pi-windows-notifier 0.1.1 → 0.2.0

package/README.md

@@ -4,7 +4,7 @@
 
 Get a Windows notification when Pi needs your attention—or when it's finished responding. The extension shows a toast and plays a system sound for permission requests, structured questions, and completed, interrupted, or failed responses, even while you're looking at another window.
 
-Notifications stay on your machine and only tell you what happened. They don't include your questions, commands, file paths, or Pi's replies. The extension doesn't approve permissions or answer questions for you.
+Notifications stay on your machine. They don't pull questions, commands, file paths, or Pi's replies from your session; you can set your own static notification text. The extension doesn't approve permissions or answer questions for you.
 
 [GitHub](https://github.com/C-W-Z/pi-windows-notifier) · [npm](https://www.npmjs.com/package/pi-windows-notifier)
 
@@ -41,7 +41,7 @@ pi remove npm:pi-windows-notifier
 | `aborted` | The response was interrupted | Exclamation |
 | `failed` | The response ended in an error | Exclamation |
 
-The toast title is **Pi**. Notification text and the extension's command messages are currently in Traditional Chinese; there isn't a language setting yet.
+The default toast title is **Pi**, and default messages are in English. You can change the title and message for each event in your config. Command messages are still in Traditional Chinese; there isn't a language switch.
 
 Permission notifications work with `@gotgenes/pi-permission-system`, including requests forwarded from a subagent to its parent session. Requests that are automatically allowed or denied, or covered by an existing session approval, don't trigger a notification.
 
@@ -61,36 +61,101 @@ Some question packages also ring the terminal bell themselves. If you hear an ex
 
 ## Settings
 
-To change the defaults, create `~/.pi/agent/pi-windows-notifier/config.json`. On Windows, that's `.pi\agent\pi-windows-notifier\config.json` inside your user home folder.
+To change the defaults, create `~/.pi/agent/pi-windows-notifier/config.json`. On Windows, that's `.pi\agent\pi-windows-notifier\config.json` inside your user home folder. The extension doesn't create or edit this file, and it doesn't read project-level settings.
 
-The extension doesn't create or edit this file for you, and it doesn't read project-level settings. If the file doesn't exist, it uses these defaults:
+### Complete config
+
+This example includes every supported field and all five events. You can copy it as a starting point, but **you only need to keep the fields you want to change**, along with `schemaVersion: 2`. Each event overrides the shared message below, so the example behaves like the built-in defaults.
 
 ```json
 {
+  "schemaVersion": 2,
   "enabled": true,
+  "defaults": {
+    "toast": {
+      "enabled": true,
+      "title": "Pi",
+      "message": "Pi needs your attention."
+    },
+    "sound": {
+      "enabled": true,
+      "source": {
+        "type": "system",
+        "name": "Exclamation"
+      }
+    }
+  },
   "events": {
-    "permission": { "enabled": true, "sound": true },
-    "question": { "enabled": true, "sound": true },
-    "completed": { "enabled": true, "sound": true },
-    "aborted": { "enabled": true, "sound": true },
-    "failed": { "enabled": true, "sound": true }
+    "permission": {
+      "enabled": true,
+      "toast": { "enabled": true, "title": "Pi", "message": "Permission approval needed" },
+      "sound": { "enabled": true, "source": { "type": "system", "name": "Exclamation" } }
+    },
+    "question": {
+      "enabled": true,
+      "toast": { "enabled": true, "title": "Pi", "message": "Waiting for your answer" },
+      "sound": { "enabled": true, "source": { "type": "system", "name": "Exclamation" } }
+    },
+    "completed": {
+      "enabled": true,
+      "toast": { "enabled": true, "title": "Pi", "message": "Response complete" },
+      "sound": { "enabled": true, "source": { "type": "system", "name": "Asterisk" } }
+    },
+    "aborted": {
+      "enabled": true,
+      "toast": { "enabled": true, "title": "Pi", "message": "Response interrupted" },
+      "sound": { "enabled": true, "source": { "type": "system", "name": "Exclamation" } }
+    },
+    "failed": {
+      "enabled": true,
+      "toast": { "enabled": true, "title": "Pi", "message": "Response failed" },
+      "sound": { "enabled": true, "source": { "type": "system", "name": "Exclamation" } }
+    }
   }
 }
 ```
 
-You only need to include the values you want to change. For example, to keep completion toasts but turn off their sound:
+### Fields and override rules
 
-```json
-{ "events": { "completed": { "sound": false } } }
-```
+Settings are applied in this order: **built-in event defaults → shared `defaults` → individual `events.<event>` settings**. Omitted fields inherit the previous layer. For example, `defaults.toast.message` supplies one message for all events unless an event sets its own message; omit it to keep the built-in event-specific messages.
+
+| Field | What it does |
+|---|---|
+| `schemaVersion` | Set to `2` for this format |
+| `enabled` | Master switch; `false` turns all notifications off |
+| `defaults` | Shared `toast` and `sound` settings; there is no `defaults.enabled` |
+| `events.<event>` | Overrides for `permission`, `question`, `completed`, `aborted`, or `failed` |
+| `events.<event>.enabled` | Turns that entire event on or off |
+| `toast.enabled` | Turns the toast on or off |
+| `toast.title` | Static notification title |
+| `toast.message` | Static notification message |
+| `sound.enabled` | Turns the sound on or off |
+| `sound.source.type` | Only `"system"` is supported |
+| `sound.source.name` | `Asterisk`, `Beep`, `Exclamation`, `Hand`, or `Question`; case-sensitive |
+
+The `toast` and `sound` fields can appear under either `defaults` or an individual event. **The complete example explicitly sets every event field, so changing `defaults` alone won't change those overrides.** Remove the corresponding event fields if you want them to inherit shared settings. When setting `sound.source`, include both `type` and `name`; it replaces the source as a whole.
+
+- **Toast only**: set `sound.enabled` to `false` and `toast.enabled` to `true`.
+- **Sound only**: set `toast.enabled` to `false` and `sound.enabled` to `true`.
+- If both channels are off, no helper starts. Event settings can override shared channel switches, but can't override a disabled master or event switch.
+
+Without a config file, all events and channels are enabled, the title is Pi, and messages are in English. Completion uses Asterisk; the other events use Exclamation.
+
+### Text and sound limits
 
-The top-level `enabled` switch controls everything. Each event's `enabled` switch controls both its toast and sound; `sound` only controls its sound.
+Text is used exactly as written—there are no templates or substitutions from your session. Titles can contain up to 128 UTF-16 code units and messages up to 512; an emoji may count as two. Both must be nonblank, single-line strings without control characters or invalid XML characters. Your text appears in Windows notifications, so don't put secrets in it. It isn't shown by `status` or error messages.
 
