feat(registry): add Pinecone Vector Store plugin

[Finley-Agent-Zhuazhua]

Summary

Adds the pineconeVectorStore FastGPT community toolset as a pinned submodule.

• Plugin source: https://github.com/Finley-Agent-Zhuazhua/fastgpt-plugin-pineconeVectorStore
• Plugin commit: d6f0366984edefbfbf93009c09a2c075683917f7
• Registry branch commit: 1a00c59e5b858501dfd28303edf9351d86c626e2
• Tool IDs: queryVectors, upsertVectors, fetchVectors, deleteVectors

Tool coverage

• Query dense vectors with optional namespace/filter/include controls.
• Upsert vectors with IDs, dense values, and metadata.
• Fetch vectors by ID.
• Delete vectors with exactly one selector (ids, filter, or deleteAll=true).

Endpoint safety: the plugin only uses the configured Pinecone index host after validating HTTPS, no embedded credentials, no URL path, and a .pinecone.io hostname.

Verification

Plugin repo (fastgpt-plugin-pineconeVectorStore):

• pnpm install --ignore-workspace ✅
• pnpm run type-check ✅
• pnpm test ✅ — 2 files / 9 tests passed
• pnpm build ✅
• pnpm check ✅
• pnpm run pack ✅ — produced fastgpt-plugin-pineconeVectorStore.pkg

Registry repo:

• pnpm validate ✅ ({ "ok": true })
• pnpm test ✅ — 8 files / 34 tests passed
• pnpm type-check ✅
• git submodule status --recursive ✅ — includes packages/tools/pineconeVectorStore at d6f0366984edefbfbf93009c09a2c075683917f7

Remote dev debug

Skipped in this scheduled agent run because it requires a live FastGPT remote-debug connection key plus a real Pinecone API key/index host. Local build, CLI check, package, and mocked API tests all passed.

[FinleyGe]

Plugin Review: pineconeVectorStore@0.1.0

Verdict: pass
Source: https://github.com/Finley-Agent-Zhuazhua/fastgpt-plugin-pineconeVectorStore.git@d6f0366984edefbfbf93009c09a2c075683917f7
Plugin root: packages/tools/pineconeVectorStore/.

Findings

• None.

Evidence

• registry/submodule: pnpm run validate -- --base origin/main --head HEAD passed with ok: true and changedPluginIds: ["pineconeVectorStore"]. The submodule checked out at d6f0366984edefbfbf93009c09a2c075683917f7, matching the registry commit and .gitmodules source URL.
• install/build/check/pack: plugin dependencies installed from the plugin lockfile with pnpm install --frozen-lockfile in an independent source checkout. pnpm test passed (2 test files, 9 tests), pnpm run type-check passed, pnpm run build passed, pnpm run check passed, and pnpm run pack passed. A nested-submodule test run inherited the parent repo Vitest config and was not used as the final plugin gate; the same pinned commit passed in the standalone checkout.
• policy scan: plugin-local package.json, index.ts, and pnpm-lock.yaml are present; no catalog: or workspace: dependency specifiers were found. Manual scan found no hardcoded secrets, child_process, filesystem mutation, process execution, or destructive deletion. Network access is limited in code to validated HTTPS Pinecone index hosts ending in .pinecone.io; the Pinecone API key is declared as a secret.
• dependency/license: no runtime dependency section; build bundle includes zod; dev dependencies resolve from npm. MIT license is present.
• package sha256: 3892c031bda3c3c6eadc843786314752dd7d23a1b4fe98e057ae96a3577645cf for the generated review .pkg artifact (86,335 bytes).

Publish Decision

Proceed

Scheduled Merge Gate

Merged. Scheduled run 20260708T120000Z squash-merged this PR with gh pr merge --squash --delete-branch --match-head-commit 1a00c59e5b858501dfd28303edf9351d86c626e2. Merge commit: d91630ffd01bd13eba4b3bd8a3766ed2aae6f10d.