v2.0.0-beta.8 - Test build (updater check fixed)

Update check fix — beta.7 still had a problem

Thanks for testing. Beta.7 improved the updater, but it still failed on your
network for a different reason:

• api.github.com kept returning HTTP 503/504.
• The Atom-feed fallback then failed because github.com itself could not be
  resolved (Unable to resolve host "github.com"), and later returned 502 /
  connection aborted.

So beta.7 could still not check for updates when both GitHub’s API and website
were unavailable. Beta.8 adds a source that does not depend on either of them.

Fixed

• Update checks now read the CHANGELOG.md served by
  raw.githubusercontent.com first. That host is separate from
  api.github.com and github.com.
• If raw GitHub is unavailable, the check falls back to the GitHub API and then
  to the release Atom feed.
• Release notes and the APK URL are reconstructed from the changelog when the
  API is unavailable.
• The HTTP/1.1, retry, Open release page, and Shizuku fork fixes from
  beta.6/beta.7 remain in place.

Testing

• 20/20 emulator tests pass.
• A live emulator check succeeded through raw GitHub in about 1.2 seconds
  while the GitHub API was returning 504 and github.com was unavailable.
• The WordPress test APK downloaded with the matching SHA-256 and installed
  successfully.

Important

This fixes checking for updates. Downloading still uses GitHub release
assets. If github.com is unreachable at download time, the update screen
offers Open release page so the APK can be installed manually.

GitHub’s raw CDN can cache the changelog for a few minutes, so a brand-new
release may take a short while to appear.

SHA-256: 5c4dfbb1a494ea54b8ad07161aa90c8e203c0fd13a31e510f372e15dba5c2304

v2.0.0-beta.7 - Test build (basic checks passed)

Update networking fix for GitHub HTTP/2 and API outages

The attached log showed two network failures:

• okhttp3.internal.http2.StreamResetException: stream was reset: REFUSED_STREAM
• Update download HTTP 504

Manual GitHub downloads still worked, so the repository and APK were fine — the
app’s GitHub API/HTTP/2 path was failing.

Fixed

• Update checks and downloads now use HTTP/1.1 for GitHub, avoiding HTTP/2
  REFUSED_STREAM resets on mobile networks.
• Update checks retry twice with a short delay before giving up.
• If api.github.com is unavailable (503/504), update checks now fall back to
  GitHub’s release Atom feed. The feed supplies the latest version, release
  notes, release-page link, and the APK asset URL.
• Update check attempts are written to the helper log.
• A failed update download still offers Open release page.

Important

Beta.5 and beta.6 cannot update themselves through the broken API path. Install
beta.7 manually once. After that, update checks should work again.

Testing: 18/18 emulator tests pass, including new Atom fallback parsing tests.
GitHub’s API was returning 503/504 during testing, so the live fallback could not
complete on the emulator. Please test Check for updates on your phone.

SHA-256: bf1cddcc1995e15d90ffdb910044fbde46a2cbaff28bca1b0605eb444d58ae44

v2.0.0-beta.6 - Test build (basic checks passed)

Update reliability and Shizuku fork test build

The attached log showed the real cause of the stuck update: Update download HTTP 504 from GitHub’s release CDN. Shizuku never received an APK to install;
the old message made it look like installation had already started.

Added

• Shizuku app package is now configurable under Settings → Updates for
  forks that use a different package name (for example Shizuku+). Forks that
  keep the original package, such as Shizuku Next, need no change. A live binder
  is trusted first, so a running fork with permission granted is recognised.

Fixed

• Shizuku status now checks for a live binder before looking for the manager
  package, so a renamed fork with permission granted is detected correctly.
• Update downloads now retry the GitHub asset up to three times with a short
  delay.
• The update-found message now says it is downloading the APK for Shizuku,
  not installing immediately.
• If the download still fails, the update screen now offers Open release page
  so the APK can be downloaded manually.
• The Shizuku installer now uses pm install -r --user 0, merges stderr into
  the output, and logs the result.

