No npm SDK, session ID, or plugin ID is needed. Older hosts, ordinary browser tabs, and external browsers don’t have this object, so always feature-detect. You can copy
client-api.ts from the Skill into your project for type checking; don’t load it at runtime.Feature detection
message.append(text)
Call it from a button the user clicked. The host shows its own confirmation dialog with the plugin, the target conversation, and the text. After confirmation, the text is appended to that conversation’s message input. The user can edit it and must press Send to start a turn.textis plain text, up to 100,000 UTF-16 code units per call. HTML is treated as text; add newlines yourself if you need them.- Every call needs confirmation. There is no remembered choice and no automatic sending. Multiple calls are confirmed one at a time, in order.
- Existing draft text, references, and attachments are preserved. A Mini App can’t read chat history or change sent messages.
- On failure,
messageisuser_cancelled,invalid_request,text_too_large,not_allowed,target_unavailable, orresult_unknown. Forresult_unknown, ask the user to check the message input first; never repeat the append automatically.
miniapp.window
ExperimentalA handle to the Mini App’s own window: whether the page sits in the file panel (inline) or is popped out (window), plus position, size, and a few window flags while popped out. The interface may still change, so always feature-detect first.- Changing
modeor callingfocus()must come from a user gesture; otherwise it rejects withnot_permitted. frame,transparent,minWidth, andminHeightcan only be declared in the manifest’ssurface.windowand can’t change at runtime.alwaysOnTop: trueandclickThrough: truecan be turned on at runtime only if the manifest declares them astrue.- Multiple
updatecalls in the same frame are merged into one; a patch withmodeis sent immediately so it keeps the user gesture. - Errors:
inline_mode,not_permitted,busy,result_unknown,invalid_request.
Pop-out window pitfalls
miniapp.agent
Start Agent sessions from the page, render tool approvals and questionnaires yourself, or hand a session to the host sidebar withopen. Requires agentAccess in the manifest; see Agent API.Page conventions
- Use relative or same-origin URLs, with business APIs served by the Node service. Credentials, Connector clients, and host transport never enter the page.
- Use semantic HTML: landmarks, headings, tables, forms,
role="status", and so on. That is how the Agent understands the page when it checks it in the browser. - Keep third-party scripts out of the main document. Code there, including a same-origin iframe that can reach its parent, shares the page’s trust.
- Don’t load remote resources: use local files or inline SVG for fonts, icons, and images, never a remote CDN. Pages then work offline, and third-party scripts have less chance to reach local services under the page’s identity.
- Without a specific style request, follow the MiniMax Code visual baseline in the Skill.