-After editing the file, run `/windows-notifier reload`. Unknown fields, invalid values, unreadable files, and files larger than 16 KiB disable notifications until you fix the settings and reload. Error messages won't print the file's contents.
+Sound names select **Windows system sound events**, not separate audio files bundled with the package. The sound you hear depends on your Windows sound scheme: different events can use the same sound, or have no sound assigned. You can review or change these mappings in the Windows Sound settings; changes also affect other apps using those events. Custom sound files aren't supported.
+
+### Apply changes and older configs
+
+After editing the file, run `/reload` or `/windows-notifier reload`. Unknown fields, unsupported versions or sound sources, invalid values, unreadable files, and files larger than 16 KiB disable notifications until you fix the settings and reload. Error messages won't print the file's contents.
+
+The old unversioned format, with a boolean such as `events.completed.sound: false`, still works and is converted in memory without rewriting your file. New channel objects require `schemaVersion: 2`; don't mix old sound booleans with v2 objects.
 
 ## Commands
 
-Run these inside Pi:
+Run these inside Pi. After `/windows-notifier `, press **Tab** to complete `status`, `reload`, or `test`. After `test `, Tab completes the event name; partial prefixes such as `test co` also work.
 
 ```text
 /windows-notifier status
@@ -99,32 +164,19 @@ Run these inside Pi:
 /windows-notifier test permission
 ```
 
-- `status` shows the active settings, backend status, queue counters, and diagnostic codes—not your session content.
+- `status` shows channel switches, sound choices, backend status, queue counters, and diagnostic codes—not your custom text or session content.
 - `reload` reads the config again and cancels old notification work.
 - `test` sends a completion notification by default. You can also choose `permission`, `question`, `completed`, `aborted`, or `failed`.
 
 **Tests produce real notifications and sounds.** They follow the same switches, queue limits, and rate limits as automatic notifications, so they won't override a disabled event.
 
-## Privacy and process safety
-
-This extension uses Windows' built-in notification and sound APIs through a fixed PowerShell script. You don't need a separate notification server or audio player. There are no network notifications, telemetry, or custom sound files.
-
-- PowerShell is located using an absolute path under the startup environment's `SystemRoot` or `windir`, never the project directory or `PATH`.
-- The helper runs without a shell. It receives only an event type and a sound switch, validates both, and builds the toast from fixed strings. It doesn't interpolate your content into PowerShell commands or XML.
-- The child process gets a limited set of Windows environment variables, not Pi's full environment or API tokens. `-ExecutionPolicy Bypass` applies only to that child; it doesn't grant administrator access or change permanent settings. Execution Policy isn't treated as a security boundary.
-- Only one helper runs at a time. The queue holds at most 16 notifications, launches are at least a second apart, queued work expires after 30 seconds, and the helper has a 10-second timeout. stdout and stderr are each capped at 8 KiB. Permission requests and questions take priority over response notifications.
-- It only attempts to stop its own child process, never every process with the same name. If Windows refuses to stop that process, new helpers wait for it to close instead of piling up.
-- Decisions, finished questions, new runs, reloads, session changes, and shutdown cancel the relevant old work. A toast already shown can't be taken back, and cancellation can race with submission to Windows.
-
-These safeguards assume that Windows' system directories, Pi's startup environment, and installed packages are trustworthy. They don't protect against a malicious extension running in the same process or a compromised user account. Pi's permission system doesn't sandbox extensions at the OS level.
-
 ## FAQ
 
 ### Why aren't notifications showing up?
 
 Windows still has the final say. Do Not Disturb, notification settings, your sound scheme, and muted audio can suppress a toast or sound even after the API accepts it.
 
-The sender may appear as **PowerShell** because the extension uses the `Microsoft.Windows.PowerShell` AppID. The toast itself says **Pi**. Toast audio is disabled and the system sound is played separately to avoid a duplicate sound from this backend. If one fails, the other is still attempted. There is no fallback notification or audio player.
+The sender may appear as **PowerShell** because the extension uses the `Microsoft.Windows.PowerShell` AppID. The toast title defaults to **Pi**, or the title you choose. Toast audio is disabled and the system sound is played separately to avoid a duplicate sound from this backend. If one fails, the other is still attempted. There is no fallback notification or audio player.
 
 Use `/windows-notifier status` to check these codes:
 
@@ -141,6 +193,19 @@ Use `/windows-notifier status` to check these codes:
 
 Automatic errors show at most one terminal warning per minute. Status uses fixed diagnostic codes rather than raw PowerShell error output.
 
+## Privacy and process safety
+
+This extension uses Windows' built-in notification and sound APIs through a fixed PowerShell script. You don't need a separate notification server or audio player. There are no network notifications, telemetry, or custom sound files.
+
+- PowerShell is located using an absolute path under the startup environment's `SystemRoot` or `windir`, never the project directory or `PATH`.
+- The helper runs without a shell. It receives only the event type, validated channel settings, and static config text through stdin. Text is inserted using DOM text nodes, not interpolated into PowerShell commands or XML. No session content is passed to it.
+- The child process gets a limited set of Windows environment variables, not Pi's full environment or API tokens. `-ExecutionPolicy Bypass` applies only to that child; it doesn't grant administrator access or change permanent settings. Execution Policy isn't treated as a security boundary.
+- Only one helper runs at a time. The queue holds at most 16 notifications, launches are at least a second apart, queued work expires after 30 seconds, and the helper has a 10-second timeout. stdout and stderr are each capped at 8 KiB. Permission requests and questions take priority over response notifications.
+- It only attempts to stop its own child process, never every process with the same name. If Windows refuses to stop that process, new helpers wait for it to close instead of piling up.
+- Decisions, finished questions, new runs, reloads, session changes, and shutdown cancel the relevant old work. A toast already shown can't be taken back, and cancellation can race with submission to Windows.
+
+These safeguards assume that Windows' system directories, Pi's startup environment, and installed packages are trustworthy. They don't protect against a malicious extension running in the same process or a compromised user account. Pi's permission system doesn't sandbox extensions at the OS level.
+
 ## Development
 
 ```bash

package/README.zh-TW.md

@@ -4,7 +4,7 @@
 
 不用一直盯著 Pi。需要你確認權限、回答問題，或模型回應結束時，這個 extension 會跳出 Windows 通知並播放提示音。就算你正在看別的視窗，也會提醒。
 
-通知只告訴你發生了什麼事，不會帶出問題、命令、檔案路徑或模型回答，也不會替你批准權限或回答問題。所有提醒都在本機處理。
+通知不會從 session 帶出問題、命令、檔案路徑或模型回答，但你可以設定自己的固定提醒文字。它也不會替你批准權限或回答問題，所有提醒都在本機處理。
 
 [GitHub](https://github.com/C-W-Z/pi-windows-notifier) · [npm](https://www.npmjs.com/package/pi-windows-notifier)
 
@@ -35,13 +35,13 @@ pi remove npm:pi-windows-notifier
 
 | 事件 | 通知內容 | Windows 提示音 |
 |---|---|---|
-| `permission` | 需要權限確認 | Exclamation |
-| `question` | 有問題等待回答 | Exclamation |
-| `completed` | 回應已完成 | Asterisk |
-| `aborted` | 回應已中止 | Exclamation |
-| `failed` | 回應失敗 | Exclamation |
+| `permission` | Permission approval needed | Exclamation |
+| `question` | Waiting for your answer | Exclamation |
+| `completed` | Response complete | Asterisk |
+| `aborted` | Response interrupted | Exclamation |
+| `failed` | Response failed | Exclamation |
 
-彈窗標題是 **Pi**。目前通知文字和指令提示都是繁體中文，還沒有語言切換設定。
+彈窗標題預設是 **Pi**，預設訊息是英文。每個事件都能設定自己的標題與訊息；指令提示仍是繁體中文，沒有整體語言切換設定。
 
 **權限提醒**搭配 `@gotgenes/pi-permission-system` 使用，也支援從 subagent 轉送到父 session 的權限請求。自動允許、自動拒絕，或已經有 session approval 的請求不會提醒。
 
@@ -61,36 +61,101 @@ Pi 的 UI 事件沒有說明是哪個工具開了視窗。因此，只有恰好
 
 ## 設定
 
-想改預設行為時，請自行建立 `~/.pi/agent/pi-windows-notifier/config.json`。在 Windows 上，就是使用者家目錄裡的 `.pi\agent\pi-windows-notifier\config.json`。
+想改預設行為時，請自行建立 `~/.pi/agent/pi-windows-notifier/config.json`。在 Windows 上，就是使用者家目錄裡的 `.pi\agent\pi-windows-notifier\config.json`。套件不會替你建立或修改這個檔案，也不讀專案內的設定。
 
-套件不會替你建立或修改這個檔案，也不讀專案內的設定。沒有設定檔時，使用以下預設值：
+### 完整設定範例
+
+下面列出所有支援的欄位和五種事件，可以直接複製作為起點。不過，**實際只要保留想修改的欄位，加上 `schemaVersion: 2` 就好**。每個事件都覆寫了共用訊息，因此這份範例的效果等同內建預設。
 
