rebuild: replace Python service with pi-based Slack bot

[haasonsaas]

Summary

Full rewrite of Agent PM. The old Python/FastAPI service is removed from main and preserved on the archive/python-legacy branch. Same mission — turn product ideas into PRDs and tickets — rebuilt as a Slack-native bot on the pi agent harness (TypeScript, Bun) instead of an HTTP service.

What v1 does

1. A user posts a product idea via app mention or DM.
2. A pi agent (OpenAI via @earendil-works/pi-ai + pi-agent-core) drafts a structured PRD (title / summary / problem / goals / non-goals / user stories with acceptance criteria), captured through a terminal submit_prd tool.
3. The agent files one GitHub issue per user story through a create_github_issue tool (plain fetch against api.github.com — no octokit).
4. The bot posts a "drafting…" placeholder in the Slack thread, then updates it with the PRD and issue links; failures post a short error note instead.

Slack uses Socket Mode (@slack/bolt), so no public HTTP endpoint is needed.

Config

Variable	Default	Notes
SLACK_BOT_TOKEN / SLACK_APP_TOKEN	—	Slack bot + app-level tokens (Socket Mode)
OPENAI_API_KEY	—	used by the pi agent
GITHUB_TOKEN / GITHUB_REPO	—	Issues:write on owner/name
DRY_RUN	true	carried over from the old service's safety discipline: when true, no issues are created and the reply shows the payloads that would be filed
MODEL	gpt-4o-mini	OpenAI model

Test plan

• bun test — 24 tests: config parsing/validation, GitHub client against a mocked fetch, and full agent runs against pi-ai's fauxProvider() (PRD capture, dry-run vs real issue filing, model-error and no-submit failure paths). No network or API keys required.
• bunx tsc --noEmit — clean (strict + noUncheckedIndexedAccess).
• bunx biome ci . — clean.
• CI runs all three on every PR.

Not verified

• Slack and GitHub E2E were not run — no workspace/tokens available in this environment. First real run should use DRY_RUN=true (the default) to review would-be issue payloads in Slack before enabling issue creation.

Notes

• Deps pinned exactly: @earendil-works/pi-ai@0.82.0, pi-agent-core@0.82.0, @slack/bolt@4.7.3; dev: typescript, @types/node, bun-types, @biomejs/biome. Nothing else.
• src/ is ~400 lines; old dependabot config replaced with npm ecosystem; LICENSE (MIT) preserved.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​bun-types@​1.3.14
	npm/​@​earendil-works/​pi-ai@​0.82.0
	npm/​@​earendil-works/​pi-agent-core@​0.82.0
	npm/​@​types/​node@​26.1.1
	npm/​typescript@​7.0.2
	npm/​@​slack/​bolt@​4.7.3
	npm/​@​biomejs/​biome@​2.5.5

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @protobufjs/float is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/@earendil-works/pi-ai@0.82.0 → npm/@protobufjs/float@1.0.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@protobufjs/float@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm typebox is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/@earendil-works/pi-ai@0.82.0 → npm/@earendil-works/pi-agent-core@0.82.0 → npm/typebox@1.1.38 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typebox@1.1.38. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report