s *Supervisor) ShutdownAll(ctx context.Context) {
+	s.mu.RLock()
+	ids := make([]uuid.UUID, 0, len(s.procs))
+	for id := range s.procs {
+		ids = append(ids, id)
+	}
+	s.mu.RUnlock()
+
+	shutdownCtx, cancel := context.WithTimeout(ctx, s.cfg.ShutdownGrace)
+	defer cancel()
+
+	var wg sync.WaitGroup
+	for _, id := range ids {
+		wg.Add(1)
+		go func(sid uuid.UUID) {
+			defer wg.Done()
+			s.Kill(shutdownCtx, sid, s.cfg.KillGrace)
+		}(id)
+	}
+
+	done := make(chan struct{})
+	go func() {
+		wg.Wait()
+		close(done)
+	}()
+	select {
+	case <-done:
+	case <-shutdownCtx.Done():
+		s.log.Warn("acp.shutdown_all.timeout")
+	}
+}
+
+// drainStderr 持续读取子进程 stderr，按行追加到 ring buffer。EOF 或 read error
+// 时安静退出（cmd.Wait() 已在 monitorProcess 处理）。
+func (s *Supervisor) drainStderr(proc *Process) {
+	scanner := bufio.NewScanner(proc.Stderr)
+	// 默认 token 大小 64KB，足够 ACP agent 单行 log。
+	for scanner.Scan() {
+		proc.StderrBuf.Append(scanner.Text())
+	}
+}
+
+// monitorProcess 等待子进程退出，更新 procs map 并触发 onExit。这是子进程
+// 状态唯一的合法 close 路径（done channel）。
+func (s *Supervisor) monitorProcess(proc *Process) {
+	defer close(proc.done)
+	waitErr := proc.Cmd.Wait()
+
+	exitCode := int32(0)
+	if exitErr, ok := waitErr.(*exec.ExitError); ok {
+		exitCode = int32(exitErr.ExitCode())
+	}
+
+	s.mu.Lock()
+	delete(s.procs, proc.SessionID)
+	s.mu.Unlock()
+
+	status := SessionExited
+	if !proc.KilledByUs.Load() {
+		status = SessionCrashed
+	}
+	s.onExit(context.Background(), proc, status, exitCode, waitErr)
+}
+
+// onExit 写终止状态、释放 worktree、触发通知与 audit、最后关闭 relay。
+// 不能再 acquire s.mu（monitorProcess 已 delete map 后调用本函数，但 Kill
+// 也持锁等 done，会形成 monitor → Kill → onExit 的链式 deadlock）。
+func (s *Supervisor) onExit(ctx context.Context, proc *Process, status SessionStatus, exitCode int32, waitErr error) {
+	stderrTail := proc.StderrBuf.Tail(s.cfg.StderrTailBytes)
+	var lastErr *string
+	if status == SessionCrashed && stderrTail != "" {
+		lastErr = &stderrTail
+	}
+	if err := s.repo.UpdateSessionFinished(ctx, proc.SessionID, status, &exitCode, lastErr); err != nil {
+		s.log.Error("acp.on_exit.update_session", "session_id", proc.SessionID, "err", err.Error())
+	}
+
+	// Release worktree。主 worktree 走 acp 表自己的 CAS；子 worktree 走 workspace
+	// service 的 holder 校验。当前 wtSvc.Release 接受 workspace.Caller，子 worktree
+	// 释放需要绕过 holder 检查（spec 期望 holder = "session:<sid>"，与 user holder
+	// 不同），用 IsAdmin: true 强制释放。F4 reaper 会替换为更严格的 byHolder 调用。
+	if proc.IsMain {
+		if _, err := s.repo.ReleaseMainWorktree(ctx, proc.WorkspaceID, proc.SessionID); err != nil {
+			s.log.Error("acp.on_exit.release_main",
+				"session_id", proc.SessionID, "err", err.Error())
+		}
+	} else if proc.WorktreeID != nil && s.wtSvc != nil {
+		if _, err := s.wtSvc.Release(ctx, workspace.Caller{IsAdmin: true}, *proc.WorktreeID); err != nil {
+			s.log.Error("acp.on_exit.release_worktree",
+				"session_id", proc.SessionID, "worktree_id", *proc.WorktreeID, "err", err.Error())
+		}
+	}
+
+	if status == SessionCrashed {
+		if s.notify != nil {
+			_ = s.notify.Dispatch(ctx, notify.Message{
+				UserID:   proc.UserID,
+				Topic:    "acp.session_crashed",
+				Severity: notify.SeverityError,
+				Title:    "ACP session crashed",
+				Body:     fmt.Sprintf("Session %s exited with code %d.", proc.SessionID, exitCode),
+				Metadata: map[string]any{
+					"session_id": proc.SessionID.String(),
+					"exit_code":  exitCode,
+				},
+			})
+		}
+		if s.audit != nil {
+			uid := proc.UserID
+			_ = s.audit.Record(ctx, audit.Entry{
+				UserID:     &uid,
+				Action:     "acp.session.crashed",
+				TargetType: "acp_session",
+				TargetID:   proc.SessionID.String(),
+				Metadata: map[string]any{
+					"exit_code":  exitCode,
+					"last_error": stderrTail,
+				},
+			})
+		}
+	} else {
+		if s.audit != nil {
+			uid := proc.UserID
+			_ = s.audit.Record(ctx, audit.Entry{
+				UserID:     &uid,
+				Action:     "acp.session.terminate",
+				TargetType: "acp_session",
+				TargetID:   proc.SessionID.String(),
+				Metadata:   map[string]any{"exit_code": exitCode},
+			})
+		}
+	}
+	_ = waitErr // 已通过 KilledByUs / ExitError 编码到 status / exitCode
+
+	// 最后关 relay：广播 session_terminated 给 WS subscribers。
+	proc.Relay.Close(string(status), &exitCode)
+}

internal/acp/supervisor_test.go

@@ -0,0 +1,245 @@
+//go:build integration
+
+// supervisor_test.go 集成测试 supervisor 的 spawn / handshake / kill / monitor /
+// onExit 全链路。复用 cmd/fake-acp-agent 子进程：
+//   - HappyPath：正常 spawn → handshake → 正常 Kill → 写 SessionExited
+//   - HangAgent：FAKE_ACP_HANG=true 让 agent 永不响应 → handshake 超时 → Spawn 返错
+//   - AgentCrashes：FAKE_ACP_CRASH_AFTER_PROMPTS=1 让 agent 处理一次 prompt 后 exit(1)
+//
+// 全部走 testcontainers PG，每测试一个独立容器（setupRepo 内 t.Cleanup）。
+package acp_test
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/yan1h/agent-coding-workflow/internal/acp"
+	"github.com/yan1h/agent-coding-workflow/internal/audit"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/notify"
+)
+
+// newSupervisorForTest 构造一个绑定到 PG 真实 audit Recorder 的 Supervisor，
+// 使用静音 logger + 默认 SupervisorConfig（5s SpawnTimeout 给 fake agent 留 buffer）。
+// withAudit=false 时 Recorder 为 nil，对应 onExit 跳过 audit 路径。
+func newSupervisorForTest(t *testing.T, pool *pgxpool.Pool, repo acp.Repository, withAudit bool) *acp.Supervisor {
+	t.Helper()
+	var rec audit.Recorder
+	if withAudit {
+		rec = audit.NewPostgresRecorder(pool)
+	}
+	disp := notify.NewDispatcher(notifyRepoStub{}, slogDiscard())
+	return acp.NewSupervisor(
+		repo, rec, disp,
+		nil, nil, // wtSvc / wsRepo: tests 用 IsMain=true，走 repo.ReleaseMainWorktree
+		testEncryptor(t),
+		acp.SupervisorConfig{
+			SpawnTimeout:       5 * time.Second,
+			KillGrace:          1 * time.Second,
+			StderrBufferLines:  50,
+			StderrTailBytes:    1000,
+			EventMaxPayload:    65536,
+			EventTruncateField: 4096,
+			ShutdownGrace:      5 * time.Second,
+		},
+		slogDiscard(),
+	)
+}
+
+// TestSupervisor_HappyPath_Spawn_Handshake 验证：
+//  1. Spawn 启动 fake-acp-agent 并完成 initialize + session/new
+//  2. UpdateSessionRunning 把 agent_session_id="fake-session-id" + pid 写入 DB
+//  3. Kill 触发 monitorProcess + onExit，session 落到 SessionExited
+func TestSupervisor_HappyPath_Spawn_Handshake(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	repo, pool := setupRepo(t)
+
+	uid := mustInsertUser(t, ctx, pool, "sup1@local", false)
+	pid, wsid := mustInsertProjectWorkspace(t, ctx, pool, uid)
+
+	bin := fakeAgentBinary(t)
+	k, err := repo.CreateAgentKind(ctx, &acp.AgentKind{
+		ID: uuid.New(), Name: "fake1", DisplayName: "Fake",
+		BinaryPath: bin, Args: []string{},
+		Enabled: true, CreatedBy: uid,
+	})
+	require.NoError(t, err)
+
+	cwd := t.TempDir()
+	sess, err := repo.InsertSession(ctx, &acp.Session{
+		ID: uuid.New(), WorkspaceID: wsid, ProjectID: pid,
+		AgentKindID: k.ID, UserID: uid,
+		Branch: "main", CwdPath: cwd, IsMainWorktree: true, Status: acp.SessionStarting,
+	})
+	require.NoError(t, err)
+
+	// onExit 会调 ReleaseMainWorktree → 必须先 Acquire 才能 Release（CAS 语义）。
+	ok, err := repo.AcquireMainWorktree(ctx, sess.ID, wsid)
+	require.NoError(t, err)
+	require.True(t, ok)
+
+	sup := newSupervisorForTest(t, pool, repo, true)
+	proc, err := sup.Spawn(ctx, sess, k)
+	require.NoError(t, err)
+	require.NotNil(t, proc)
+
+	got, err := repo.GetSessionByID(ctx, sess.ID)
+	require.NoError(t, err)
+	assert.Equal(t, acp.SessionRunning, got.Status)
+	require.NotNil(t, got.AgentSessionID)
+	assert.Equal(t, "fake-session-id", *got.AgentSessionID)
+	require.NotNil(t, got.PID)
+	assert.NotZero(t, *got.PID)
+
+	sup.Kill(ctx, sess.ID, 1*time.Second)
+
+	// monitorProcess + onExit 在 goroutine 里跑；轮询直到 DB 反映终态。
+	deadline := time.After(5 * time.Second)
+	for {
+		got, err = repo.GetSessionByID(ctx, sess.ID)
+		require.NoError(t, err)
+		if got.Status == acp.SessionExited || got.Status == acp.SessionCrashed {
+			break
+		}
+		select {
+		case <-deadline:
+			t.Fatalf("session never reached terminal state, last status=%s", got.Status)
+		case <-time.After(50 * time.Millisecond):
+		}
+	}
+	assert.Equal(t, acp.SessionExited, got.Status)
+}
+
+// TestSupervisor_HangAgent_HandshakeTimeout 验证：FAKE_ACP_HANG agent 永远不响应；
+// Spawn 在 SpawnTimeout 内返回 error，Kill 在内部触发 monitor → onExit → DB 终态。
+func TestSupervisor_HangAgent_HandshakeTimeout(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	repo, pool := setupRepo(t)
+
+	uid := mustInsertUser(t, ctx, pool, "sup2@local", false)
+	pid, wsid := mustInsertProjectWorkspace(t, ctx, pool, uid)
+
+	bin := fakeAgentBinary(t)
+	k, err := repo.CreateAgentKind(ctx, &acp.AgentKind{
+		ID: uuid.New(), Name: "fake-hang", DisplayName: "Fake",
+		BinaryPath: bin, Args: []string{},
+		EncryptedEnv: encryptForTest(t, map[string]string{"FAKE_ACP_HANG": "true"}),
+		Enabled:      true, CreatedBy: uid,
+	})
+	require.NoError(t, err)
+
+	sess, err := repo.InsertSession(ctx, &acp.Session{
+		ID: uuid.New(), WorkspaceID: wsid, ProjectID: pid,
+		AgentKindID: k.ID, UserID: uid,
+		Branch: "main", CwdPath: t.TempDir(), IsMainWorktree: true, Status: acp.SessionStarting,
+	})
+	require.NoError(t, err)
+	ok, err := repo.AcquireMainWorktree(ctx, sess.ID, wsid)
+	require.NoError(t, err)
+	require.True(t, ok)
+
+	// 用更短的 SpawnTimeout 加速测试（默认 5s 够，这里 1s 避免 CI 等太久）。
+	disp := notify.NewDispatcher(notifyRepoStub{}, slogDiscard())
+	sup := acp.NewSupervisor(
+		repo, audit.NewPostgresRecorder(pool), disp,
+		nil, nil, testEncryptor(t),
+		acp.SupervisorConfig{
+			SpawnTimeout:       1 * time.Second,
+			KillGrace:          500 * time.Millisecond,
+			StderrBufferLines:  10,
+			StderrTailBytes:    500,
+			EventMaxPayload:    65536,
+			EventTruncateField: 4096,
+			ShutdownGrace:      2 * time.Second,
+		},
+		slogDiscard(),
+	)
+
+	_, err = sup.Spawn(ctx, sess, k)
+	require.Error(t, err, "hang agent must trigger handshake timeout")
+
+	deadline := time.After(5 * time.Second)
+	for {
+		got, gerr := repo.GetSessionByID(ctx, sess.ID)
+		require.NoError(t, gerr)
+		if got.Status == acp.SessionCrashed || got.Status == acp.SessionExited {
+			// SIGKILL on hang agent 不属于 \"agent crashed by itself\"，
+			// supervisor 会标 KilledByUs → exited。两者都接受。
+			assert.Contains(t, []acp.SessionStatus{acp.SessionCrashed, acp.SessionExited}, got.Status)
+			return
+		}
+		select {
+		case <-deadline:
+			t.Fatalf("session never reached terminal state, last status=%s", got.Status)
+		case <-time.After(50 * time.Millisecond):
+		}
+	}
+}
+
+// TestSupervisor_AgentCrashes 验证：fake agent 在处理 1 次 prompt 后 os.Exit(1)；
+// monitorProcess 检测到非主动 Kill → status=SessionCrashed + exit_code=1，
+// onExit 写 DB + 调 Dispatcher.Dispatch + audit.Record。
+func TestSupervisor_AgentCrashes(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	repo, pool := setupRepo(t)
+
+	uid := mustInsertUser(t, ctx, pool, "sup3@local", false)
+	pid, wsid := mustInsertProjectWorkspace(t, ctx, pool, uid)
+
+	bin := fakeAgentBinary(t)
+	k, err := repo.CreateAgentKind(ctx, &acp.AgentKind{
+		ID: uuid.New(), Name: "fake-crash", DisplayName: "Fake",
+		BinaryPath: bin, Args: []string{},
+		EncryptedEnv: encryptForTest(t, map[string]string{"FAKE_ACP_CRASH_AFTER_PROMPTS": "1"}),
+		Enabled:      true, CreatedBy: uid,
+	})
+	require.NoError(t, err)
+
+	sess, err := repo.InsertSession(ctx, &acp.Session{
+		ID: uuid.New(), WorkspaceID: wsid, ProjectID: pid,
+		AgentKindID: k.ID, UserID: uid,
+		Branch: "main", CwdPath: t.TempDir(), IsMainWorktree: true, Status: acp.SessionStarting,
+	})
+	require.NoError(t, err)
+	ok, err := repo.AcquireMainWorktree(ctx, sess.ID, wsid)
+	require.NoError(t, err)
+	require.True(t, ok)
+
+	sup := newSupervisorForTest(t, pool, repo, true)
+	proc, err := sup.Spawn(ctx, sess, k)
+	require.NoError(t, err)
+	require.NotNil(t, proc)
+
+	// 通过 relay.SendClient 发一条 prompt → fake agent 处理后 exit(1)。
+	idJSON, _ := json.Marshal("client-1")
+	err = proc.Relay.SendClient(&acp.Message{
+		JSONRPC: "2.0", ID: idJSON, Method: "session/prompt",
+		Params: json.RawMessage(`{"sessionId":"fake-session-id","prompt":[{"type":"text","text":"x"}]}`),
+	})
+	require.NoError(t, err)
+
+	deadline := time.After(10 * time.Second)
+	for {
+		got, gerr := repo.GetSessionByID(ctx, sess.ID)
+		require.NoError(t, gerr)
+		if got.Status == acp.SessionCrashed {
+			require.NotNil(t, got.ExitCode)
+			assert.Equal(t, int32(1), *got.ExitCode)
+			return
+		}
+		select {
+		case <-deadline:
+			t.Fatalf("crash not detected, last status=%s", got.Status)
+		case <-time.After(100 * time.Millisecond):
+		}
+	}
+}

internal/acp/supervisor_unix.go

@@ -0,0 +1,23 @@
+//go:build !windows
+
+package acp
+
+import (
+	"syscall"
+	"time"
+)
+
+// unixGracefulTerm 在 Unix 平台上先发 SIGTERM，等待 grace 时间内退出；
+// 否则 Process.Kill。done channel 由 monitorProcess 关闭。
+func (s *Supervisor) unixGracefulTerm(proc *Process, grace time.Duration) {
+	if proc.Cmd.Process == nil {
+		return
+	}
+	_ = proc.Cmd.Process.Signal(syscall.SIGTERM)
+	select {
+	case <-proc.done:
+		return
+	case <-time.After(grace):
+		_ = proc.Cmd.Process.Kill()
+	}
+}

internal/acp/supervisor_windows.go

@@ -0,0 +1,14 @@
+//go:build windows
+
+package acp
+
+import "time"
+
+// unixGracefulTerm 在 Windows 上没有可靠的 SIGTERM 等价信号（CTRL_BREAK 仅
+// 对 console 子进程生效）。直接 Process.Kill，grace 参数不参与，仅签名一致。
+func (s *Supervisor) unixGracefulTerm(proc *Process, grace time.Duration) {
+	if proc.Cmd.Process == nil {
+		return
+	}
+	_ = proc.Cmd.Process.Kill()
+}

internal/acp/test_helpers_test.go

@@ -0,0 +1,86 @@
+//go:build integration
+
+// test_helpers_test.go 是 supervisor_test.go 的共享脚手架：
+//   - notifyRepoStub：满足 notify.Repository（5 方法），让 dispatcher 落库变成空操作
+//   - slogDiscard：丢弃日志的 logger
+//   - encryptForTest：用与 AgentKindService 相同格式产出加密 env（map → JSON → AES-GCM）
+//   - fakeAgentBinary：构建 cmd/fake-acp-agent 二进制供子进程 spawn
+//
+// 集成测试专用，不参与 go test 默认 build。
+package acp_test
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/yan1h/agent-coding-workflow/internal/infra/notify"
+)
+
+// notifyRepoStub 实现 notify.Repository 全部 5 方法。supervisor.onExit
+// 会通过 dispatcher 落库一条 crashed 通知，落库走 stub → 永远成功 + 不存。
+type notifyRepoStub struct{}
+
+func (notifyRepoStub) Insert(context.Context, notify.Message) error { return nil }
+func (notifyRepoStub) List(context.Context, uuid.UUID, bool, int) ([]notify.Message, error) {
+	return nil, nil
+}
+func (notifyRepoStub) CountUnread(context.Context, uuid.UUID) (int, error)  { return 0, nil }
+func (notifyRepoStub) MarkRead(context.Context, uuid.UUID, uuid.UUID) error { return nil }
+func (notifyRepoStub) MarkAllRead(context.Context, uuid.UUID) error         { return nil }
+
+// slogDiscard 返回静音 logger，避免测试输出污染。
+func slogDiscard() *slog.Logger { return slog.New(slog.NewTextHandler(io.Discard, nil)) }
+
+// encryptForTest 以 AgentKindService 同格式（JSON marshal → AES-GCM）产出
+// EncryptedEnv 字节，让 supervisor.decryptEnv 还原为同一 map。
+func encryptForTest(t *testing.T, m map[string]string) []byte {
+	t.Helper()
+	enc := testEncryptor(t)
+	plain, err := json.Marshal(m)
+	require.NoError(t, err)
+	out, err := enc.Encrypt(plain)
+	require.NoError(t, err)
+	return out
+}
+
+// repoRoot 从测试 cwd 向上找 go.mod，返回仓库根目录。t.TempDir + go build 用。
+func repoRoot(t *testing.T) string {
+	t.Helper()
+	wd, err := os.Getwd()
+	require.NoError(t, err)
+	for {
+		if _, err := os.Stat(filepath.Join(wd, "go.mod")); err == nil {
+			return wd
+		}
+		parent := filepath.Dir(wd)
+		if parent == wd {
+			t.Fatal("go.mod not found upward")
+		}
+		wd = parent
+	}
+}
+
+// fakeAgentBinary 编译 cmd/fake-acp-agent 到 t.TempDir() 并返回路径。
+// 测试结束后 t.TempDir 自动清理。
+func fakeAgentBinary(t *testing.T) string {
+	t.Helper()
+	bin := filepath.Join(t.TempDir(), "fake-acp-agent")
+	if runtime.GOOS == "windows" {
+		bin += ".exe"
+	}
+	cmd := exec.Command("go", "build", "-o", bin, "./cmd/fake-acp-agent")
+	cmd.Dir = repoRoot(t)
+	out, err := cmd.CombinedOutput()
+	require.NoError(t, err, "build fake-acp-agent: %s", out)
+	return bin
+}

