pi-webmcp 0.1.0

package/.pi/extensions/pi-webmcp.ts

@@ -0,0 +1,20 @@
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+
+export default function(pi: ExtensionAPI) {
+  pi.registerCommand("webmcp", {
+    description: "Connect to or disconnect from Chrome WebMCP tools",
+    getArgumentCompletions: (prefix) => {
+      const completions = [
+        { value: "connect", label: "connect", detail: "Scan Chrome WebMCP tools" },
+        { value: "disconnect", label: "disconnect", detail: "Disconnect from Chrome WebMCP" },
+        { value: "list", label: "list", detail: "Show active WebMCP tools above the composer" },
+      ];
+      const filtered = completions.filter(({ value }) => value.startsWith(prefix));
+      return filtered.length > 0 ? filtered : null;
+    },
+    handler: async (args, ctx) => {
+      const { handle } = await import("../../src/main");
+      await handle(pi, args, ctx);
+    },
+  });
+}

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nick Breaton
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,67 @@
+# pi-webmcp
+
+A [Pi](https://pi.dev/) extension that connects Pi to webpages that register [WebMCP](https://github.com/webmachinelearning/webmcp) tools.
+
+> [!IMPORTANT]
+> Both the WebMCP specification and Chrome’s implementation are in active development. Anticipate breaking changes that affect this extension.
+
+> [!CAUTION]
+> This extension can pose a security risk in its default operating mode once the `/webmcp` command is run. A malicious webpage could poison the running Pi session’s context via its WebMCP tool instructions.
+>
+> Use at your own risk. Consider setting `allowedOrigins` to restrict which webpages Pi can connect to.
+
+## First-time Setup
+
+1. Install this extension via npm.
+
+   ```sh
+   pi install npm:pi-webmcp
+   ```
+
+2. Enable Chrome remote debugging by visiting [`chrome://inspect/#remote-debugging`](chrome://inspect/#remote-debugging).
+
+![Chrome remote debugging settings](.github/chrome_enable_remote_debugging.png)
+
+3. Enable the relevant Chrome flags for WebMCP.
+
+   - [`chrome://flags/#devtools-webmcp-support`](chrome://flags/#devtools-webmcp-support)
+   - [`chrome://flags/#enable-webmcp-testing`](chrome://flags/#enable-webmcp-testing)
+
+![Chrome WebMCP flags](.github/chrome_webmcp_flags.png)
+
+## Usage
+
+1. Run `/webmcp` and accept the once-per-session confirmation prompt in Chrome.
+
+![Chrome remote debugging permission prompt](.github/chrome_allow_remote_debugging.png)
+
+2. Navigate to a WebMCP-capable page, such as Chrome Lab’s [WebMCP Travel](https://googlechromelabs.github.io/webmcp-tools/demos/react-flightsearch/) demo.
+
+   More can be found [here](https://github.com/GoogleChromeLabs/webmcp-tools).
+
+### Commands
+
+- `/webmcp` or `/webmcp connect` — Connect to Chrome and discover WebMCP tools.
+- `/webmcp disconnect` — Disconnect from Chrome WebMCP.
+- `/webmcp list` — Show active WebMCP tools.
+
+## Options
+
+Configure WebMCP options under the `webmcp` key in Pi settings, either globally in `~/.pi/agent/settings.json` or per trusted project in `.pi/settings.json`:
+
+```json
+{
+  "webmcp": {
+    "allowedOrigins": ["googlechromelabs.github.io"]
+  }
+}
+```
+
+| Option                     | Description                                                                           |
+| -------------------------- | ------------------------------------------------------------------------------------- |
+| `webmcp.allowedOrigins`    | When specified, Pi will only discover and connect to WebMCP tools from these origins. |
+| `webmcp.disallowedOrigins` | When specified, Pi will not discover or connect to WebMCP tools from these origins.   |
+
+## Browser Support
+
+WebMCP is currently only implemented in Chrome, so this extension is scoped to Chromium-based browsers for now. We plan to support additional browsers if / when they implement WebMCP.

