Platform & misc

platform.info

const info = await window.chatoss.platform.info();
// → { name, version, os: 'macos'|'windows'|'linux', arch?, osVersion? }

🔴 platform.info().os is the real host OS, resolved host-side. Never sniff navigator.userAgent or navigator.platform from inside the app frame to decide how to quote a shell command or build a path — the sandboxed frame's UA does not reliably tell you the host, and getting it wrong is how a "works on my Mac" app breaks on Windows.

platform.apis

const namespaces = await window.chatoss.platform.apis();
// → the whole window.chatoss surface as plain data: [{ id, title, purpose, capability,
//    methods: [{ name, signature, description, headless, prompts, mutating, capability? }] }]

platform.apis() is the machine-readable API registry, kept in lockstep with the real bridge by a test. If you're authoring an app with an AI and are unsure whether a method exists, query this instead of trusting a doc that might be stale.

Approvals — show "waiting for your approval" instead of hanging

Some calls (terminal.exec/spawn on an undeclared prefix, http.request to an undeclared host, notifications.send the first time, …) park behind a permission modal the user has not answered yet. From inside the app that looks identical to a hang. approvals is a read-only window onto your own pending prompts — no capability, no prompt of its own, works headless:

const waiting = await window.chatoss.approvals.pending();
// → [{ id, appId, appName, capability, scope?, what, why, since }]  (only THIS app's prompts)
const unsub = window.chatoss.approvals.onPending(() => refreshWaitingBanner());

An unanswered prompt settles as denied after 5 minutes, so a call never hangs forever — but 5 minutes of silent nothing is still a broken-looking app. Render a banner while pending() is non-empty.

manifest.get

const manifest = await window.chatoss.manifest.get();   // your own app.json

Plain fetch()

fetch() to the internet works like on any web page (subject to the remote server's CORS). For APIs that don't send CORS headers, use hostHttp instead.