fix(deps): upgrade ai-sdk provider family and force-patch @hono/node-server

[jithin23-kv]

Summary

Resolves the remaining Dependabot-flagged vulnerabilities that couldn't be fixed by a plain npm audit fix:

• @ai-sdk/anthropic, @ai-sdk/google, @ai-sdk/openai, @ai-sdk/openai-compatible: bumped from 2.x/1.x to the ai-v6-tagged 3.x/2.x releases (matching the major generation our ai@^6.0.0 dependency already uses), which resolves the @ai-sdk/provider-utils uncontrolled resource consumption issue (GHSA-866g-f22w-33x8). Deliberately chosen over npm audit fix --force, which would have jumped two majors to 4.x and also silently downgraded @anthropic-ai/claude-agent-sdk.
• @hono/node-server: added an overrides entry pinning it to ^2.0.5, since @modelcontextprotocol/sdk's own declared range (^1.19.9) excludes the patched 2.x line (GHSA-frvp-7c67-39w9). Verified this package isn't even reachable in our own code paths (we use StdioServerTransport/StreamableHTTPClientTransport, not the MCP SDK's HTTP-server transport that pulls this in), so risk was already low — this closes the alert regardless.

Follow-up cleanup in core/src/providers/factory.ts: removed the global AI_SDK_LOG_WARNINGS = false suppression. It existed only because the old @ai-sdk/openai-compatible@1.x implemented an older provider spec than ai@6 and warned on every model instance. With the v2 bump in this PR that mismatch is gone, so the suppression is now dead code (and its comment stale) — dropping it also stops silently muting genuine AI SDK warnings for all other providers.

Also includes an unrelated stray version sync in runners/cli/ui/package-lock.json (0.10.0 → 0.10.1) picked up during the dependency install.

Resolves: https://github.com/KeyValueSoftwareSystems/agent-opfor/security/dependabot/59, https://github.com/KeyValueSoftwareSystems/agent-opfor/security/dependabot/65, https://github.com/KeyValueSoftwareSystems/agent-opfor/security/dependabot/20

Test plan

• npm run build, npm run typecheck, npm run lint, npm run format:check all pass
• npm test passes (163/163) — re-verified after removing the warning suppression; providerFactory tests instantiate the groq + openai-compatible models and no AI SDK Warning line surfaces
• npm audit — down to 1 pre-existing low-severity, unfixable-without-breaking issue (esbuild, pinned by tsx)
• Manually verified opfor run end-to-end with openai and openai-compatible attacker LLMs
• Manually verified opfor hunt (autonomous mode)
• Manually verified opfor run against a live MCP target (remote server)
• Manually verified opfor's own MCP server (stdio initialize + tools/list) responds correctly
• anthropic/google attacker LLM providers verified by typecheck only (no live call) — no test API keys available for this pass; recommend a live smoke test by someone with those keys before/after merge

Summary by CodeRabbit

• Chores
  • Updated AI provider integrations to newer versions for improved compatibility and access to the latest capabilities.
  • Standardized the node server package version across the project.
  • Refreshed command-line tooling dependencies.

[coderabbitai]

Walkthrough

Updated AI SDK dependency ranges in core and CLI manifests, added a root override for @hono/node-server, and removed suppression of AI SDK specification compatibility warnings in the provider factory.

Changes

Dependency and SDK warning updates

Layer / File(s)	Summary
Align AI SDK dependency ranges core/package.json, runners/cli/package.json	Updated Anthropic, Google, OpenAI, and OpenAI-compatible AI SDK ranges in core dependencies and CLI development dependencies.
Restore provider compatibility warnings core/src/providers/factory.ts	Removed the global setting that disabled AI SDK specification compatibility warnings.
Pin Hono node server version package.json	Added a root override forcing @hono/node-server to use ^2.0.5.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: AI SDK dependency upgrades and a Hono node-server override.
Description check	✅ Passed	The description covers the problem, solution, changed files, issue links, and testing, though it doesn't follow the template headings exactly.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ai-sdk-mcp-sdk-audit

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Around line 48-50: Update the package.json overrides entry for
`@hono/node-server` to remain within the `@modelcontextprotocol/sdk-supported`
^1.19.9 range, or add an MCP integration test that validates compatibility with
the 2.x override; do not retain the current unsupported override without
coverage.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 26abeb00-14ca-4285-b324-64e9cae84c71

📥 Commits

Reviewing files that changed from the base of the PR and between 338f98b and 90860df.

⛔ Files ignored due to path filters (2)

• package-lock.json is excluded by !**/package-lock.json
• runners/cli/ui/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

• core/package.json
• package.json
• runners/cli/package.json