package/docs/webmcp-demos.md

@@ -0,0 +1,18 @@
+# WebMCP Demos
+
+- https://googlechromelabs.github.io/webmcp-tools/demos/react-flightsearch/
+- https://googlechromelabs.github.io/webmcp-tools/demos/pizza-maker/
+- https://googlechromelabs.github.io/webmcp-tools/demos/doors/
+- https://googlechromelabs.github.io/webmcp-tools/demos/webmcp-maze/
+- https://googlechromelabs.github.io/webmcp-tools/demos/ticket-booking/
+- https://googlechromelabs.github.io/webmcp-tools/demos/order-tracking/
+- https://googlechromelabs.github.io/webmcp-tools/demos/hotel-chain/
+- https://googlechromelabs.github.io/webmcp-tools/demos/sport-shop-angular/
+- https://googlechromelabs.github.io/webmcp-tools/demos/coffee-shop
+- https://googlechromelabs.github.io/webmcp-tools/demos/real-estate-map
+- https://googlechromelabs.github.io/webmcp-tools/demos/leather-bag
+- https://googlechromelabs.github.io/webmcp-tools/demos/smart-home
+- https://googlechromelabs.github.io/webmcp-tools/demos/page-agent
+- https://andreinwald.github.io/webmcp-demo/
+- https://webmcp-flight-demo.netlify.app/
+- https://webmcp-flight-demo.netlify.app/declarative.html

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "pi-webmcp",
+  "version": "0.1.0",
+  "type": "module",
+  "license": "MIT",
+  "description": "A Pi extension that connects Pi to webpages that register WebMCP tools.",
+  "author": "Nick Breaton <nick@nickbreaton.com>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nickbreaton/pi-webmcp.git"
+  },
+  "bugs": {
+    "url": "https://github.com/nickbreaton/pi-webmcp/issues"
+  },
+  "homepage": "https://github.com/nickbreaton/pi-webmcp#readme",
+  "keywords": [
+    "pi-package",
+    "pi-extension",
+    "webmcp"
+  ],
+  "files": [
+    ".pi/extensions/**",
+    "src/**",
+    "docs/**",
+    ".github/*.png"
+  ],
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "fmt": "dprint fmt",
+    "fmt:check": "dprint check",
+    "prepack": "npm run typecheck && npm test && npm run fmt:check"
+  },
+  "dependencies": {
+    "@effect/platform-node": "4.0.0-beta.84",
+    "chrome-remote-interface": "^0.33.3",
+    "effect": "4.0.0-beta.84",
+    "micro-memoize": "^5.1.1"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-coding-agent": "*",
+    "@earendil-works/pi-tui": "*",
+    "typebox": "*"
+  },
+  "devDependencies": {
+    "@earendil-works/pi-coding-agent": "^0.78.1",
+    "@earendil-works/pi-tui": "^0.78.1",
+    "@effect/language-service": "^0.86.2",
+    "@effect/vitest": "4.0.0-beta.84",
+    "@types/chrome-remote-interface": "^0.34.0",
+    "@types/node": "^25.9.2",
+    "dprint": "^0.54.0",
+    "typebox": "^1.2.1",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.9"
+  },
+  "pi": {
+    "extensions": [
+      ".pi/extensions/pi-webmcp.ts"
+    ]
+  }
+}