internal/app/acp_integration_test.go

@@ -0,0 +1,498 @@
+//go:build integration
+
+// acp_integration_test.go — through-stack integration matrix for the ACP module
+// (spec §11.3, 14 scenarios).
+//
+// SCOPE: This file lays out the matrix of 14 scenarios as a scaffold + sub-tests.
+// Most scenarios are already covered at lower test layers; through-stack coverage
+// here ensures the wiring (HTTP → SessionService → Supervisor → Relay → fake-agent)
+// composes correctly under real testcontainers/Postgres + a real fake-agent
+// subprocess + a real chi router.
+//
+// Coverage map (lower-layer test ↔ this file):
+//
+//	Scenario                       Lower-layer coverage              This file
+//	-----------------------------  --------------------------------  -----------------
+//	CreateSessionSuccess           E3 TestSupervisor_HappyPath       ✓ scaffold + test
+//	WSStreamLiveEvents             G4 TestHandler_Session_E2E        deferred (G4 ≈)
+//	PromptAndCancel                D8 TestRelay_Call_RoundTrip*      deferred
+//	SpawnFailedBadBinary           E3 TestSupervisor_HangAgent       deferred
+//	HandshakeTimeout               E3 TestSupervisor_HangAgent       deferred
+//	ChildCrashed                   E3 TestSupervisor_AgentCrashes    deferred
+//	StartupReaper                  D1 ResetStuckSessionsOnRestart    deferred
+//	WSReconnectWithSince           D8 TestRelay_FanoutToSubscribers  deferred
+//	FsOutsideWorktreeRejected      D4 fs/read_text_file unit         deferred
+//	PerUserQuotaExceeded           F3 SessionService.Create unit     ✓ scaffold + test
+//	BranchConflict                 F3 SessionService.Create unit     ✓ scaffold + test
+//	MainWorktreeMutex              D1 AcquireMainWorktree unit       deferred
+//	DeleteAgentKindInUse           A11 repo TestPgRepo_DeleteInUse   deferred
+//	DisableAgentKindOK             A* AgentKindService unit          deferred
+//
+// DEFERRED scenarios remain as t.Skip stubs with the lower-layer test referenced.
+// Future work: fill them in using the same suite + helpers below.
+//
+// Build/run:
+//   go test -count=1 -tags=integration ./internal/app/... -run TestACPIntegration
+
+package app_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	tcpg "github.com/testcontainers/testcontainers-go/modules/postgres"
+
+	"github.com/yan1h/agent-coding-workflow/internal/acp"
+	"github.com/yan1h/agent-coding-workflow/internal/acp/handlers"
+	"github.com/yan1h/agent-coding-workflow/internal/audit"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/crypto"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/db"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/logger"
+	"github.com/yan1h/agent-coding-workflow/internal/infra/notify"
+	"github.com/yan1h/agent-coding-workflow/internal/project"
+	"github.com/yan1h/agent-coding-workflow/internal/transport/http/middleware"
+	"github.com/yan1h/agent-coding-workflow/internal/user"
+	"github.com/yan1h/agent-coding-workflow/internal/workspace"
+)
+
+func TestACPIntegration_Matrix(t *testing.T) {
+	if testing.Short() {
+		t.Skip("integration; needs docker + go build")
+	}
+	suite := newACPIntegrationSuite(t)
+	t.Cleanup(suite.cleanup)
+
+	// 14 scenarios per spec §11.3. Implemented = full through-stack assertion.
+	// Deferred = covered at lower test layers; sub-test t.Skip's with the reference.
+	t.Run("CreateSessionSuccess", suite.testCreateSessionSuccess)
+	t.Run("WSStreamLiveEvents", deferredAt("G4 TestHandler_Session_CreateAndWS_E2E"))
+	t.Run("PromptAndCancel", deferredAt("D8 TestRelay_*"))
+	t.Run("SpawnFailedBadBinary", deferredAt("E3 TestSupervisor_HangAgent"))
+	t.Run("HandshakeTimeout", deferredAt("E3 TestSupervisor_HangAgent_HandshakeTimeout"))
+	t.Run("ChildCrashed", deferredAt("E3 TestSupervisor_AgentCrashes"))
+	t.Run("StartupReaper", deferredAt("D1 unit + F4 reaper wiring inspection"))
+	t.Run("WSReconnectWithSince", deferredAt("D8 TestRelay_FanoutToSubscribers"))
+	t.Run("FsOutsideWorktreeRejected", deferredAt("D4 fs/read_text_file unit"))
+	t.Run("PerUserQuotaExceeded", suite.testPerUserQuotaExceeded)
+	t.Run("BranchConflict", suite.testBranchConflict)
+	t.Run("MainWorktreeMutex", deferredAt("D1 AcquireMainWorktree unit"))
+	t.Run("DeleteAgentKindInUse", deferredAt("A11 TestPgRepo_AgentKind_DeleteInUse"))
+	t.Run("DisableAgentKindOK", deferredAt("A* AgentKindService unit"))
+}
+
+// deferredAt returns a sub-test that t.Skip's with a pointer to the lower-layer
+// test that already covers the scenario.
+func deferredAt(ref string) func(t *testing.T) {
+	return func(t *testing.T) {
+		t.Skipf("covered at lower layer: %s", ref)
+	}
+}
+
+// acpIntegrationSuite holds shared state across the matrix sub-tests.
+type acpIntegrationSuite struct {
+	srv        *httptest.Server
+	pool       *pgxpool.Pool
+	adminToken string
+	userToken  string
+	wsID       uuid.UUID
+	fakeBin    string
+	cleanup    func()
+}
+
+func newACPIntegrationSuite(t *testing.T) *acpIntegrationSuite {
+	t.Helper()
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("git not available")
+	}
+
+	ctx := context.Background()
+
+	container, err := tcpg.Run(ctx, "postgres:16-alpine",
+		tcpg.WithDatabase("acw"),
+		tcpg.WithUsername("acw"),
+		tcpg.WithPassword("acw"),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = container.Terminate(ctx) })
+
+	dsn, err := container.ConnectionString(ctx, "sslmode=disable")
+	require.NoError(t, err)
+	require.NoError(t, db.Migrate(ctx, dsn, "file://../../migrations"))
+
+	pool, err := db.NewPool(ctx, dsn)
+	require.NoError(t, err)
+	t.Cleanup(pool.Close)
+
+	log := logger.New(logger.Options{Format: logger.FormatJSON, Level: logger.LevelInfo})
+
+	auditRec := audit.NewPostgresRecorder(pool)
+	encKey := make([]byte, 32)
+	for i := range encKey {
+		encKey[i] = byte(i + 1)
+	}
+	enc, err := crypto.NewEncryptor(encKey)
+	require.NoError(t, err)
+
+	userRepo := user.NewPostgresRepository(pool)
+	userSvc := user.NewService(userRepo, auditRec)
+
+	notifyRepo := notify.NewPostgresRepository(pool)
+	disp := notify.NewDispatcher(notifyRepo, log)
+
+	adminUser, err := userSvc.Bootstrap(ctx, "admin@local", "password123")
+	require.NoError(t, err)
+	require.NotNil(t, adminUser)
+
+	// Build the ACP supervisor + service against this DB.
+	acpRepo := acp.NewPostgresRepository(pool)
+
+	akSvc := acp.NewAgentKindService(acpRepo, enc, auditRec)
+
+	supCfg := acp.SupervisorConfig{
+		SpawnTimeout:       5 * time.Second,
+		KillGrace:          1 * time.Second,
+		StderrBufferLines:  50,
+		StderrTailBytes:    1000,
+		EventMaxPayload:    65536,
+		EventTruncateField: 4096,
+		ShutdownGrace:      5 * time.Second,
+	}
+	sup := acp.NewSupervisor(acpRepo, auditRec, disp, nil, nil, enc, supCfg, log)
+
+	// Minimal stubs for SessionService dependencies — sufficient for branch=main
+	// path (no wtSvc / wsRepo calls) and tests that exercise quota/conflict logic.
+	wsStub := &acpStubWsSvc{}
+	paStub := &acpStubProjectAccess{}
+
+	sessSvc := acp.NewSessionService(
+		acpRepo, wsStub, nil, nil, paStub, sup, auditRec,
+		acp.SessionServiceConfig{MaxActiveGlobal: 20, MaxActivePerUser: 3},
+	)
+
+	r := chi.NewRouter()
+	r.Use(middleware.RequestID)
+	user.NewHandler(userSvc).Mount(r)
+	acp.NewHandler(
+		akSvc, sessSvc, sup, acpRepo,
+		userSvc,
+		acpUserAdminAdapter{svc: userSvc},
+		enc,
+		acp.WSConfig{PingInterval: 30 * time.Second, PongTimeout: 10 * time.Second, SendBuffer: 64},
+	).Mount(r)
+
+	srv := httptest.NewServer(r)
+	t.Cleanup(srv.Close)
+
+	// Login admin → adminToken
+	adminToken := login(t, srv.URL, "admin@local", "password123")
+
+	// Provision a regular user via direct SQL + Login (user.Service has no public
+	// Create method; Bootstrap is idempotent admin-only). Hash matches user.NewService's
+	// expectation: bcrypt of "password123" produced by user package's hashing helper.
+	regularUserID := uuid.New()
+	regularEmail := "regular@local"
+	// Use Bootstrap on a fresh email to get a properly hashed user, then flip is_admin off.
+	regularUser, err := userSvc.Bootstrap(ctx, regularEmail, "password123")
+	require.NoError(t, err)
+	require.NotNil(t, regularUser)
+	regularUserID = regularUser.ID
+	_, err = pool.Exec(ctx, `UPDATE users SET is_admin = false WHERE id = $1`, regularUserID)
+	require.NoError(t, err)
+	userToken := login(t, srv.URL, regularEmail, "password123")
+
+	// Project + workspace rows. Direct SQL to avoid needing the full project handler
+	// here — the ACP path uses workspace.WorkspaceService.Get (stubbed) so the rows
+	// only need to exist for the ProjectAccess lookups SessionService performs.
+	pid := uuid.New()
+	wsID := uuid.New()
+	cwd := t.TempDir()
+	_, err = pool.Exec(ctx, `INSERT INTO projects (id, slug, name, owner_id) VALUES ($1, $2, 'p', $3)`,
+		pid, "p-acp-int", regularUser.ID)
+	require.NoError(t, err)
+	_, err = pool.Exec(ctx, `INSERT INTO workspaces
+		(id, project_id, slug, name, git_remote_url, main_path, default_branch)
+		VALUES ($1, $2, $3, 'w', 'git@x:y.git', $4, 'main')`,
+		wsID, pid, "ws-acp-int", cwd)
+	require.NoError(t, err)
+
+	// Acquire the workspace row for the stub to return.
+	wsRepoLocal := workspace.NewPostgresRepository(pool)
+	wsRow, err := wsRepoLocal.GetWorkspaceByID(ctx, wsID)
+	require.NoError(t, err)
+	wsStub.ws = wsRow
+	paStub.pid = pid
+
+	suite := &acpIntegrationSuite{
+		srv:        srv,
+		pool:       pool,
+		adminToken: adminToken,
+		userToken:  userToken,
+		wsID:       wsID,
+		fakeBin:    buildFakeAgent(t),
+	}
+	suite.cleanup = func() {
+		sup.ShutdownAll(context.Background())
+	}
+	return suite
+}
+
+// === Implemented sub-tests ===
+
+func (s *acpIntegrationSuite) testCreateSessionSuccess(t *testing.T) {
+	akID := s.createAgentKind(t, "fake-success", s.fakeBin, nil)
+
+	body, _ := json.Marshal(map[string]any{
+		"workspace_id": s.wsID.String(), "agent_kind_id": akID, "branch": "main",
+	})
+	resp := s.do(t, http.MethodPost, "/api/v1/acp/sessions", s.userToken, body)
+	require.Equal(t, http.StatusCreated, resp.StatusCode)
+
+	var dto struct {
+		ID     string `json:"id"`
+		Status string `json:"status"`
+	}
+	require.NoError(t, json.NewDecoder(resp.Body).Decode(&dto))
+	_ = resp.Body.Close()
+	assert.Equal(t, "starting", dto.Status)
+
+	s.waitFor(t, 10*time.Second, func() bool {
+		return s.getSession(t, dto.ID).Status == "running"
+	})
+}
+
+func (s *acpIntegrationSuite) testPerUserQuotaExceeded(t *testing.T) {
+	akID := s.createAgentKind(t, "fake-quota", s.fakeBin, nil)
+
+	// MaxActivePerUser=3 (set in suite). Create 3 sessions on distinct branches.
+	for i := 0; i < 3; i++ {
+		body, _ := json.Marshal(map[string]any{
+			"workspace_id":  s.wsID.String(),
+			"agent_kind_id": akID,
+			"branch":        "feat-q-" + strconv.Itoa(i),
+		})
+		resp := s.do(t, http.MethodPost, "/api/v1/acp/sessions", s.userToken, body)
+		require.Equal(t, http.StatusCreated, resp.StatusCode, "creating session %d", i)
+		_ = resp.Body.Close()
+	}
+
+	// 4th must 429.
+	body, _ := json.Marshal(map[string]any{
+		"workspace_id":  s.wsID.String(),
+		"agent_kind_id": akID,
+		"branch":        "feat-q-overflow",
+	})
+	resp := s.do(t, http.MethodPost, "/api/v1/acp/sessions", s.userToken, body)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusTooManyRequests, resp.StatusCode)
+}
+
+func (s *acpIntegrationSuite) testBranchConflict(t *testing.T) {
+	akID := s.createAgentKind(t, "fake-bc", s.fakeBin, nil)
+
+	first, _ := json.Marshal(map[string]any{
+		"workspace_id":  s.wsID.String(),
+		"agent_kind_id": akID,
+		"branch":        "main",
+	})
+	resp := s.do(t, http.MethodPost, "/api/v1/acp/sessions", s.userToken, first)
+	require.Equal(t, http.StatusCreated, resp.StatusCode)
+	_ = resp.Body.Close()
+
+	// Second request on same main branch: main worktree mutex blocks → 409.
+	resp2 := s.do(t, http.MethodPost, "/api/v1/acp/sessions", s.userToken, first)
+	defer resp2.Body.Close()
+	assert.Equal(t, http.StatusConflict, resp2.StatusCode)
+}
+
+// === Helper methods ===
+
+func (s *acpIntegrationSuite) do(t *testing.T, method, path, token string, body []byte) *http.Response {
+	t.Helper()
+	var rd io.Reader
+	if body != nil {
+		rd = bytes.NewReader(body)
+	}
+	req, _ := http.NewRequest(method, s.srv.URL+path, rd)
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	return resp
+}
+
+func (s *acpIntegrationSuite) createAgentKind(t *testing.T, name, bin string, env map[string]string) string {
+	t.Helper()
+	body := map[string]any{
+		"name": name, "display_name": name, "binary_path": bin,
+		"args": []string{}, "env": env, "enabled": true,
+	}
+	bjson, _ := json.Marshal(body)
+	resp := s.do(t, http.MethodPost, "/api/v1/acp/agent-kinds", s.adminToken, bjson)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusCreated, resp.StatusCode)
+	var dto struct {
+		ID string `json:"id"`
+	}
+	require.NoError(t, json.NewDecoder(resp.Body).Decode(&dto))
+	return dto.ID
+}
+
+type acpSessionDTO struct {
+	ID     string `json:"id"`
+	Status string `json:"status"`
+}
+
+func (s *acpIntegrationSuite) getSession(t *testing.T, sid string) acpSessionDTO {
+	t.Helper()
+	resp := s.do(t, http.MethodGet, "/api/v1/acp/sessions/"+sid, s.userToken, nil)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	var dto acpSessionDTO
+	require.NoError(t, json.NewDecoder(resp.Body).Decode(&dto))
+	return dto
+}
+
+func (s *acpIntegrationSuite) waitFor(t *testing.T, d time.Duration, pred func() bool) {
+	t.Helper()
+	deadline := time.Now().Add(d)
+	for time.Now().Before(deadline) {
+		if pred() {
+			return
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+	t.Fatal("waitFor: timeout")
+}
+
+// === Stubs / adapters ===
+
+type acpUserAdminAdapter struct{ svc user.Service }
+
+func (a acpUserAdminAdapter) IsAdmin(ctx context.Context, id uuid.UUID) (bool, error) {
+	u, err := a.svc.Get(ctx, id)
+	if err != nil {
+		return false, err
+	}
+	return u.IsAdmin, nil
+}
+
+// acpStubWsSvc is the minimal workspace.WorkspaceService stub needed for the
+// branch=main happy path (only Get is called).
+type acpStubWsSvc struct {
+	ws *workspace.Workspace
+}
+
+func (s *acpStubWsSvc) Get(_ context.Context, _ workspace.Caller, _ uuid.UUID) (*workspace.Workspace, error) {
+	return s.ws, nil
+}
+
+func (s *acpStubWsSvc) Create(context.Context, workspace.Caller, string, workspace.CreateWorkspaceInput) (*workspace.Workspace, error) {
+	return nil, fmt.Errorf("acpStubWsSvc.Create unused")
+}
+
+func (s *acpStubWsSvc) List(context.Context, workspace.Caller, string) ([]*workspace.Workspace, error) {
+	return nil, fmt.Errorf("acpStubWsSvc.List unused")
+}
+
+func (s *acpStubWsSvc) Update(context.Context, workspace.Caller, uuid.UUID, workspace.UpdateWorkspaceInput) (*workspace.Workspace, error) {
+	return nil, fmt.Errorf("acpStubWsSvc.Update unused")
+}
+
+func (s *acpStubWsSvc) Delete(context.Context, workspace.Caller, uuid.UUID) error {
+	return fmt.Errorf("acpStubWsSvc.Delete unused")
+}
+
+func (s *acpStubWsSvc) Sync(context.Context, workspace.Caller, uuid.UUID) (*workspace.Workspace, error) {
+	return nil, fmt.Errorf("acpStubWsSvc.Sync unused")
+}
+
+func (s *acpStubWsSvc) UpsertCredential(context.Context, workspace.Caller, uuid.UUID, workspace.UpsertCredentialInput) (*workspace.Credential, error) {
+	return nil, fmt.Errorf("acpStubWsSvc.UpsertCredential unused")
+}
+
+func (s *acpStubWsSvc) GetCredentialMeta(context.Context, workspace.Caller, uuid.UUID) (*workspace.Credential, error) {
+	return nil, fmt.Errorf("acpStubWsSvc.GetCredentialMeta unused")
+}
+
+// acpStubProjectAccess satisfies acp.ProjectAccess; only GetProjectByWorkspace is
+// exercised by the branch=main path.
+type acpStubProjectAccess struct {
+	pid uuid.UUID
+}
+
+func (s *acpStubProjectAccess) GetProjectByWorkspace(_ context.Context, _ uuid.UUID) (*project.Project, error) {
+	return &project.Project{ID: s.pid, Slug: "p-acp-int"}, nil
+}
+
+func (s *acpStubProjectAccess) GetIssueByNumber(context.Context, uuid.UUID, int) (*project.Issue, error) {
+	return nil, fmt.Errorf("acpStubProjectAccess.GetIssueByNumber unused")
+}
+
+func (s *acpStubProjectAccess) GetRequirementByNumber(context.Context, uuid.UUID, int) (*project.Requirement, error) {
+	return nil, fmt.Errorf("acpStubProjectAccess.GetRequirementByNumber unused")
+}
+
+// === Helpers ===
+
+// login posts /api/v1/auth/login and returns the bearer token.
+func login(t *testing.T, baseURL, email, password string) string {
+	t.Helper()
+	body, _ := json.Marshal(map[string]string{"email": email, "password": password})
+	resp, err := http.Post(baseURL+"/api/v1/auth/login", "application/json", bytes.NewReader(body))
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	var lr struct {
+		Token string `json:"token"`
+	}
+	require.NoError(t, json.NewDecoder(resp.Body).Decode(&lr))
+	require.NotEmpty(t, lr.Token)
+	return lr.Token
+}
+
+// buildFakeAgent compiles cmd/fake-acp-agent into t.TempDir and returns the path.
+func buildFakeAgent(t *testing.T) string {
+	t.Helper()
+	bin := filepath.Join(t.TempDir(), "fake-acp-agent")
+	if runtime.GOOS == "windows" {
+		bin += ".exe"
+	}
+	wd, _ := os.Getwd()
+	for {
+		if _, err := os.Stat(filepath.Join(wd, "go.mod")); err == nil {
+			break
+		}
+		parent := filepath.Dir(wd)
+		if parent == wd {
+			t.Fatal("repo root not found")
+		}
+		wd = parent
+	}
+	cmd := exec.Command("go", "build", "-o", bin, "./cmd/fake-acp-agent")
+	cmd.Dir = wd
+	out, err := cmd.CombinedOutput()
+	require.NoError(t, err, "build fake-acp-agent: %s", out)
+	return bin
+}
+
+// suppress unused import warnings while scaffold is partial:
+var _ = handlers.NewFsHandler
+var _ = strings.HasPrefix

internal/app/app.go

@@ -29,6 +29,7 @@ import (
 	"time"
 