 ```json
 {
+  "schemaVersion": 2,
   "enabled": true,
+  "defaults": {
+    "toast": {
+      "enabled": true,
+      "title": "Pi",
+      "message": "Pi needs your attention."
+    },
+    "sound": {
+      "enabled": true,
+      "source": {
+        "type": "system",
+        "name": "Exclamation"
+      }
+    }
+  },
   "events": {
-    "permission": { "enabled": true, "sound": true },
-    "question": { "enabled": true, "sound": true },
-    "completed": { "enabled": true, "sound": true },
-    "aborted": { "enabled": true, "sound": true },
-    "failed": { "enabled": true, "sound": true }
+    "permission": {
+      "enabled": true,
+      "toast": { "enabled": true, "title": "Pi", "message": "Permission approval needed" },
+      "sound": { "enabled": true, "source": { "type": "system", "name": "Exclamation" } }
+    },
+    "question": {
+      "enabled": true,
+      "toast": { "enabled": true, "title": "Pi", "message": "Waiting for your answer" },
+      "sound": { "enabled": true, "source": { "type": "system", "name": "Exclamation" } }
+    },
+    "completed": {
+      "enabled": true,
+      "toast": { "enabled": true, "title": "Pi", "message": "Response complete" },
+      "sound": { "enabled": true, "source": { "type": "system", "name": "Asterisk" } }
+    },
+    "aborted": {
+      "enabled": true,
+      "toast": { "enabled": true, "title": "Pi", "message": "Response interrupted" },
+      "sound": { "enabled": true, "source": { "type": "system", "name": "Exclamation" } }
+    },
+    "failed": {
+      "enabled": true,
+      "toast": { "enabled": true, "title": "Pi", "message": "Response failed" },
+      "sound": { "enabled": true, "source": { "type": "system", "name": "Exclamation" } }
+    }
   }
 }
 ```
 
-只要寫想改的欄位就好。例如保留完成彈窗，但不要播放提示音：
+### 欄位與覆寫規則
 
-```json
-{ "events": { "completed": { "sound": false } } }
-```
+設定依序套用：**內建事件預設 → 共用的 `defaults` → 個別 `events.<事件>` 設定**。沒寫的欄位沿用前一層。例如，`defaults.toast.message` 會讓所有事件共用同一則訊息，除非事件另外設定自己的訊息；省略它就能保留內建的各事件文字。
+
+| 欄位 | 用途 |
+|---|---|
+| `schemaVersion` | 使用這個格式時設為 `2` |
+| `enabled` | 總開關，`false` 關閉所有通知 |
+| `defaults` | 共用的 `toast` 和 `sound` 設定，沒有 `defaults.enabled` |
+| `events.<事件>` | 可設定 `permission`、`question`、`completed`、`aborted`、`failed` |
+| `events.<事件>.enabled` | 開啟或關閉整個事件 |
+| `toast.enabled` | 彈窗開關 |
+| `toast.title` | 固定的通知標題 |
+| `toast.message` | 固定的通知訊息 |
+| `sound.enabled` | 音效開關 |
+| `sound.source.type` | 目前只支援 `"system"` |
+| `sound.source.name` | `Asterisk`、`Beep`、`Exclamation`、`Hand`、`Question`，大小寫要一致 |
+
+`toast` 和 `sound` 欄位都能放在 `defaults` 或個別事件底下。**完整範例已寫出每個事件的所有欄位，只改 `defaults` 不會改到已被事件覆寫的值。** 想讓事件沿用共用設定，請刪除該事件底下對應的欄位。設定 `sound.source` 時必須一起提供 `type` 和 `name`，它會整組取代原本的來源。
+
+- **只要彈窗**：將 `sound.enabled` 設為 `false`、`toast.enabled` 設為 `true`。
+- **只要音效**：將 `toast.enabled` 設為 `false`、`sound.enabled` 設為 `true`。
+- 兩個通道都關閉時，不啟動 helper。事件可以覆寫共用通道開關，但不能繞過已關閉的總開關或事件開關。
+
+沒有設定檔時，所有事件與通道都開啟，標題是 Pi，訊息是英文。完成通知使用 Asterisk，其他事件使用 Exclamation。
+
+### 文字與音效限制
 
-最外層的 `enabled` 是總開關。每個事件的 `enabled` 控制該類彈窗與音效，`sound` 則只控制音效。
+文字會照你寫的內容顯示，不會從 session 帶入變數，也沒有模板替換。標題最多 128 個 UTF-16 code units，訊息最多 512 個；emoji 可能算兩個。兩者都必須是非空白的單行字串，不能包含控制字元或不合法的 XML 字元。自訂文字會出現在 Windows 通知裡，請不要放敏感資訊；它不會顯示在 `status` 或錯誤提示中。
 
-修改後執行 `/windows-notifier reload`。如果有未知欄位、值的型別不對、檔案無法讀取或超過 16 KiB，通知會先停用；修正後再 reload 即可。錯誤提示不會印出設定檔內容。
+音效名稱選的是 **Windows 系統音效事件**，不是套件內附的不同音效檔。實際聲音取決於 Windows 音效配置；不同事件可能共用同一個聲音，也可能沒有對應音效。你可以在 Windows「音效」設定中查看或修改對應，但修改也會影響使用相同事件的其他程式。目前不支援自訂音效檔。
+
+### 套用修改與舊格式相容
+
+修改後執行 `/reload` 或 `/windows-notifier reload`。如果有未知欄位、不支援的版本或音效來源、值不合法、檔案無法讀取或超過 16 KiB，通知會先停用；修正後再 reload 即可。錯誤提示不會印出設定檔內容。
+
+原本沒有版本欄位、音效使用 boolean 的格式（例如 `events.completed.sound: false`）仍能使用，只在記憶體裡轉換，不會修改你的檔案。要使用新的通道物件，請加上 `schemaVersion: 2`；不要把舊的音效 boolean 和 v2 物件混在一起。
 
 ## 指令
 
-在 Pi 裡執行：
+在 Pi 裡執行。輸入 `/windows-notifier ` 後按 **Tab**，可以補全 `status`、`reload` 或 `test`；輸入 `test ` 後，Tab 會補全事件名稱，也支援 `test co` 這類前綴。
 