package/src/main.ts

@@ -0,0 +1,212 @@
+import type { ExtensionAPI, ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
+import { Key, matchesKey } from "@earendil-works/pi-tui";
+import { NodeHttpServer } from "@effect/platform-node";
+import { Layer, ManagedRuntime, Option, Schema } from "effect";
+import { memoize } from "micro-memoize";
+import { Type } from "typebox";
+import { Origin, ToolId, WebMcpTools } from "./schemas/WebMcpTool";
+import { BrowserClient } from "./services/BrowserClient";
+import { PiApi, PiContext } from "./services/PiApi";
+import { PiTurnRefService } from "./services/PiTurnRefService";
+import { PiWebMcpAllowedOriginService } from "./services/PiWebMcpAllowedOriginService";
+import { PiWebMcpCommandService } from "./services/PiWebMcpCommandService";
+import { PiWebMcpDescribeService } from "./services/PiWebMcpDescribeService";
+import { PiWebMcpExecuteService } from "./services/PiWebMcpExecuteService";
+import { PiWebMcpListService } from "./services/PiWebMcpListService";
+import { PiWebMcpServeService } from "./services/PiWebMcpServeService";
+import { PiWebMcpSystemPromptService } from "./services/PiWebMcpSystemPromptService";
+import { PiWebMcpToolStateService } from "./services/PiWebMcpToolStateService";
+import { WebMcpToolDiffService } from "./services/WebMcpToolDiffService";
+import { WebMcpToolsService } from "./services/WebMcpToolsService";
+import { renderPiWebMcpCall, renderPiWebMcpListMessage, renderPiWebMcpMarkdownResult, renderPiWebMcpResult, renderPiWebMcpServeResult } from "./utils/renderers";
+
+const init = memoize((pi: ExtensionAPI, ctx: ExtensionCommandContext) => {
+  const live = PiWebMcpCommandService.liveWithoutDependencies.pipe(
+    Layer.provideMerge(PiWebMcpDescribeService.live),
+    Layer.provideMerge(PiWebMcpExecuteService.live),
+    Layer.provideMerge(PiWebMcpListService.live),
+    Layer.provideMerge(PiWebMcpServeService.live),
+    Layer.provideMerge(PiWebMcpSystemPromptService.live),
+    Layer.provideMerge(PiWebMcpToolStateService.live),
+    Layer.provideMerge(PiTurnRefService.live),
+    Layer.provideMerge(WebMcpToolDiffService.live),
+    Layer.provideMerge(WebMcpToolsService.live),
+    Layer.provideMerge(PiWebMcpAllowedOriginService.live),
+    Layer.provideMerge(Layer.mergeAll(
+      Layer.succeed(PiApi, pi),
+      Layer.succeed(PiContext, ctx),
+      BrowserClient.live,
+      NodeHttpServer.layerHttpServices,
+    )),
+  );
+
+  const runtime = ManagedRuntime.make(live);
+
+  pi.registerMessageRenderer("webmcp-list", renderPiWebMcpListMessage);
+
+  pi.registerTool({
+    name: "webmcp_list",
+    label: "WebMCP List",
+    description: "List the WebMCP tools currently known to the session, grouped by origin. Does not scan the browser.",
+    promptSnippet: "List WebMCP tools currently known to the session, grouped by origin",
+    promptGuidelines: [
+      "The available WebMCP tools are already injected into your system prompt each turn; keep a running internal ledger of them and prefer it over calling webmcp_list.",
+      "Only call webmcp_list when you are genuinely confused about which tools are available or need the full grouped listing again; it does not trigger a new browser scan.",
+    ],
+    parameters: Type.Object({
+      filter: Type.Optional(Type.String({ description: "Optional URL/title/target/origin filter to narrow the listed tools." })),
+      refresh: Type.Optional(Type.Boolean({ description: "Reserved; the session does not actively scan the browser on call." })),
+      origin: Type.Optional(Type.String({ description: "Optional origin/host to limit results to tools from a single WebMCP page (e.g. example.com)." })),
+    }),
+    renderCall: (_, theme) =>
+      renderPiWebMcpCall(theme, {
+        toolName: "webmcp_list",
+      }),
+    renderResult: renderPiWebMcpMarkdownResult,
+    async execute(_, params) {
+      return runtime.runPromise(PiWebMcpListService.use((service) => service.execute(params)));
+    },
+  });
+
+  pi.registerTool({
+    name: "webmcp_describe",
+    label: "WebMCP Describe",
+    description: "Describe a WebMCP tool's page, origin, description, and input parameters.",
+    promptSnippet: "Inspect a WebMCP page tool schema before executing it; pass the origin from webmcp_list",
+    promptGuidelines: [
+      "Use webmcp_describe with both tool and origin from webmcp_list when you need a WebMCP tool's exact parameters before execution.",
+    ],
+    parameters: Type.Object({
+      tool: Type.String({ description: "Tool id from webmcp_list, or the page-provided tool name." }),
+      origin: Type.String({ description: "Origin/host where the tool is registered, without protocol (e.g. example.com)." }),
+    }),
+    renderCall: (args, theme) =>
+      renderPiWebMcpCall(theme, {
+        toolName: "webmcp_describe",
