Maintenance sweep: langchain-retrieval-agent-example

[jhamon]

Tracking issue for a full maintenance sweep of this repo, audited against the seven-theme quality bar. Children are ordered so the verification safety net (tests + CI) exists before risky change (major upgrades) — see the Depends on links in each.

Headline finding: the example no longer runs against current Pinecone. @pinecone-database/pinecone is pinned at ^0.1.6 (current 8.x) using the removed pre-serverless API, and langchain at ^0.0.85 (current 1.x). These two ancient direct deps are the root of the 90 open Dependabot alerts.

Discoverability

• Set GitHub description, topics (pinecone, langchain, rag, openai, typescript, vector-search), and homepage
• Confirm community-health files (CONTRIBUTING / CODE_OF_CONDUCT / SECURITY) are covered by org .github defaults

Cleanup

• Cleanup: fix package.json metadata, drop library/turbo scaffolding #14 Fix package.json metadata, drop library/turbo scaffolding

Testing + CI (safety net)

• Add CI workflow (lint + typecheck + build smoke test) #13 Add CI workflow (lint + typecheck + build smoke test)
• Add automated tests (unit + self-skipping live e2e) #15 Add automated tests (unit + self-skipping live e2e) — depends on Add CI workflow (lint + typecheck + build smoke test) #13

Dependencies

• Modernize core stack: Pinecone SDK v0.1→v8 + LangChain 0.0.85→v1 #16 Modernize core stack: Pinecone SDK v0.1→v8 + LangChain 0.0.85→v1 — risky, depends on Add CI workflow (lint + typecheck + build smoke test) #13, Add automated tests (unit + self-skipping live e2e) #15
• Clear remaining Dependabot alerts + regenerate lockfile #17 Clear remaining Dependabot alerts + regenerate lockfile — depends on Modernize core stack: Pinecone SDK v0.1→v8 + LangChain 0.0.85→v1 #16

Security

• CI GITHUB_TOKEN scoped to least privilege (permissions: contents: read); live-credential e2e gated off untrusted PRs and self-skipping — verified in ci.yml (Add CI workflow (lint + typecheck + build smoke test) #13)
• Code-scanning: 0 open alerts; no committed secrets (.env.example only) — no action needed

Docs

• Rewrite README as a runnable quickstart; sync snippets to current SDK #18 Rewrite README as a runnable quickstart; sync snippets to current SDK — depends on Modernize core stack: Pinecone SDK v0.1→v8 + LangChain 0.0.85→v1 #16 (closes Make it more clear how to run example #1)

UX / correctness

• [Bug] Issue with data prep leads to incorrectly sized vectors #3 Data-prep bug: incorrectly sized vectors — fold fix into Modernize core stack: Pinecone SDK v0.1→v8 + LangChain 0.0.85→v1 #16 (those files are rewritten there)
• Restore sensible upsert chunk size + drop legacy PINECONE_ENVIRONMENT — folded into Modernize core stack: Pinecone SDK v0.1→v8 + LangChain 0.0.85→v1 #16
• Fix race condition in dataLoader CSV write (use fs.writeFileSync) #24 Fix race condition in dataLoader CSV write (async fs.writeFile read back before flush)

---

Implement each child with the resolve-repo-issue workflow. Progress is reconstructable at any time via gh issue list --label maintenance / gh pr list --label maintenance --state merged.