Tool Neuron v3.0 is a ground-up rewrite. Very little of the v2.x code survived. The old app could not honestly call itself privacy-first. Chat history sat on disk in plaintext. So did preferences. On a rooted phone or after a malicious app reinstall, everything was readable.
v3.0 fixes that at the foundation. Every byte the app persists lives inside an encrypted vault sealed under a key the OS will not hand to a different signer. Every gated feature is checked by native C++ code that returns a session token, not a Kotlin boolean. PIN entry runs Argon2id at t=4, m=128 MiB. There is a panic PIN that wipes the device. There is boot integrity, hook-baseline verification, frida and debugger detection. If any of it trips, the app exits the process.
The app now requires Android 12 (API 31) or newer. v2.0.3 dropped to Android 10 to support Note 9 users. v3.0 cannot. The security work depends on StrongBox and TEE attestation paths that on pre-API 31 either do not exist or are unreliable. The trade is worth it for the rest of the user base.
The APK in the asset is built from main, R8-minified, signed with the production key. It is 76 MB because it ships llama.cpp, sherpa-onnx, the Stable Diffusion runtime, and the full embedded HTTP server in one binary.
New in v3.0 (relative to v2.0.3)
App Guide. A multi-screen walkthrough covering chat, models, RAG, vision, voice, themes, lock, and the remote server. Reachable from the drawer.
Chat compact. When the conversation gets long, the user can fold older turns into a single LLM-generated summary card. The KV cache resets after compact so the next turn prefills against the summary only. Old messages stay visible (greyed out) and remain searchable, but the model only sees the summary going forward.
Fork from any message. Tap the fork action on any user, assistant, or compact-summary message and the chat clones up to that point into a new chat titled " (fork)". Closes issue 76.
Edit any message. User and AI both. Editing a user message saves the new text and regenerates from there. Editing an AI message saves it in place without regenerating, so a user can fix a model's reply they otherwise liked. Compact summaries are not editable.
Vision. Load a multimodal GGUF with a sibling mmproj projector and attach images from the input bar. The projector auto-loads when the base model loads.
Voice. sherpa-onnx VITS for text-to-speech and Whisper for speech-to-text, both fully offline. Speak any assistant message. Tap the mic to dictate. First install of each kind becomes the active default.
Remote Server. Embedded native HTTP server exposing every installed engine over an OpenAI-compatible API on the local network. Chat, vision, embeddings, TTS, STT, image generation, and 4x upscale all live behind one bearer token. Bundled web UI at the loopback URL. Runs in its own process so a server crash does not take the app down with it.
HuggingFace Explorer. Rewritten on top of curl-impersonate so the requests look like a desktop browser. Dynamic filter chips populated from the live tags catalog. README rendered client-side. Gated repo detection.
RAG with hybrid retrieval. Dense embeddings, BM25 lexical, RRF fusion, optional LLM rerank, optional multi-query rewriting. Citation matching maps the assistant's [1] markers back to chunks the user can tap to inspect.
Web search. DuckDuckGo behind curl-impersonate, three generated queries, fifteen unique snippets, then a single LLM synthesis with inline citations. Seconds, not minutes. The synthesized answer is what the next turn sees, not the user's original query.
Image generation. Stable Diffusion 1.5 plus two SDXL contexts on the Snapdragon NPU through QNN, MNN as a CPU fallback for non-Snapdragon devices. Text2img, img2img, inpaint, 4x upscale via Real-ESRGAN or UltraSharp. The model picker auto-filters by SoC bucket so you only see what your chip can actually run.
First-party plugin runtime. Plugin authors compile against a small contract module, ship a single classes.dex, and the app loads them through DexClassLoader. Plugins declare capabilities (ONNX inference, encrypted storage, network) and the host gates each one. There is a floating plugin dock that switches between open plugins.
Diagnostics. Crash report screen reachable from Settings shows recent errors and the exportable JSON bundle. Themed to whichever palette the user picked.
Setup flow. Proper first-launch sequence (terms, dev notes, lock setup, theme, model packs, RAG setup) with three preset model packs for users who do not want to pick from the catalog manually.
