ToolNeuron CLAUDE.md

ToolNeuron — Repo Guide

Project memory for this repo. When you change anything that affects future work — architecture, security behavior, new features, deprecated paths, public APIs, native JNI contracts, new scope — update this file as part of the same change. A future session reads this to reconstruct intent; if it drifts, work breaks.

---

Project scope

Privacy-first, offline-only on-device AI assistant. No Google Play services, no network telemetry, no analytics. In-scope pillars: on-device LLM chat, RAG over user documents, vision-language models (VLM), voice (TTS+STT), Remote Server with bundled web UI, HF Explorer, on-device image generation / img2img / inpaint / 4× upscale via the :ai_sd AAR (re-pivoted in 2026-05-08), first-party plugin system with ONNX inference + capability-gated APIs (re-pivoted in 2026-05-11). Out of scope: tool calling, Termux integration. (Image generation was originally cut on 2026-04-20 and re-added on 2026-05-08. Plugin marketplace was also originally cut on 2026-04-20 and re-added on 2026-05-11 as a first-party plugin runtime — DexClassLoader, Plugin contract with @Composable Content(), capability-gated OnnxApi/HxsApi/NetworkApi, floating plugin dock with smooth switch transitions.)

Package: com.dark.tool_neuron · minSdk 29 · targetSdk 36 · abiFilters arm64-v8a, x86_64.

Modules:

• :app — UI (Compose), viewmodels, DI graph, activities, services.
• :hxs — encrypted key-value store (Kotlin wrapper + C++ core).
• :hxs_encryptor — crypto + integrity primitives: Argon2id, AES-GCM/ChaCha20-Poly1305, BoringSSL, ML-KEM-768, ML-DSA-65, Ed25519, HKDF, mmap+mlock SecureBuffer, plus the native security policy / auth / boot-integrity stack.
• :native-server — embedded OpenAI-compatible HTTP server (cpp-httplib + nlohmann/json header-only via FetchContent, no BoringSSL / OpenSSL / zlib dep). Powers Remote Server mode.
• :plugin-api — pure-Kotlin contract plugin authors compile against. Plugin interface with lifecycle + @Composable Content(), PluginContext, PluginCapability enum, PluginManifest, OnnxApi, HxsApi, NetworkApi. Compose deps are compileOnly; host provides them at runtime via classloader-parent.
• :plugin-exc — plugin host runtime. PluginExecutor, PluginLoader (DexClassLoader from <filesDir>/plugins/<id>/classes.dex + .so detection across SUPPORTED_ABIS), PluginRegistry, PluginInstance, CapabilityGate (PolicyEngine.hasSession + manifest cap check), PluginContainerActivity (hosts plugin's Content() with AnimatedContent fade+scale plugin-switch transitions), PluginDock (floating M3-expressive surface with circle chips per open plugin, tertiary-corner native-code badge), OnnxApiImpl (wraps onnxruntime-android 1.20.0, gated by AI_ONNX), HxsApiImpl (per-plugin collection plugin_<id>, indexed string keys, gated by HXS_READ/WRITE), NetworkApiImpl (WebNative.fetchBytes GET, gated by INTERNET).
• :download_manager, :networking — ancillary modules.