Feat/pinecone extended

[petitmj]

📝 Description

• Refactors packages/core/src/subsystems/IO/VectorDB.service/connectors/PineconeVectorDB.class.ts to delegate runtime operations to the shared connection manager and wrap Pinecone calls with standardized retry/timeout helpers.

• Introduces helper modules under packages/core/src/subsystems/IO/VectorDB.service/connectors/pinecone/ including types.ts, async-utils.ts, retry-utils.ts, and connection-manager.ts to centralize configuration, cancellation, retry handling, and credential resolution.

• Adds targeted unit coverage in packages/core/tests/unit/004-VectorDB/pinecone-helpers.test.ts validating the helper utilities and connection lifecycle.

• Documents the Phase 1 refactor scope, business impact, testing instructions, and roadmap in docs/pinecone-connector-refactor-summary.md.

🔗 Related Issues

• Fixes #

• Relates to Add SmythOS Milvus Connector (all files ready for PR) #148 – Milvus Connector PR establishes shared VectorDB connector patterns leveraged here.

• Relates to #[NEW] – Standardize retry logic across all VectorDB connectors (enhancement, vectordb, reliability). Propagate Pinecone retry-utils approach to Milvus and RAMVec.

• Relates to #[NEW] – Implement circuit breaker pattern for VectorDB connectors (enhancement, vectordb, reliability, Phase 2). Generalize Pinecone circuit-breaker groundwork within the connection manager.

• Relates to #[NEW] – Centralize credential management via ManagedVault for all connectors (enhancement, security, vault). Extend Pinecone’s ManagedVault/Vault caching pattern to other IO connectors.

• Relates to #[NEW] – Environment-based configuration validation for all connectors (enhancement, configuration). Align configuration resolution across Storage, Cache, and VectorDB services.

• Relates to #[NEW] – Increase VectorDB test coverage to 95%+ (testing, vectordb, quality). Build on Pinecone helper tests with broader VectorDB coverage.

• Relates to #[NEW] – Document VectorDB connector architecture and patterns (documentation, vectordb). Expand docs with retry, connection management, and security best practices.

🔧 Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 📚 Documentation update
• 🔧 Code refactoring (no functional changes)
• 🧪 Test improvements
• 🔨 Build/CI changes

✅ Checklist

• Self-review performed
• Tests added/updated
• Documentation updated (if needed)

[alaa-eddine-k]

Hi @petitmj

Could you explain the point of adding this to the pinecone configuration ?

What scenarios/issues does this solve ?

[petitmj]

Vault-based credentials provide federated access based on the user's level of privilege. They also help maintain security and compliance across multiple domains at the production level.

On the other hand, apiKey is good for lower levels such as the development phase. auth.apiKey also keeps production resilient if vault is down

[alaa-eddine-k]

SRE has an integrated vault system, I want to understand how does this proposition integrate with it / enhance it ?

[petitmj]

It enhances SRE's security-first architecture by centralizing the governance of security keys. The Pinecone keys are now included alongside other SRE secrets.
Before, the Pinecone keys were either exclusively managed via the direct apiKey?: string

[alaa-eddine-k]

The intention is good, but it adds unnecessary complexity and breaks concerns separation rule.

In the current approach we can easily use the vault without interfering with Pinecone connector
all connectors already have an "instance()" method that can create a forked instance for a given candidate, this is how the SDK creates dedicated connectors for the agents

const pinecone = ConnectorService.getVectorDBConnector('Pinecone'); //get the default Pinecone connector
const vault = ConnectorService.getVaultConnector();
const apiKey = await vault.agent(agent.id).get('my_pinecone_vault_key'); // .agent(agent.id) is a shortcut for .requester(AccessCandidate.agent(agent.id))

const myPinecone = pinecone.instance({  apiKey, /*... other Pinecone settings ...*/ });  // this instance is configured with custom settings and using apiKey from the vault.

The benefit of the existing system is that it's usable with all IO, Memory and Cache connectors without a custom auth manager per connector.