 ```text
 /windows-notifier status
@@ -99,24 +164,12 @@ Pi 的 UI 事件沒有說明是哪個工具開了視窗。因此，只有恰好
 /windows-notifier test permission
 ```
 
-- `status`：查看目前設定、backend 狀態、佇列計數和診斷碼，不會顯示 session 內容。
+- `status`：查看通道開關、音效選擇、backend 狀態、佇列計數和診斷碼，不會顯示自訂文字或 session 內容。
 - `reload`：重新讀取設定，取消舊的通知工作。
 - `test`：預設測試完成通知，也能指定 `permission`、`question`、`completed`、`aborted` 或 `failed`。
 
 **測試會真的跳通知、播放音效。** 和自動通知一樣，它會遵守開關、佇列與限流，不會強行送出已停用的事件。
 
-## 隱私與程序安全
-
-套件透過固定的 PowerShell 腳本呼叫 Windows 內建通知和音效 API，不用另外裝通知服務或播放器。沒有網路通知、遙測或自訂音效檔。
-
-- PowerShell 使用啟動環境的 `SystemRoot`／`windir` 下的絕對路徑，不從專案目錄或 `PATH` 搜尋。
-- helper 不透過 shell 執行，只接收事件類型與音效開關。驗證後使用固定文字建立通知，不把工作內容拼進 PowerShell 命令或 XML。
-- 子程序只拿到必要的 Windows 環境變數，不繼承 Pi 的完整環境或 API tokens。`-ExecutionPolicy Bypass` 只作用於該子程序，不會取得管理員權限或改動永久設定，也不把 Execution Policy 當成安全邊界。
-- 同時最多一個 helper，佇列最多 16 筆，啟動至少間隔一秒。工作等待超過 30 秒會過期，helper 的 timeout 是 10 秒，stdout 和 stderr 各限制 8 KiB。權限和提問比回應結束通知優先。
-- 只嘗試終止自己建立的子程序，不會按名稱關閉其他程序。如果 Windows 不允許終止，就等它結束，不會繼續堆出新的 helper。
-- 權限決策、問題結束、新回應、reload、session 切換和 shutdown 都會取消相關舊工作。已經顯示的 Toast 無法收回，取消和提交給 Windows 之間仍可能發生競態。
-
-這些防護假設 Windows 系統目錄、Pi 啟動環境和已安裝套件可信。它們無法防禦同程序裡的惡意 extension，或已遭入侵的使用者帳號。Pi permission system 並不是 extension 的 OS 沙盒。
 
 ## 常見問題
 
@@ -124,7 +177,7 @@ Pi 的 UI 事件沒有說明是哪個工具開了視窗。因此，只有恰好
 
 Windows 仍然有最終決定權。勿擾模式、通知設定、系統音效方案和靜音，都可能讓已提交的通知沒有彈出或沒有聲音。
 
-因為使用 `Microsoft.Windows.PowerShell` AppID，通知來源可能顯示 **PowerShell**，但彈窗本身會寫 **Pi**。Toast 自帶的音效關閉，提示音另外播放，避免這個 backend 自己重複響兩次。彈窗和音效分開處理，一個失敗仍會嘗試另一個；沒有備用通知方式或播放器。
+因為使用 `Microsoft.Windows.PowerShell` AppID，通知來源可能顯示 **PowerShell**，但彈窗標題預設是 **Pi**，也可以改成你設定的標題。Toast 自帶的音效關閉，提示音另外播放，避免這個 backend 自己重複響兩次。彈窗和音效分開處理，一個失敗仍會嘗試另一個；沒有備用通知方式或播放器。
 
 可以用 `/windows-notifier status` 查看診斷碼：
 
@@ -141,6 +194,19 @@ Windows 仍然有最終決定權。勿擾模式、通知設定、系統音效方
 
 自動通知錯誤最多每分鐘顯示一次終端警告。診斷只使用固定代碼，不會帶出 PowerShell 原始錯誤內容。
 
+## 隱私與程序安全
+
+套件透過固定的 PowerShell 腳本呼叫 Windows 內建通知和音效 API，不用另外裝通知服務或播放器。沒有網路通知、遙測或自訂音效檔。
+
+- PowerShell 使用啟動環境的 `SystemRoot`／`windir` 下的絕對路徑，不從專案目錄或 `PATH` 搜尋。
+- helper 不透過 shell 執行，只從 stdin 接收事件類型、已驗證的通道設定與固定設定文字。文字用 DOM text node 加進通知，不拼進 PowerShell 命令或 XML，也不傳入 session 內容。
+- 子程序只拿到必要的 Windows 環境變數，不繼承 Pi 的完整環境或 API tokens。`-ExecutionPolicy Bypass` 只作用於該子程序，不會取得管理員權限或改動永久設定，也不把 Execution Policy 當成安全邊界。
+- 同時最多一個 helper，佇列最多 16 筆，啟動至少間隔一秒。工作等待超過 30 秒會過期，helper 的 timeout 是 10 秒，stdout 和 stderr 各限制 8 KiB。權限和提問比回應結束通知優先。
+- 只嘗試終止自己建立的子程序，不會按名稱關閉其他程序。如果 Windows 不允許終止，就等它結束，不會繼續堆出新的 helper。
+- 權限決策、問題結束、新回應、reload、session 切換和 shutdown 都會取消相關舊工作。已經顯示的 Toast 無法收回，取消和提交給 Windows 之間仍可能發生競態。
+
+這些防護假設 Windows 系統目錄、Pi 啟動環境和已安裝套件可信。它們無法防禦同程序裡的惡意 extension，或已遭入侵的使用者帳號。Pi permission system 並不是 extension 的 OS 沙盒。
+
 ## 開發
 