 	"github.com/google/uuid"
+	"github.com/yan1h/agent-coding-workflow/internal/acp"
 	"github.com/yan1h/agent-coding-workflow/internal/audit"
 	"github.com/yan1h/agent-coding-workflow/internal/chat"
 	"github.com/yan1h/agent-coding-workflow/internal/config"
@@ -59,6 +60,7 @@ type App struct {
 	dispatcher *notify.Dispatcher
 	jobs       *jobs.Module
 	jobsCancel context.CancelFunc
+	acpSup     *acp.Supervisor // ACP supervisor — ShutdownAll on Run shutdown
 }
 
 // New 把所有模块按启动顺序拼装好。任何阶段失败都会返回错误，不留半成品资源。
@@ -249,6 +251,88 @@ func New(ctx context.Context, cfg *config.Config, dist embed.FS) (*App, error) {
 	chat.NewHandler(chatConvSvc, chatMsgSvc, chatTplSvc, chatEpSvc, chatUsageSvc,
 		chatUploader, userSvc, userAdminAdapter{svc: userSvc}).Mount(r)
 
+	// ===== ACP module wiring (Part 2: full SessionService + Supervisor) =====
+	acpRepo := acp.NewPostgresRepository(pool)
+	akSvc := acp.NewAgentKindService(acpRepo, enc, auditRec)
+
+	// Phase 1: startup reaper — recover sessions interrupted by previous crash.
+	// ResetStuckSessionsOnRestart marks all 'starting'/'running' sessions as 'crashed'
+	// and returns them; we release their worktrees and notify owners.
+	abortedSessions, rerr := acpRepo.ResetStuckSessionsOnRestart(ctx)
+	if rerr != nil {
+		log.Warn("acp.startup_reaper.reset_failed", "err", rerr.Error())
+	} else {
+		for _, sess := range abortedSessions {
+			if sess.IsMainWorktree {
+				if _, rerr := acpRepo.ReleaseMainWorktree(ctx, sess.WorkspaceID, sess.ID); rerr != nil {
+					log.Warn("acp.startup_reaper.release_main_failed",
+						"session_id", sess.ID, "err", rerr.Error())
+				}
+			} else {
+				if _, rerr := wtSvc.ReleaseByHolder(ctx, "session:"+sess.ID.String()); rerr != nil {
+					log.Warn("acp.startup_reaper.release_subwt_failed",
+						"session_id", sess.ID, "err", rerr.Error())
+				}
+			}
+			uid := sess.UserID
+			if rerr := auditRec.Record(ctx, audit.Entry{
+				UserID: &uid, Action: "acp.session.aborted_on_restart",
+				TargetType: "acp_session", TargetID: sess.ID.String(),
+				Metadata: map[string]any{
+					"agent_kind_id": sess.AgentKindID.String(),
+					"branch":        sess.Branch,
+				},
+			}); rerr != nil {
+				log.Warn("acp.startup_reaper.audit_failed",
+					"session_id", sess.ID, "err", rerr.Error())
+			}
+			if derr := notifyDispatcher.Dispatch(ctx, notify.Message{
+				UserID:   sess.UserID,
+				Topic:    "acp.session_crashed",
+				Severity: notify.SeverityWarning,
+				Title:    "ACP session terminated by server restart",
+				Body:     "Your session was interrupted while the server restarted.",
+				Metadata: map[string]any{
+					"session_id": sess.ID.String(),
+					"branch":     sess.Branch,
+				},
+			}); derr != nil {
+				log.Warn("acp.startup_reaper.notify_failed",
+					"session_id", sess.ID, "err", derr.Error())
+			}
+		}
+	}
+
+	// Phase 2: build supervisor + session service.
+	acpProjAccess := acpProjectAccessAdapter{wsRepo: wsRepo, projectRepo: projectRepo}
+	acpSup := acp.NewSupervisor(
+		acpRepo, auditRec, notifyDispatcher,
+		wtSvc, wsRepo, enc,
+		acp.SupervisorConfig{
+			SpawnTimeout:       cfg.Acp.SpawnTimeout,
+			KillGrace:          cfg.Acp.KillGrace,
+			StderrBufferLines:  cfg.Acp.StderrBufferLines,
+			StderrTailBytes:    cfg.Acp.StderrTailBytes,
+			EventMaxPayload:    cfg.Acp.EventMaxPayload,
+			EventTruncateField: cfg.Acp.EventTruncateField,
+			ShutdownGrace:      cfg.Acp.ShutdownGrace,
+		},
+		log,
+	)
+	sessSvc := acp.NewSessionService(
+		acpRepo, wsSvc, wtSvc, wsRepo,
+		acpProjAccess, acpSup, auditRec,
+		acp.SessionServiceConfig{
+			MaxActiveGlobal:  cfg.Acp.MaxActiveGlobal,
+			MaxActivePerUser: cfg.Acp.MaxActivePerUser,
+		},
+	)
+	acp.NewHandler(akSvc, sessSvc, acpSup, acpRepo, userSvc, userAdminAdapter{svc: userSvc}, enc, acp.WSConfig{
+		PingInterval: cfg.Acp.WSPingInterval,
+		PongTimeout:  cfg.Acp.WSPongTimeout,
+		SendBuffer:   cfg.Acp.WSSendBuffer,
+	}).Mount(r)
+
 	// ===== jobs module wiring =====
 	jobsRepo := jobs.NewPostgresRepository(pool)
 
@@ -289,6 +373,8 @@ func New(ctx context.Context, cfg *config.Config, dist embed.FS) (*App, error) {
 		log)
 	jobReaperRunner := runners.NewJobReaper(jobsRepo, cfg.Jobs.JobReaper.LeaseTimeout, log)
 	jobPurgeRunner := runners.NewJobPurge(jobsRepo, cfg.Jobs.JobPurge.CompletedRetention, log)
+	acpEventsPurgeRunner := runners.NewAcpEventsPurge(
+		acpEventsPurgeAdapter{repo: acpRepo}, cfg.Jobs.AcpEventsPurge.Retention, log)
 
 	deadLetterFn := func(ctx context.Context, job jobs.Job, herr error) {
 		errMsg := herr.Error()
@@ -359,6 +445,11 @@ func New(ctx context.Context, cfg *config.Config, dist embed.FS) (*App, error) {
 			Interval:           cfg.Jobs.JobPurge.Interval,
 			CompletedRetention: cfg.Jobs.JobPurge.CompletedRetention,
 		},
+		AcpEventsPurge: jobs.AcpEventsPurgeConfig{
+			Enabled:   cfg.Jobs.AcpEventsPurge.Enabled,
+			Interval:  cfg.Jobs.AcpEventsPurge.Interval,
+			Retention: cfg.Jobs.AcpEventsPurge.Retention,
+		},
 	}, jobs.ModuleDeps{
 		Repo: jobsRepo,
 		Handlers: map[jobs.JobType]jobs.Handler{
@@ -370,6 +461,7 @@ func New(ctx context.Context, cfg *config.Config, dist embed.FS) (*App, error) {
 			"attachment_cleanup": attCleanupRunner.Run,
 			"job_reaper":         jobReaperRunner.Run,
 			"job_purge":          jobPurgeRunner.Run,
+			"acp_events_purge":   acpEventsPurgeRunner.Run,
 		},
 		Clock:         clock.Real(),
 		Log:           log,
@@ -398,7 +490,13 @@ func New(ctx context.Context, cfg *config.Config, dist embed.FS) (*App, error) {
 		WriteTimeout:      60 * time.Second,
 		IdleTimeout:       120 * time.Second,
 	}
-	return &App{cfg: cfg, log: log, pool: pool, server: srv, dispatcher: notifyDispatcher, jobs: jobsModule, jobsCancel: jobsCancel}, nil
+	return &App{
+		cfg: cfg, log: log, pool: pool, server: srv,
+		dispatcher: notifyDispatcher,
+		jobs:       jobsModule,
+		jobsCancel: jobsCancel,
+		acpSup:     acpSup,
+	}, nil
 }
 
 // Run 启动 HTTP server 并阻塞直到 ctx 取消（Shutdown）或服务器报错。
@@ -422,6 +520,11 @@ func (a *App) Run(ctx context.Context) error {
 		if shutErr != nil {
 			a.log.Error("server shutdown", "err", shutErr.Error())
 		}
+		// Stop ACP subprocesses (kill child agents) BEFORE jobs/dispatcher drain so
+		// any final crash notifications dispatched by onExit can flow through.
+		if a.acpSup != nil {
+			a.acpSup.ShutdownAll(shutCtx)
+		}
 		// Stop jobs module first so no in-flight worker can dispatch new
 		// notifications after we begin to drain the dispatcher.
 		if a.jobs != nil && a.cfg.Jobs.Enabled {
@@ -444,6 +547,9 @@ func (a *App) Run(ctx context.Context) error {
 	case err := <-errCh:
 		drainCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 		defer cancel()
+		if a.acpSup != nil {
+			a.acpSup.ShutdownAll(drainCtx)
+		}
 		if a.jobs != nil && a.cfg.Jobs.Enabled {
 			a.jobsCancel()
 			stopCtx, stopCancel := context.WithTimeout(context.Background(), a.cfg.Jobs.ShutdownGrace+5*time.Second)
@@ -518,6 +624,29 @@ func projectACL(pj *project.Project, callerID uuid.UUID, isAdmin bool) (canRead,
 	return canRead, canWrite
 }
 
+// acpProjectAccessAdapter satisfies acp.ProjectAccess. It uses workspace.Repository
+// to resolve workspace → project, then project.Repository for issue/requirement.
+type acpProjectAccessAdapter struct {
+	wsRepo      workspace.Repository
+	projectRepo project.Repository
+}
+
+func (a acpProjectAccessAdapter) GetProjectByWorkspace(ctx context.Context, wsID uuid.UUID) (*project.Project, error) {
+	ws, err := a.wsRepo.GetWorkspaceByID(ctx, wsID)
+	if err != nil {
+		return nil, err
+	}
+	return a.projectRepo.GetProjectByID(ctx, ws.ProjectID)
+}
+
+func (a acpProjectAccessAdapter) GetIssueByNumber(ctx context.Context, projectID uuid.UUID, number int) (*project.Issue, error) {
+	return a.projectRepo.GetIssueByNumber(ctx, projectID, number)
+}
+
+func (a acpProjectAccessAdapter) GetRequirementByNumber(ctx context.Context, projectID uuid.UUID, number int) (*project.Requirement, error) {
+	return a.projectRepo.GetRequirementByNumber(ctx, projectID, number)
+}
+
 // ===== Adapters: bridge cross-module types into the narrow interfaces the
 // jobs/runners package expects, so the runners package never imports
 // workspace/chat/notify.
@@ -682,3 +811,11 @@ type dispatcherAdapter struct{ d *notify.Dispatcher }
 func (a dispatcherAdapter) Dispatch(ctx context.Context, msg notify.Message) error {
 	return a.d.Dispatch(ctx, msg)
 }
+
+// acpEventsPurgeAdapter exposes acp.Repository.PurgeEventsBefore as the narrow
+// interface required by runners.AcpEventsPurge.
+type acpEventsPurgeAdapter struct{ repo acp.Repository }
+
+func (a acpEventsPurgeAdapter) PurgeEventsBefore(ctx context.Context, before time.Time) (int64, error) {
+	return a.repo.PurgeEventsBefore(ctx, before)
+}

internal/audit/sqlc/models.go

@@ -10,6 +10,52 @@ import (
 	"github.com/jackc/pgx/v5/pgtype"
 )
 
+type AcpAgentKind struct {
+	ID           pgtype.UUID        `json:"id"`
+	Name         string             `json:"name"`
+	DisplayName  string             `json:"display_name"`
+	Description  string             `json:"description"`
+	BinaryPath   string             `json:"binary_path"`
+	Args         []string           `json:"args"`
+	EncryptedEnv []byte             `json:"encrypted_env"`
+	Enabled      bool               `json:"enabled"`
+	CreatedBy    pgtype.UUID        `json:"created_by"`
+	CreatedAt    pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt    pgtype.Timestamptz `json:"updated_at"`
+}
+
+type AcpEvent struct {
+	ID          int64              `json:"id"`
+	SessionID   pgtype.UUID        `json:"session_id"`
+	Direction   string             `json:"direction"`
+	RpcKind     string             `json:"rpc_kind"`
+	Method      *string            `json:"method"`
+	Payload     []byte             `json:"payload"`
+	PayloadSize int32              `json:"payload_size"`
+	Truncated   bool               `json:"truncated"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+}
+
+type AcpSession struct {
+	ID             pgtype.UUID        `json:"id"`
+	WorkspaceID    pgtype.UUID        `json:"workspace_id"`
+	ProjectID      pgtype.UUID        `json:"project_id"`
+	AgentKindID    pgtype.UUID        `json:"agent_kind_id"`
+	UserID         pgtype.UUID        `json:"user_id"`
+	IssueID        pgtype.UUID        `json:"issue_id"`
+	RequirementID  pgtype.UUID        `json:"requirement_id"`
+	AgentSessionID *string            `json:"agent_session_id"`
+	Branch         string             `json:"branch"`
+	CwdPath        string             `json:"cwd_path"`
+	IsMainWorktree bool               `json:"is_main_worktree"`
+	Status         string             `json:"status"`
+	Pid            *int32             `json:"pid"`
+	ExitCode       *int32             `json:"exit_code"`
+	LastError      *string            `json:"last_error"`
+	StartedAt      pgtype.Timestamptz `json:"started_at"`
+	EndedAt        pgtype.Timestamptz `json:"ended_at"`
+}
+
 type AuditLog struct {
 	ID         int64              `json:"id"`
 	UserID     pgtype.UUID        `json:"user_id"`
@@ -233,6 +279,7 @@ type Workspace struct {
 	LastSyncError       *string            `json:"last_sync_error"`
 	CreatedAt           pgtype.Timestamptz `json:"created_at"`
 	UpdatedAt           pgtype.Timestamptz `json:"updated_at"`
+	ActiveMainSessionID pgtype.UUID        `json:"active_main_session_id"`
 }
 
 type WorkspaceWorktree struct {

internal/chat/sqlc/models.go

@@ -10,6 +10,52 @@ import (
 	"github.com/jackc/pgx/v5/pgtype"
 )
 
+type AcpAgentKind struct {
+	ID           pgtype.UUID        `json:"id"`
+	Name         string             `json:"name"`
+	DisplayName  string             `json:"display_name"`
+	Description  string             `json:"description"`
+	BinaryPath   string             `json:"binary_path"`
+	Args         []string           `json:"args"`
+	EncryptedEnv []byte             `json:"encrypted_env"`
+	Enabled      bool               `json:"enabled"`
+	CreatedBy    pgtype.UUID        `json:"created_by"`
+	CreatedAt    pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt    pgtype.Timestamptz `json:"updated_at"`
+}
+
+type AcpEvent struct {
+	ID          int64              `json:"id"`
+	SessionID   pgtype.UUID        `json:"session_id"`
+	Direction   string             `json:"direction"`
+	RpcKind     string             `json:"rpc_kind"`
+	Method      *string            `json:"method"`
+	Payload     []byte             `json:"payload"`
+	PayloadSize int32              `json:"payload_size"`
+	Truncated   bool               `json:"truncated"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+}
+
+type AcpSession struct {
+	ID             pgtype.UUID        `json:"id"`
+	WorkspaceID    pgtype.UUID        `json:"workspace_id"`
+	ProjectID      pgtype.UUID        `json:"project_id"`
+	AgentKindID    pgtype.UUID        `json:"agent_kind_id"`
+	UserID         pgtype.UUID        `json:"user_id"`
+	IssueID        pgtype.UUID        `json:"issue_id"`
+	RequirementID  pgtype.UUID        `json:"requirement_id"`
+	AgentSessionID *string            `json:"agent_session_id"`
+	Branch         string             `json:"branch"`
+	CwdPath        string             `json:"cwd_path"`
+	IsMainWorktree bool               `json:"is_main_worktree"`
+	Status         string             `json:"status"`
+	Pid            *int32             `json:"pid"`
+	ExitCode       *int32             `json:"exit_code"`
+	LastError      *string            `json:"last_error"`
+	StartedAt      pgtype.Timestamptz `json:"started_at"`
+	EndedAt        pgtype.Timestamptz `json:"ended_at"`
+}
+
 type AuditLog struct {
 	ID         int64              `json:"id"`
 	UserID     pgtype.UUID        `json:"user_id"`
@@ -233,6 +279,7 @@ type Workspace struct {
 	LastSyncError       *string            `json:"last_sync_error"`
 	CreatedAt           pgtype.Timestamptz `json:"created_at"`
 	UpdatedAt           pgtype.Timestamptz `json:"updated_at"`
+	ActiveMainSessionID pgtype.UUID        `json:"active_main_session_id"`
 }
 
 type WorkspaceWorktree struct {

internal/config/config.go

@@ -41,6 +41,7 @@ type Config struct {
 	Storage   Storage         `mapstructure:"storage"`
 	Jobs      JobsConfig      `mapstructure:"jobs"`
 	Notify    NotifyConfig    `mapstructure:"notify"`
+	Acp       AcpConfig       `mapstructure:"acp"`
 }
 
 // HTTPConfig 描述 HTTP 服务监听参数。
@@ -119,6 +120,7 @@ type JobsConfig struct {
 	AttachmentCleanup AttachmentCleanupCfg `mapstructure:"attachment_cleanup"`
 	JobReaper         JobReaperCfg         `mapstructure:"job_reaper"`
 	JobPurge          JobPurgeCfg          `mapstructure:"job_purge"`
+	AcpEventsPurge    AcpEventsPurgeCfg    `mapstructure:"acp_events_purge"`
 }
 
 type RunnerCfg struct {
@@ -151,6 +153,12 @@ type JobPurgeCfg struct {
 	CompletedRetention time.Duration `mapstructure:"completed_retention"`
 }
 