+        origin: Schema.decodeUnknownSync(Origin)(args.origin),
+        webMcpTool: Schema.decodeUnknownSync(ToolId)(args.tool),
+      }),
+    renderResult: renderPiWebMcpResult,
+    async execute(_, params) {
+      return runtime.runPromise(PiWebMcpDescribeService.use((service) => service.execute(params)));
+    },
+  });
+
+  pi.registerTool({
+    name: "webmcp_execute",
+    label: "WebMCP Execute",
+    description: "Execute a WebMCP tool exposed by an open Chrome tab.",
+    promptSnippet: "Execute a selected WebMCP page tool with JSON arguments",
+    promptGuidelines: [
+      "Before using webmcp_execute, ask the user to run /webmcp if WebMCP is not connected or no matching tool is known.",
+      "When calling webmcp_execute, pass the page-provided tool name or the safe tool id, and always include the origin from webmcp_list.",
+    ],
+    parameters: Type.Object({
+      tool: Type.String({ description: "Tool id or page-provided WebMCP tool name." }),
+      origin: Type.String({ description: "Origin/host where the tool is registered, without protocol (e.g. example.com)." }),
+      args: Type.Optional(Type.String({ description: "Arguments as a JSON object string for the WebMCP tool." })),
+    }),
+    renderCall: (args, theme) =>
+      renderPiWebMcpCall(theme, {
+        toolName: "webmcp_execute",
+        origin: Schema.decodeUnknownSync(Origin)(args.origin),
+        webMcpTool: Schema.decodeUnknownSync(ToolId)(args.tool),
+      }),
+    renderResult: renderPiWebMcpResult,
+    async execute(_toolCallId, params) {
+      return runtime.runPromise(PiWebMcpExecuteService.use((service) => service.execute(params)));
+    },
+  });
+
+  pi.registerTool({
+    name: "webmcp_serve",
+    label: "WebMCP Serve",
+    description: "Serve a local file or folder over HTTP so WebMCP pages can reference it.",
+    promptSnippet: "Serve a local file or folder and return a browser-accessible URL",
+    promptGuidelines: [
+      "Use webmcp_serve when a WebMCP page needs to fetch or embed a local file or folder from this session.",
+      "Pass a file or directory path. Relative paths resolve from the current Pi working directory.",
+      "The returned URL remains available for the normal Pi application lifecycle.",
+    ],
+    parameters: Type.Object({
+      path: Type.String({ description: "File or directory path to serve. Relative paths resolve from the current Pi working directory." }),
+    }),
+    renderCall: (args, theme) =>
+      renderPiWebMcpCall(theme, {
+        toolName: "webmcp_serve",
+        target: args.path,
+      }),
+    renderResult: renderPiWebMcpServeResult,
+    async execute(_, params) {
+      return runtime.runPromise(PiWebMcpServeService.use((service) => service.execute(params)));
+    },
+  });
+
+  pi.on("turn_end", async () => {
+    await runtime.runPromise(PiTurnRefService.use((service) => service.reset()));
+  });
+
+  pi.on("before_agent_start", async (event, ctx) => {
+    ctx.ui.setWidget("webmcp-list", undefined);
+
+    const prompt = await runtime.runPromise(PiWebMcpSystemPromptService.use((service) => service.getSystemPrompt()));
+
+    if (!prompt) return;
+
+    return {
+      systemPrompt: event.systemPrompt + `\n\n${prompt}`,
+    };
+  });
+
+  pi.on("message_end", async (event) => {
+    if (event.message.role !== "user") return;
+
+    const tools = await runtime.runPromise(PiWebMcpToolStateService.use((service) => service.commit()));
+    if (Option.isNone(tools)) return;
+
+    const messageWithDetails = event.message as typeof event.message & { details?: Record<string, unknown>; };
+
+    return {
+      message: {
+        ...event.message,
+        details: {
+          ...messageWithDetails.details,
+          webmcp: { tools: JSON.parse(JSON.stringify(Schema.encodeSync(WebMcpTools)(tools.value))) },
+        },
+      },
+    };
+  });
+
+  pi.on("agent_end", async () => {
+    await runtime.runPromise(PiWebMcpCommandService.use((service) => service.nudge()));
+  });
+
+  pi.on("session_tree", async () => {
+    await runtime.runPromise(PiWebMcpCommandService.use((service) => service.nudge()));
+  });
+
+  pi.on("session_shutdown", async () => {
+    await runtime.dispose();
+  });
+
+  if (ctx.mode === "tui") {
+    ctx.ui.onTerminalInput((data) => {
+      if (matchesKey(data, Key.escape)) {
+        ctx.ui.setWidget("webmcp-list", undefined);
+      }
+      return undefined;
+    });
+  }
+
+  return { runtime };
+}, { transformKey: () => ["pi-webmcp-runtime"] });
+
+export async function handle(pi: ExtensionAPI, args: string, ctx: ExtensionCommandContext) {
+  const { runtime } = init(pi, ctx);
+
+  const effect = PiWebMcpCommandService.use((service) => {
+    return service.handle(args);
+  });
+
+  await runtime.runPromise(effect);
+}