 ```bash

package/docs/verification.md

@@ -3,7 +3,8 @@
 ## 自動驗證
 
 - TypeScript `tsc --noEmit` 與 Node test runner 通過；測試覆蓋設定驗證、權限與提問事件、回應狀態、去重取消、限流佇列、PowerShell launcher、資源清理與發布檔案清單。
-- Windows 測試檢查固定 PowerShell helper 語法及無效輸入；不呼叫 Toast 成功路徑，也不播放系統音效。
+- 設定測試涵蓋 schema v2 合併、舊格式相容、獨立通道、系統音效白名單、自訂文字上限與 Unicode／XML 驗證；status 與錯誤提示不展示設定文字。
+- Windows 測試檢查固定 PowerShell helper 語法、無效輸入，以及通道全關閉時的有效輸入；不呼叫 Toast 或音效 API。單通道成功／失敗結果由 mock launcher 驗證。
 - 發布包以 npm pack dry-run 核對；僅包含套件 metadata、runtime 原始碼、PowerShell helper、文件及授權。
 
 執行完整檢查：
@@ -16,7 +17,9 @@ npm pack --dry-run
 
 ## 實機驗證範圍
 
-Windows backend 的五類通知（permission、question、completed、aborted、failed）曾逐一送出，並經人工確認有 Toast 彈窗與提示音。
+0.1.x Windows backend 的五類通知（permission、question、completed、aborted、failed）曾逐一送出，並經人工確認有 Toast 彈窗與提示音。
+
+0.2.0 的自訂標題／訊息、Toast-only、sound-only 與新增系統音效選擇尚未完成實際可見／可聽驗收；不以舊版結果推論新 helper 已通過。
 
 這項 backend 驗證不等於所有 Pi 整合情境均已端到端驗收。以下項目仍需在實際使用環境確認：
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-windows-notifier",
-  "version": "0.1.1",
-  "description": "Pi 的 Windows Toast 與系統提示音：權限、結構化提問及回應結束通知。",
+  "version": "0.2.0",
+  "description": "Windows notifications and sounds for Pi permission requests, questions, and completed, interrupted, or failed responses.",
   "type": "module",
   "license": "MIT",
   "repository": {

package/src/config.ts

@@ -1,10 +1,13 @@
 import { closeSync, fstatSync, openSync, readSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { KINDS, isRecord, type NotificationKind } from "./types.ts";
+import { KINDS, SYSTEM_SOUNDS, TITLE_LIMIT, MESSAGE_LIMIT, isRecord, onlyKeys, validText,
+  type NotificationKind, type ToastConfig, type SoundConfig } from "./types.ts";
 
-export interface EventConfig { enabled: boolean; sound: boolean }
+export interface EventConfig { enabled: boolean; toast: ToastConfig; sound: SoundConfig }
+/** 解析後的有效設定；defaults 已合併至各事件，不保留重複設定來源。 */
 export interface Config {
+  schemaVersion: 2;
   enabled: boolean;
   events: Record<NotificationKind, EventConfig>;
 }
@@ -12,32 +15,79 @@ export type ConfigResult =
   | { ok: true; config: Config }
   | { ok: false; code: "CONFIG_INVALID" | "CONFIG_TOO_LARGE" | "CONFIG_READ_FAILED"; config: Config };
 
+const MESSAGES: Record<NotificationKind, string> = {
+  permission: "Permission approval needed", question: "Waiting for your answer", completed: "Response complete",
+  aborted: "Response interrupted", failed: "Response failed",
+};
 export function defaults(): Config {
-  return { enabled: true, events: Object.fromEntries(KINDS.map(kind =>
-    [kind, { enabled: true, sound: true }])) as Config["events"] };
+  return { schemaVersion: 2, enabled: true, events: Object.fromEntries(KINDS.map(kind =>
+    [kind, { enabled: true, toast: { enabled: true, title: "Pi", message: MESSAGES[kind] },
+      sound: { enabled: true, source: { type: "system", name: kind === "completed" ? "Asterisk" : "Exclamation" } } }])) as Config["events"] };
 }
-function onlyKeys(value: Record<string, unknown>, keys: readonly string[]): boolean {
-  return Object.keys(value).every(key => keys.includes(key));
+function applyChannels(target: EventConfig, value: Record<string, unknown>): boolean {
+  if (Object.hasOwn(value, "toast")) {
+    const toast = value.toast;
+    if (!isRecord(toast) || !onlyKeys(toast, ["enabled", "title", "message"])) return false;
+    if (Object.hasOwn(toast, "enabled")) {
+      if (typeof toast.enabled !== "boolean") return false;
+      target.toast.enabled = toast.enabled;
+    }
+    for (const field of ["title", "message"] as const) {
+      if (!Object.hasOwn(toast, field)) continue;
+      const text = toast[field];
+      if (!validText(text, field === "title" ? TITLE_LIMIT : MESSAGE_LIMIT)) return false;
+      target.toast[field] = text;
+    }
+  }
+  if (Object.hasOwn(value, "sound")) {
+    const sound = value.sound;
+    if (!isRecord(sound) || !onlyKeys(sound, ["enabled", "source"])) return false;
+    if (Object.hasOwn(sound, "enabled")) {
+      if (typeof sound.enabled !== "boolean") return false;
+      target.sound.enabled = sound.enabled;
+    }
+    if (Object.hasOwn(sound, "source")) {
+      const source = sound.source;
+      if (!isRecord(source) || !onlyKeys(source, ["type", "name"]) ||
+          source.type !== "system" || !SYSTEM_SOUNDS.includes(source.name as SoundConfig["source"]["name"])) return false;
+      // source 作為完整單位覆寫，避免未來不同來源類型留下混合欄位。
+      target.sound.source = { type: "system", name: source.name as SoundConfig["source"]["name"] };
+    }
+  }
+  return true;
 }
 export function parseConfig(value: unknown): ConfigResult {
   const config = defaults();
   const invalid = (): ConfigResult => ({ ok: false, code: "CONFIG_INVALID", config: { ...defaults(), enabled: false } });
-  if (!isRecord(value) || !onlyKeys(value, ["enabled", "events"])) return invalid();
+  if (!isRecord(value)) return invalid();
+  const legacy = !Object.hasOwn(value, "schemaVersion");
+  if (!onlyKeys(value, legacy ? ["enabled", "events"] : ["schemaVersion", "enabled", "defaults", "events"]) ||
+      !legacy && value.schemaVersion !== 2) return invalid();
   if (Object.hasOwn(value, "enabled")) {
     if (typeof value.enabled !== "boolean") return invalid();
     config.enabled = value.enabled;
   }
+  if (!legacy && Object.hasOwn(value, "defaults")) {
+    if (!isRecord(value.defaults) || !onlyKeys(value.defaults, ["toast", "sound"])) return invalid();
+    for (const kind of KINDS) if (!applyChannels(config.events[kind], value.defaults)) return invalid();
+  }
   if (Object.hasOwn(value, "events")) {
     if (!isRecord(value.events) || !onlyKeys(value.events, KINDS)) return invalid();
     for (const kind of KINDS) {
       if (!Object.hasOwn(value.events, kind)) continue;
       const item = value.events[kind];
-      if (!isRecord(item) || !onlyKeys(item, ["enabled", "sound"])) return invalid();
-      for (const field of ["enabled", "sound"] as const) {
-        if (!Object.hasOwn(item, field)) continue;
-        if (typeof item[field] !== "boolean") return invalid();
-        config.events[kind][field] = item[field];
+      if (!isRecord(item) || !onlyKeys(item, legacy ? ["enabled", "sound"] : ["enabled", "toast", "sound"])) return invalid();
+      const target = config.events[kind];
+      if (Object.hasOwn(item, "enabled")) {
+        if (typeof item.enabled !== "boolean") return invalid();
+        target.enabled = item.enabled;
       }
+      if (legacy) {
+        if (Object.hasOwn(item, "sound")) {
+          if (typeof item.sound !== "boolean") return invalid();
+          target.sound.enabled = item.sound;
+        }
+      } else if (!applyChannels(target, item)) return invalid();
     }
   }
   return { ok: true, config };

