chore: bump pi-agent-core/pi-ai to 0.73.1 and refresh model docs/deps

[stealthwhizz]

Fixes #98

Summary

• Bumps @mariozechner/pi-agent-core and @mariozechner/pi-ai from ^0.70.2 to ^0.73.1 — unblocks newer model IDs already present in the pi-ai registry.
• Bumps the safe minor/patch set: @modelcontextprotocol/sdk, @opentelemetry/* (excluding instrumentation-undici), @sinclair/typebox.
• Refreshes stale model references in README.md / Documentation.md / examples to models confirmed present in the 0.73.1 registry: claude-sonnet-4-6, claude-haiku-4-5, gpt-4.1-mini, gemini-2.5-flash.

Deliberately held back (see issue #98 for rationale)

• node-cron 4.x and @opentelemetry/instrumentation-undici 0.31.0 — majors/multi-minor jumps needing an API check.
• typescript 7.x and @types/node 26.x — majors needing a deliberate migration.
• The @mariozechner → @earendil-works package rename (pi-agent-core/pi-ai now deprecated in favor of the new scope, currently at 0.82.1) — separate migration touching ~31 call sites in src/, out of scope here.

Test plan

• npm install — resolves cleanly
• npm run build — tsc passes with no errors
• npm test — 65/65 tests pass

[shreyas-lyzr]

Reviewed the full diff. This is a clean dependency maintenance PR — well-scoped, clearly documented, and all green on every check I ran.

What was reviewed:

• package.json version bumps (pi-agent-core/pi-ai 0.70.x → 0.73.1, MCP SDK 1.29 → 1.30, full OTel suite 0.215/2.7 → 0.221/2.10, typebox, smithy, aws-sdk, hono, etc.)
• package-lock.json lockfile consistency — resolved URLs all point to registry.npmjs.org with matching integrity hashes
• README.md and Documentation.md model reference refreshes
• examples/local-repo.ts and examples/sdk-demo.ts

Security pass: No CVEs on any bumped package (queried OSV.dev for all 12 key packages). No secrets or hardcoded credentials. No injection surface changes — this touches only dependency versions and documentation. The @hono/node-server major bump (1.x → 2.x) is explicitly allowed by the MCP SDK 1.30.0 peer dep spec (^1.19.9 || ^2.0.5); the node engine floor bump (>=18 → >=20) is consistent with this repo's own engines: { node: '>=20' }.

One pre-existing doc nit (not introduced by this PR): README.md line 769 still references anthropic:claude-4-6-sonnet-latest (a stale alias that was already on main before this PR). Worth a follow-up cleanup but not a blocker.

The deliberately held-back items (node-cron 4.x, TypeScript 7.x, the @earendil-works package rename) are well-reasoned and tracked in issue #98.

[shreyas-lyzr]

Re-reviewed in full. Everything checks out.

Changes are confined to package.json (dep version bumps), package-lock.json (lockfile refresh), and docs/examples (model string updates). No src/ changes.

Key findings:

• All 18 newly resolved packages checked against OSV.dev: zero CVEs.
• The @hono/node-server 1.x → 2.x jump is handled correctly — MCP SDK 1.30.0 explicitly widens its peer range to ^1.19.9 || ^2.0.5, so no conflict.
• @opentelemetry/instrumentation-undici@0.25.0 nests its own instrumentation@0.215.0 alongside the top-level 0.221.0. This is expected npm deduplication behavior and does not cause a conflict at runtime.
• @mistralai/mistralai@2.5.0 adds an optional @opentelemetry/api peer dep — it's optional and the existing api@1.9.1 satisfies it.
• No hard-coded secrets, no injection surface changes, no frontend key exposure.
• Stale model IDs in src/, agents/, and docs/ (e.g. gpt-4o-mini, claude-sonnet-4-5-20250929) are pre-existing on main and not introduced or worsened by this PR. Out of scope here as noted in the PR description.

Clean dep bump. Safe to merge.

[shreyas-lyzr]

Dependency bump looks well-scoped and the rationale for what was held back is clearly documented.

pi-agent-core/pi-ai 0.70.x → 0.73.1: Both packages now carry a deprecation notice pointing to the @earendil-works scope. The PR correctly calls this out as a separate migration (31 call sites, out of scope here). Worth ensuring there's a tracked issue for that migration — at 0.73.1 the deprecated packages likely still receive critical fixes, but this will need to happen before the upstream maintainer drops the old scope.

@opentelemetry/* bumps (0.215.0 → 0.221.0 for instrumentations, 2.7.x → 2.10.0 for SDKs): The lock file shows the version spread collapsing significantly — many per-package overrides of resources/sdk-metrics/sdk-trace-base that existed at 2.7.x are gone at 2.10.0, which means npm's resolution is now cleaner. Good side-effect.

@hono/node-server 1.x → 2.0.12: This is a major bump. The PR describes it as 'minor/patch' in the summary but the lock file shows 1.19.14 → 2.0.12. The peerDependency node requirement also tightened from >=18.14.1 to >=20. Since the project already requires node >=20 this doesn't break anything, but it's worth verifying that the MCP SDK (which uses @hono/node-server) does not exercise any 2.x breaking changes. The MCP SDK's own peer dep range was updated to accept both 1.19.9 and 2.0.5+ so the version is explicitly supported.

node-cron held at 3.x: correct call. The 4.x release changed the constructor API.

express-rate-limit 8.5.2 → 8.6.1 in the lock: this brought in a new debug dependency. Not a concern but worth noting it wasn't in the PR description.

Security pass: checked changed direct dependencies against OSV.dev — no known CVEs in pi-agent-core 0.73.1, pi-ai 0.73.1, @modelcontextprotocol/sdk 1.30.0, or the @opentelemetry/* packages at these versions. No hard-coded secrets or API keys added. No frontend-exposed tokens. Clean.

The PR description says 65/65 tests pass with the new versions, which is the right confirmation bar for a dependency bump.