Important

The currently installed beta.5 still contains the old downloader. If GitHub
returns 504 again, install beta.6 manually once. After that, future update
checks use the retry and release-page fallback.

Testing so far: 16/16 emulator tests pass, including the new Shizuku package
setting checks. The custom-package row was verified on the API 36 emulator, and
the public settings file now includes shizuku_package. The real Shizuku
self-update path and a real renamed Shizuku fork still need phone testing.

SHA-256: 9114dc2eea47dcec6c0668cc5cf733b36629536753fc23ed2a9ce83ac26c425f

v2.0.0-beta.5 - Test build (basic checks passed)

Test build — basic checks passed, full phone testing still needed

The remaining beta.4 follow-ups are implemented in this build.

Checked so far:

• 12/12 validator and VirusTotal parser tests pass on an Android 16 emulator.
• Focused Manage dialog, three-way VirusTotal setting, gradient progress ring,
  source reordering, delete-all dialog, and theme switching were checked visually.
• A real F-Droid download completed with the new details and ring.

Still needs testing on a phone:

• Choosing an arbitrary source with Stop & switch during a long download.
• VirusTotal Ask / Always block / Always continue with a real API key and detection.
• Uptodown retry on a real network.
• General real-device use.

---

What changed

Focused source management

• Manage on Main now opens a focused source-manager dialog over the Main
  screen instead of opening Settings.
• It includes source toggles, reordering arrows, Test all sources, and the same
  enabled-first ordering. Reported in
  #12.

Stop & switch source

• The download screen button now opens a source picker.
• Selecting a source cancels the current attempt and restarts from the chosen
  enabled source, including the exact source needed for FOSS-variant cases.

VirusTotal

• Detection handling now has three modes: Ask me (default),
  Always block, and Always continue.
• Detection messages include flagged engine names, and the VirusTotal report
  link remains available.
• Existing block/continue settings are migrated automatically.
• Reported in #22.

Progress ring

• Reworked the circular progress display with a gradient sweep and a rotating
  comet-style indeterminate arc, closer to Morphe's updater.

Also included from beta.4

• VirusTotal result-stage Back safety and Continue/Delete choices.
• Uptodown HTTP/1.1 fallback, DoH fallback, and corrected failed-source retry.
• Saturation-aware theme tinting (Mono neutral, Ice blue).
• Custom-scheme keyboard scroll fix.
• Expand/Collapse All, focused Sources view, delete-all downloads, extra download
  details, changelog/version-picker theming, and field-specific XAPK mismatch
  messages.

SHA-256: c03b985841475774e4ebfe3578214822361091f76234835999ba62051c1e62be

v2.0.0-beta.4 - Early test build (basic tests only)

⚠️ Early test build

The code for these fixes is implemented, and basic checks passed — but this
build is not fully tested yet.

What has been checked:

• 11/11 XAPK/APKS fixture tests pass on an Android 16 emulator.
• Basic UI checks for themes, scrolling, Settings, Main, and the download screen.
• One real F-Droid download completed successfully with the new progress details.

What still needs real-world testing:

• Uptodown HTTP/1.1 fallback and “Retry failed sources”.
• VirusTotal Back / Continue / Delete behaviour with a real API key.
• Stop & switch source during a long download.
• General use on a physical phone.

Please treat this as a test release and report anything that breaks.

---

What changed

VirusTotal and hand-off safety

• Clean and unscanned results continue immediately; the fixed five-second wait
  is gone.
• Back during the result stage no longer cancels and deletes a finished APK.
• Detections, quota aborts, and pending analysis now show Continue anyway /
  Delete and cancel instead of deleting automatically.
• Added a View on VirusTotal link.
• Cancelling when a validated file already exists now asks whether to keep or
  discard it.
• Reported by @thegodfather-hub in
  #22.

