chore(deps): bump AWS SDK to 3.1162.0, OpenTelemetry to 0.223.0/2.12.0, and @daytona/sdk to 0.227.3 - #9900

Summary

• @daytona/sdk 0.207.0 → 0.227.3, moved together with the AWS SDK and OpenTelemetry so Daytona's own AWS/OTel dependencies resolve to Sim's copies instead of nesting duplicates (bun.lock now has no @daytona/sdk/@aws-sdk/* or @daytona/sdk/@opentelemetry/* entries; every @opentelemetry/* package has a single copy).
• All @aws-sdk/* clients (apps/sim, packages/runtime-secrets) 3.1150.0 → 3.1162.0. 3.1162 rather than 3.1161: with 3.1161 pins, the 7-day minimumReleaseAge gate still lets shared transitive packages (@aws-sdk/core, credential providers, lib-storage) float to the 3.1162 line, leaving a mixed set, a nested token-providers copy, and a lib-storage peer mismatch (client-s3 ^3.1162.0). One release line avoids all three.
• OpenTelemetry 0.221.0 → 0.223.0 and 2.10.0 → 2.12.0 (apps/sim, packages/logger), staying on the 0.22x/2.x lines that Daytona requires (not the 0.300/3.0 majors).
• @smithy/node-http-handler pin 4.12.1 → 4.14.1 (apps/sim, runtime-secrets): the 3.1162 clients require ^4.14.0, so the old pin nested a second copy under every client and Sim's proxy NodeHttpHandler would have been a different version from the SDK's.
• No Sim code changes. Changelog review:
  • OTel 0.222/0.223 breaking changes only touch startNodeSDK/declarative config and web network utilities; Sim builds new NodeSDK(...) with explicit processors and exporters.
  • Daytona types for every call daytona.ts makes (create, fs.*, process.*Session*, delete) are unchanged. Behavioral additions are a connection-level retry (connect-phase errors on any method, mid-flight resets only on idempotent methods) and resolving DAYTONA_API_URL from the process environment only; Sim does not set an endpoint.
  • AWS 3.1162 adds a per-service default socket timeout, but it is off unless AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true.
• Lockfile side effects: Daytona dropped dotenv/fast-glob (now tinyglobby), so root dotenv resolves 16.6.1 and fast-glob is gone; nothing in Sim imports either. @earendil-works/pi-ai exactly pins its own @smithy/node-http-handler@4.12.1 and Bedrock client 3.1127.0, so its existing nested subtree gains a few entries.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other: dependency upgrade

Testing

• bun install --frozen-lockfile clean; bun.lock checked for nested AWS/OTel/Smithy copies before and after.
• Existing tests: packages/runtime-secrets (17 passed, includes the proxy egress path through the SDK handlers), packages/logger (27 passed), and 13 apps/sim files covering the Daytona/E2B remote-sandbox conformance and CLI tooling, environment proxy handlers, AppConfig, S3 uploads/operations, Bedrock, Marketplace entitlements, AWS service-account credentials and the S3 data drain (372 passed).
• OpenTelemetry: ran Sim's real instrumentation-node register() under Bun against a local OTLP/HTTP receiver, emitted a business span, a counter, and a @sim/logger line, then shut down via the SIGTERM handler. Traces, metrics, and logs all reached /v1/traces, /v1/metrics, /v1/logs with no exporter or SDK errors, on sdk-node 0.223.0 / sdk-trace 2.12.0.
• Live Daytona run: still pending. A script exercising exactly the SDK calls daytona.ts makes (create, upload/details/download-stream/list/delete files, session create/execute with the stdin handshake/logs/get/delete, sandbox delete) is ready, but no Daytona API key access yet. It will be run before merge and the result added here.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code