You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+34Lines changed: 34 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -79,6 +79,40 @@ Built-in sound profiles:
79
79
80
80
Quiet Hours can suppress sounds, with an optional critical notification override. The Test Lab section in the app includes a rule tester for sample notification payloads.
81
81
82
+
## Native Mode Integrations
83
+
84
+
ToastDeck Native Mode lets local tools create first-class ToastDeck cards through the CLI and named pipe IPC.
The CLI talks to the running ToastDeck app through the local named pipe `ToastDeck.NativeMode`. If the app is not running or does not respond, the CLI returns a clear error instead of silently dropping the notification.
The MSIX manifest declares the `toastdeck` protocol. Full activation routing from Windows into the running app is planned after the single-instance app model is added.
105
+
106
+
Optional localhost API skeleton:
107
+
108
+
```http
109
+
POST http://127.0.0.1:17387/v1/notifications
110
+
Content-Type: application/json
111
+
Authorization: Bearer <token>
112
+
```
113
+
114
+
The localhost API is disabled by default. It must stay bound to localhost, require a token, and add rate limiting before it is enabled.
<p>The CLI sends JSON commands to the running ToastDeck app through the local named pipe <code>ToastDeck.NativeMode</code>. If the app is not running, the CLI returns a clear error.</p>
<p>The protocol is declared in the app manifest. Runtime activation routing is planned with the single-instance app model.</p>
20
+
<h2>Localhost API</h2>
21
+
<p>The localhost API skeleton is present but disabled by default. Before it can be enabled, it must bind only to localhost, require a token, and enforce rate limiting.</p>
22
+
<h2>Security Notes</h2>
23
+
<ul>
24
+
<li>Do not send secrets or OTPs unless you are comfortable displaying them locally.</li>
25
+
<li>The local API must never listen on external network interfaces by default.</li>
26
+
<li>Command actions from external payloads are not trusted and are not executed by default.</li>
27
+
<li>Notification bodies must not be written to logs by default.</li>
0 commit comments