package/src/schemas/WebMcpTool.ts

@@ -0,0 +1,59 @@
+import { Hash, Schema } from "effect";
+
+export class WebMcpToolAnnotation extends Schema.Class<WebMcpToolAnnotation>("WebMcpToolAnnotation")({
+  readOnly: Schema.optionalKey(Schema.Boolean),
+  untrustedContent: Schema.optionalKey(Schema.Boolean),
+  autosubmit: Schema.optionalKey(Schema.Boolean),
+}) {}
+
+export class WebMcpToolMetadata extends Schema.Class<WebMcpToolMetadata>("WebMcpToolMetadata")({
+  targetId: Schema.String,
+  title: Schema.String,
+  url: Schema.String,
+}) {}
+
+export const Origin = Schema.String.pipe(Schema.brand("Origin"));
+export type Origin = typeof Origin.Type;
+
+export const ToolId = Schema.String.pipe(Schema.brand("ToolId"));
+export type ToolId = typeof ToolId.Type;
+
+export class WebMcpTool extends Schema.Class<WebMcpTool>("WebMcpTool")({
+  name: Schema.String,
+  origin: Origin,
+  sessionId: Schema.optionalKey(Schema.String),
+  description: Schema.optionalKey(Schema.String),
+  inputSchema: Schema.optionalKey(Schema.Json),
+  outputSchema: Schema.optionalKey(Schema.Json),
+  annotations: Schema.optionalKey(WebMcpToolAnnotation),
+  frameId: Schema.String,
+  backendNodeId: Schema.optionalKey(Schema.Number),
+  stackTrace: Schema.optionalKey(Schema.Unknown),
+}) {
+  get id(): ToolId {
+    const transformed = this.name.toLowerCase()
+      .replace(/[^a-z0-9_]+/g, "_")
+      .replace(/^_+|_+$/g, "")
+      .slice(0, 48);
+    return Schema.decodeSync(ToolId)(transformed);
+  }
+
+  get hash(): number {
+    return Hash.hash({
+      name: this.name,
+      origin: this.origin,
+      description: this.description,
+      inputSchema: this.inputSchema,
+      outputSchema: this.outputSchema,
+      annotations: this.annotations,
+    });
+  }
+}
+
+export class WebMcpToolContainer extends Schema.Class<WebMcpToolContainer>("WebMcpToolContainer")({
+  metadata: WebMcpToolMetadata,
+  tool: WebMcpTool,
+}) {}
+
+export const WebMcpTools = Schema.Array(WebMcpTool);
+export const WebMcpToolContainers = Schema.Array(WebMcpToolContainer);

