html-api-sdk

Use window.Magic.fs.readFile(path) to read a file as a string and window.Magic.fs.writeFile(path, content) to write strings, Blobs, or ArrayBuffers. Paths are relative to the app root by default, and a leading slash accesses project-root files with the appropriate permission scopes.

Use window.Magic.llm.chat(messages, { model }) for a single response or window.Magic.llm.stream(messages, onChunk, { model }) for streaming output. The model field is required with "auto" as default, and the app must declare the llm.use scope in app.json.

Yes, window.Magic.fs.watchFile(path, callback) polls a file roughly every 3 seconds and watchDir(dir, callback) reports added and removed direct children. Both return an unwatch function, and each app is limited to 10 watched paths.

Sensitive fields like nickname, real_name, user_id, and organization_code are privacy-gated. You must declare the matching user.profile scopes in app.json permissions and request them at runtime with getInfo({ scopes, reason }), which the user must approve.

High-risk operations require declared scopes: llm.use for LLM calls, fs.project.read and fs.project.write for project-root file access, project.files.upload/download for file transfers, project.message.write for messaging, and user.profile scopes for sensitive user info.

No, inline event attributes like onclick are forbidden. All events must be bound with addEventListener, and lists rendered via innerHTML should use event delegation with data-action and data-id attributes on a stable container.