+type AcpEventsPurgeCfg struct {
+	Enabled   bool          `mapstructure:"enabled"`
+	Interval  time.Duration `mapstructure:"interval"`
+	Retention time.Duration `mapstructure:"retention"`
+}
+
 // NotifyConfig 是 notify 模块的可选外发通道配置。当前仅 webhook。
 type NotifyConfig struct {
 	Webhook WebhookCfg `mapstructure:"webhook"`
@@ -165,6 +173,24 @@ type WebhookCfg struct {
 	Topics  []string      `mapstructure:"topics"`
 }
 
+// AcpConfig 控制 ACP 模块的并发限流、子进程超时、WS 心跳与事件保留。
+type AcpConfig struct {
+	Enabled            bool          `mapstructure:"enabled"`
+	MaxActiveGlobal    int           `mapstructure:"max_active_global"`
+	MaxActivePerUser   int           `mapstructure:"max_active_per_user"`
+	SpawnTimeout       time.Duration `mapstructure:"spawn_timeout"`
+	KillGrace          time.Duration `mapstructure:"kill_grace"`
+	StderrBufferLines  int           `mapstructure:"stderr_buffer_lines"`
+	StderrTailBytes    int           `mapstructure:"stderr_tail_bytes"`
+	WSPingInterval     time.Duration `mapstructure:"ws_ping_interval"`
+	WSPongTimeout      time.Duration `mapstructure:"ws_pong_timeout"`
+	WSSendBuffer       int           `mapstructure:"ws_send_buffer"`
+	EventMaxPayload    int           `mapstructure:"event_max_payload_bytes"`
+	EventTruncateField int           `mapstructure:"event_truncate_field_bytes"`
+	EventRetentionDays int           `mapstructure:"event_retention_days"`
+	ShutdownGrace      time.Duration `mapstructure:"shutdown_grace"`
+}
+
 // Load 从（按优先级递增）默认值 → 配置文件（如有）→ 环境变量 加载配置。
 // configFile 可为空字符串，仅用环境变量。
 func Load(configFile string) (*Config, error) {
@@ -208,8 +234,25 @@ func Load(configFile string) (*Config, error) {
 	v.SetDefault("jobs.job_purge.enabled", true)
 	v.SetDefault("jobs.job_purge.interval", "24h")
 	v.SetDefault("jobs.job_purge.completed_retention", "168h")
+	v.SetDefault("jobs.acp_events_purge.enabled", true)
+	v.SetDefault("jobs.acp_events_purge.interval", "24h")
+	v.SetDefault("jobs.acp_events_purge.retention", "168h")
 	v.SetDefault("notify.webhook.enabled", false)
 	v.SetDefault("notify.webhook.timeout", "10s")
+	v.SetDefault("acp.enabled", true)
+	v.SetDefault("acp.max_active_global", 20)
+	v.SetDefault("acp.max_active_per_user", 3)
+	v.SetDefault("acp.spawn_timeout", "30s")
+	v.SetDefault("acp.kill_grace", "5s")
+	v.SetDefault("acp.stderr_buffer_lines", 100)
+	v.SetDefault("acp.stderr_tail_bytes", 2000)
+	v.SetDefault("acp.ws_ping_interval", "30s")
+	v.SetDefault("acp.ws_pong_timeout", "60s")
+	v.SetDefault("acp.ws_send_buffer", 256)
+	v.SetDefault("acp.event_max_payload_bytes", 65536)
+	v.SetDefault("acp.event_truncate_field_bytes", 4096)
+	v.SetDefault("acp.event_retention_days", 7)
+	v.SetDefault("acp.shutdown_grace", "30s")
 
 	if configFile != "" {
 		v.SetConfigFile(configFile)

internal/infra/errs/errs.go

@@ -73,6 +73,19 @@ const (
 	CodeJobPayloadInvalid    Code = "job.payload_invalid"
 	CodeJobPayloadTooLarge   Code = "job.payload_too_large"
 	CodeWebhookNotConfigured Code = "webhook.not_configured"
+
+	// ACP 域
+	CodeAcpAgentKindNotFound      Code = "acp.agent_kind_not_found"
+	CodeAcpAgentKindDisabled      Code = "acp.agent_kind_disabled"
+	CodeAcpAgentKindInUse         Code = "acp.agent_kind_in_use"
+	CodeAcpSessionNotFound        Code = "acp.session_not_found"
+	CodeAcpSessionQuotaExceeded   Code = "acp.session_quota_exceeded"
+	CodeAcpSessionNotOwned        Code = "acp.session_not_owned"
+	CodeAcpSessionTerminated      Code = "acp.session_terminated"
+	CodeAcpSessionBranchConflict  Code = "acp.session_branch_conflict"
+	CodeAcpSpawnFailed            Code = "acp.spawn_failed"
+	CodeAcpHandshakeTimeout       Code = "acp.handshake_timeout"
+	CodeAcpFsPathOutsideWorktree  Code = "acp.fs_path_outside_worktree"
 )
 
 // AppError is the application's structured error type. It carries a stable
@@ -182,6 +195,19 @@ func HTTPStatus(code Code) int {
 		return http.StatusNotFound
 	case CodeJobInvalidType, CodeJobPayloadInvalid, CodeJobPayloadTooLarge:
 		return http.StatusBadRequest
+	case CodeAcpAgentKindNotFound, CodeAcpSessionNotFound:
+		return http.StatusNotFound
+	case CodeAcpAgentKindDisabled, CodeAcpAgentKindInUse,
+		CodeAcpSessionTerminated, CodeAcpSessionBranchConflict:
+		return http.StatusConflict
+	case CodeAcpSessionQuotaExceeded:
+		return http.StatusTooManyRequests
+	case CodeAcpSessionNotOwned:
+		return http.StatusForbidden
+	case CodeAcpSpawnFailed, CodeAcpHandshakeTimeout:
+		return http.StatusBadGateway
+	case CodeAcpFsPathOutsideWorktree:
+		return http.StatusInternalServerError
 	case CodeWebhookNotConfigured:
 		return http.StatusServiceUnavailable
 	default:

internal/infra/notify/sqlc/models.go

@@ -10,6 +10,52 @@ import (
 	"github.com/jackc/pgx/v5/pgtype"
 )
 
+type AcpAgentKind struct {
+	ID           pgtype.UUID        `json:"id"`
+	Name         string             `json:"name"`
+	DisplayName  string             `json:"display_name"`
+	Description  string             `json:"description"`
+	BinaryPath   string             `json:"binary_path"`
+	Args         []string           `json:"args"`
+	EncryptedEnv []byte             `json:"encrypted_env"`
+	Enabled      bool               `json:"enabled"`
+	CreatedBy    pgtype.UUID        `json:"created_by"`
+	CreatedAt    pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt    pgtype.Timestamptz `json:"updated_at"`
+}
+
+type AcpEvent struct {
+	ID          int64              `json:"id"`
+	SessionID   pgtype.UUID        `json:"session_id"`
+	Direction   string             `json:"direction"`
+	RpcKind     string             `json:"rpc_kind"`
+	Method      *string            `json:"method"`
+	Payload     []byte             `json:"payload"`
+	PayloadSize int32              `json:"payload_size"`
+	Truncated   bool               `json:"truncated"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+}
+
+type AcpSession struct {
+	ID             pgtype.UUID        `json:"id"`
+	WorkspaceID    pgtype.UUID        `json:"workspace_id"`
+	ProjectID      pgtype.UUID        `json:"project_id"`
+	AgentKindID    pgtype.UUID        `json:"agent_kind_id"`
+	UserID         pgtype.UUID        `json:"user_id"`
+	IssueID        pgtype.UUID        `json:"issue_id"`
+	RequirementID  pgtype.UUID        `json:"requirement_id"`
+	AgentSessionID *string            `json:"agent_session_id"`
+	Branch         string             `json:"branch"`
+	CwdPath        string             `json:"cwd_path"`
+	IsMainWorktree bool               `json:"is_main_worktree"`
+	Status         string             `json:"status"`
+	Pid            *int32             `json:"pid"`
+	ExitCode       *int32             `json:"exit_code"`
+	LastError      *string            `json:"last_error"`
+	StartedAt      pgtype.Timestamptz `json:"started_at"`
+	EndedAt        pgtype.Timestamptz `json:"ended_at"`
+}
+
 type AuditLog struct {
 	ID         int64              `json:"id"`
 	UserID     pgtype.UUID        `json:"user_id"`
@@ -233,6 +279,7 @@ type Workspace struct {
 	LastSyncError       *string            `json:"last_sync_error"`
 	CreatedAt           pgtype.Timestamptz `json:"created_at"`
 	UpdatedAt           pgtype.Timestamptz `json:"updated_at"`
+	ActiveMainSessionID pgtype.UUID        `json:"active_main_session_id"`
 }
 
 type WorkspaceWorktree struct {

internal/jobs/domain.go

@@ -120,6 +120,13 @@ type JobPurgeConfig struct {
 	CompletedRetention time.Duration
 }
 
+// AcpEventsPurgeConfig extends RunnerConfig with acp_events retention.
+type AcpEventsPurgeConfig struct {
+	Enabled   bool
+	Interval  time.Duration
+	Retention time.Duration
+}
+
 // Config is the full jobs.Module configuration.
 type Config struct {
 	Enabled           bool
@@ -130,4 +137,5 @@ type Config struct {
 	AttachmentCleanup AttachmentCleanupConfig
 	JobReaper         JobReaperConfig
 	JobPurge          JobPurgeConfig
+	AcpEventsPurge    AcpEventsPurgeConfig
 }

internal/jobs/module.go

@@ -129,6 +129,8 @@ func scheduleEntry(cfg Config, name string) (schedEntry, bool) {
 		return schedEntry{cfg.JobReaper.Interval, cfg.JobReaper.Enabled}, true
 	case "job_purge":
 		return schedEntry{cfg.JobPurge.Interval, cfg.JobPurge.Enabled}, true
+	case "acp_events_purge":
+		return schedEntry{cfg.AcpEventsPurge.Interval, cfg.AcpEventsPurge.Enabled}, true
 	}
 	return schedEntry{0, false}, false
 }

internal/jobs/runners/acp_events_purge.go

@@ -0,0 +1,41 @@
+package runners
+
+import (
+	"context"
+	"log/slog"
+	"time"
+)
+
+// AcpEventsPurgeRepo is the minimal repo surface this runner needs.
+// internal/acp.Repository satisfies it via an adapter in app.go.
+type AcpEventsPurgeRepo interface {
+	PurgeEventsBefore(ctx context.Context, before time.Time) (int64, error)
+}
+
+// AcpEventsPurge deletes acp_events older than retention. Periodic; idempotent.
+type AcpEventsPurge struct {
+	repo      AcpEventsPurgeRepo
+	retention time.Duration
+	log       *slog.Logger
+}
+
+// NewAcpEventsPurge builds the purger.
+func NewAcpEventsPurge(repo AcpEventsPurgeRepo, retention time.Duration, log *slog.Logger) *AcpEventsPurge {
+	if log == nil {
+		log = slog.Default()
+	}
+	return &AcpEventsPurge{repo: repo, retention: retention, log: log}
+}
+
+// Run purges once.
+func (r *AcpEventsPurge) Run(ctx context.Context) {
+	cutoff := time.Now().Add(-r.retention)
+	rows, err := r.repo.PurgeEventsBefore(ctx, cutoff)
+	if err != nil {
+		r.log.Error("acp_events.purge", "err", err.Error())
+		return
+	}
+	if rows > 0 {
+		r.log.Info("acp_events.purged", "count", rows, "before", cutoff.UTC().Format(time.RFC3339))
+	}
+}

internal/jobs/runners/acp_events_purge_test.go

@@ -0,0 +1,60 @@
+package runners_test
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/yan1h/agent-coding-workflow/internal/jobs/runners"
+)
+
+type fakeAcpEventsPurgeRepo struct {
+	purged         int64
+	purgeErr       error
+	capturedCutoff time.Time
+	called         bool
+}
+
+func (f *fakeAcpEventsPurgeRepo) PurgeEventsBefore(_ context.Context, before time.Time) (int64, error) {
+	f.called = true
+	f.capturedCutoff = before
+	if f.purgeErr != nil {
+		return 0, f.purgeErr
+	}
+	return f.purged, nil
+}
+
+func TestAcpEventsPurge_RunCallsPurgeWithCorrectCutoff(t *testing.T) {
+	t.Parallel()
+	repo := &fakeAcpEventsPurgeRepo{purged: 5}
+	retention := 168 * time.Hour
+	r := runners.NewAcpEventsPurge(repo, retention, discardLogger())
+	before := time.Now()
+	r.Run(context.Background())
+	after := time.Now()
+	require.True(t, repo.called)
+	expectedFloor := before.Add(-retention).Add(-time.Second)
+	expectedCeil := after.Add(-retention).Add(time.Second)
+	assert.True(t, !repo.capturedCutoff.Before(expectedFloor) && !repo.capturedCutoff.After(expectedCeil),
+		"cutoff %s outside [%s, %s]", repo.capturedCutoff, expectedFloor, expectedCeil)
+}
+
+func TestAcpEventsPurge_RunErrorDoesNotPanic(t *testing.T) {
+	t.Parallel()
+	repo := &fakeAcpEventsPurgeRepo{purgeErr: errors.New("db down")}
+	r := runners.NewAcpEventsPurge(repo, time.Hour, discardLogger())
+	require.NotPanics(t, func() { r.Run(context.Background()) })
+	assert.True(t, repo.called)
+}
+
+func TestAcpEventsPurge_NoRowsIsNoOp(t *testing.T) {
+	t.Parallel()
+	repo := &fakeAcpEventsPurgeRepo{purged: 0}
+	r := runners.NewAcpEventsPurge(repo, time.Hour, discardLogger())
+	require.NotPanics(t, func() { r.Run(context.Background()) })
+	assert.True(t, repo.called)
+}

internal/jobs/sqlc/models.go

@@ -10,6 +10,52 @@ import (
 	"github.com/jackc/pgx/v5/pgtype"
 )
 
+type AcpAgentKind struct {
+	ID           pgtype.UUID        `json:"id"`
+	Name         string             `json:"name"`
+	DisplayName  string             `json:"display_name"`
+	Description  string             `json:"description"`
+	BinaryPath   string             `json:"binary_path"`
+	Args         []string           `json:"args"`
+	EncryptedEnv []byte             `json:"encrypted_env"`
+	Enabled      bool               `json:"enabled"`
+	CreatedBy    pgtype.UUID        `json:"created_by"`
+	CreatedAt    pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt    pgtype.Timestamptz `json:"updated_at"`
+}
+
+type AcpEvent struct {
+	ID          int64              `json:"id"`
+	SessionID   pgtype.UUID        `json:"session_id"`
+	Direction   string             `json:"direction"`
+	RpcKind     string             `json:"rpc_kind"`
+	Method      *string            `json:"method"`
+	Payload     []byte             `json:"payload"`
+	PayloadSize int32              `json:"payload_size"`
+	Truncated   bool               `json:"truncated"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+}
+
+type AcpSession struct {
+	ID             pgtype.UUID        `json:"id"`
+	WorkspaceID    pgtype.UUID        `json:"workspace_id"`
+	ProjectID      pgtype.UUID        `json:"project_id"`
+	AgentKindID    pgtype.UUID        `json:"agent_kind_id"`
+	UserID         pgtype.UUID        `json:"user_id"`
+	IssueID        pgtype.UUID        `json:"issue_id"`
+	RequirementID  pgtype.UUID        `json:"requirement_id"`
+	AgentSessionID *string            `json:"agent_session_id"`
+	Branch         string             `json:"branch"`
+	CwdPath        string             `json:"cwd_path"`
+	IsMainWorktree bool               `json:"is_main_worktree"`
+	Status         string             `json:"status"`
+	Pid            *int32             `json:"pid"`
+	ExitCode       *int32             `json:"exit_code"`
+	LastError      *string            `json:"last_error"`
+	StartedAt      pgtype.Timestamptz `json:"started_at"`
+	EndedAt        pgtype.Timestamptz `json:"ended_at"`
+}
+
 type AuditLog struct {
 	ID         int64              `json:"id"`
 	UserID     pgtype.UUID        `json:"user_id"`
@@ -233,6 +279,7 @@ type Workspace struct {
 	LastSyncError       *string            `json:"last_sync_error"`
 	CreatedAt           pgtype.Timestamptz `json:"created_at"`
 	UpdatedAt           pgtype.Timestamptz `json:"updated_at"`
+	ActiveMainSessionID pgtype.UUID        `json:"active_main_session_id"`
 }
 
 type WorkspaceWorktree struct {

internal/project/sqlc/models.go

@@ -10,6 +10,52 @@ import (
 	"github.com/jackc/pgx/v5/pgtype"
 )
 
+type AcpAgentKind struct {
+	ID           pgtype.UUID        `json:"id"`
+	Name         string             `json:"name"`
+	DisplayName  string             `json:"display_name"`
+	Description  string             `json:"description"`
+	BinaryPath   string             `json:"binary_path"`
+	Args         []string           `json:"args"`
+	EncryptedEnv []byte             `json:"encrypted_env"`
+	Enabled      bool               `json:"enabled"`
+	CreatedBy    pgtype.UUID        `json:"created_by"`
+	CreatedAt    pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt    pgtype.Timestamptz `json:"updated_at"`
+}
+
+type AcpEvent struct {
+	ID          int64              `json:"id"`
+	SessionID   pgtype.UUID        `json:"session_id"`
+	Direction   string             `json:"direction"`
+	RpcKind     string             `json:"rpc_kind"`
+	Method      *string            `json:"method"`
+	Payload     []byte             `json:"payload"`
+	PayloadSize int32              `json:"payload_size"`
+	Truncated   bool               `json:"truncated"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+}
+
+type AcpSession struct {
+	ID             pgtype.UUID        `json:"id"`
+	WorkspaceID    pgtype.UUID        `json:"workspace_id"`
+	ProjectID      pgtype.UUID        `json:"project_id"`
+	AgentKindID    pgtype.UUID        `json:"agent_kind_id"`
+	UserID         pgtype.UUID        `json:"user_id"`
+	IssueID        pgtype.UUID        `json:"issue_id"`
+	RequirementID  pgtype.UUID        `json:"requirement_id"`
+	AgentSessionID *string            `json:"agent_session_id"`
+	Branch         string             `json:"branch"`
+	CwdPath        string             `json:"cwd_path"`
+	IsMainWorktree bool               `json:"is_main_worktree"`
+	Status         string             `json:"status"`
+	Pid            *int32             `json:"pid"`
+	ExitCode       *int32             `json:"exit_code"`
+	LastError      *string            `json:"last_error"`
+	StartedAt      pgtype.Timestamptz `json:"started_at"`
+	EndedAt        pgtype.Timestamptz `json:"ended_at"`
+}
+
 type AuditLog struct {
 	ID         int64              `json:"id"`
 	UserID     pgtype.UUID        `json:"user_id"`
@@ -233,6 +279,7 @@ type Workspace struct {
 	LastSyncError       *string            `json:"last_sync_error"`
 	CreatedAt           pgtype.Timestamptz `json:"created_at"`
 	UpdatedAt           pgtype.Timestamptz `json:"updated_at"`
+	ActiveMainSessionID pgtype.UUID        `json:"active_main_session_id"`
 }
 
 type WorkspaceWorktree struct {

internal/transport/http/middleware/auth.go

@@ -99,11 +99,19 @@ func UserIDFromContext(ctx context.Context) (uuid.UUID, bool) {
 // prefix; case-insensitive matching is intentionally NOT performed
 // because RFC 6750 specifies the literal "Bearer" scheme name and being
 // strict here keeps the parsing surface small.
+//
+// As a fallback, ?token= query parameter is accepted for endpoints that
+// cannot send custom headers (notably browser-native WebSocket connections).
+// Callers must keep token lifetimes short so the URL-borne token is not a
+// long-lived secret should it be logged by intermediaries.
 func extractBearer(r *http.Request) string {
 	h := r.Header.Get("Authorization")
 	const prefix = "Bearer "
-	if !strings.HasPrefix(h, prefix) {
-		return ""
-	}
+	if strings.HasPrefix(h, prefix) {
 		return strings.TrimSpace(h[len(prefix):])
+	}
+	if q := r.URL.Query().Get("token"); q != "" {
+		return q
+	}
+	return ""
 }

internal/user/sqlc/models.go

@@ -10,6 +10,52 @@ import (
 	"github.com/jackc/pgx/v5/pgtype"
 )
 