package/src/services/BrowserClient.ts

@@ -0,0 +1,90 @@
+import CDP from "chrome-remote-interface";
+import type { Client } from "chrome-remote-interface";
+import { Context, Effect, Layer, Option, Ref, Schema, Scope } from "effect";
+
+// The Chrome type package only includes the standard protocol schema, but WebMCP
+// exposes experimental `WebMCP.*` commands/events through the same CDP client.
+// Keep this local widening until we add proper generated protocol typings for
+// the WebMCP domain.
+export type CdpClient = Client & {
+  send(method: string, params?: any, sessionId?: string): Promise<any>;
+  on(method: string, cb: (params: any, sessionId?: string) => void): void;
+  off?(method: string, cb: (params: any, sessionId?: string) => void): void;
+};
+
+const DEFAULT_HOST = process.env.CDP_HOST ?? "127.0.0.1";
+const DEFAULT_PORT = Number(process.env.CDP_PORT ?? 9222);
+const DEFAULT_WS = process.env.CDP_WS ?? `ws://${DEFAULT_HOST}:${DEFAULT_PORT}/devtools/browser`;
+
+export class BrowserClientError extends Schema.TaggedErrorClass<BrowserClientError>()("BrowserClientError", {
+  operation: Schema.Union([Schema.Literal("connect"), Schema.Literal("disconnect")]),
+  cause: Schema.Unknown,
+}) {}
+
+export class BrowserClient extends Context.Service<BrowserClient, {
+  readonly connect: (options?: { readonly force?: boolean; }) => Effect.Effect<CdpClient, BrowserClientError>;
+  readonly get: Effect.Effect<Option.Option<CdpClient>>;
+  readonly disconnect: () => Effect.Effect<void, BrowserClientError>;
+}>()("pi-webmcp/BrowserClient") {
+  static readonly live = Layer.effect(
+    BrowserClient,
+    Effect.gen(function*() {
+      const clientRef = yield* Ref.make<Option.Option<CdpClient>>(Option.none());
+      const scope = yield* Effect.scope;
+      const context = yield* Effect.context();
+
+      const clear = Ref.set(clientRef, Option.none());
+
+      const connect = Effect.fn("BrowserClient.connect")(function*(options?: { readonly force?: boolean; }) {
+        const existing = yield* Ref.get(clientRef);
+
+        if (Option.isSome(existing)) {
+          if (!options?.force) return existing.value;
+
+          yield* Ref.set(clientRef, Option.none());
+          yield* Effect.tryPromise({
+            try: () => existing.value.close(),
+            catch: (cause) => new BrowserClientError({ operation: "disconnect", cause }),
+          }).pipe(Effect.ignore);
+        }
+
+        const client = yield* Effect.acquireRelease(
+          Effect.tryPromise({
+            try: () => CDP({ target: DEFAULT_WS, local: true }),
+            catch: (cause) => new BrowserClientError({ operation: "connect", cause }),
+          }),
+          (client) =>
+            Effect.gen(function*() {
+              const existing = yield* Ref.get(clientRef);
+              if (Option.isNone(existing) || existing.value !== client) return;
+              yield* Ref.set(clientRef, Option.none());
+              yield* Effect.tryPromise({
+                try: () => client.close(),
+                catch: (cause) => new BrowserClientError({ operation: "disconnect", cause }),
+              }).pipe(Effect.ignore);
+            }),
+        ).pipe(Scope.provide(scope));
+
+        client.on("disconnect", () => Effect.runSyncWith(context)(clear));
+        yield* Ref.set(clientRef, Option.some(client));
+        return client;
+      });
+
+      const disconnect = Effect.fn("BrowserClient.disconnect")(function*() {
+        const existing = yield* Ref.get(clientRef);
+        if (Option.isNone(existing)) return;
+        yield* Ref.set(clientRef, Option.none());
+        yield* Effect.tryPromise({
+          try: () => existing.value.close(),
+          catch: (cause) => new BrowserClientError({ operation: "disconnect", cause }),
+        });
+      });
+
+      return BrowserClient.of({
+        connect,
+        get: Ref.get(clientRef),
+        disconnect,
+      });
+    }),
+  );
+}

