feat(agents): bump pi-acp release pin to 0.0.32

[ChristianLuciani]

Summary

• Bump the ACP Registry npx release pin for Pi from pi-acp@0.0.31 → pi-acp@0.0.32 in crates/aionui-runtime/resources/acp-registry-npx-lock.json.
• Runtime still resolves DB args ["-y","pi-acp"] to the locked version via pin_registry_npx_args (migration 025 left args unversioned on purpose).
• Migration 029: advertise session_capabilities.delete: {} on the Pi builtin row so seeded agent_capabilities match the live ACP handshake from pi-acp#76 (released in v0.0.32).

This unblocks AionUi users of the builtin Pi agent from getting session/delete (and the rest of the 0.0.32 fixes) without manual agent setup.

Why not edit migration 023?

Historical seed stays intact. The pin of record is the release lock; DB command/args remain the stable package identity.

Behavior notes from pi-acp 0.0.32 (for QA)

Beyond session/delete:

• Startup info can include project-level packages in the extensions list
• Bash tools render as terminals in ACP clients
• Extension notifications can carry severity via _meta

The long “available skills” list on first turn is intentional pi-acp startup info (disable with quietStartup: true in pi settings), not an AionUi bug.

Test plan

• cargo test -p aionui-runtime registry_npx_lock
• cargo test -p aionui-db --test pi_acp_agent_migration
• cargo test -p aionui-ai-agent --lib resolve_agent_command_spec_flattens_bare_npx_command
• cargo test -p aionui-ai-agent --lib manual_check_persists_command_not_found
• cargo fmt --all -- --check
• cargo clippy -p aionui-runtime -p aionui-db -- -D warnings
• CI green on this draft
• Optional: live smoke against npx -y pi-acp@0.0.32 + Pi CLI handshake

Related

• Prior: AionCore #618 (Pi builtin @ 0.0.31)
• Upstream feature: svkozak/pi-acp#76 / v0.0.32

Thanks for maintaining AionCore — happy to adjust the migration or PR shape if you prefer a lock-only change.

[kaizhou-lab]

Thanks for the contribution — the pi-acp 0.0.32 findings here are solid. We independently re-probed pi-acp@0.0.32 today: initialize ok, session/new returns a cleanly classified auth-required error, and the handshake indeed advertises sessionCapabilities.delete.

Two notes on how this lands on our side:

1. The pin bump is now covered by chore(acp): bump registry npx lock to probed versions #695, which syncs all 8 drifted Registry pins (including pi-acp 0.0.31 -> 0.0.32) with fresh ACP probe evidence, and updates the same three lock-derived test assertions this PR touches.

2. On migration 029: we'd prefer to keep release-pin updates lock-only by design. agent_capabilities is refreshed at runtime from the live handshake — initialize/session/new results are written back to the catalog row through the registry's catalog-sync path — so the seeded value is bootstrap-only and self-heals on the first real connect with 0.0.32. Coupling migrations to upstream capability deltas doesn't scale: this sync alone bumped 8 packages, and the seed would still drift for any bump that skips its migration. So we'd rather not take the migration or its test.

Given that, we suggest closing this PR in favor of #695 — the pi bump lands there, and the delete capability is picked up automatically on first handshake. Sorry for the overlap: your PR predates #695 by two days, and the probe evidence here matches ours exactly.

[ChristianLuciani]

Thanks for the detailed review and for picking up the pi-acp bump in #695 — the lock-only approach makes complete sense. We had not fully appreciated that agent_capabilities self-heals from the live ACP handshake via the catalog-sync path; coupling migrations to upstream capability deltas indeed does not scale, and we will follow that pattern going forward.

Closing in favor of #695. Appreciate the patience with the overlap — glad the probe evidence matched exactly.