+type AcpAgentKind struct {
+	ID           pgtype.UUID        `json:"id"`
+	Name         string             `json:"name"`
+	DisplayName  string             `json:"display_name"`
+	Description  string             `json:"description"`
+	BinaryPath   string             `json:"binary_path"`
+	Args         []string           `json:"args"`
+	EncryptedEnv []byte             `json:"encrypted_env"`
+	Enabled      bool               `json:"enabled"`
+	CreatedBy    pgtype.UUID        `json:"created_by"`
+	CreatedAt    pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt    pgtype.Timestamptz `json:"updated_at"`
+}
+
+type AcpEvent struct {
+	ID          int64              `json:"id"`
+	SessionID   pgtype.UUID        `json:"session_id"`
+	Direction   string             `json:"direction"`
+	RpcKind     string             `json:"rpc_kind"`
+	Method      *string            `json:"method"`
+	Payload     []byte             `json:"payload"`
+	PayloadSize int32              `json:"payload_size"`
+	Truncated   bool               `json:"truncated"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+}
+
+type AcpSession struct {
+	ID             pgtype.UUID        `json:"id"`
+	WorkspaceID    pgtype.UUID        `json:"workspace_id"`
+	ProjectID      pgtype.UUID        `json:"project_id"`
+	AgentKindID    pgtype.UUID        `json:"agent_kind_id"`
+	UserID         pgtype.UUID        `json:"user_id"`
+	IssueID        pgtype.UUID        `json:"issue_id"`
+	RequirementID  pgtype.UUID        `json:"requirement_id"`
+	AgentSessionID *string            `json:"agent_session_id"`
+	Branch         string             `json:"branch"`
+	CwdPath        string             `json:"cwd_path"`
+	IsMainWorktree bool               `json:"is_main_worktree"`
+	Status         string             `json:"status"`
+	Pid            *int32             `json:"pid"`
+	ExitCode       *int32             `json:"exit_code"`
+	LastError      *string            `json:"last_error"`
+	StartedAt      pgtype.Timestamptz `json:"started_at"`
+	EndedAt        pgtype.Timestamptz `json:"ended_at"`
+}
+
 type AuditLog struct {
 	ID         int64              `json:"id"`
 	UserID     pgtype.UUID        `json:"user_id"`
@@ -233,6 +279,7 @@ type Workspace struct {
 	LastSyncError       *string            `json:"last_sync_error"`
 	CreatedAt           pgtype.Timestamptz `json:"created_at"`
 	UpdatedAt           pgtype.Timestamptz `json:"updated_at"`
+	ActiveMainSessionID pgtype.UUID        `json:"active_main_session_id"`
 }
 
 type WorkspaceWorktree struct {

internal/workspace/domain.go

@@ -112,14 +112,21 @@ type FetchTarget struct {
 }
 
 // Caller 表示发起请求的用户上下文。Service 据此判定鉴权与 holder 字符串。
+// SessionID 非 nil 时，Holder() 返回 "session:<uuid>"（ACP 模块用），
+// 否则返回 "user:<uuid>"。
 type Caller struct {
 	UserID    uuid.UUID
 	IsAdmin   bool
+	SessionID *uuid.UUID
 }
 
-// Holder 把 Caller 折成 acquire_holder 字符串。Plan #4 的 ACP supervisor 会用
-// "session:<sid>" 形式调相同接口。
+// Holder 把 Caller 折成 acquire_holder 字符串。
+//   - SessionID 非 nil → "session:<sid>"（ACP supervisor）
+//   - 否则 → "user:<uid>"（普通 HTTP 调用）
 func (c Caller) Holder() string {
+	if c.SessionID != nil {
+		return "session:" + c.SessionID.String()
+	}
 	return "user:" + c.UserID.String()
 }
 
@@ -147,6 +154,10 @@ type WorktreeService interface {
 	Delete(ctx context.Context, c Caller, wtID uuid.UUID) error
 	Acquire(ctx context.Context, c Caller, wtID uuid.UUID) (*Worktree, error)
 	Release(ctx context.Context, c Caller, wtID uuid.UUID) (*Worktree, error)
+	// ReleaseByHolder 按 holder 字符串释放所有该 holder 持有的 worktree。
+	// 由 ACP startup reaper / supervisor.onExit 在不知道 wtID 时使用。
+	// 不写 audit（caller 自己写 — audit 上下文是 caller 知道的）。
+	ReleaseByHolder(ctx context.Context, holder string) ([]*Worktree, error)
 }
 
 // GitOpsService 暴露 status/commit/push 操作。target 既可以是 Workspace（main_path）

internal/workspace/queries/worktrees.sql

@@ -81,3 +81,13 @@ DELETE FROM workspace_worktrees WHERE id = $1;
 UPDATE workspace_worktrees
    SET status = 'idle'
  WHERE id = $1 AND status = 'pruning';
+
+-- name: ReleaseWorktreesByHolder :many
+UPDATE workspace_worktrees
+SET status = 'idle',
+    active_holder = NULL,
+    acquired_at = NULL,
+    last_used_at = now(),
+    prune_warning_at = NULL
+WHERE active_holder = $1 AND status = 'active'
+RETURNING *;

internal/workspace/repository.go

@@ -58,6 +58,9 @@ type Repository interface {
 	TryStartPrune(ctx context.Context, id uuid.UUID) (*Worktree, error)
 	FinishPruneSuccess(ctx context.Context, id uuid.UUID) error
 	FinishPruneRollback(ctx context.Context, id uuid.UUID) error
+	// ReleaseWorktreesByHolder 一次性释放某 holder 持有的所有活跃 worktree。
+	// 用于 ACP 启动 reaper / supervisor.onExit 不知道具体 wtID 时的清理。
+	ReleaseWorktreesByHolder(ctx context.Context, holder string) ([]*Worktree, error)
 
 	// Workspace fetch (jobs runner)
 	ListFetchTargets(ctx context.Context) ([]FetchTarget, error)
@@ -403,6 +406,18 @@ func (r *pgRepo) FinishPruneRollback(ctx context.Context, id uuid.UUID) error {
 	return nil
 }
 
+func (r *pgRepo) ReleaseWorktreesByHolder(ctx context.Context, holder string) ([]*Worktree, error) {
+	rows, err := r.q.ReleaseWorktreesByHolder(ctx, &holder)
+	if err != nil {
+		return nil, errs.Wrap(err, errs.CodeInternal, "release worktrees by holder")
+	}
+	out := make([]*Worktree, 0, len(rows))
+	for _, row := range rows {
+		out = append(out, rowToWorktree(row))
+	}
+	return out, nil
+}
+
 // ===== Credential =====
 
 func rowToCredential(r workspacesqlc.GitCredential) *Credential {

internal/workspace/sqlc/models.go

@@ -10,6 +10,52 @@ import (
 	"github.com/jackc/pgx/v5/pgtype"
 )
 
+type AcpAgentKind struct {
+	ID           pgtype.UUID        `json:"id"`
+	Name         string             `json:"name"`
+	DisplayName  string             `json:"display_name"`
+	Description  string             `json:"description"`
+	BinaryPath   string             `json:"binary_path"`
+	Args         []string           `json:"args"`
+	EncryptedEnv []byte             `json:"encrypted_env"`
+	Enabled      bool               `json:"enabled"`
+	CreatedBy    pgtype.UUID        `json:"created_by"`
+	CreatedAt    pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt    pgtype.Timestamptz `json:"updated_at"`
+}
+
+type AcpEvent struct {
+	ID          int64              `json:"id"`
+	SessionID   pgtype.UUID        `json:"session_id"`
+	Direction   string             `json:"direction"`
+	RpcKind     string             `json:"rpc_kind"`
+	Method      *string            `json:"method"`
+	Payload     []byte             `json:"payload"`
+	PayloadSize int32              `json:"payload_size"`
+	Truncated   bool               `json:"truncated"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+}
+
+type AcpSession struct {
+	ID             pgtype.UUID        `json:"id"`
+	WorkspaceID    pgtype.UUID        `json:"workspace_id"`
+	ProjectID      pgtype.UUID        `json:"project_id"`
+	AgentKindID    pgtype.UUID        `json:"agent_kind_id"`
+	UserID         pgtype.UUID        `json:"user_id"`
+	IssueID        pgtype.UUID        `json:"issue_id"`
+	RequirementID  pgtype.UUID        `json:"requirement_id"`
+	AgentSessionID *string            `json:"agent_session_id"`
+	Branch         string             `json:"branch"`
+	CwdPath        string             `json:"cwd_path"`
+	IsMainWorktree bool               `json:"is_main_worktree"`
+	Status         string             `json:"status"`
+	Pid            *int32             `json:"pid"`
+	ExitCode       *int32             `json:"exit_code"`
+	LastError      *string            `json:"last_error"`
+	StartedAt      pgtype.Timestamptz `json:"started_at"`
+	EndedAt        pgtype.Timestamptz `json:"ended_at"`
+}
+
 type AuditLog struct {
 	ID         int64              `json:"id"`
 	UserID     pgtype.UUID        `json:"user_id"`
@@ -233,6 +279,7 @@ type Workspace struct {
 	LastSyncError       *string            `json:"last_sync_error"`
 	CreatedAt           pgtype.Timestamptz `json:"created_at"`
 	UpdatedAt           pgtype.Timestamptz `json:"updated_at"`
+	ActiveMainSessionID pgtype.UUID        `json:"active_main_session_id"`
 }
 
 type WorkspaceWorktree struct {

internal/workspace/sqlc/workspaces.sql.go

@@ -16,7 +16,7 @@ INSERT INTO workspaces (
   id, project_id, slug, name, description,
   git_remote_url, default_branch, main_path, sync_status
 ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
-RETURNING id, project_id, slug, name, description, git_remote_url, default_branch, main_path, sync_status, last_synced_at, last_sync_error, created_at, updated_at
+RETURNING id, project_id, slug, name, description, git_remote_url, default_branch, main_path, sync_status, last_synced_at, last_sync_error, created_at, updated_at, active_main_session_id
 `
 
 type CreateWorkspaceParams struct {
@@ -58,6 +58,7 @@ func (q *Queries) CreateWorkspace(ctx context.Context, arg CreateWorkspaceParams
 		&i.LastSyncError,
 		&i.CreatedAt,
 		&i.UpdatedAt,
+		&i.ActiveMainSessionID,
 	)
 	return i, err
 }
@@ -72,7 +73,7 @@ func (q *Queries) DeleteWorkspace(ctx context.Context, id pgtype.UUID) error {
 }
 
 const getWorkspaceByID = `-- name: GetWorkspaceByID :one
-SELECT id, project_id, slug, name, description, git_remote_url, default_branch, main_path, sync_status, last_synced_at, last_sync_error, created_at, updated_at FROM workspaces WHERE id = $1
+SELECT id, project_id, slug, name, description, git_remote_url, default_branch, main_path, sync_status, last_synced_at, last_sync_error, created_at, updated_at, active_main_session_id FROM workspaces WHERE id = $1
 `
 
 func (q *Queries) GetWorkspaceByID(ctx context.Context, id pgtype.UUID) (Workspace, error) {
@@ -92,12 +93,13 @@ func (q *Queries) GetWorkspaceByID(ctx context.Context, id pgtype.UUID) (Workspa
 		&i.LastSyncError,
 		&i.CreatedAt,
 		&i.UpdatedAt,
+		&i.ActiveMainSessionID,
 	)
 	return i, err
 }
 
 const getWorkspaceBySlug = `-- name: GetWorkspaceBySlug :one
-SELECT w.id, w.project_id, w.slug, w.name, w.description, w.git_remote_url, w.default_branch, w.main_path, w.sync_status, w.last_synced_at, w.last_sync_error, w.created_at, w.updated_at FROM workspaces w
+SELECT w.id, w.project_id, w.slug, w.name, w.description, w.git_remote_url, w.default_branch, w.main_path, w.sync_status, w.last_synced_at, w.last_sync_error, w.created_at, w.updated_at, w.active_main_session_id FROM workspaces w
 JOIN projects p ON p.id = w.project_id
 WHERE p.slug = $1 AND w.slug = $2
 `
@@ -124,6 +126,7 @@ func (q *Queries) GetWorkspaceBySlug(ctx context.Context, arg GetWorkspaceBySlug
 		&i.LastSyncError,
 		&i.CreatedAt,
 		&i.UpdatedAt,
+		&i.ActiveMainSessionID,
 	)
 	return i, err
 }
@@ -170,7 +173,7 @@ func (q *Queries) ListFetchTargets(ctx context.Context) ([]ListFetchTargetsRow,
 }
 
 const listWorkspacesByProject = `-- name: ListWorkspacesByProject :many
-SELECT id, project_id, slug, name, description, git_remote_url, default_branch, main_path, sync_status, last_synced_at, last_sync_error, created_at, updated_at FROM workspaces WHERE project_id = $1
+SELECT id, project_id, slug, name, description, git_remote_url, default_branch, main_path, sync_status, last_synced_at, last_sync_error, created_at, updated_at, active_main_session_id FROM workspaces WHERE project_id = $1
 ORDER BY created_at DESC
 `
 
@@ -197,6 +200,7 @@ func (q *Queries) ListWorkspacesByProject(ctx context.Context, projectID pgtype.
 			&i.LastSyncError,
 			&i.CreatedAt,
 			&i.UpdatedAt,
+			&i.ActiveMainSessionID,
 		); err != nil {
 			return nil, err
 		}
@@ -279,7 +283,7 @@ const updateWorkspaceCore = `-- name: UpdateWorkspaceCore :one
 UPDATE workspaces
 SET name = $2, description = $3, default_branch = $4, updated_at = now()
 WHERE id = $1
-RETURNING id, project_id, slug, name, description, git_remote_url, default_branch, main_path, sync_status, last_synced_at, last_sync_error, created_at, updated_at
+RETURNING id, project_id, slug, name, description, git_remote_url, default_branch, main_path, sync_status, last_synced_at, last_sync_error, created_at, updated_at, active_main_session_id
 `
 
 type UpdateWorkspaceCoreParams struct {
@@ -311,6 +315,7 @@ func (q *Queries) UpdateWorkspaceCore(ctx context.Context, arg UpdateWorkspaceCo
 		&i.LastSyncError,
 		&i.CreatedAt,
 		&i.UpdatedAt,
+		&i.ActiveMainSessionID,
 	)
 	return i, err
 }
@@ -322,7 +327,7 @@ SET sync_status = $2,
     last_sync_error = $4,
     updated_at = now()
 WHERE id = $1
-RETURNING id, project_id, slug, name, description, git_remote_url, default_branch, main_path, sync_status, last_synced_at, last_sync_error, created_at, updated_at
+RETURNING id, project_id, slug, name, description, git_remote_url, default_branch, main_path, sync_status, last_synced_at, last_sync_error, created_at, updated_at, active_main_session_id
 `
 
 type UpdateWorkspaceSyncStatusParams struct {
@@ -354,6 +359,7 @@ func (q *Queries) UpdateWorkspaceSyncStatus(ctx context.Context, arg UpdateWorks
 		&i.LastSyncError,
 		&i.CreatedAt,
 		&i.UpdatedAt,
+		&i.ActiveMainSessionID,
 	)
 	return i, err
 }

internal/workspace/sqlc/worktrees.sql.go

@@ -282,6 +282,48 @@ func (q *Queries) MarkPruneWarning(ctx context.Context, id pgtype.UUID) error {
 	return err
 }
 
+const releaseWorktreesByHolder = `-- name: ReleaseWorktreesByHolder :many
+UPDATE workspace_worktrees
+SET status = 'idle',
+    active_holder = NULL,
+    acquired_at = NULL,
+    last_used_at = now(),
+    prune_warning_at = NULL
+WHERE active_holder = $1 AND status = 'active'
+RETURNING id, workspace_id, branch, path, status, active_holder, acquired_at, last_used_at, created_at, prune_warning_at
+`
+
+func (q *Queries) ReleaseWorktreesByHolder(ctx context.Context, activeHolder *string) ([]WorkspaceWorktree, error) {
+	rows, err := q.db.Query(ctx, releaseWorktreesByHolder, activeHolder)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []WorkspaceWorktree
+	for rows.Next() {
+		var i WorkspaceWorktree
+		if err := rows.Scan(
+			&i.ID,
+			&i.WorkspaceID,
+			&i.Branch,
+			&i.Path,
+			&i.Status,
+			&i.ActiveHolder,
+			&i.AcquiredAt,
+			&i.LastUsedAt,
+			&i.CreatedAt,
+			&i.PruneWarningAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const setWorktreeActive = `-- name: SetWorktreeActive :one
 UPDATE workspace_worktrees
 SET status = 'active',

internal/workspace/workspace_service_test.go

@@ -105,6 +105,9 @@ func (f *fakeRepo) TryStartPrune(_ context.Context, _ uuid.UUID) (*Worktree, err
 }
 func (f *fakeRepo) FinishPruneSuccess(_ context.Context, _ uuid.UUID) error  { return nil }
 func (f *fakeRepo) FinishPruneRollback(_ context.Context, _ uuid.UUID) error { return nil }
+func (f *fakeRepo) ReleaseWorktreesByHolder(_ context.Context, _ string) ([]*Worktree, error) {
+	return nil, nil
+}
 func (f *fakeRepo) UpsertCredential(_ context.Context, c *Credential) (*Credential, error) {
 	cp := *c
 	f.creds[c.WorkspaceID] = &cp

internal/workspace/worktree_service.go

@@ -184,6 +184,12 @@ func (s *worktreeService) Release(ctx context.Context, c Caller, wtID uuid.UUID)
 	return out, nil
 }
 
