refactor(mcp): replace vendored adapter with published pi-mcp-adapter package

.github/workflows/canary.yml

@@ -13,6 +13,7 @@ on:
       - 'biome.json'
       - 'scripts/**'
       - 'tools/proxy-helper/**'
+      - '.github/workflows/**'
   workflow_dispatch:
     inputs:
       force:
@@ -152,6 +153,29 @@ jobs:
         if: ${{ matrix.os == 'windows' }}
         run: node scripts/build-binary.js --target ${{ matrix.target }}
 
+      - name: Install Linux credential-store service
+        if: ${{ matrix.os == 'linux' }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes dbus-x11 gnome-keyring
+
+      - name: Verify MCP native keyring
+        if: ${{ matrix.os == 'darwin' }}
+        run: ./dist/bin/kimchi mcp keyring-check --json
+
+      - name: Verify MCP native keyring on Linux
+        if: ${{ matrix.os == 'linux' }}
+        run: |
+          dbus-run-session -- bash -euo pipefail -c '
+            printf "\n" | gnome-keyring-daemon --unlock --components=secrets
+            ./dist/bin/kimchi mcp keyring-check --json
+          '
+
+      - name: Verify MCP native keyring on Windows
+        if: ${{ matrix.os == 'windows' }}
+        shell: pwsh
+        run: .\dist\bin\kimchi.exe mcp keyring-check --json
+
       - name: Verify binary architecture
         if: ${{ matrix.os != 'windows' }}
         run: |

.github/workflows/release.yml

@@ -99,6 +99,29 @@ jobs:
       - name: Build binary
         run: node scripts/build-binary.js --target ${{ matrix.target }}
 
+      - name: Install Linux credential-store service
+        if: ${{ matrix.os == 'linux' }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes dbus-x11 gnome-keyring
+
+      - name: Verify MCP native keyring
+        if: ${{ matrix.os == 'darwin' }}
+        run: ./dist/bin/kimchi mcp keyring-check --json
+
+      - name: Verify MCP native keyring on Linux
+        if: ${{ matrix.os == 'linux' }}
+        run: |
+          dbus-run-session -- bash -euo pipefail -c '
+            printf "\n" | gnome-keyring-daemon --unlock --components=secrets
+            ./dist/bin/kimchi mcp keyring-check --json
+          '
+
+      - name: Verify MCP native keyring on Windows
+        if: ${{ matrix.os == 'windows' }}
+        shell: pwsh
+        run: .\dist\bin\kimchi.exe mcp keyring-check --json
+
       - name: Verify binary architecture
         if: ${{ matrix.os != 'windows' }}
         run: |

package.json

@@ -31,7 +31,7 @@
 		"test:e2e:tui:trace:replay": "node scripts/run-tui-e2e.js replay",
 		"test:e2e:acp": "pnpm run build:binary && vitest run --config tests/e2e/acp/vitest.config.ts",
 		"test:e2e:mcp": "pnpm run build:binary && pnpm run test:e2e:mcp:tui && pnpm run test:e2e:mcp:acp && pnpm run test:e2e:mcp:conformance",
-		"test:e2e:mcp:tui": "node scripts/run-tui-e2e.js mcp-stdio && node scripts/run-tui-e2e.js mcp-failures && node scripts/run-tui-e2e.js mcp-http && node scripts/run-tui-e2e.js mcp-oauth && node scripts/run-tui-e2e.js mcp-restart && node scripts/run-tui-e2e.js mcp-panel && node scripts/run-tui-e2e.js mcp-lifecycle && node scripts/run-tui-e2e.js mcp-ui",
+		"test:e2e:mcp:tui": "node scripts/run-tui-e2e.js mcp-config && node scripts/run-tui-e2e.js mcp-project-trust && node scripts/run-tui-e2e.js mcp-stdio && node scripts/run-tui-e2e.js mcp-failures && node scripts/run-tui-e2e.js mcp-http && node scripts/run-tui-e2e.js mcp-browser-branding && node scripts/run-tui-e2e.js mcp-oauth && node scripts/run-tui-e2e.js mcp-restart && node scripts/run-tui-e2e.js mcp-panel && node scripts/run-tui-e2e.js mcp-lifecycle && node scripts/run-tui-e2e.js mcp-ui",
 		"test:e2e:mcp:acp": "vitest run --config tests/e2e/acp/vitest.config.ts tests/e2e/acp/mcp-workflow.test.ts tests/e2e/acp/mcp-probe-command.test.ts",
 		"test:e2e:mcp:conformance": "conformance client --command \"pnpm exec tsx tests/e2e/mcp/conformance-client.ts\" --scenario initialize --spec-version 2025-11-25 --timeout 30000 --output-dir .kimchi/mcp-conformance-results && conformance client --command \"pnpm exec tsx tests/e2e/mcp/conformance-client.ts\" --scenario tools_call --spec-version 2025-11-25 --timeout 30000 --output-dir .kimchi/mcp-conformance-results && conformance client --command \"pnpm exec tsx tests/e2e/mcp/conformance-client.ts\" --scenario sse-retry --spec-version 2025-11-25 --timeout 30000 --output-dir .kimchi/mcp-conformance-results && conformance client --command \"pnpm exec tsx tests/e2e/mcp/conformance-client.ts\" --scenario auth/metadata-default --spec-version 2025-11-25 --timeout 60000 --output-dir .kimchi/mcp-conformance-results && conformance client --command \"pnpm exec tsx tests/e2e/mcp/conformance-client.ts\" --scenario auth/pre-registration --spec-version 2025-11-25 --timeout 60000 --output-dir .kimchi/mcp-conformance-results",
 		"postinstall": "node scripts/patch-pi-ai-oauth.js && node scripts/copy-resources.js --dev",
@@ -45,12 +45,14 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "0.19.2",
 		"@bulkhead-ai/core": "^0.7.0",
-		"@kimchi-dev/kimchi-workflows": "0.0.8",
 		"@clack/prompts": "^1.3.0",
 		"@earendil-works/pi-coding-agent": "0.84.1",
 		"@earendil-works/pi-tui": "0.84.1",
+		"@kimchi-dev/kimchi-workflows": "0.0.8",
+		"@modelcontextprotocol/client": "2.0.0",
 		"@modelcontextprotocol/ext-apps": "^1.7.1",
 		"@modelcontextprotocol/sdk": "^1.29.0",
+		"@napi-rs/keyring": "1.3.0",
 		"@shikijs/cli": "^4.0.2",
 		"@types/diff": "^8.0.0",
 		"@types/proper-lockfile": "^4.1.4",
@@ -59,6 +61,7 @@
 		"diff": "^9.0.0",
 		"micromatch": "^4.0.8",
 		"open": "^10.2.0",
+		"pi-mcp-adapter": "2.32.1",
 		"proper-lockfile": "^4.1.2",
 		"shell-quote": "1.8.4",
 		"shiki": "^4.0.2",
@@ -88,6 +91,7 @@
 		"@microsoft/tui-test": "0.0.4",
 		"@mixmark-io/domino": "^2.2.0",
 		"@modelcontextprotocol/conformance": "0.1.16",
+		"@types/cross-spawn": "6.0.6",
 		"@types/micromatch": "^4.0.10",
 		"@types/node": "^22.19.18",
 		"@types/shell-quote": "^1.7.5",