Security architecture. Too much to list in release notes. The CLAUDE.md file in the repo has the full description. Headline items: HXS-encrypted vaults with signer-bound keys, native PolicyEngine for every gated call, Argon2id PIN, panic PIN, boot-integrity TOFU on every .so file, hook-baseline verification, frida and debugger hard-fail, FLAG_SECURE on PIN entry, auto-clearing clipboard, scorched-earth hardWipe.
Performance work in this release. Voice and image-gen archive extraction is now parallel. tar.bz2 runs through a producer-consumer pipeline, ZIP entries extract N at a time on a thread pool. Voice model installs that used to take roughly 25 seconds now take roughly 12. The RAG keyword index moved into native C++ with HXS-encrypted storage so the index is no longer plaintext on disk.
What this release does not fix
Issue 102, web search does not work properly. The new single-shot pipeline works in our testing but several users report blank results or hangs on certain queries. Most likely either curl-impersonate getting blocked by DuckDuckGo on specific IPs, or the synthesis LLM bailing on weirdly formatted snippets. Under investigation, no fix in this build.
Issues 99 and 96, gemma 4 e4b loading failures. The Q4_K_M and Q5_K_M variants of the Gemma 4 E4B family fail to load. This is upstream. llama.cpp has a known quant-detection bug with this family. We are tracking the fix PR and will refresh the gguf_lib AAR once it merges.
Issue 95, RAG import issue. Some PDFs and DOCX files fail to import. The PDF text extractor in the bundled engine is fragile on scanned PDFs and certain encrypted PDFs. No native API to swap in a better extractor right now.
Issue 91, RAG embedding tool failed to initialize. Specific to a few embedding models the loader cannot resolve thread placement for. Workaround: use a different embedding model. Permanent fix needs a llama.cpp loader change.
Issue 90, mmproj import crash. Manual mmproj import is gone in v3.0. The contract is now auto-load from the sibling file next to the base GGUF. If a VLM repo does not follow that layout, the model is not usable yet. A fallback path is on the list.
Issue 92, chat history sidebar bug. The intermittent disappearance some users reported should be fixed in the rewrite, but we could not reproduce it reliably enough to confirm. If it still happens in v3.0, please file a fresh report with reproduction steps.
Issue 86, markdown and math rendering. Markdown is much better in v3.0. Code blocks, links, headers, emphasis all render correctly. LaTeX math is partially supported but not complete. Full KaTeX-style math is on the list.
What we are working on
Dynamic Island overlay. A floating pill above every app that morphs into a card on tap, with a smart-dodge accessibility service that moves the pill out of the way of clickable buttons in the foreground app. The code is in this build (service files committed) but the manifest declarations are still commented out. Needs more on-device testing before we ship it enabled. Will turn on in a point release.
Pro license tier. Every gated feature already routes through the native PolicyEngine and feature IDs at 1000 or above are reserved for paid features that currently return false. The blob format is sketched out (Ed25519 or ML-DSA-65 signed, device-bound, with expiry). Not in v3.0. Coming in v3.1 or v3.2.
KleidiAI re-enablement. Disabled in v2.0.3 to stop SIGILL crashes on non-SVE devices. Will be re-enabled with proper backend variant selection once we can detect the SVE capability properly at load time.
Better PDF and DOCX extraction for RAG. Replacing the in-engine extractor with a dedicated native module that handles scanned PDFs via on-device OCR.
A note on size and offline guarantees
The APK is 76 MB. The install footprint after first launch (qnnlibs extracted, models downloaded) can reach several hundred MB or more depending on what you install. There is no network telemetry, no Google Play Services, no analytics. Outbound traffic only happens when you ask for it: model downloads from HuggingFace, web search, HF Explorer browsing. The local HTTP server when enabled does not initiate outbound calls.
If you find a crash, the Diagnostics screen under Settings shows the JSON bundle and lets you export it. Attach that to any bug report.
Source: https://github.com/Siddhesh2377/ToolNeuron
Issues: https://github.com/Siddhesh2377/ToolNeuron/issues