Sources and retries

• Uptodown CDN downloads use HTTP/1.1, avoiding the HTTP/2 header stall from
  #23.
• AdGuard DoH checks fall back to Google DNS when the certificate chain fails.
• “Retry failed sources” now re-includes the Morphe fallback when an Uptodown,
  APKMirror, or APKPure sub-source failed. The old path retried nothing and
  failed with “Sources tried: None”.
• Added Stop & switch source while downloading. It aborts the current source
  and moves to the next enabled source.
• Added a single-stream / multi-connection indicator and request details
  (package, version/build, format, ABI, size).
• Reported in #20
  and #23.

Themes and scrolling

• Surface tinting now respects accent saturation. Mono is neutral grey while
  Ice keeps blue surfaces.
• Fixed the custom-scheme keyboard bug that left the Appearance page scrolled
  into empty space.
• The custom-scheme editor is inline under the Accent card and only expands when
  the colour-wheel row is tapped.

Settings, Main, and validation

• Expand all / Collapse all in Settings.
• Manage from Main opens a focused Sources-only view.
• Delete all downloaded APKs on Main, with confirmation. Settings backups are
  kept.
• XAPK manifest/APK mismatches now name the field and both values, as requested
  in #21.

Changelog

• Changelog screen now uses the same cards and themed buttons as the rest of the
  app.
• Version picker includes stable and pre-release builds with green/amber pills,
  and is limited to the 20 newest versions.

SHA-256: e82db51bf02e571a56246a76551ba4acd2dd11193d6f00a4a840d9f5fcf19238

v2.0 - Stable release

Morphe Download Helper 2.0

First stable release of the 2.0 line. This rolls up all of the 2.0 beta work,
including the new branding, themes, download improvements, validation
hardening, and update reliability fixes.

Further fixes will be handled in a 2.0.1 beta if needed.

Highlights

• Patch Pass launcher icon with foreground, background, and Android 13
  monochrome layers. The launcher keeps the cyan → purple → magenta palette.
• Theme-aware in-app logo in the Main and Settings headers, the Appearance
  preview, and every accent option.
• 13 accent schemes, custom scheme/accent HEX, and AMOLED, light, dark, and
  system modes.
• Focused source manager on Main, plus Stop & switch source with an
  arbitrary source picker.
• Multi-connection downloads as an opt-in setting, detailed download
  information, and the Morphe-style gradient progress ring.
• VirusTotal three-way detection action, flagged engine names, report link,
  and explicit Continue anyway / Delete and cancel decisions.
• Shizuku fork support with a configurable manager package and live-binder
  detection.
• Update reliability: HTTP/1.1 GitHub traffic, retries, Atom-feed fallback,
  raw-changelog fallback, and Open release page.
• Uptodown WebView improvements: HTTP/1.1 CDN downloads, automatic cookie
  banner rejection, no forced scroll away from the download screen, and a
  verification hint when the page is still waiting.
• Harder split-archive validation: APK-first checks, manifest cross-checks,
  and package checks for unversioned requests.

Testing

• 20/20 emulator tests pass.
• Main flows, themes, custom schemes, the launcher icon, Appearance previews,
  Uptodown verification, and update checks were rechecked on the emulator and
  test devices.
• If a new issue appears, please open a GitHub issue with the helper log. It
  will be handled in a 2.0.1 beta if needed.

Universal debug-signed APK for arm64-v8a, armeabi-v7a, x86, and x86_64.

SHA-256: 6a183fe3bb62902d4890bae9c468ed0023cdc23828d51f03f2126e9e1058654b

v2.0.0-beta.3 - Richer themes, transparent logos, and custom colours

v2.0.0-beta.3 — richer themes, transparent logos, and custom colours

This is a pre-release for testing. Stable remains v1.6.15; stable updates
will not offer this build automatically.