+// ReleaseByHolder 释放给定 holder 字符串持有的所有活跃 worktree。
+// 实现仅委托 repo；audit 由 caller 在更高层根据自己上下文写入。
+func (s *worktreeService) ReleaseByHolder(ctx context.Context, holder string) ([]*Worktree, error) {
+	return s.repo.ReleaseWorktreesByHolder(ctx, holder)
+}
+
 func (s *worktreeService) audit(ctx context.Context, uid *uuid.UUID, action, ttype, tid string, meta map[string]any) {
 	_ = s.rec.Record(ctx, audit.Entry{
 		UserID: uid, Action: action, TargetType: ttype, TargetID: tid, Metadata: meta,

migrations/0006_acp.down.sql

@@ -0,0 +1,18 @@
+DROP INDEX IF EXISTS idx_acp_events_created_at;
+DROP INDEX IF EXISTS idx_acp_events_session_id;
+DROP TABLE IF EXISTS acp_events;
+
+ALTER TABLE workspaces DROP CONSTRAINT IF EXISTS workspaces_active_main_session_fk;
+ALTER TABLE workspaces DROP COLUMN IF EXISTS active_main_session_id;
+
+DROP INDEX IF EXISTS idx_acp_sessions_requirement;
+DROP INDEX IF EXISTS idx_acp_sessions_issue;
+DROP INDEX IF EXISTS idx_acp_sessions_user_status;
+DROP INDEX IF EXISTS idx_acp_sessions_workspace_status;
+DROP TABLE IF EXISTS acp_sessions;
+
+ALTER TABLE requirements DROP CONSTRAINT IF EXISTS requirements_project_id_unique;
+ALTER TABLE issues       DROP CONSTRAINT IF EXISTS issues_project_id_unique;
+
+DROP INDEX IF EXISTS idx_acp_agent_kinds_enabled;
+DROP TABLE IF EXISTS acp_agent_kinds;

migrations/0006_acp.up.sql

@@ -0,0 +1,75 @@
+-- ============ AgentKind ============
+CREATE TABLE acp_agent_kinds (
+  id              UUID PRIMARY KEY,
+  name            TEXT NOT NULL UNIQUE,
+  display_name    TEXT NOT NULL,
+  description     TEXT NOT NULL DEFAULT '',
+  binary_path     TEXT NOT NULL,
+  args            TEXT[] NOT NULL DEFAULT '{}',
+  encrypted_env   BYTEA,
+  enabled         BOOLEAN NOT NULL DEFAULT TRUE,
+  created_by      UUID NOT NULL REFERENCES users(id) ON DELETE RESTRICT,
+  created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at      TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX idx_acp_agent_kinds_enabled ON acp_agent_kinds(enabled) WHERE enabled = TRUE;
+
+-- ============ Prerequisites for composite FK ============
+ALTER TABLE issues       ADD CONSTRAINT issues_project_id_unique       UNIQUE (project_id, id);
+ALTER TABLE requirements ADD CONSTRAINT requirements_project_id_unique UNIQUE (project_id, id);
+
+-- ============ Sessions ============
+CREATE TABLE acp_sessions (
+  id                 UUID PRIMARY KEY,
+  workspace_id       UUID NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  project_id         UUID NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  agent_kind_id      UUID NOT NULL REFERENCES acp_agent_kinds(id) ON DELETE RESTRICT,
+  user_id            UUID NOT NULL REFERENCES users(id) ON DELETE RESTRICT,
+  issue_id           UUID,
+  requirement_id     UUID,
+  agent_session_id   TEXT,
+  branch             TEXT NOT NULL,
+  cwd_path           TEXT NOT NULL,
+  is_main_worktree   BOOLEAN NOT NULL DEFAULT FALSE,
+  status             TEXT NOT NULL,
+  pid                INT,
+  exit_code          INT,
+  last_error         TEXT,
+  started_at         TIMESTAMPTZ NOT NULL DEFAULT now(),
+  ended_at           TIMESTAMPTZ,
+  CONSTRAINT acp_sessions_status_check CHECK (status IN ('starting','running','crashed','exited')),
+  CONSTRAINT acp_sessions_issue_project_fk
+    FOREIGN KEY (project_id, issue_id)
+    REFERENCES issues (project_id, id) MATCH SIMPLE ON DELETE SET NULL,
+  CONSTRAINT acp_sessions_req_project_fk
+    FOREIGN KEY (project_id, requirement_id)
+    REFERENCES requirements (project_id, id) MATCH SIMPLE ON DELETE SET NULL
+);
+CREATE INDEX idx_acp_sessions_workspace_status ON acp_sessions(workspace_id, status);
+CREATE INDEX idx_acp_sessions_user_status      ON acp_sessions(user_id, status);
+CREATE INDEX idx_acp_sessions_issue            ON acp_sessions(issue_id)       WHERE issue_id IS NOT NULL;
+CREATE INDEX idx_acp_sessions_requirement      ON acp_sessions(requirement_id) WHERE requirement_id IS NOT NULL;
+
+-- ============ Workspaces main worktree mutex ============
+ALTER TABLE workspaces ADD COLUMN active_main_session_id UUID;
+ALTER TABLE workspaces
+  ADD CONSTRAINT workspaces_active_main_session_fk
+  FOREIGN KEY (active_main_session_id)
+  REFERENCES acp_sessions(id) ON DELETE SET NULL DEFERRABLE INITIALLY DEFERRED;
+
+-- ============ Events ============
+CREATE TABLE acp_events (
+  id                BIGSERIAL PRIMARY KEY,
+  session_id        UUID NOT NULL REFERENCES acp_sessions(id) ON DELETE CASCADE,
+  direction         TEXT NOT NULL,
+  rpc_kind          TEXT NOT NULL,
+  method            TEXT,
+  payload           JSONB NOT NULL,
+  payload_size      INT NOT NULL,
+  truncated         BOOLEAN NOT NULL DEFAULT FALSE,
+  created_at        TIMESTAMPTZ NOT NULL DEFAULT now(),
+  CONSTRAINT acp_events_direction_check CHECK (direction IN ('in','out')),
+  CONSTRAINT acp_events_kind_check      CHECK (rpc_kind IN ('request','response','notification','error'))
+);
+CREATE INDEX idx_acp_events_session_id ON acp_events(session_id, id);
+CREATE INDEX idx_acp_events_created_at ON acp_events(created_at);

sqlc.yaml

@@ -70,3 +70,13 @@ sql:
         sql_package: pgx/v5
         emit_pointers_for_null_types: true
         emit_json_tags: true
+  - engine: postgresql
+    queries: internal/acp/queries
+    schema: migrations
+    gen:
+      go:
+        package: acpsqlc
+        out: internal/acp/sqlc
+        sql_package: pgx/v5
+        emit_pointers_for_null_types: true
+        emit_json_tags: true

web/src/api/acp.ts

@@ -0,0 +1,139 @@
+import { request } from './client'
+
+// Admin DTO from `internal/acp/dto.go: AgentKindAdminDTO`.
+export interface AgentKindAdmin {
+  id: string
+  name: string
+  display_name: string
+  description: string
+  binary_path: string
+  args: string[]
+  env_keys: string[]
+  enabled: boolean
+  created_by: string
+  created_at: string
+  updated_at: string
+}
+
+// Public DTO (non-admin view) from `internal/acp/dto.go: AgentKindPublicDTO`.
+export interface AgentKindPublic {
+  id: string
+  name: string
+  display_name: string
+  enabled: boolean
+}
+
+// Type guard distinguishing admin vs public DTO based on presence of admin-only fields.
+export function isAgentKindAdmin(k: AgentKindAdmin | AgentKindPublic): k is AgentKindAdmin {
+  return 'binary_path' in k
+}
+
+export interface CreateAgentKindReq {
+  name: string
+  display_name: string
+  description?: string
+  binary_path: string
+  args?: string[]
+  env?: Record<string, string>
+  enabled?: boolean
+}
+
+export interface UpdateAgentKindReq {
+  display_name?: string
+  description?: string
+  binary_path?: string
+  args?: string[]
+  env?: Record<string, string>
+  enabled?: boolean
+}
+
+// AcpSession mirrors the backend session DTO returned by /api/v1/acp/sessions.
+export interface AcpSession {
+  id: string
+  workspace_id: string
+  project_id: string
+  agent_kind_id: string
+  user_id: string
+  issue_id: string | null
+  requirement_id: string | null
+  agent_session_id: string | null
+  branch: string
+  cwd_path: string
+  is_main_worktree: boolean
+  status: 'starting' | 'running' | 'crashed' | 'exited'
+  pid: number | null
+  exit_code: number | null
+  last_error: string | null
+  started_at: string
+  ended_at: string | null
+}
+
+export interface CreateSessionReq {
+  workspace_id: string
+  agent_kind_id: string
+  branch?: string
+  issue_number?: number
+  requirement_number?: number
+  initial_prompt?: string
+}
+
+// AcpEvent is one frame from the session event stream (history REST + WS push).
+export interface AcpEvent {
+  id: number
+  direction: 'in' | 'out'
+  kind:
+    | 'request'
+    | 'response'
+    | 'notification'
+    | 'error'
+    | 'state'
+    | 'session_terminated'
+    | 'slow_consumer_disconnect'
+    | 'client_error'
+  method?: string
+  payload: unknown
+  truncated: boolean
+}
+
+const enc = (v: string) => encodeURIComponent(v)
+
+export const acpApi = {
+  agentKinds: {
+    list: () =>
+      request<(AgentKindAdmin | AgentKindPublic)[]>('/api/v1/acp/agent-kinds'),
+    get: (id: string) =>
+      request<AgentKindAdmin>(`/api/v1/acp/agent-kinds/${enc(id)}`),
+    create: (req: CreateAgentKindReq) =>
+      request<AgentKindAdmin>('/api/v1/acp/agent-kinds', { method: 'POST', body: req }),
+    update: (id: string, req: UpdateAgentKindReq) =>
+      request<AgentKindAdmin>(`/api/v1/acp/agent-kinds/${enc(id)}`, { method: 'PATCH', body: req }),
+    remove: (id: string) =>
+      request<void>(`/api/v1/acp/agent-kinds/${enc(id)}`, { method: 'DELETE' }),
+  },
+  sessions: {
+    list: (all?: boolean) =>
+      request<AcpSession[]>('/api/v1/acp/sessions' + (all ? '?all=true' : '')),
+    get: (id: string) =>
+      request<AcpSession>(`/api/v1/acp/sessions/${enc(id)}`),
+    create: (req: CreateSessionReq) =>
+      request<AcpSession>('/api/v1/acp/sessions', { method: 'POST', body: req }),
+    terminate: (id: string) =>
+      request<void>(`/api/v1/acp/sessions/${enc(id)}`, { method: 'DELETE' }),
+    events: (id: string, since: number) =>
+      request<AcpEvent[]>(`/api/v1/acp/sessions/${enc(id)}/events?since=${since}`),
+  },
+}
+
+// openSessionWS opens a native WebSocket to /sessions/{id}/ws.
+//
+// Auth: browser WebSocket cannot send custom headers, so the token is sent
+// via the ?token= query parameter. The backend auth middleware accepts it
+// as a fallback to Authorization. Keep token lifetimes short.
+export function openSessionWS(sessionId: string, since: number, token: string): WebSocket {
+  const proto = window.location.protocol === 'https:' ? 'wss' : 'ws'
+  const host = window.location.host
+  const url =
+    `${proto}://${host}/api/v1/acp/sessions/${enc(sessionId)}` +
+    `/ws?since=${since}&token=${enc(token)}`
+  return new WebSocket(url)
+}

web/src/components/acp/AgentEventCard.vue

@@ -0,0 +1,148 @@
+<script setup lang="ts">
+import { computed, ref } from 'vue'
+import type { AcpEvent } from '@/api/acp'
+
+const props = defineProps<{ event: AcpEvent }>()
+
+// Backend may serialize payload as a string in some edge paths; defensively parse.
+const payload = computed<Record<string, unknown>>(() => {
+  if (typeof props.event.payload === 'string') {
+    try {
+      return JSON.parse(props.event.payload) as Record<string, unknown>
+    } catch {
+      return {}
+    }
+  }
+  return (props.event.payload as Record<string, unknown>) ?? {}
+})
+
+const eventType = computed(() => {
+  if (props.event.kind === 'session_terminated') return 'session_terminated'
+  if (props.event.kind === 'client_error') return 'client_error'
+
+  const m = props.event.method ?? ''
+  if (m === 'session/prompt') return 'user_prompt'
+  if (m === 'session/cancel') return 'user_cancel'
+  if (m === 'fs/read_text_file') return 'tool_fs_read'
+  if (m === 'fs/write_text_file') return 'tool_fs_write'
+  if (m === 'session/request_permission') return 'tool_permission'
+  if (m === 'session/update') {
+    const params = payload.value?.params as Record<string, unknown> | undefined
+    const update = params?.update as Record<string, unknown> | undefined
+    const su = update?.sessionUpdate
+    if (su === 'agent_message_chunk') return 'agent_text'
+    if (su === 'agent_thought_chunk') return 'agent_thought'
+    if (su === 'tool_call') return 'tool_call_update'
+    return 'agent_update'
+  }
+  if (m === 'initialize' || m === 'session/new') return 'protocol'
+  return 'other'
+})
+
+const thoughtCollapsed = ref(true)
+
+function chunkText(): string {
+  const params = payload.value?.params as Record<string, unknown> | undefined
+  const update = params?.update as Record<string, unknown> | undefined
+  const content = update?.content
+  if (Array.isArray(content)) {
+    return content.map((c: { text?: string }) => c.text ?? '').join('')
+  }
+  return ''
+}
+
+function userPromptText(): string {
+  const params = payload.value?.params as Record<string, unknown> | undefined
+  const prompt = params?.prompt
+  if (Array.isArray(prompt)) {
+    return prompt.map((p: { text?: string }) => p.text ?? '').join('')
+  }
+  return ''
+}
+
+function fsPath(): string {
+  const params = payload.value?.params as Record<string, unknown> | undefined
+  return (params?.path as string) ?? ''
+}
+
+function fsWriteSize(): number {
+  const params = payload.value?.params as Record<string, unknown> | undefined
+  const c = params?.content
+  return typeof c === 'string' ? c.length : 0
+}
+</script>
+
+<template>
+  <div class="py-1">
+    <div v-if="eventType === 'user_prompt'" class="flex gap-2">
+      <span class="text-xs text-gray-500 mt-0.5 w-12">user</span>
+      <div class="flex-1 px-2 py-1 bg-blue-50 rounded text-sm">{{ userPromptText() }}</div>
+    </div>
+
+    <div v-else-if="eventType === 'user_cancel'" class="flex gap-2 text-xs text-gray-500">
+      <span class="w-12">user</span>
+      <span>· cancel</span>
+    </div>
+
+    <div v-else-if="eventType === 'agent_text'" class="flex gap-2">
+      <span class="text-xs text-gray-500 mt-0.5 w-12">agent</span>
+      <div class="flex-1 text-sm whitespace-pre-wrap">{{ chunkText() }}</div>
+    </div>
+
+    <div v-else-if="eventType === 'agent_thought'" class="flex gap-2">
+      <span class="text-xs text-gray-500 mt-0.5 w-12">thought</span>
+      <div class="flex-1">
+        <button
+          class="text-xs text-gray-500 hover:text-gray-700"
+          @click="thoughtCollapsed = !thoughtCollapsed"
+        >
+          {{ thoughtCollapsed ? '▶' : '▼' }} thinking...
+        </button>
+        <div
+          v-if="!thoughtCollapsed"
+          class="mt-1 px-2 py-1 bg-gray-50 text-sm text-gray-700 italic whitespace-pre-wrap"
+        >
+          {{ chunkText() }}
+        </div>
+      </div>
+    </div>
+
+    <div v-else-if="eventType === 'tool_fs_read'" class="flex gap-2 text-sm">
+      <span class="text-xs text-gray-500 mt-0.5 w-12">tool</span>
+      <div class="flex-1 px-2 py-0.5 bg-yellow-50 rounded">
+        read <code class="text-xs">{{ fsPath() }}</code>
+      </div>
+    </div>
+
+    <div v-else-if="eventType === 'tool_fs_write'" class="flex gap-2 text-sm">
+      <span class="text-xs text-gray-500 mt-0.5 w-12">tool</span>
+      <div class="flex-1 px-2 py-0.5 bg-orange-50 rounded">
+        write <code class="text-xs">{{ fsPath() }}</code> ({{ fsWriteSize() }} bytes)
+      </div>
+    </div>
+
+    <div v-else-if="eventType === 'tool_permission'" class="flex gap-2 text-sm">
+      <span class="text-xs text-gray-500 mt-0.5 w-12">perm</span>
+      <div class="flex-1 px-2 py-0.5 bg-purple-50 rounded">
+        permission requested (auto-rejected)
+      </div>
+    </div>
+
+    <div
+      v-else-if="eventType === 'session_terminated'"
+      class="text-center text-xs text-gray-500 py-2"
+    >
+      session terminated
+    </div>
+
+    <div v-else-if="eventType === 'client_error'" class="flex gap-2 text-sm text-red-600">
+      <span class="text-xs mt-0.5 w-12">error</span>
+      <div class="flex-1">{{ (payload as { message?: string }).message }}</div>
+    </div>
+
+    <div v-else class="flex gap-2 text-xs text-gray-400">
+      <span class="w-12">{{ eventType }}</span>
+      <code class="flex-1 truncate">{{ event.method }}</code>
+    </div>
+  </div>
+</template>

web/src/components/acp/AgentKindForm.vue

@@ -0,0 +1,177 @@
+<script setup lang="ts">
+import { ref, watch, computed } from 'vue'
+import { NInput, NButton, NCheckbox } from 'naive-ui'
+
+const props = defineProps<{
+  modelValue: {
+    name: string
+    display_name: string
+    description: string
+    binary_path: string
+    args: string[]
+    env: Record<string, string>
+    enabled: boolean
+  }
+  isEdit: boolean
+  existingEnvKeys?: string[]
+}>()
+
+const emit = defineEmits<{
+  (e: 'update:modelValue', value: typeof props.modelValue): void
+  (e: 'submit'): void
+  (e: 'cancel'): void
+}>()
+
+const local = ref({ ...props.modelValue })
+watch(
+  () => props.modelValue,
+  (v) => {
+    local.value = { ...v }
+  },
+)
+watch(local, (v) => emit('update:modelValue', v), { deep: true })
+
+const argsText = computed({
+  get: () => local.value.args.join('\n'),
+  set: (v: string) => {
+    local.value.args = v.split('\n').filter((x) => x.trim() !== '')
+  },
+})
+
+interface EnvRow {
+  k: string
+  v: string
+}
+const envEntries = ref<EnvRow[]>(
+  Object.entries(local.value.env).map(([k, v]) => ({ k, v })),
+)
+
+watch(
+  envEntries,
+  (entries) => {
+    const m: Record<string, string> = {}
+    for (const { k, v } of entries) {
+      if (k.trim()) m[k] = v
+    }
+    local.value.env = m
+  },
+  { deep: true },
+)
+
+function addEnv() {
+  envEntries.value.push({ k: '', v: '' })
+}
+function removeEnv(idx: number) {
+  envEntries.value.splice(idx, 1)
+}
+</script>
+
+<template>
+  <form
+    class="space-y-4"
+    @submit.prevent="emit('submit')"
+  >
+    <div>
+      <label class="block text-sm font-medium mb-1">Name</label>
+      <NInput
+        v-model:value="local.name"
+        :readonly="isEdit"
+        placeholder="claude_code"
+      />
+      <p
+        v-if="isEdit"
+        class="text-xs text-gray-500 mt-1"
+      >
+        Name cannot be changed after creation
+      </p>
+    </div>
+    <div>
+      <label class="block text-sm font-medium mb-1">Display Name</label>
+      <NInput
+        v-model:value="local.display_name"
+        placeholder="Claude Code"
+      />
+    </div>
+    <div>
+      <label class="block text-sm font-medium mb-1">Description</label>
+      <NInput
+        v-model:value="local.description"
+        type="textarea"
+        :autosize="{ minRows: 2, maxRows: 6 }"
+      />
+    </div>
+    <div>
+      <label class="block text-sm font-medium mb-1">Binary Path</label>
+      <NInput
+        v-model:value="local.binary_path"
+        placeholder="claude-code or /usr/local/bin/claude-code"
+      />
+    </div>
+    <div>
+      <label class="block text-sm font-medium mb-1">Args (one per line)</label>
+      <NInput
+        v-model:value="argsText"
+        type="textarea"
+        :autosize="{ minRows: 3, maxRows: 8 }"
+        placeholder="--acp"
+      />
+    </div>
+    <div>
+      <label class="block text-sm font-medium mb-1">Env</label>
+      <p
+        v-if="isEdit && existingEnvKeys?.length"
+        class="text-xs text-gray-500 mb-2"
+      >
+        Existing keys (values hidden): {{ existingEnvKeys.join(', ') }}.
+        Edit below to replace entirely.
+      </p>
+      <div
+        v-for="(e, idx) in envEntries"
+        :key="idx"
+        class="flex gap-2 mb-2"
+      >
+        <NInput
+          v-model:value="e.k"
+          placeholder="KEY"
+          class="flex-1"
+        />
+        <NInput
+          v-model:value="e.v"
+          type="password"
+          show-password-on="click"
+          placeholder="value"
+          class="flex-1"
+        />
+        <NButton
+          quaternary
+          @click="removeEnv(idx)"
+        >
+          ×
+        </NButton>
+      </div>
+      <NButton
+        size="small"
+        dashed
+        @click="addEnv"
+      >
+        + Add
+      </NButton>
+    </div>
+    <div class="flex items-center gap-2">
+      <NCheckbox v-model:checked="local.enabled">
+        Enabled
+      </NCheckbox>
+    </div>
+    <div class="flex gap-2">
+      <NButton
+        type="primary"
+        attr-type="submit"
+      >
+        Save
+      </NButton>
+      <NButton @click="emit('cancel')">
+        Cancel
+      </NButton>
+    </div>
+  </form>
+</template>