package/src/launcher.ts

@@ -2,7 +2,7 @@ import { spawn, type ChildProcess, type SpawnOptions } from "node:child_process"
 import { statSync } from "node:fs";
 import { dirname, win32 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { isRecord, type NotificationKind } from "./types.ts";
+import { isRecord, validPayload, type NotificationPayload } from "./types.ts";
 
 export const HELPER_TIMEOUT = 10_000;
 export const OUTPUT_LIMIT = 8 * 1024;
@@ -17,7 +17,7 @@ export interface LaunchResult {
 export interface Backend {
   available: boolean;
   code: string;
-  launch(kind: NotificationKind, sound: boolean, signal: AbortSignal): Promise<LaunchResult>;
+  launch(payload: NotificationPayload, signal: AbortSignal): Promise<LaunchResult>;
 }
 const SCRIPT = fileURLToPath(new URL("./windows-notify.ps1", import.meta.url));
 const ENV_KEYS = ["SystemRoot", "windir", "USERPROFILE", "APPDATA", "LOCALAPPDATA", "TEMP", "TMP", "USERNAME", "USERDOMAIN"];
@@ -43,7 +43,7 @@ export function windowsPaths(env: NodeJS.ProcessEnv): { executable: string; env:
   return { executable: win32.join(clean, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"), env: result };
 }
 function failed(code: LaunchCode): LaunchResult { return { code, toast: false, sound: "failed" }; }
-function parseResult(output: Buffer, exitCode: number | null, sound: boolean): LaunchResult {
+function parseResult(output: Buffer, exitCode: number | null, payload: NotificationPayload): LaunchResult {
   try {
     const parsed: unknown = JSON.parse(output.toString("utf8").trim());
     if (!isRecord(parsed) || Object.keys(parsed).length !== 3 ||
@@ -51,13 +51,14 @@ function parseResult(output: Buffer, exitCode: number | null, sound: boolean): L
         typeof parsed.sound !== "string" || !["played", "disabled", "failed"].includes(parsed.sound)) return failed("HELPER_PROTOCOL");
     const code = parsed.code as LaunchCode;
     const audio = parsed.sound as LaunchResult["sound"];
-    const expected = parsed.toast
-      ? (audio === "failed" ? "SOUND_FAILED" : "OK")
-      : (audio === "failed" ? "BOTH_FAILED" : "TOAST_FAILED");
-    if (audio === "disabled" && sound || audio === "played" && !sound) return failed("HELPER_PROTOCOL");
     if (["INPUT_INVALID", "INTERNAL_ERROR"].includes(code)) {
-      return !parsed.toast && audio === "failed" && exitCode !== 0 ? failed(code) : failed("HELPER_PROTOCOL");
+      return !parsed.toast && audio === "failed" && exitCode === 1 ? failed(code) : failed("HELPER_PROTOCOL");
     }
+    if ((!payload.toast.enabled && parsed.toast) ||
+        (payload.sound.enabled ? audio === "disabled" : audio !== "disabled")) return failed("HELPER_PROTOCOL");
+    const toastFailed = payload.toast.enabled && !parsed.toast;
+    const soundFailed = payload.sound.enabled && audio === "failed";
+    const expected = toastFailed ? (soundFailed ? "BOTH_FAILED" : "TOAST_FAILED") : (soundFailed ? "SOUND_FAILED" : "OK");
     if (code !== expected || exitCode !== (code === "OK" ? 0 : 1)) return failed("HELPER_PROTOCOL");
     return { code, toast: parsed.toast, sound: audio };
   } catch { return failed("HELPER_PROTOCOL"); }
@@ -83,7 +84,11 @@ export function createWindowsBackend(options: BackendOptions = {}): Backend {
   const code = available ? "OK" : "BACKEND_UNAVAILABLE";
   return {
     available, code,
-    launch(kind, sound, signal) {
+    launch(payload, signal) {
+      if (!validPayload(payload)) return Promise.resolve(failed("INPUT_INVALID"));
+      // 再建立白名單快照，避免呼叫方中途修改設定或額外傳入事件內容。
+      const request: NotificationPayload = { kind: payload.kind, toast: { ...payload.toast },
+        sound: { enabled: payload.sound.enabled, source: { ...payload.sound.source } } };
       if (!available || !paths) return Promise.resolve(failed("BACKEND_UNAVAILABLE"));
       if (signal.aborted) return Promise.resolve(failed("CANCELLED"));
       return new Promise(resolve => {
@@ -130,11 +135,11 @@ export function createWindowsBackend(options: BackendOptions = {}): Backend {
           if (stderrSize > OUTPUT_LIMIT) stop("OUTPUT_LIMIT");
           // 不保存或展示 PowerShell 的原始錯誤文字。
         });
-        child.once("close", exitCode => finish(reason ? failed(reason) : parseResult(output, exitCode, sound)));
+        child.once("close", exitCode => finish(reason ? failed(reason) : parseResult(output, exitCode, request)));
         child.stdin?.on("error", () => stop("LAUNCH_FAILED"));
         child.stdout?.on("error", () => stop("LAUNCH_FAILED"));
         child.stderr?.on("error", () => stop("LAUNCH_FAILED"));
-        try { child.stdin?.end(JSON.stringify({ kind, sound })); }
+        try { child.stdin?.end(JSON.stringify(request)); }
         catch { stop("LAUNCH_FAILED"); }
         if (signal.aborted) onAbort();
       });

package/src/runtime.ts

@@ -121,6 +121,19 @@ export function registerNotifier(pi: ExtensionAPI, options: RuntimeOptions = {})
 