Themes

• Custom colour scheme in Appearance. Tap the colour-wheel row and the
  Accent card expands downward with the HEX field and Save button right below
  it. Saving generates the background, card, border, control, and button
  colours from that base colour. Light and dark versions are generated
  automatically.
• The custom scheme is mandatory-HEX: saving without a colour shows an
  error and keeps the editor open. It no longer silently falls back to indigo.
• The custom scheme swatch is now a colour wheel, placed below Material You,
  so it is easy to tell apart from the solid accent presets.
• Tint backgrounds from accent is a new setting, on by default. Turn it off
  to return to the neutral blue-black or light surfaces. The custom scheme
  always keeps its full tint.
• All accent presets now tint backgrounds, cards, borders, and controls, not
  just the main button. Light mode uses noticeably stronger tints so each
  scheme reads clearly; AMOLED still keeps true-black backgrounds.
• Card borders are accent-tinted and more visible in every mode.
• A full custom colour scheme was requested by @IkoMosiEntertainmentHub in
  #12.

Main screen

• The Open Morphe button now uses the external-link box-and-arrow icon from
  the mockup.
• The Manage button is a distinct outlined pill with a chevron.
• Source logos now have transparent backgrounds, including cleaner APKPure
  artwork and the official F-Droid logo. The Morphe link source uses a
  chain-link icon.
• The source redesign concept comes from @thegodfather-hub in
  #12.

Contrast

• Button text contrast is chosen from luminance, not a straight RGB
  inversion. An inversion guarantees a different colour but not a readable one,
  so it is not used for text.

Also included from beta.2

• XAPK/APKS validation fixes with 10 fixture tests.
• Opt-in multi-connection downloads, still off by default.
• Import/export with download folder, retention, and the optional VirusTotal
  key.
• Merged Sources list with drag ordering, all enabled sources on Main, real
  logos, and one Test all sources button.

SHA-256: 57979710fd97b1b089fe2a7c843ddc6245b84e55e7bcf5166c1ec0b3a39f10b9

v2.0.0-beta.2 - UI polish, safer validation, and backups

v2.0.0-beta.2 — UI polish, safer validation, and backups

This is a pre-release for testing. Stable remains v1.6.15; stable updates
will not offer this build automatically.

UI and usability

• One merged Sources list instead of separate Sources and Source order
  sections. Enabled sources are shown first; disabled sources stay at the bottom.
  Drag the handle to change the priority. Thanks to @IkoMosiEntertainmentHub in
  #11 and
  #12.
• Real source logos in the source lists, with the rounded tile style.
  Concept feedback from @thegodfather-hub and @IkoMosiEntertainmentHub in
  #12.
• All enabled sources are now shown on the Main screen, not just the first
  four. This also addresses the missing-source report from
  @IkoMosiEntertainmentHub in
  #11.
• One “Test all sources” button at the bottom of the Sources card replaces
  the individual Test buttons. Results are still saved under each source.
• Themed rounded dialogs and tinted Settings icon tiles. Reported as
  inconsistent by @IkoMosiEntertainmentHub in
  #12.
• Removed the Uninstall Helper button from Main. Suggested by
  @IkoMosiEntertainmentHub in
  #12.
• Settings and Appearance no longer jump to the top after changing the theme.
  Originally reported by @rowi123 in
  #5.

Backup and restore

• Import/export now includes the download folder and retention setting.
  A custom folder may need to be re-approved on a new device.
• The optional VirusTotal API key can be included in the export.
• Requested by @IkoMosiEntertainmentHub in
  #12.

Validation

• XAPK/APKS validation no longer trusts manifest.json before reading the
  contained APKs. A readable APK now takes priority, package checks also run
  for unversioned requests, and manifest/APK contradictions are rejected.
  Reported by @thegodfather-hub in
  #21.
• Added 10 fixture tests covering correct archives, manifest-only archives,
  wrong packages, wrong versions, unversioned requests, and the manifest
  fallback. All 10 pass on a phone and on an Android 16 emulator.

