SetBeat v0.3.4 - wave works with spatial audio on, security hardening (Standalone, Full, Vibes)

v0.3.4 fixes the flat beat wave when your phone's spatial-audio effect is on, and closes a small security gap found in a source audit. All three editions are published again, signed with the same key as before, so they update in place from 0.3.0 or later.

What was wrong, and the fix

The wave stayed flat even though audio access was granted. The wave reads loudness from Android's main audio mix. On a POCO X7 Pro (HyperOS), Xiaomi's Immersive sound (Settings → Sound effects → Dolby effects) sends the music through the system spatializer instead, and the main mix then carries only silence. The app logged peak=0.0; with Immersive sound off the same track gave real values (peak ≈ 90–130). Earlier releases (0.3.1 to 0.3.3) blamed hardware audio offload and Bluetooth. That was wrong for this phone, and the hint card, README and docs said so too; they are corrected in this release.

Full now works with Immersive sound on. When the main mix stays silent while music is playing, Full looks for the playing track's own audio session and reads that instead. Spatial audio doesn't hide that session. Checked on the phone with Immersive sound on: it found the track's session within about 4 seconds and the wave followed the music; after skipping a track it re-attached to the new one in about 4 seconds. It reads loudness levels only, stores and sends nothing, runs only while the companion screen is visible and playing, needs no new permission, and scans at most once every 10 seconds.

Hardware offload is a separate, real Android limit that no app can read. The silent-wave card still covers it, and now also tells you to try switching spatial audio off.

Security (source audit, no confirmed vulnerabilities)

A source-only audit found one low-impact issue: the media playback service was exported with no permission, and Media3's default start handling acts on media-button and notification-action intents without running the app's controller check. On v0.3.3, one adb shell am startservice call started the stopwatch on the test phone. Whether a normal third-party app could do the same from the background was not tested.

• Fixed: PlaybackService is no longer exported. The same intents are now refused (Requires permission not exported from uid …), the timer is unaffected, and companion mode and the media session still work on the phone.
• Release builds refuse to be signed with the debug key. Without the private keystore.properties, packaging a release now fails with a message. -PallowDebugSignedRelease opts in for throwaway local builds.
• The merged release manifests were checked: the only exported components are MainActivity, BootReceiver, the permission-gated notification listener (Full and Vibes), and two permission-gated library components.

Which file do I download?

Edition	File	What you get	Installs
Standalone	setbeat-standalone-v0.3.4.apk	Stopwatch and countdown, gestures, local video and audio with the negative-blend timer, playlists, background countdown alarm. No companion mode, no wave.	Any phone, from a browser or file manager
Full	setbeat-full-v0.3.4.apk	Everything in Standalone plus companion mode and the beat-reactive wave, driven by real audio, now including with spatial audio on. Says so plainly when it can't.	Needs Google Play or adb on phones that apply the Play Protect block
Vibes	setbeat-vibes-v0.3.4.apk	Everything in Full except the wave is not real: a procedural animation that always moves, whatever is playing. Never asks for Record audio.	Same as Full

Only one edition can be installed at a time (same app id and signing key, so installing one replaces another and keeps your data). Vibes was built on the offload explanation; it stays as the always-moving option, but Full is now the edition that follows real audio in more cases.

Signing and checksums

Certificate SHA-256 (must match):

23:79:00:8C:6B:C1:D0:15:77:63:FD:A5:D3:23:4B:51:3E:A5:78:55:1E:A9:5E:5D:8E:3B:17:5D:13:DF:B8:6A

File checksums (SHA-256, also in SHA256SUMS.txt):

61416a8a486d9b88773654202ecba3c97da2265f3bd80bb03806c768a5e8f7da  setbeat-full-v0.3.4.apk
363fc84e4d60f66fdc8667d16d700920e5c6c122d93e601cb39b9ba2eec3dcbb  setbeat-standalone-v0.3.4.apk
49cd0fec097533de059dbdb204c4c07b3cb53dad7d39f39ffc8b7865d8acc9a5  setbeat-vibes-v0.3.4.apk

Versions before 0.3.0 used a shared debug key, so from those you must uninstall first (playlists and timer are removed).

How it was tested

• Unit tests and lint pass on all three editions; all three APKs rebuilt from the tagged commit.
• Each APK checked with apksigner (verifies, release key above) and aapt2 (not debuggable). Permissions:
  • Standalone: no notification listener, no Record audio.
  • Full: notification listener, Record audio, Modify audio settings.
  • Vibes: notification listener, no Record audio or Modify audio settings.
• On the test phone (POCO X7 Pro, HyperOS, Mi Music): Immersive sound off gave real data; Immersive sound on gave zeros on the old build and live data with the new scan; skipping a track re-attached to the new session; the security intents were accepted on v0.3.3 and refused on v0.3.4; the final Full 0.3.4 APK launched with no crashes and live wave data.

Not verified

• Pause and resume with the new scan were not confirmed on the phone (pausing stops the visualizer by the existing code path).
• Standalone 0.3.4 and Vibes 0.3.4 were not installed on a phone in their final form (an earlier Vibes build from the security commit was). Both are covered by the unit tests, lint and manifest checks above.
• The real wave with players other than Mi Music and YouTube, and on phones other than this POCO. The scan picks the loudest live audio session, so another app's audio playing at the same time could win.
• Hardware offload is still unreadable and was not re-tested.
• Whether a normal third-party app could reach the old exported service from the background (only adb was tested).
• The on-device gesture and timer test suites were last run for 0.3.0.
• Not on Google Play, and R8/minification is still off (about 29 MB per APK).

Full diff: v0.3.3...v0.3.4