fix: keep AGUI browser thread IDs stable

[jstar0]

Summary

• Fix the local AGUI web UI proxy so messages from the same browser session keep the same AGUI threadId.
• Reuse the existing AGUI input helper so local and deployed AGUI paths derive threadId from the session id while keeping a unique runId per invocation.
• Add a regression test that sends two local AGUI messages with the same browser session id and verifies stable threadId plus distinct runId values.

Changes

The local AGUI path was creating a new threadId with randomUUID() for every proxied message. This meant the browser session header stayed stable while the AGUI request body looked like a new thread each time, breaking multi-turn session persistence for AGUI agents.

This change uses buildAguiRunInput(prompt, sessionId) in handleAguiInvocation, matching the deployed AGUI invocation path without changing response streaming, headers, A2A routing, or non-AGUI local invocations.

Verification

npm test -- src/cli/operations/dev/web-ui/__tests__/local-agui-invocations.test.ts
npm test -- src/cli/operations/dev/web-ui/__tests__/deployed-invocations.test.ts src/cli/aws/__tests__/agui-types.test.ts src/cli/operations/dev/web-ui/__tests__/local-agui-invocations.test.ts
npm run typecheck
npm run lint
npm run build
npm test

Related Issue

Closes #1678

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published, or no dependent changes are required

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[tejaskash]

LGTM