Experimental faster downloads

• Optional Faster multi-connection downloads in Storage, off by default.
  Requested by @thegodfather-hub in
  #20.
• It splits large files into up to four HTTP Range connections and falls back to
  the normal single stream automatically.
• On our fast Wi-Fi test, a single OkHttp stream was already faster:
  about 5.3 seconds versus 7.2 seconds for the same 305 MB APK. Four connections
  add overhead when the connection is already saturated. It therefore stays
  experimental and opt-in; it may help servers that throttle each connection.
  Feedback from slower or throttled connections is welcome.

Still to come

• Full custom colour schemes, not just accent colours.
• Further icon artwork polish and more layout refinements.

SHA-256: bdd10ae42f12a4eb62ec258c9bca9bc97fc8038a25c48bd5b252a530c71fe0af

v2.0.0-beta.1 - Redesigned UI beta

v2.0.0-beta.1 — Redesigned UI beta

This is a pre-release for testing. Stable remains v1.6.15, and stable
updates will not offer this build automatically.

New Appearance system

• Dark, AMOLED, Light, and Follow system modes.
• Accent presets: Original (the previous violet), Aurora, Mint, Forest, Gold,
  Sunset, Rose, Berry, Ice, Ocean, and Mono.
• Material You accent on Android 12+, using the device wallpaper colours.
• Custom #RRGGBB accent with automatic light/dark button text.
• Live preview, one-tap reset, and scroll position preserved when switching.
• Dialogs, system bars, switches, progress indicators, and WebView chrome follow
  the selected theme.

Redesigned screens

• Settings: collapsible sections with icons for General, Updates, Download
  pages, Sources, Storage, Security, and Background.
• Main: compact header with a settings shortcut, hero action card, source
  list with descriptions and live states, and an Edit order link that opens the
  Source order section directly.
• Download: circular progress ring with percentage, live source steps
  (NOW / NEXT / OK / FAILED), and a clearer failure screen with retry, edit
  sources, and copy details.

Behaviour

• Follow system is the default. Reset returns to System + Aurora.
• Settings and source order save immediately; the Done button only closes
  Settings.
• Switches now clearly separate checked and unchecked states.
• The helper still hands the APK back to Morphe immediately on success.

Also included

• Opt-in Live AdGuard checks from v1.6.16-beta.1.
• The helper log is capped at 512 KB, keeping the latest 128 KB.

Testing

Tested on an Android 16 phone and Android 12 / Android 16 emulators. If the beta
gets enough good feedback, the next stable release will be 2.0.

SHA-256: 0c78bd73ec79a83fb8722d135b26c7953434c2b474fe26d5f763b973a0ab1d70

v1.6.16-beta.1 - Live AdGuard checks

v1.6.16-beta.1 — live AdGuard checks

This is a pre-release for testers. Stable updates will not offer it automatically.

Added

• Settings → Download pages → Live AdGuard checks (off by default). The
  bundled list is checked first; unknown hosts are then checked once against
  AdGuard DNS-over-HTTPS and the answer is cached. It needs no VPN or extra
  permissions.
• The helper log is capped at 512 KB and keeps the most recent 128 KB,
  so it cannot grow without limit.

Behaviour

• Blocked hosts: cached for 30 minutes.
• Allowed hosts: cached for 10 minutes.
• If AdGuard is unavailable, requests fail open and live checks pause for
  60 seconds.
• Cloudflare Turnstile, captcha, and download/CDN hosts stay allowlisted.
• Disabling Block ads and trackers also disables live checks.

Verified

• Physical phone, HushGram: correct build 386014758 downloaded and validated.
• Live checks blocked additional hosts not in the bundled list, including
  scripts.ssm.codes, stats.wp.com, static.cloudflareinsights.com,
  tag.crsspxl.com, ads.pro-market.net, and
  visit-server.inmobi-choice.io.
• Normal fonts, images, and APKMirror resources were allowed.
• The log was reduced from 828 KB to about 128 KB on the next start.

Requested in #18.