JSON-RPC API
Automate supported Chau7 operations over a local socket.
Availability
Partially implemented in stable. Read the limits below before relying on this workflow.
Reviewed against stable v0.5.1. Rust candidate additions are labeled separately. Release status.
The pain this solves
- Scripts need a local way to query and operate on registered Chau7 features.
What ships with it
- A 0600 owner-only Unix socket carries newline-delimited JSON requests with a bounded method list.
- History, snippet, and settings methods have narrower behavior than generic CRUD or export claims.
- run_command uses shared command checks; the scripting adapter bypasses the MCP-only tab-scope check and has no separate request-token auth layer.
Questions this answers
- Where does Chau7's scripting socket listen?
- Does it implement the full JSON-RPC 2.0 protocol?
- Can scripts change any setting or manage snippets?
How it works
The scripting server listens at ~/Library/Application Support/Chau7/scripting.sock and exchanges newline-delimited JSON. Requests use method, params, and an optional id; responses echo a provided id, but the implementation does not establish strict JSON-RPC 2.0 framing.
The supported methods cover tab listing and status, command execution and input, output, tab creation and closure, repository events, history query, limited settings access, snippet listing, snippet-body retrieval, and status. It does not expose generic snippet CRUD, history export, arbitrary settings writes, or event notifications.
The socket file is owner-only with mode 0600; the reviewed code does not add a separate API-token authentication layer. run_command uses the shared command filter and approval flow, while the scripting adapter deliberately bypasses the MCP-only control-scope check for app-internal callers.
Why it matters
A local socket can support scripts that need Chau7's registered operations. The method list, limited setting allowlist, owner-only file permissions, and command approval behavior define its actual scope.
Frequently asked questions
Is this a general JSON-RPC 2.0 server?
It uses a JSON-RPC-style method/params/id shape over newline-delimited JSON, but the implementation does not include the standard jsonrpc field and error object framing.
Can I update any setting or create and delete snippets?
No. set_setting accepts only three allowlisted keys, and snippet methods list or return snippet content rather than providing CRUD.
How is access restricted?
The socket file is created with owner-only 0600 permissions. The scripting API source does not implement a separate request token; command execution still passes the shared command permission and approval checks.