Box v1.0.7
Two variants available:
Box_v1.0.7_Main_Signed_Release.apk — stock Android 15 +
Box_v1.0.7_custom-rom-support_Signed_Release.apk — GrapheneOS / custom ROMs without Google Play Services
✨ New
Catppuccin Accent
Settings now has a Catppuccin Accent option. When enabled, the app's accent colors (buttons, links, chat bubbles, tabs) switch
to the Catppuccin palette — Mocha in dark mode, Latte in light mode. 14 accent colors to pick from: Mauve, Blue, Sapphire, Sky,
Teal, Green, Lavender, Pink, Peach, Rosewater, Flamingo, Maroon, Red, Yellow. Wallpaper-derived surfaces are preserved so it
still feels like Material You.
LaTeX
Functional.
Bug Fixes
New Chat (＋) button opened the wrong model
If you had only downloaded E4B, tapping ＋ would open the E2B download panel instead of starting a chat with E4B. Now picks the
first model you actually have downloaded.
New Chat (＋) didn't create a new conversation
After tapping ＋ the next message was silently appended to the previous conversation in History instead of starting a fresh
one. Fixed — ＋ now always begins a new conversation.
Switching models crashed the app with two models downloaded
Switching between two downloaded LiteRT models caused both to load on GPU simultaneously → out of memory → process crash. Root
cause: a Compose state bug where remember { "" } on a plain String didn't persist across recompositions, causing the old model
to be re-selected ~58ms into the new model's init. Fixed with mutableStateOf.
Switching models lost conversation history for the new model
After a model switch, the new model's messages were saved under the previous model's conversation ID, corrupting history. Fixed
— stale conversation ID is now cleared on model switch.
Voice-to-voice: turning off mic or speaker didn't stop speech immediately
Tapping the mic toggle or speaker icon to OFF while the AI was talking had no effect on already-queued TTS sentences — the AI
kept talking. Both toggles now call stop immediately.
Same Whisper models showed as separate downloads in Voice Input and Audio Scribe
Whisper Large-v3-Turbo downloaded in Voice Input would show as "not downloaded" in Audio Scribe (and vice versa) due to a name
mismatch. Both tabs now share the same model objects — one download covers both.
Whisper model stuck in permanent ERROR state after a bad download
A corrupted or truncated Whisper download left the model stuck showing ERROR with no way to retry. Now automatically resets to
"not downloaded" if the file is missing or undersized, so you can tap Download again.
LaTeX ∇ (nabla) rendered as abla or nabla in AI Chat math
The gradient operator consistently broke in math responses. Fixed — the LLM tokenizer's newline corruption of \nabla is now
repaired before any math parsing runs.
HTTP connection leaked in the update checker
The update checker opened an HTTP connection but never closed it on early exits. Fixed with a try-finally block.
Audio Scribe leaked audio codec resources on errors
MediaCodec and MediaExtractor were not released if an exception occurred during audio processing. Fixed.
Image generation OOM was silently swallowed
OutOfMemoryError during Stable Diffusion generation was caught by catch (Exception) and discarded, leaving the UI stuck with no
feedback. Now surfaces a user-readable "Out of memory — try a smaller image size" message.
Security
SQLCipher database key was stored in plain SharedPreferences
When biometric database encryption was turned off, the SQLCipher passphrase was Base64-encoded and written to unprotected
SharedPreferences. Migrated to EncryptedSharedPreferences backed by Android Keystore AES-256-GCM. Existing keys are
automatically migrated on first launch — no data loss.
PII was being written to logcat
A security audit found several places where user data was logged at debug level — readable by any USB-connected computer or
rooted device:
- Email content (to, subject, body), SMS messages, phone numbers, calendar events, alarm/timer details, and locations
- User prompts logged in MobileActions
- AI prompts and responses logged in TinyGarden
- All intent extras (including values) dumped on every app launch and deep link
- Full FCM message body and deep link URL logged
All wrapped in BuildConfig.DEBUG or removed. Nothing is logged in release builds.
Hardened Manifest
Upstream remaining firebase logging stripped and removed.