feat(acp): add IBM Bob as a builtin Registry ACP agent

[kaizhou-lab]

Summary

IBM Bob is now listed on the public ACP Registry with an npx distribution. This PR seeds it as a builtin ACP agent, following the migration 044 (MiniMax Code) pattern:

• crates/aionui-db/migrations/045_add_bob_builtin_agent.sql adds the bob row.
• @ibm/bob@2.0.7 is pinned in the npx release lock. No version is stored in metadata.
• The official Registry SVG is embedded as acp-registry/bob.svg.
• Count and enumeration guards are updated, and a dedicated migration test is added.

This is not a lock-only change, so it is left open for human review. Two decisions below are yours.

Identity

Source	Evidence
Public Registry page	Card title="Bob", href="https://bob.ibm.com", "IBM Bob is your AI-Powered Development Partner", 2.0.7
CDN JSON (v2026.10.14-5f08813)	id bob, name Bob, website https://bob.ibm.com, npx @ibm/bob@2.0.7, args ["acp"], license proprietary
npm package	@ibm/bob, homepage https://bob.ibm.com/, bin bob, engines node >= 22
Live initialize	agentInfo {name: "bob-shell", title: "Bob", version: "2.0.7"}

backend = "bob": the product name and also the canonical CLI the vendor documents. It coincides with the CDN JSON lookup id but is not derived from it. The JSON id appeared one day before the public page card (2026-10-14). It was held until the page listed it.

Seeded fields and evidence

Field	Value	Evidence
command / args	npx / ["-y","@ibm/bob","acp"]	Registry argv. Vendor ACP.md: "bob acp starts Bob Shell as an ACP server"
binary_name	bob	README installs with npm install -g @ibm/bob. bob --version (clean HOME) exits 0 printing 2.0.7 and a commit: line, so no skip_version_probe
agent_capabilities	load_session, prompt image + embedded_context, mcp http, session list/delete/resume/close, _meta.bob/extensions	snake_case form of the probed initialize, per the migration 003 contract
auth_methods	[{"id":"sso",...}]	probed initialize
yolo_id	NULL	Session modes in source are agent (default), plan, ask. None bypasses approvals. ACP.md: protected operations "still require explicit approval" even with the --auto-approve launch flag
native_skills_dirs	[".bob/skills"]	Provisional, source-level. Bob's WorkspaceSkillsManager scans .bob/skills, .bob/plugins/*/skills, .agents/skills and .claude/skills. Not loaded end to end, because that needs an authenticated session. skill_delivery stays NULL (injected)
behavior_policy	{"supports_side_question":false}	No negative team flag (migration 033)
description	NULL	builtin rows do not persist Registry descriptions

Probe evidence

Serial ACP probes against @ibm/bob@2.0.7, clean temporary HOME, no credentials:

argv	initialize	session/new	classification
npx -y @ibm/bob@2.0.7 acp	ok, protocolVersion 1	-32600 "Workspace … is not trusted. Pass --trust …, or run Bob Shell interactively in this folder and choose a trust level"	configuration (workspace trust)
npx -y @ibm/bob@2.0.7 acp --trust	ok	-32000 "Authentication required"	auth required

Decisions for the reviewer

1. --trust is not in the stored argv. With the Registry argv, every new workspace fails session/new until the user trusts it once in Bob Shell, which is exactly what Bob's error message instructs. Adding --trust would make the ACP server auto-trust every workspace it opens. That is a security trade-off this PR deliberately does not make. If you want it, it is a one-line argv change, and launch_argv_does_not_trust_workspaces_or_auto_approve exists so it has to be deliberate.
2. Migration number 045 collides with open PRs feat(mcp): dynamic client registration and bearer injection for OAuth MCP servers #1029, feat(cron): add native shell action for scheduled jobs #1011, feat(acp): add DeepSeek Harness (dsh) builtin agent and support sessi… #995 and feat(agent): add DeepSeek Harness as a builtin ACP agent #936, which all add a 045_* migration. Whichever merges later must renumber.

Known limitations

These are shared with every agent whose yolo_id is NULL and has no full_auto_mode_id arm, for example minimax-code. They are not fixed here because the scope is metadata-only.

• A NULL yolo_id falls back to "yolo", which Bob does not advertise. Nothing invalid reaches the wire: AcpSession::clear_invalid_desired_mode drops it, and cron's full-auto path only applies advertised modes. However, a cron-bound conversation persists "yolo" as its runtime mode (cron/src/executor.rs), and a session/load resume then reports it as the current mode (agent_session_flow.rs). This affects state and display only.
• Bob is team-capable through MCP (mcp_capabilities.http). AionCore auto-approves aionui-team tool calls only when the permission request carries raw_input.server_name or an mcp__<server>__ title (permission_router.rs). Bob's source suggests its requests use a "Running ()" title and raw tool arguments. If so, Bob teammates would prompt for each team tool call. This comes from reading the bundle, not from the wire: confirming it needs an authenticated capture.

Validation

• cargo test -p aionui-db --test bob_builtin_agent_migration: 6 passed (includes argv and alias bad paths).
• cargo test -p aionui-db --test team_capability_criteria_migration: 4 passed.
• cargo test -p aionui-db --test minimax_code_builtin_agent_migration: 4 passed.
• cargo test -p aionui-db --lib -- sqlite_agent_metadata: 20 passed.
• cargo test -p aionui-runtime --lib -- registry_npx_lock: 5 passed.
• cargo test -p aionui-assets --lib -- registry_agent_logos_are_embedded_as_svg: 1 passed.
• cargo test -p aionui-ai-agent --lib -- registry::tests: 30 passed.
• cargo clippy -p aionui-db -p aionui-runtime -p aionui-assets -p aionui-ai-agent --all-targets -- -D warnings, just lint-fix, just fmt, just migration-check: clean.
• Local validation ran name-filtered tests only. The full workspace suite is left to the Test check on this PR.
• Before opening this PR, an independent four-way read-only review covered contract compliance, evidence claims, guard completeness, and the yolo fallback's runtime path. Its confirmed findings were fixed: bob was added to the seeded auth-methods guard, and the comment's version and fallback wording was corrected. The two limitations above came from that review.

No AionUi issues are linked (scheduled-run policy).

Logging

No logging change. This is a metadata-only addition; existing startup and session errors already identify a failing agent by backend.