web/src/components/acp/PromptInput.vue

@@ -0,0 +1,60 @@
+<script setup lang="ts">
+import { ref } from 'vue'
+
+const props = defineProps<{
+  disabled: boolean
+  isPrompting: boolean
+}>()
+
+const emit = defineEmits<{
+  (e: 'send', text: string): void
+  (e: 'cancel'): void
+}>()
+
+const text = ref('')
+
+function submit() {
+  if (props.disabled) return
+  if (props.isPrompting) {
+    emit('cancel')
+    return
+  }
+  const t = text.value.trim()
+  if (!t) return
+  emit('send', t)
+  text.value = ''
+}
+
+function onKeydown(ev: KeyboardEvent) {
+  // Enter (no Shift) → submit. Shift+Enter → newline.
+  if (ev.key === 'Enter' && !ev.shiftKey) {
+    ev.preventDefault()
+    submit()
+  }
+}
+</script>
+
+<template>
+  <form class="flex gap-2 items-end" @submit.prevent="submit">
+    <textarea
+      v-model="text"
+      class="flex-1 resize-none border rounded px-2 py-1 text-sm"
+      rows="2"
+      :placeholder="disabled ? 'Session ended' : 'Type a prompt...'"
+      :disabled="disabled || isPrompting"
+      @keydown="onKeydown"
+    />
+    <button
+      type="submit"
+      class="px-3 py-1 rounded text-sm font-medium border"
+      :class="
+        isPrompting
+          ? 'bg-yellow-100 border-yellow-300 text-yellow-800 hover:bg-yellow-200'
+          : 'bg-blue-600 border-blue-600 text-white hover:bg-blue-700 disabled:bg-gray-300 disabled:border-gray-300 disabled:text-gray-500'
+      "
+      :disabled="disabled || (!isPrompting && !text.trim())"
+    >
+      {{ isPrompting ? 'Cancel' : 'Send' }}
+    </button>
+  </form>
+</template>

web/src/components/acp/SessionStatusBadge.vue

@@ -0,0 +1,55 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+
+const props = defineProps<{
+  status: 'starting' | 'running' | 'crashed' | 'exited'
+}>()
+
+const cls = computed(() => {
+  switch (props.status) {
+    case 'starting':
+      return 'bg-blue-100 text-blue-800 border-blue-300'
+    case 'running':
+      return 'bg-green-100 text-green-800 border-green-300'
+    case 'crashed':
+      return 'bg-red-100 text-red-800 border-red-300'
+    case 'exited':
+      return 'bg-gray-100 text-gray-700 border-gray-300'
+    default:
+      return 'bg-gray-100 text-gray-700 border-gray-300'
+  }
+})
+
+const label = computed(() => {
+  switch (props.status) {
+    case 'starting':
+      return 'Starting'
+    case 'running':
+      return 'Running'
+    case 'crashed':
+      return 'Crashed'
+    case 'exited':
+      return 'Exited'
+    default:
+      return ''
+  }
+})
+</script>
+
+<template>
+  <span
+    class="inline-flex items-center px-2 py-0.5 text-xs font-medium border rounded"
+    :class="cls"
+  >
+    <span
+      class="w-1.5 h-1.5 rounded-full mr-1"
+      :class="{
+        'bg-blue-500 animate-pulse': status === 'starting',
+        'bg-green-500': status === 'running',
+        'bg-red-500': status === 'crashed',
+        'bg-gray-400': status === 'exited',
+      }"
+    />
+    {{ label }}
+  </span>
+</template>

web/src/composables/useAcpStream.test.ts

@@ -0,0 +1,141 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+
+vi.mock('@/stores/auth', () => ({
+  useAuthStore: () => ({ token: 'jwt-token' }),
+}))
+
+import { useAcpStream } from './useAcpStream'
+
+class MockWebSocket {
+  static CONNECTING = 0
+  static OPEN = 1
+  static CLOSING = 2
+  static CLOSED = 3
+  static instances: MockWebSocket[] = []
+  static last(): MockWebSocket {
+    return this.instances[this.instances.length - 1]
+  }
+
+  url: string
+  readyState = 0
+  onopen: ((ev: unknown) => void) | null = null
+  onmessage: ((ev: { data: string }) => void) | null = null
+  onerror: ((ev: unknown) => void) | null = null
+  onclose: ((ev: unknown) => void) | null = null
+  sent: string[] = []
+
+  constructor(url: string) {
+    this.url = url
+    MockWebSocket.instances.push(this)
+    queueMicrotask(() => {
+      this.readyState = 1
+      this.onopen?.({})
+    })
+  }
+
+  send(data: string) {
+    this.sent.push(data)
+  }
+
+  close() {
+    this.readyState = 3
+    this.onclose?.({})
+  }
+
+  emit(data: unknown) {
+    this.onmessage?.({ data: JSON.stringify(data) })
+  }
+}
+
+beforeEach(() => {
+  MockWebSocket.instances = []
+  vi.stubGlobal('WebSocket', MockWebSocket)
+  vi.stubGlobal('crypto', { randomUUID: () => 'fake-uuid' })
+  vi.stubGlobal('window', { location: { protocol: 'http:', host: 'test.local' } })
+})
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+  vi.restoreAllMocks()
+})
+
+describe('useAcpStream', () => {
+  it('connects with ?since=0 on mount', async () => {
+    const stream = useAcpStream('sess-1')
+    await new Promise((r) => setTimeout(r, 10))
+    const ws = MockWebSocket.last()
+    expect(ws.url).toContain('/sessions/sess-1/ws')
+    expect(ws.url).toContain('since=0')
+    expect(ws.url).toContain('token=jwt-token')
+    expect(stream.status.value).toBe('streaming')
+    stream.close()
+  })
+
+  it('updates sessionStatus from state event', async () => {
+    const stream = useAcpStream('s1')
+    await new Promise((r) => setTimeout(r, 10))
+    MockWebSocket.last().emit({ kind: 'state', status: 'running' })
+    expect(stream.sessionStatus.value).toBe('running')
+    stream.close()
+  })
+
+  it('accumulates events and tracks lastEventID', async () => {
+    const stream = useAcpStream('s2')
+    await new Promise((r) => setTimeout(r, 10))
+    MockWebSocket.last().emit({
+      id: 1,
+      direction: 'out',
+      kind: 'notification',
+      method: 'session/update',
+      payload: {},
+    })
+    MockWebSocket.last().emit({
+      id: 2,
+      direction: 'out',
+      kind: 'notification',
+      method: 'session/update',
+      payload: {},
+    })
+    expect(stream.events.value).toHaveLength(2)
+    stream.close()
+  })
+
+  it('reconnects with ?since=<last> after close', async () => {
+    const stream = useAcpStream('s3')
+    await new Promise((r) => setTimeout(r, 10))
+    MockWebSocket.last().emit({ id: 5, direction: 'out', kind: 'notification' })
+
+    MockWebSocket.last().close()
+    await new Promise((r) => setTimeout(r, 1100))
+    const ws2 = MockWebSocket.last()
+    expect(ws2.url).toContain('since=5')
+    stream.close()
+  })
+
+  it('sends session/prompt with client-<uuid> ID', async () => {
+    const stream = useAcpStream('s4')
+    await new Promise((r) => setTimeout(r, 10))
+    stream.prompt('hello', 'agent-sid')
+    const sent = MockWebSocket.last().sent
+    expect(sent).toHaveLength(1)
+    const parsed = JSON.parse(sent[0]) as {
+      method: string
+      id: string
+      params: { sessionId: string; prompt: { text: string }[] }
+    }
+    expect(parsed.method).toBe('session/prompt')
+    expect(parsed.id).toMatch(/^client-/)
+    expect(parsed.params.sessionId).toBe('agent-sid')
+    expect(parsed.params.prompt[0].text).toBe('hello')
+    stream.close()
+  })
+
+  it('manual close prevents reconnect', async () => {
+    const stream = useAcpStream('s5')
+    await new Promise((r) => setTimeout(r, 10))
+    stream.close()
+    expect(stream.status.value).toBe('closed')
+    await new Promise((r) => setTimeout(r, 1500))
+    expect(MockWebSocket.instances).toHaveLength(1)
+  })
+})

web/src/composables/useAcpStream.ts

@@ -0,0 +1,160 @@
+// useAcpStream wraps the ACP WebSocket per spec §10.3:
+//   - connect + auto-reconnect once with exponential backoff (1s/3s, then give up)
+//   - ?since=lastEventID resumption
+//   - send session/prompt / session/cancel (generates client-<uuid> ID)
+//   - accumulate events into a ref array
+//   - expose sessionStatus + connection-state status
+import { ref, onScopeDispose, type Ref } from 'vue'
+import { openSessionWS, type AcpEvent } from '@/api/acp'
+import { useAuthStore } from '@/stores/auth'
+
+export type StreamStatus = 'idle' | 'connecting' | 'streaming' | 'closed' | 'error'
+export type SessionStatus = 'starting' | 'running' | 'crashed' | 'exited'
+
+export interface UseAcpStreamReturn {
+  status: Ref<StreamStatus>
+  sessionStatus: Ref<SessionStatus>
+  events: Ref<AcpEvent[]>
+  prompt: (text: string, agentSessionID: string) => void
+  cancel: (agentSessionID: string) => void
+  reconnect: () => void
+  close: () => void
+}
+
+interface ServerStateEvent {
+  kind: 'state'
+  status: SessionStatus
+}
+
+interface SessionTerminatedPayload {
+  status?: 'crashed' | 'exited'
+}
+
+export function useAcpStream(sessionId: string): UseAcpStreamReturn {
+  const status = ref<StreamStatus>('idle')
+  const sessionStatus = ref<SessionStatus>('starting')
+  const events = ref<AcpEvent[]>([])
+  const lastEventID = ref(0)
+
+  let ws: WebSocket | null = null
+  let retried = 0
+  let manualClose = false
+  let reconnectTimer: ReturnType<typeof setTimeout> | null = null
+
+  const auth = useAuthStore()
+
+  function connect() {
+    if (ws || manualClose) return
+    status.value = 'connecting'
+    const token = auth.token ?? ''
+    const sock = openSessionWS(sessionId, lastEventID.value, token)
+    ws = sock
+
+    sock.onopen = () => {
+      status.value = 'streaming'
+      retried = 0
+    }
+
+    sock.onmessage = (ev: MessageEvent) => {
+      let parsed: unknown
+      try {
+        parsed = JSON.parse(ev.data as string)
+      } catch {
+        return
+      }
+      if (!parsed || typeof parsed !== 'object') return
+      const obj = parsed as Record<string, unknown>
+
+      // Initial state event from server
+      if (obj.kind === 'state') {
+        const s = (parsed as ServerStateEvent).status
+        if (s) sessionStatus.value = s
+        return
+      }
+
+      // Final session_terminated event
+      if (obj.kind === 'session_terminated') {
+        let payloadObj: SessionTerminatedPayload = {}
+        const rawPayload = obj.payload
+        if (typeof rawPayload === 'string') {
+          try {
+            payloadObj = JSON.parse(rawPayload) as SessionTerminatedPayload
+          } catch {
+            payloadObj = {}
+          }
+        } else if (rawPayload && typeof rawPayload === 'object') {
+          payloadObj = rawPayload as SessionTerminatedPayload
+        }
+        sessionStatus.value = payloadObj.status === 'crashed' ? 'crashed' : 'exited'
+        events.value.push(parsed as AcpEvent)
+        return
+      }
+
+      // Regular event envelope
+      const ev2 = parsed as AcpEvent
+      if (typeof ev2.id === 'number' && ev2.id > lastEventID.value) {
+        lastEventID.value = ev2.id
+      }
+      events.value.push(ev2)
+    }
+
+    sock.onerror = () => {
+      status.value = 'error'
+    }
+
+    sock.onclose = () => {
+      ws = null
+      if (manualClose) {
+        status.value = 'closed'
+        return
+      }
+      if (retried < 2) {
+        const delay = retried === 0 ? 1000 : 3000
+        retried += 1
+        reconnectTimer = setTimeout(connect, delay)
+      } else {
+        status.value = 'closed'
+      }
+    }
+  }
+
+  function send(method: string, params: Record<string, unknown>) {
+    if (!ws || ws.readyState !== WebSocket.OPEN) return
+    const id = 'client-' + crypto.randomUUID()
+    const msg = { jsonrpc: '2.0', id, method, params }
+    ws.send(JSON.stringify(msg))
+  }
+
+  function prompt(text: string, agentSessionID: string) {
+    send('session/prompt', {
+      sessionId: agentSessionID,
+      prompt: [{ type: 'text', text }],
+    })
+  }
+
+  function cancel(agentSessionID: string) {
+    send('session/cancel', { sessionId: agentSessionID })
+  }
+
+  function reconnect() {
+    if (ws) ws.close()
+    retried = 0
+    manualClose = false
+    connect()
+  }
+
+  function close() {
+    manualClose = true
+    if (reconnectTimer) {
+      clearTimeout(reconnectTimer)
+      reconnectTimer = null
+    }
+    if (ws) ws.close()
+    status.value = 'closed'
+  }
+
+  connect()
+  onScopeDispose(close)
+
+  return { status, sessionStatus, events, prompt, cancel, reconnect, close }
+}

web/src/router/index.ts

@@ -62,6 +62,24 @@ const routes: RouteRecordRaw[] = [
     component: () => import('@/views/workspaces/WorkspaceHomeView.vue'),
     meta: { requiresAuth: true },
   },
+  {
+    path: '/p/:slug/w/:wsSlug/acp-sessions',
+    name: 'acp-sessions-list',
+    component: () => import('@/views/acp/AcpSessionListView.vue'),
+    meta: { requiresAuth: true },
+  },
+  {
+    path: '/p/:slug/w/:wsSlug/acp-sessions/new',
+    name: 'acp-sessions-new',
+    component: () => import('@/views/acp/AcpSessionCreateView.vue'),
+    meta: { requiresAuth: true },
+  },
+  {
+    path: '/p/:slug/w/:wsSlug/acp-sessions/:sessionId',
+    name: 'acp-sessions-detail',
+    component: () => import('@/views/acp/AcpSessionDetailView.vue'),
+    meta: { requiresAuth: true },
+  },
   {
     path: '/chat',
     name: 'chat-home',
@@ -118,6 +136,21 @@ const routes: RouteRecordRaw[] = [
     props: { adminMode: true },
     meta: { requiresAuth: true, requiresAdmin: true },
   },
+  {
+    path: '/admin/acp/agent-kinds',
+    component: () => import('@/views/admin/AgentKindAdminListView.vue'),
+    meta: { requiresAuth: true, requiresAdmin: true },
+  },
+  {
+    path: '/admin/acp/agent-kinds/new',
+    component: () => import('@/views/admin/AgentKindEditView.vue'),
+    meta: { requiresAuth: true, requiresAdmin: true },
+  },
+  {
+    path: '/admin/acp/agent-kinds/:id',
+    component: () => import('@/views/admin/AgentKindEditView.vue'),
+    meta: { requiresAuth: true, requiresAdmin: true },
+  },
 ]
 
 const router = createRouter({

web/src/stores/acp.ts

@@ -0,0 +1,115 @@
+import { defineStore } from 'pinia'
+import { ref } from 'vue'
+
+import {
+  acpApi,
+  isAgentKindAdmin,
+  type AcpSession,
+  type AgentKindAdmin,
+  type AgentKindPublic,
+  type CreateAgentKindReq,
+  type CreateSessionReq,
+  type UpdateAgentKindReq,
+} from '@/api/acp'
+
+export const useAcpStore = defineStore('acp', () => {
+  const agentKinds = ref<AgentKindAdmin[]>([]) // admin view (full DTO)
+  const enabledAgentKinds = ref<AgentKindPublic[]>([]) // public view (redacted DTO)
+  const loading = ref(false)
+  const error = ref<string | null>(null)
+
+  const sessions = ref<AcpSession[]>([])
+  const currentSession = ref<AcpSession | null>(null)
+
+  async function listAgentKinds(asAdmin: boolean) {
+    loading.value = true
+    error.value = null
+    try {
+      const data = await acpApi.agentKinds.list()
+      if (asAdmin) {
+        agentKinds.value = data.filter(isAgentKindAdmin)
+      } else {
+        enabledAgentKinds.value = data as AgentKindPublic[]
+      }
+    } catch (e) {
+      error.value = e instanceof Error ? e.message : 'failed'
+    } finally {
+      loading.value = false
+    }
+  }
+
+  async function createAgentKind(req: CreateAgentKindReq) {
+    const k = await acpApi.agentKinds.create(req)
+    agentKinds.value.unshift(k)
+    return k
+  }
+
+  async function updateAgentKind(id: string, req: UpdateAgentKindReq) {
+    const updated = await acpApi.agentKinds.update(id, req)
+    const idx = agentKinds.value.findIndex((k) => k.id === id)
+    if (idx >= 0) agentKinds.value[idx] = updated
+    return updated
+  }
+
+  async function deleteAgentKind(id: string) {
+    await acpApi.agentKinds.remove(id)
+    agentKinds.value = agentKinds.value.filter((k) => k.id !== id)
+  }
+
+  async function getAgentKind(id: string) {
+    return acpApi.agentKinds.get(id)
+  }
+
+  async function listSessions(all = false) {
+    loading.value = true
+    error.value = null
+    try {
+      sessions.value = await acpApi.sessions.list(all)
+    } catch (e) {
+      error.value = e instanceof Error ? e.message : 'failed'
+    } finally {
+      loading.value = false
+    }
+  }
+
+  async function getSession(id: string) {
+    const s = await acpApi.sessions.get(id)
+    currentSession.value = s
+    return s
+  }
+
+  async function createSession(req: CreateSessionReq) {
+    const s = await acpApi.sessions.create(req)
+    sessions.value.unshift(s)
+    return s
+  }
+
+  async function terminateSession(id: string) {
+    await acpApi.sessions.terminate(id)
+    const idx = sessions.value.findIndex((x) => x.id === id)
+    if (idx >= 0) {
+      sessions.value[idx] = { ...sessions.value[idx], status: 'exited' as const }
+    }
+    if (currentSession.value?.id === id) {
+      currentSession.value = { ...currentSession.value, status: 'exited' as const }
+    }
+  }
+
+  return {
+    agentKinds,
+    enabledAgentKinds,
+    loading,
+    error,
+    listAgentKinds,
+    createAgentKind,
+    updateAgentKind,
+    deleteAgentKind,
+    getAgentKind,
+    sessions,
+    currentSession,
+    listSessions,
+    getSession,
+    createSession,
+    terminateSession,
+  }
+})

web/src/views/acp/AcpSessionCreateView.test.ts

@@ -0,0 +1,66 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { mount } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+
+vi.mock('@/api/acp', () => ({
+  acpApi: {
+    sessions: {
+      list: vi.fn(),
+      get: vi.fn(),
+      create: vi.fn(),
+      terminate: vi.fn(),
+      events: vi.fn(),
+    },
+    agentKinds: {
+      list: vi.fn().mockResolvedValue([]),
+      get: vi.fn(),
+      create: vi.fn(),
+      update: vi.fn(),
+      remove: vi.fn(),
+    },
+  },
+  isAgentKindAdmin: () => false,
+}))
+
+vi.mock('@/api/workspaces', () => ({
+  workspacesApi: {
+    list: vi.fn().mockResolvedValue([]),
+    get: vi.fn(),
+    create: vi.fn(),
+    update: vi.fn(),
+    delete: vi.fn(),
+    sync: vi.fn(),
+    upsertCredential: vi.fn(),
+    getCredential: vi.fn(),
+    listWorktrees: vi.fn(),
+    createWorktree: vi.fn(),
+    deleteWorktree: vi.fn(),
+    acquire: vi.fn(),
+    release: vi.fn(),
+    statusOnMain: vi.fn(),
+    commitOnMain: vi.fn(),
+    pushOnMain: vi.fn(),
+    statusOnWorktree: vi.fn(),
+    commitOnWorktree: vi.fn(),
+    pushOnWorktree: vi.fn(),
+  },
+}))
+
+vi.mock('vue-router', () => ({
+  useRoute: () => ({ params: { slug: 'p', wsSlug: 'w' } }),
+  useRouter: () => ({ push: vi.fn() }),
+}))
+
+import AcpSessionCreateView from './AcpSessionCreateView.vue'
+
+beforeEach(() => {
+  setActivePinia(createPinia())
+})
+
+describe('AcpSessionCreateView', () => {
+  it('mounts without error', async () => {
+    const wrapper = mount(AcpSessionCreateView)
+    await new Promise((r) => setTimeout(r, 20))
+    expect(wrapper.html()).toContain('New ACP Session')
+  })
+})

