Changelog

🔐 Zero-knowledge encryption (not a feature — a foundation)

• All sensitive data encrypted at rest with AES-256: encrypted notes / contacts / camera / gallery / password vault / TOTP / clipboard history
• Master key derived with Argon2id (128MiB/3/1) and protected by the Android hardware Keystore; keys never stored in plaintext
• Backups v3+ always encrypted: PBKDF2 300k / Argon2id + AES-256-GCM; changing the master password auto-migrates all data

🤖 AI productivity engine

• AI coding agent: generate frontends / scripts / configs / plugins from one sentence — skeleton-first, iterative edits, version snapshots, WebView preview, zip export
• Web search in AI chat (BYOK, keyless Bing by default): page content extraction + smart query rewriting + source cards
• Task proxy: backgrounding or killing the app no longer interrupts generation — resume by taskId; self-check repairs truncated output
• Voice assistant: streaming TTS/ASR + web search + AI chat; self-hosted relay mode keeps keys off the device

🧩 Open plugin platform

• Encrypted plugins (.encplugin) and regular plugins (.cbplugin); plugin market; packager
• WebView sandbox: CSP injection / SSRF protection / per-action permissions / path traversal protection

🔒 Privacy details

• Clipboard sensitive filtering (bank cards / password keywords auto-skipped); log sanitization; cleartext traffic fully blocked; screenshot protection
• 46+ built-in tools: encryption / calculator / text / image / dev / life categories

🔒 August 2026 security hardening (same-version update)

• Clipboard protected by default: sensitive data gated, lockable per tool
• AI endpoints HTTPS-only: non-loopback http rejected (global + project + request layers)
• External file import no longer overwrites existing data: merge import + atomic replacement
• Screen recording honors the lock-screen auto-stop switch; memory keys wiped on lock / background
• Three security audit rounds (08-16/17/18): zero high/medium, analyze 0 errors / 351 tests passed

This was the last release under the old YuzhouHe naming — archived, not available for download. It fixed issues that directly affected daily use: encrypted data becoming unreachable after a password change, lag when switching between photo and video modes, and AI chat having no web capability.

• Changing the master password now auto-migrates all encrypted data (photos / videos / thumbnails / notes / contacts / character cards / password manager) — per-file fault tolerance, atomic replacement, in-session self-healing
• Fixed the guaranteed decryption failure caused by an incorrect photo nonce offset; fixed the “invalid chunk size” on v3 chunked videos
• Web search in AI chat (keyless Bing by default + Tavily / Bocha / DuckDuckGo / Brave / SearXNG), page content extraction + smart query rewriting + direct URL fetch
• AI coding agent (skeleton-first / iterative edits / snapshot rollback / WebView preview / zip export)
• Voice assistant web search: asking about weather / news no longer returns “I don’t know” — search results are re-synthesized into spoken answers

• 🔑 Password manager fully rewritten: the original “encryption” was fake — a Caesar shift + base64 that any password could unlock — now real AES-256-GCM + PBKDF2 100k iterations + encrypted persistence, clipboard auto-clears after 30s
• 🔑 2FA codes persisted: they used to vanish on every restart; now encrypted in Hive
• 🌐 SSL certificate verification fixed: the network toolbox no longer trusts every certificate (a silent MITM success bug)
• 🔑 AI API keys bucketed per vendor: switching service presets no longer overwrites keys; encrypted per-bucket storage
• 📋 Clipboard history revived: fixed a “fake feature” that had never been read
• 30+ tool crash and logic fixes: scientific calculator / calendar out-of-bounds / level / magnifier / random picker; pomodoro wall-clock anti-drift
• New plugins: digital wooden fish v2.0, ID lookup v2.0, relative-relationship calculator, entertainment trio

• Volcano Engine streaming TTS (multiple model voices) + streaming ASR; long-press record · release to send
• v1.6.1: fixed streaming playback stopping mid-sentence (buffer dropped when synthesis outpaced playback); selectable TTS mode (streaming / full synthesis); new adorable Sichuan-accent voice

• New RSA tools: public-key encryption / private-key decryption, digital signing and verification, secure key distribution (anti-MITM)

• Privacy passwords hashed with SHA-256, plugin requests rate-limited to 60/min, error logs sanitized, 3 memory leaks fixed, 67 English translations completed
• New: Hanzi-to-Pinyin / Morse code / image EXIF / SQL formatter / HTTP request tester / UA parser / HIIT timer / decibel tester

• New password manager plugin (AES-256 encrypted storage); fixed install dialogs, fullscreen adaptation, manifest.json configuration

• Opening an encrypted plugin externally prompts for the password directly; .encplugin / .cbplugin formats distinguished; packager double-confirms passwords; Android file-association config