   pi.registerCommand("windows-notifier", {
     description: "Windows 通知：status、reload、test [permission|question|completed|aborted|failed]",
+    getArgumentCompletions: prefix => {
+      const leading = prefix.match(/^\s*/u)![0];
+      const argument = prefix.slice(leading.length);
+      if (!/\s/u.test(argument)) {
+        const matches = ["status", "reload", "test"].filter(value => value.startsWith(argument));
+        return matches.length ? matches.map(value => ({ value: leading + value, label: value })) : null;
+      }
+      const match = argument.match(/^test(\s+)(\S*)$/u);
+      if (!match) return null;
+      const matches = KINDS.filter(kind => kind.startsWith(match[2]));
+      // Pi 會替換整段 argument prefix；必須保留 test 與空白，不只回傳事件名稱。
+      return matches.length ? matches.map(kind => ({ value: leading + "test" + match[1] + kind, label: kind })) : null;
+    },
     handler: async (args, context) => {
       const parts = args.trim().split(/\s+/u);
       if (parts.length === 1 && parts[0] === "reload") {
@@ -133,7 +146,13 @@ export function registerNotifier(pi: ExtensionAPI, options: RuntimeOptions = {})
         const status = {
           backend: target?.backendCode ?? "NOT_STARTED",
           enabled: target?.result.config.enabled ?? false,
-          events: target?.result.config.events,
+          schemaVersion: target?.result.config.schemaVersion,
+          // 自訂文字只送入 helper；status 不展示可能含敏感資訊的設定文字。
+          events: target ? Object.fromEntries(KINDS.map(kind => {
+            const event = target.result.config.events[kind];
+            return [kind, { enabled: event.enabled, toast: { enabled: event.toast.enabled },
+              sound: { enabled: event.sound.enabled, source: { ...event.sound.source } } }];
+          })) : undefined,
           ...target?.scheduler?.status(),
           diagnostics: [...(target?.diagnostics ?? [])],
         };

package/src/scheduler.ts

@@ -47,7 +47,8 @@ export class NotificationScheduler {
   }
   private enabled(job: NotificationJob): boolean {
     const config = this.config();
-    return !this.closed && this.backend.available && config.enabled && config.events[job.kind].enabled;
+    const event = config.events[job.kind];
+    return !this.closed && this.backend.available && config.enabled && event.enabled && (event.toast.enabled || event.sound.enabled);
   }
   private valid(job: NotificationJob): boolean {
     try { return job.valid(); } catch { return false; }
@@ -114,7 +115,11 @@ export class NotificationScheduler {
   }
   private async deliver(item: Pending, signal: AbortSignal): Promise<void> {
     let result: LaunchResult;
-    try { result = await this.backend.launch(item.job.kind, this.config().events[item.job.kind].sound, signal); }
+    try {
+      const event = this.config().events[item.job.kind];
+      result = await this.backend.launch({ kind: item.job.kind, toast: { ...event.toast },
+        sound: { enabled: event.sound.enabled, source: { ...event.sound.source } } }, signal);
+    }
     catch { result = { code: "LAUNCH_FAILED", toast: false, sound: "failed" }; }
     if (signal.aborted || result.code === "CANCELLED") { item.resolve({ status: "cancelled" }); return; }
     if (result.code !== "OK") this.diagnose(result.code);

package/src/types.ts

@@ -1,6 +1,32 @@
 export const KINDS = ["permission", "question", "completed", "aborted", "failed"] as const;
 export type NotificationKind = (typeof KINDS)[number];
 export type Outcome = "completed" | "aborted" | "error";
+export const SYSTEM_SOUNDS = ["Asterisk", "Beep", "Exclamation", "Hand", "Question"] as const;
+export type SystemSound = (typeof SYSTEM_SOUNDS)[number];
+export const TITLE_LIMIT = 128;
+export const MESSAGE_LIMIT = 512;
+export interface ToastConfig { enabled: boolean; title: string; message: string }
+export interface SoundConfig { enabled: boolean; source: { type: "system"; name: SystemSound } }
+export interface NotificationPayload { kind: NotificationKind; toast: ToastConfig; sound: SoundConfig }
+/** 限制單行 XML 文字；保留引號與 XML 字元，由 DOM 安全編碼。 */
+export function validText(value: unknown, limit: number): value is string {
+  return typeof value === "string" && value.trim().length > 0 && value.length <= limit &&
+    !/[\u0000-\u001f\u007f-\u009f\u2028\u2029\ufffe\uffff\ud800-\udfff]/u.test(value);
+}
+export function onlyKeys(value: Record<string, unknown>, keys: readonly string[]): boolean {
+  return Object.keys(value).every(key => keys.includes(key));
+}
+export function validPayload(value: unknown): value is NotificationPayload {
+  if (!isRecord(value) || !onlyKeys(value, ["kind", "toast", "sound"]) ||
+      !KINDS.includes(value.kind as NotificationKind) || !isRecord(value.toast) || !isRecord(value.sound)) return false;
+  const { toast, sound } = value;
+  return onlyKeys(toast, ["enabled", "title", "message"]) && typeof toast.enabled === "boolean" &&
+    validText(toast.title, TITLE_LIMIT) && validText(toast.message, MESSAGE_LIMIT) &&
+    onlyKeys(sound, ["enabled", "source"]) && typeof sound.enabled === "boolean" &&
+    isRecord(sound.source) && onlyKeys(sound.source, ["type", "name"]) &&
+    sound.source.type === "system" && SYSTEM_SOUNDS.includes(sound.source.name as SystemSound) &&
+    (toast.enabled || sound.enabled);
+}
 export interface NotificationJob {
   key: string;
   kind: NotificationKind;

package/src/windows-notify.ps1

@@ -1,37 +1,76 @@
-# 固定 helper：stdin 僅接受事件 enum 與音效開關，不接受任意訊息或命令。
+# 固定 helper：只接受已驗證的通道設定與靜態文字，不接受任意命令或音效路徑。
 Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
+[Console]::InputEncoding = [System.Text.UTF8Encoding]::new($false, $true)
 [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)
 
 function Write-Result {
   param([string]$Code, [bool]$Toast, [string]$Sound)
   [Console]::Out.WriteLine((@{ code = $Code; toast = $Toast; sound = $Sound } | ConvertTo-Json -Compress))
 }
+function Assert-Keys {
+  param($Value, [string[]]$Keys)
+  if ($Value -isnot [pscustomobject]) { throw "INPUT_INVALID" }
+  $names = @($Value.PSObject.Properties.Name)
+  if ($names.Count -ne $Keys.Count) { throw "INPUT_INVALID" }
+  foreach ($name in $names) {
+    if ($Keys -cnotcontains $name) { throw "INPUT_INVALID" }
+  }
+}
+function Assert-Text {
+  param($Value, [int]$Limit)
+  if ($Value -isnot [string] -or [string]::IsNullOrWhiteSpace($Value) -or $Value.Length -gt $Limit -or
+      $Value -match '[\x00-\x1f\x7f-\x9f\u2028\u2029\ufffe\uffff]') { throw "INPUT_INVALID" }
+  # 同時拒絕未配對的 UTF-16 surrogate；合法 emoji 可保留。
+  [System.Xml.XmlConvert]::VerifyXmlChars($Value) | Out-Null
+}
+
+function Assert-JsonSurrogates {
+  param([string]$Value)
+  # ConvertFrom-Json 會把未配對的 surrogate 換成 replacement character；先檢查原始 JSON escape。
+  foreach ($match in [regex]::Matches($Value, '"(?:[^"\\]|\\.)*"')) {
+    $text = $match.Value
+    for ($i = 1; $i -lt $text.Length - 1; $i++) {
+      if ($text[$i] -cne '\') { continue }
+      if ($text[$i + 1] -cne 'u') { $i++; continue }
+      $code = [Convert]::ToInt32($text.Substring($i + 2, 4), 16)
+      if ($code -ge 0xd800 -and $code -le 0xdbff) {
+        if ($i + 12 -gt $text.Length - 1 -or $text.Substring($i + 6, 2) -cne '\u') { throw "INPUT_INVALID" }
+        $low = [Convert]::ToInt32($text.Substring($i + 8, 4), 16)
+        if ($low -lt 0xdc00 -or $low -gt 0xdfff) { throw "INPUT_INVALID" }
+        $i += 11
+      } elseif ($code -ge 0xdc00 -and $code -le 0xdfff) {
+        throw "INPUT_INVALID"
+      } else { $i += 5 }
+    }
+  }
+}
 