web/src/views/acp/AcpSessionCreateView.vue

@@ -0,0 +1,160 @@
+<script setup lang="ts">
+import { ref, onMounted } from 'vue'
+import { useRoute, useRouter } from 'vue-router'
+import { useAcpStore } from '@/stores/acp'
+import { useWorkspacesStore } from '@/stores/workspaces'
+
+const route = useRoute()
+const router = useRouter()
+const acpStore = useAcpStore()
+const wsStore = useWorkspacesStore()
+
+const form = ref({
+  agent_kind_id: '',
+  branch: '',
+  issue_number: '' as string,
+  requirement_number: '' as string,
+  initial_prompt: '',
+})
+const submitting = ref(false)
+const errorMsg = ref<string | null>(null)
+
+onMounted(async () => {
+  await acpStore.listAgentKinds(false)
+  if (wsStore.list.length === 0) {
+    await wsStore.fetchByProject(route.params.slug as string)
+  }
+})
+
+async function submit() {
+  errorMsg.value = null
+  submitting.value = true
+  try {
+    const ws = wsStore.list.find((w) => w.slug === route.params.wsSlug)
+    if (!ws) {
+      errorMsg.value = 'Workspace not found; please reload the page.'
+      return
+    }
+    const req: {
+      workspace_id: string
+      agent_kind_id: string
+      branch?: string
+      issue_number?: number
+      requirement_number?: number
+      initial_prompt?: string
+    } = {
+      workspace_id: ws.id,
+      agent_kind_id: form.value.agent_kind_id,
+    }
+    if (form.value.branch) req.branch = form.value.branch
+    if (form.value.issue_number) req.issue_number = Number(form.value.issue_number)
+    if (form.value.requirement_number)
+      req.requirement_number = Number(form.value.requirement_number)
+    if (form.value.initial_prompt) req.initial_prompt = form.value.initial_prompt
+
+    const sess = await acpStore.createSession(req)
+    router.push(
+      `/p/${route.params.slug}/w/${route.params.wsSlug}/acp-sessions/${sess.id}`,
+    )
+  } catch (e) {
+    errorMsg.value = `Create failed: ${e instanceof Error ? e.message : 'unknown'}`
+  } finally {
+    submitting.value = false
+  }
+}
+
+function cancel() {
+  router.push(
+    `/p/${route.params.slug}/w/${route.params.wsSlug}/acp-sessions`,
+  )
+}
+</script>
+
+<template>
+  <div class="p-6 max-w-2xl">
+    <h1 class="text-2xl font-semibold mb-4">New ACP Session</h1>
+
+    <form class="space-y-4" @submit.prevent="submit">
+      <div>
+        <label class="block text-sm font-medium mb-1">Agent Kind</label>
+        <select
+          v-model="form.agent_kind_id"
+          class="block w-full border rounded px-2 py-1 text-sm"
+          required
+        >
+          <option value="" disabled>-- choose --</option>
+          <option
+            v-for="k in acpStore.enabledAgentKinds"
+            :key="k.id"
+            :value="k.id"
+          >
+            {{ k.display_name }}
+          </option>
+        </select>
+      </div>
+
+      <div>
+        <label class="block text-sm font-medium mb-1">
+          Branch <span class="text-xs text-gray-500">(optional, takes priority)</span>
+        </label>
+        <input
+          v-model="form.branch"
+          class="block w-full border rounded px-2 py-1 text-sm font-mono"
+          placeholder="feat/x or main"
+        />
+      </div>
+
+      <div class="grid grid-cols-2 gap-2">
+        <div>
+          <label class="block text-sm font-medium mb-1">Issue # (optional)</label>
+          <input
+            v-model="form.issue_number"
+            type="number"
+            class="block w-full border rounded px-2 py-1 text-sm"
+          />
+        </div>
+        <div>
+          <label class="block text-sm font-medium mb-1">Requirement # (optional)</label>
+          <input
+            v-model="form.requirement_number"
+            type="number"
+            class="block w-full border rounded px-2 py-1 text-sm"
+          />
+        </div>
+      </div>
+
+      <p class="text-xs text-gray-500">
+        Branch resolution: explicit &gt; issue &gt; requirement &gt; auto temp branch.
+      </p>
+
+      <div>
+        <label class="block text-sm font-medium mb-1">Initial Prompt (optional)</label>
+        <textarea
+          v-model="form.initial_prompt"
+          rows="3"
+          class="block w-full border rounded px-2 py-1 text-sm"
+          placeholder="Send this immediately after agent ready..."
+        />
+      </div>
+
+      <p v-if="errorMsg" class="text-sm text-red-600">{{ errorMsg }}</p>
+
+      <div class="flex gap-2">
+        <button
+          type="submit"
+          class="px-3 py-1 rounded text-sm font-medium bg-blue-600 text-white hover:bg-blue-700 disabled:bg-gray-300"
+          :disabled="submitting || !form.agent_kind_id"
+        >
+          {{ submitting ? 'Creating...' : 'Create Session' }}
+        </button>
+        <button
+          type="button"
+          class="px-3 py-1 rounded text-sm border hover:bg-gray-50"
+          @click="cancel"
+        >
+          Cancel
+        </button>
+      </div>
+    </form>
+  </div>
+</template>

web/src/views/acp/AcpSessionDetailView.vue

@@ -0,0 +1,148 @@
+<script setup lang="ts">
+import { ref, shallowRef, computed, onMounted, onUnmounted, watch, nextTick } from 'vue'
+import { useRoute } from 'vue-router'
+import { useAcpStore } from '@/stores/acp'
+import { useAcpStream, type UseAcpStreamReturn } from '@/composables/useAcpStream'
+import type { AcpEvent } from '@/api/acp'
+import SessionStatusBadge from '@/components/acp/SessionStatusBadge.vue'
+import AgentEventCard from '@/components/acp/AgentEventCard.vue'
+import PromptInput from '@/components/acp/PromptInput.vue'
+
+const route = useRoute()
+const store = useAcpStore()
+
+const sessionId = computed(() => route.params.sessionId as string)
+
+const stream = shallowRef<UseAcpStreamReturn | null>(null)
+const eventsContainer = ref<HTMLElement | null>(null)
+const errorMsg = ref<string | null>(null)
+
+const events = computed<AcpEvent[]>(() => stream.value?.events.value ?? [])
+
+onMounted(async () => {
+  try {
+    await store.getSession(sessionId.value)
+  } catch (e) {
+    errorMsg.value = e instanceof Error ? e.message : 'failed to load session'
+    return
+  }
+  stream.value = useAcpStream(sessionId.value)
+  watch(
+    () => events.value.length,
+    async () => {
+      await nextTick()
+      if (eventsContainer.value) {
+        eventsContainer.value.scrollTop = eventsContainer.value.scrollHeight
+      }
+    },
+  )
+})
+
+onUnmounted(() => {
+  stream.value?.close()
+})
+
+const isPrompting = computed(() => {
+  const evs = events.value
+  let lastPrompt = -1
+  for (let i = evs.length - 1; i >= 0; i--) {
+    if (evs[i].method === 'session/prompt' && evs[i].direction === 'in') {
+      lastPrompt = i
+      break
+    }
+  }
+  if (lastPrompt < 0) return false
+  for (let i = lastPrompt + 1; i < evs.length; i++) {
+    if (evs[i].kind === 'response') return false
+  }
+  return true
+})
+
+function onPrompt(text: string) {
+  const sess = store.currentSession
+  if (!sess?.agent_session_id) {
+    errorMsg.value = 'Agent not ready yet'
+    return
+  }
+  errorMsg.value = null
+  stream.value?.prompt(text, sess.agent_session_id)
+}
+
+function onCancel() {
+  const sess = store.currentSession
+  if (!sess?.agent_session_id) return
+  stream.value?.cancel(sess.agent_session_id)
+}
+
+async function terminate() {
+  if (!confirm('Terminate this session?')) return
+  try {
+    await store.terminateSession(sessionId.value)
+  } catch (e) {
+    errorMsg.value = e instanceof Error ? e.message : 'terminate failed'
+  }
+}
+
+const sessionStatus = computed(
+  () => stream.value?.sessionStatus.value ?? store.currentSession?.status ?? 'starting',
+)
+</script>
+
+<template>
+  <div class="flex flex-col h-full">
+    <!-- Top bar -->
+    <div class="flex items-center justify-between px-4 py-2 border-b">
+      <div class="space-x-3 text-sm">
+        <span class="font-mono">{{ store.currentSession?.branch }}</span>
+        <span class="text-gray-500">·</span>
+        <span
+          class="text-xs text-gray-500 font-mono truncate max-w-md inline-block align-middle"
+        >
+          {{ store.currentSession?.cwd_path }}
+        </span>
+      </div>
+      <div class="flex items-center gap-2">
+        <SessionStatusBadge :status="sessionStatus" />
+        <button
+          v-if="sessionStatus === 'starting' || sessionStatus === 'running'"
+          class="px-2 py-1 text-xs rounded border text-red-600 hover:bg-red-50"
+          @click="terminate"
+        >
+          Terminate
+        </button>
+      </div>
+    </div>
+
+    <p v-if="errorMsg" class="px-4 py-2 text-sm text-red-600 bg-red-50">
+      {{ errorMsg }}
+    </p>
+
+    <!-- Events stream -->
+    <div
+      ref="eventsContainer"
+      class="flex-1 overflow-y-auto px-4 py-3 space-y-1"
+    >
+      <AgentEventCard
+        v-for="ev in events"
+        :key="ev.id"
+        :event="ev"
+      />
+      <div
+        v-if="events.length === 0"
+        class="text-center text-gray-400 py-8"
+      >
+        Waiting for agent...
+      </div>
+    </div>
+
+    <!-- Prompt input -->
+    <div class="border-t px-4 py-3">
+      <PromptInput
+        :disabled="sessionStatus === 'crashed' || sessionStatus === 'exited'"
+        :is-prompting="isPrompting"
+        @send="onPrompt"
+        @cancel="onCancel"
+      />
+    </div>
+  </div>
+</template>

web/src/views/acp/AcpSessionListView.test.ts

@@ -0,0 +1,44 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { mount } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+
+vi.mock('@/api/acp', () => ({
+  acpApi: {
+    sessions: {
+      list: vi.fn().mockResolvedValue([]),
+      get: vi.fn(),
+      create: vi.fn(),
+      terminate: vi.fn(),
+      events: vi.fn(),
+    },
+    agentKinds: {
+      list: vi.fn().mockResolvedValue([]),
+      get: vi.fn(),
+      create: vi.fn(),
+      update: vi.fn(),
+      remove: vi.fn(),
+    },
+  },
+  isAgentKindAdmin: () => false,
+}))
+
+vi.mock('vue-router', () => ({
+  useRoute: () => ({ params: { slug: 'p', wsSlug: 'w' } }),
+  useRouter: () => ({ push: vi.fn() }),
+}))
+
+import AcpSessionListView from './AcpSessionListView.vue'
+
+beforeEach(() => {
+  setActivePinia(createPinia())
+})
+
+describe('AcpSessionListView', () => {
+  it('mounts without error and shows empty state', async () => {
+    const wrapper = mount(AcpSessionListView)
+    await new Promise((r) => setTimeout(r, 20))
+    const html = wrapper.html()
+    expect(html).toContain('ACP Sessions')
+    expect(html).toContain('No sessions yet')
+  })
+})

web/src/views/acp/AcpSessionListView.vue

@@ -0,0 +1,90 @@
+<script setup lang="ts">
+import { onMounted } from 'vue'
+import { useRouter, useRoute } from 'vue-router'
+import { useAcpStore } from '@/stores/acp'
+import SessionStatusBadge from '@/components/acp/SessionStatusBadge.vue'
+
+const route = useRoute()
+const router = useRouter()
+const store = useAcpStore()
+
+onMounted(() => {
+  void store.listSessions(false)
+})
+
+function open(id: string) {
+  router.push(
+    `/p/${route.params.slug}/w/${route.params.wsSlug}/acp-sessions/${id}`,
+  )
+}
+
+function newSession() {
+  router.push(
+    `/p/${route.params.slug}/w/${route.params.wsSlug}/acp-sessions/new`,
+  )
+}
+
+async function terminate(id: string) {
+  if (!confirm('Terminate this session?')) return
+  try {
+    await store.terminateSession(id)
+  } catch (e) {
+    alert(e instanceof Error ? e.message : 'failed')
+  }
+}
+</script>
+
+<template>
+  <div class="p-6 space-y-4">
+    <div class="flex items-center justify-between">
+      <h1 class="text-2xl font-semibold">ACP Sessions</h1>
+      <button
+        class="px-3 py-1 rounded text-sm font-medium bg-blue-600 text-white hover:bg-blue-700"
+        @click="newSession"
+      >
+        + New
+      </button>
+    </div>
+
+    <div v-if="store.loading" class="text-gray-500">Loading...</div>
+    <div v-else-if="store.error" class="text-red-600">{{ store.error }}</div>
+    <div v-else-if="store.sessions.length === 0" class="text-gray-500">
+      No sessions yet. Click "+ New" to create one.
+    </div>
+
+    <table v-else class="w-full text-sm">
+      <thead class="text-left">
+        <tr class="border-b">
+          <th class="px-3 py-2">Branch</th>
+          <th class="px-3 py-2">Status</th>
+          <th class="px-3 py-2">Started</th>
+          <th class="px-3 py-2 text-right">Actions</th>
+        </tr>
+      </thead>
+      <tbody>
+        <tr v-for="s in store.sessions" :key="s.id" class="border-t hover:bg-gray-50">
+          <td class="px-3 py-2 font-mono text-xs">{{ s.branch }}</td>
+          <td class="px-3 py-2"><SessionStatusBadge :status="s.status" /></td>
+          <td class="px-3 py-2 text-xs text-gray-500">
+            {{ new Date(s.started_at).toLocaleString() }}
+          </td>
+          <td class="px-3 py-2 text-right space-x-2">
+            <button
+              class="text-blue-600 hover:underline"
+              @click="open(s.id)"
+            >
+              Open
+            </button>
+            <button
+              v-if="s.status === 'starting' || s.status === 'running'"
+              class="text-red-600 hover:underline"
+              @click="terminate(s.id)"
+            >
+              Terminate
+            </button>
+          </td>
+        </tr>
+      </tbody>
+    </table>
+  </div>
+</template>

web/src/views/admin/AgentKindAdminListView.vue

@@ -0,0 +1,115 @@
+<script setup lang="ts">
+import { onMounted } from 'vue'
+import { useRouter } from 'vue-router'
+import { NButton, NSpin } from 'naive-ui'
+import AppShell from '@/layouts/AppShell.vue'
+import { useAcpStore } from '@/stores/acp'
+
+const router = useRouter()
+const store = useAcpStore()
+
+onMounted(() => store.listAgentKinds(true))
+
+async function toggleEnabled(id: string, enabled: boolean) {
+  await store.updateAgentKind(id, { enabled })
+}
+
+async function remove(id: string, name: string) {
+  if (!confirm(`Delete agent kind "${name}"?`)) return
+  try {
+    await store.deleteAgentKind(id)
+  } catch (e) {
+    alert(`Delete failed: ${e instanceof Error ? e.message : 'unknown'}`)
+  }
+}
+</script>
+
+<template>
+  <AppShell>
+    <NSpin :show="store.loading">
+      <div class="space-y-4">
+        <div class="flex items-center justify-between">
+          <h1 class="text-2xl font-semibold">
+            ACP Agent Kinds
+          </h1>
+          <NButton
+            type="primary"
+            @click="router.push('/admin/acp/agent-kinds/new')"
+          >
+            + New
+          </NButton>
+        </div>
+        <div
+          v-if="store.error"
+          class="text-red-600"
+        >
+          {{ store.error }}
+        </div>
+        <table
+          v-else
+          class="w-full text-sm"
+        >
+          <thead class="text-left">
+            <tr>
+              <th class="px-3 py-2">
+                Name
+              </th>
+              <th class="px-3 py-2">
+                Display
+              </th>
+              <th class="px-3 py-2">
+                Binary
+              </th>
+              <th class="px-3 py-2">
+                Enabled
+              </th>
+              <th class="px-3 py-2 text-right">
+                Actions
+              </th>
+            </tr>
+          </thead>
+          <tbody>
+            <tr
+              v-for="k in store.agentKinds"
+              :key="k.id"
+              class="border-t"
+            >
+              <td class="px-3 py-2 font-mono">
+                {{ k.name }}
+              </td>
+              <td class="px-3 py-2">
+                {{ k.display_name }}
+              </td>
+              <td class="px-3 py-2 font-mono text-xs">
+                {{ k.binary_path }}
+              </td>
+              <td class="px-3 py-2">
+                <input
+                  type="checkbox"
+                  :checked="k.enabled"
+                  @change="toggleEnabled(k.id, !k.enabled)"
+                >
+              </td>
+              <td class="px-3 py-2 text-right space-x-2">
+                <NButton
+                  text
+                  type="primary"
+                  @click="router.push(`/admin/acp/agent-kinds/${k.id}`)"
+                >
+                  Edit
+                </NButton>
+                <NButton
+                  text
+                  type="error"
+                  @click="remove(k.id, k.name)"
+                >
+                  Delete
+                </NButton>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </div>
+    </NSpin>
+  </AppShell>
+</template>

web/src/views/admin/AgentKindEditView.vue

@@ -0,0 +1,90 @@
+<script setup lang="ts">
+import { ref, onMounted, computed } from 'vue'
+import { useRoute, useRouter } from 'vue-router'
+import AppShell from '@/layouts/AppShell.vue'
+import AgentKindForm from '@/components/acp/AgentKindForm.vue'
+import { useAcpStore } from '@/stores/acp'
+import type { UpdateAgentKindReq } from '@/api/acp'
+
+const route = useRoute()
+const router = useRouter()
+const store = useAcpStore()
+
+const id = computed(() => (route.params.id as string | undefined) ?? null)
+const isEdit = computed(() => id.value !== null)
+
+const form = ref({
+  name: '',
+  display_name: '',
+  description: '',
+  binary_path: '',
+  args: [] as string[],
+  env: {} as Record<string, string>,
+  enabled: true,
+})
+const existingEnvKeys = ref<string[]>([])
+
+onMounted(async () => {
+  if (isEdit.value && id.value) {
+    const k = await store.getAgentKind(id.value)
+    form.value = {
+      name: k.name,
+      display_name: k.display_name,
+      description: k.description,
+      binary_path: k.binary_path,
+      args: [...k.args],
+      env: {}, // Edit mode: do not prefill values; user must replace entirely if they want to change.
+      enabled: k.enabled,
+    }
+    existingEnvKeys.value = [...k.env_keys]
+  }
+})
+
+async function submit() {
+  try {
+    if (isEdit.value && id.value) {
+      const req: UpdateAgentKindReq = {
+        display_name: form.value.display_name,
+        description: form.value.description,
+        binary_path: form.value.binary_path,
+        args: form.value.args,
+        enabled: form.value.enabled,
+      }
+      // Only send env if user actually entered some values; an empty map would
+      // wipe existing env on the backend (per service patch semantics).
+      if (Object.keys(form.value.env).length > 0) req.env = form.value.env
+      await store.updateAgentKind(id.value, req)
+    } else {
+      await store.createAgentKind({
+        name: form.value.name,
+        display_name: form.value.display_name,
+        description: form.value.description,
+        binary_path: form.value.binary_path,
+        args: form.value.args,
+        env: form.value.env,
+        enabled: form.value.enabled,
+      })
+    }
+    router.push('/admin/acp/agent-kinds')
+  } catch (e) {
+    alert(`Save failed: ${e instanceof Error ? e.message : 'unknown'}`)
+  }
+}
+</script>
+
+<template>
+  <AppShell>
+    <div class="p-6 max-w-2xl">
+      <h1 class="text-2xl font-semibold mb-4">
+        {{ isEdit ? 'Edit Agent Kind' : 'New Agent Kind' }}
+      </h1>
+      <AgentKindForm
+        v-model="form"
+        :is-edit="isEdit"
+        :existing-env-keys="existingEnvKeys"
+        @submit="submit"
+        @cancel="router.push('/admin/acp/agent-kinds')"
+      />
+    </div>
+  </AppShell>
+</template>