package/src/services/PiApi.ts

@@ -0,0 +1,6 @@
+import type { ExtensionAPI, ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
+import { Context } from "effect";
+
+export class PiApi extends Context.Service<PiApi, ExtensionAPI>()("pi-webmcp/PiApi") {}
+
+export class PiContext extends Context.Service<PiContext, ExtensionCommandContext>()("pi-webmcp/PiContext") {}

package/src/services/PiTurnRefService.ts

@@ -0,0 +1,32 @@
+import { Context, Effect, Layer, Option, Ref, Scope } from "effect";
+
+export class PiTurnRefService extends Context.Service<PiTurnRefService, {
+  readonly make: <A>(value?: Option.Option<A>) => Effect.Effect<Ref.Ref<Option.Option<A>>, never, Scope.Scope>;
+  readonly reset: () => Effect.Effect<void>;
+}>()("pi-webmcp/PiTurnRefService") {
+  static readonly live = Layer.effect(
+    PiTurnRefService,
+    Effect.gen(function*() {
+      const refs = new Set<Ref.Ref<Option.Option<any>>>();
+
+      return PiTurnRefService.of({
+        make: Effect.fn("PiTurnRefService.make")(function*<A>(value: Option.Option<A> = Option.none()) {
+          const ref = yield* Ref.make(value);
+
+          refs.add(ref);
+
+          yield* Effect.addFinalizer(() => {
+            return Effect.sync(() => refs.delete(ref));
+          });
+
+          return ref;
+        }),
+        reset: Effect.fn("PiTurnRefService.reset")(function*() {
+          for (const ref of refs) {
+            yield* Ref.set(ref, Option.none());
+          }
+        }),
+      });
+    }),
+  );
+}

package/src/services/PiWebMcpAllowedOriginService.ts

@@ -0,0 +1,32 @@
+import { Context, Effect, Layer, Option } from "effect";
+import { Origin } from "../schemas/WebMcpTool";
+import { PiWebMcpSettingsService } from "./PiWebMcpSettingsService";
+
+export class PiWebMcpAllowedOriginService extends Context.Service<PiWebMcpAllowedOriginService, {
+  readonly isAllowed: (origin: Origin) => boolean;
+}>()("pi-webmcp/PiWebMcpAllowedOriginService") {
+  static readonly liveWithoutDependencies = Layer.effect(
+    PiWebMcpAllowedOriginService,
+    Effect.gen(function*() {
+      const settings = yield* PiWebMcpSettingsService;
+
+      const isAllowed = (origin: Origin): boolean => {
+        const allowed = Option.match(settings.allowedOrigins, {
+          onNone: () => true,
+          onSome: (origins) => origins.has(origin),
+        });
+        const disallowed = Option.match(settings.disallowedOrigins, {
+          onNone: () => false,
+          onSome: (origins) => origins.has(origin),
+        });
+        return allowed && !disallowed;
+      };
+
+      return PiWebMcpAllowedOriginService.of({ isAllowed });
+    }),
+  );
+
+  static readonly live = PiWebMcpAllowedOriginService.liveWithoutDependencies.pipe(
+    Layer.provide(PiWebMcpSettingsService.live),
+  );
+}