 try {
-  $buffer = New-Object char[] 513
+  $buffer = New-Object char[] 4097
   $size = 0
   while ($size -lt $buffer.Length) {
     $count = [Console]::In.Read($buffer, $size, $buffer.Length - $size)
     if ($count -eq 0) { break }
     $size += $count
   }
-  if ($size -gt 512) { throw "INPUT_INVALID" }
-  $inputData = (-join $buffer[0..($size - 1)]) | ConvertFrom-Json
-  $names = @($inputData.PSObject.Properties.Name)
-  if ($names.Count -ne 2 -or -not ($names -contains "kind") -or -not ($names -contains "sound") -or
-      $inputData.kind -isnot [string] -or $inputData.sound -isnot [bool]) { throw "INPUT_INVALID" }
-  $messages = @{
-    permission = "需要權限確認"
-    question = "有問題等待回答"
-    completed = "回應已完成"
-    aborted = "回應已中止"
-    failed = "回應失敗"
-  }
-  # PowerShell hashtable 預設不區分大小寫，先以 case-sensitive 比較鎖定 enum。
-  if (-not (@("permission", "question", "completed", "aborted", "failed") -ccontains $inputData.kind)) {
-    throw "INPUT_INVALID"
-  }
+  if ($size -eq 0 -or $size -gt 4096) { throw "INPUT_INVALID" }
+  $json = -join $buffer[0..($size - 1)]
+  Assert-JsonSurrogates $json
+  $inputData = $json | ConvertFrom-Json
+  Assert-Keys $inputData @("kind", "toast", "sound")
+  if ($inputData.kind -isnot [string] -or
+      @("permission", "question", "completed", "aborted", "failed") -cnotcontains $inputData.kind) { throw "INPUT_INVALID" }
+  Assert-Keys $inputData.toast @("enabled", "title", "message")
+  if ($inputData.toast.enabled -isnot [bool]) { throw "INPUT_INVALID" }
+  Assert-Text $inputData.toast.title 128
+  Assert-Text $inputData.toast.message 512
+  Assert-Keys $inputData.sound @("enabled", "source")
+  if ($inputData.sound.enabled -isnot [bool]) { throw "INPUT_INVALID" }
+  Assert-Keys $inputData.sound.source @("type", "name")
+  if ($inputData.sound.source.type -cne "system" -or $inputData.sound.source.type -isnot [string] -or
+      $inputData.sound.source.name -isnot [string] -or
+      @("Asterisk", "Beep", "Exclamation", "Hand", "Question") -cnotcontains $inputData.sound.source.name) { throw "INPUT_INVALID" }
 }
 catch {
   Write-Result "INPUT_INVALID" $false "failed"
@@ -40,28 +79,36 @@ catch {
 
 $toastOk = $false
 $soundStatus = "disabled"
-try {
-  [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null
-  [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null
-  $xml = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent(
-    [Windows.UI.Notifications.ToastTemplateType]::ToastText02)
-  $nodes = $xml.GetElementsByTagName("text")
-  $nodes.Item(0).AppendChild($xml.CreateTextNode("Pi")) | Out-Null
-  $nodes.Item(1).AppendChild($xml.CreateTextNode($messages[$inputData.kind])) | Out-Null
-  $audio = $xml.CreateElement("audio")
-  $audio.SetAttribute("silent", "true")
-  $xml.DocumentElement.AppendChild($audio) | Out-Null
-  $toast = [Windows.UI.Notifications.ToastNotification]::new($xml)
-  $notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier("Microsoft.Windows.PowerShell")
-  $notifier.Show($toast)
-  $toastOk = $true
+if ($inputData.toast.enabled) {
+  try {
+    [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null
+    [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null
+    $xml = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent(
+      [Windows.UI.Notifications.ToastTemplateType]::ToastText02)
+    $nodes = $xml.GetElementsByTagName("text")
+    $nodes.Item(0).AppendChild($xml.CreateTextNode($inputData.toast.title)) | Out-Null
+    $nodes.Item(1).AppendChild($xml.CreateTextNode($inputData.toast.message)) | Out-Null
+    $audio = $xml.CreateElement("audio")
+    $audio.SetAttribute("silent", "true")
+    $xml.DocumentElement.AppendChild($audio) | Out-Null
+    $toast = [Windows.UI.Notifications.ToastNotification]::new($xml)
+    $notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier("Microsoft.Windows.PowerShell")
+    $notifier.Show($toast)
+    $toastOk = $true
+  }
+  catch { $toastOk = $false }
 }
-catch { $toastOk = $false }
 
-if ($inputData.sound) {
+if ($inputData.sound.enabled) {
   try {
-    if ($inputData.kind -ceq "completed") { [System.Media.SystemSounds]::Asterisk.Play() }
-    else { [System.Media.SystemSounds]::Exclamation.Play() }
+    # 固定 switch 不使用反射、動態 member access 或外部播放器。
+    switch -CaseSensitive ($inputData.sound.source.name) {
+      "Asterisk" { [System.Media.SystemSounds]::Asterisk.Play() }
+      "Beep" { [System.Media.SystemSounds]::Beep.Play() }
+      "Exclamation" { [System.Media.SystemSounds]::Exclamation.Play() }
+      "Hand" { [System.Media.SystemSounds]::Hand.Play() }
+      "Question" { [System.Media.SystemSounds]::Question.Play() }
+    }
     $soundStatus = "played"
     # Play 非同步；有界等待不保證聲音實際送達，也不建立其他播放器。
     Start-Sleep -Milliseconds 750
@@ -69,10 +116,12 @@ if ($inputData.sound) {
   catch { $soundStatus = "failed" }
 }
 
-$code = if ($toastOk) {
-  if ($soundStatus -eq "failed") { "SOUND_FAILED" } else { "OK" }
+$toastFailed = $inputData.toast.enabled -and -not $toastOk
+$soundFailed = $inputData.sound.enabled -and $soundStatus -eq "failed"
+$code = if ($toastFailed) {
+  if ($soundFailed) { "BOTH_FAILED" } else { "TOAST_FAILED" }
 } else {
-  if ($soundStatus -eq "failed") { "BOTH_FAILED" } else { "TOAST_FAILED" }
+  if ($soundFailed) { "SOUND_FAILED" } else { "OK" }
 }
 Write-Result $code $toastOk $soundStatus
 if ($code -eq "OK") { exit 0 } else { exit 1 }