Companion SDK — the six capabilities, and how each goes beyond the sandbox

The companion exposes six capabilities. Each is reachable over the SDK, and each has a platform-neutral contract — so the first-party web app is just one host. A native iOS/Android app, a CLI, a game engine, or a kiosk can use the same capability; only the renderer/executor differs per platform.

Capability SDK surface Scope Beyond the web sandbox
Memory (记忆) remember tool · recall() memory.read/write:app, :core Shared core brain recalled across every app, not one browser's IndexedDB
Reasoning (推理) the server agent loop (every turn) · generate_image (agent-opt-in imageGen; server-side generation, replies carry a 7-day capability URL) · find_apps (app-directory lookup — surfaces a launch URL for what the user wants to do) chat Same model loop drives any host; tools can reach native capabilities
Skills (技能) get_skills (list; { skill, doc } fetches one bundled reference doc) · learn_skill (install from an https skill.md / zip bundle / ClawHub URL — guarded fetch + safety gate, rate-limited, reversible) · forget_skill · run_skill · http_request (free-HTTP — drive an armed skill's API from its prose body; GET/HEAD auto-run, mutations confirm-gated; see skills.md §6b) · read_skill_resource · get_skill_prompt; host-declared tools; confirmAction / pendingConfirms (platform sessions resolve confirm-gated runs) skills.execute HTTP/MCP and local/device commands a host declares (shell, clipboard, notifications, camera…); platform custom skills split into auto-run (credential-free GET) vs confirm-gated (POST / vault-credentialed); a docs-only skill runs via free-HTTP once its owner arms it
A2A / Social (社交) get_friends · send_friend_message · message_friends · read_friend_messages; onSocialMessage social.message Friend messages delivered cross-app over the event stream, not just the first-party Social view
Wallet (钱包) get_wallet_balance · get_deposit_address · pay_friend · pay_address; onConfirmRequest wallet.read (balance + deposit address, read-only) / wallet.spend (payments) Biometric confirm on a native surface for spends; wallet.read alone can never move funds (platform instances get read-only)
Instant UI (即时UI) render_interface tool → companion.ui_action · update_interface (in-place state-bag writes to an already-rendered panel); onRender ui.render One {interface} JSON renders on web, iOS, Android, and CLI

How a capability "transcends" — the pattern

Every capability is data + a renderer/executor:

  • The server produces platform-neutral output (a memory fact, a tool-call request, an {interface} tree, a friend message) and enforces the safeguards (scopes, spend caps, confirm-gate, SSRF/domain allowlists).
  • The host consumes it however its platform allows. The browser is one host; it has no special status.

So "Instant UI on iOS", "skills as CLI commands", "cross-app A2A" aren't new engines — they're new hosts of contracts that were already platform-neutral.

Events an embed receives (companion.*)

hello.ack · companion.message · companion.audio (reserved — not emitted yet) · companion.tool_call · companion.ui_action · companion.ui_update · companion.social_message · companion.confirm_request · companion.expression (reserved — not emitted yet) · companion.voice_inject · companion.typing · control.*. Subscribe with on(type, fn) or the typed helpers (onMessage / onToolCall / onRender / onSocialMessage / onConfirmRequest / onTyping / onVoiceInject). See companion-sdk-protocol.md.

Reference renderers & hosts

Surface Where
Instant UI — web (framework-free) examples/web-instant-ui
Instant UI — iOS (SwiftUI) examples/native-instant-ui/InstantUI.swift
Instant UI — Android (Compose) examples/native-instant-ui/InstantUI.kt
Skills + Instant UI — CLI/terminal examples/cli-skills
Voice play-along — web examples/poker-voice

Deep dives