wangzhishou/OneBox

OneBox (万宝盒)

English | 简体中文

A free AI agent & toolbox for Android: say what you need and the built-in agent drives 90+ in-app tools to get it done — plus image & document tools, productivity and daily utilities.

• International: Google Play · Official site
• 中国: 万宝盒官网 · 小米 / 应用宝 / OPPO / vivo / 华为应用商店搜索「万宝盒」

Plenty of toolbox apps are long on features. OneBox's built-in AI assistant saves you from hunting for tools and memorizing steps — just say what you want:

"Turn these images into a PDF." "Log this bill screenshot into my ledger." "Make me a to-do list." "Look up today's stock prices online."

It understands, acts, and reports back — in one flow.

• Bounded by its own permissions: everything the agent does stays inside the app's own Android sandbox and declared permission set — it never touches contacts, SMS or call logs; local tools run entirely on-device, and only the conversation with your chosen model goes online.
• An agent that drives the tools: the AI agent can invoke 90+ in-app local tools (PDF processing, image editing, file management, bookkeeping…), chaining multi-step tasks across tools — executed locally with per-tool timeouts and iteration limits.
• Picture-in-picture robot, no more waiting around: long agent task? Just leave the app — with an active AI session it drops into system picture-in-picture, where the mini-window robot keeps you posted on progress and one tap brings you back to the result. Native PiP, zero permissions required.
• One chat, many models: talk to multiple mainstream LLMs from a single entry, with custom AI engines and prompt management.
• Bring your own key — use it for free: drop in any OpenAI-compatible API key (including free tiers like Gemini or OpenRouter's free models) and the full assistant + agent is yours at zero cost. Custom engines, endpoints and tokens are fully open in the Google Play build and in builds from this repo.
• Transparent by source: every line is public — how data is processed locally and what never leaves the device is something you can verify, not a promise you have to trust.

OneBox ships 104 feature modules. Local tools run entirely on-device; only the conversation with your chosen AI model goes online. The tables below list every module — names refer to the feature/* directories in this repo.

• UI: Jetpack Compose, Material 3
• Navigation / components: Decompose (StackNavigation, childStack, retained components)
• DI: Hilt
• Code generation: KSP
• Build conventions: custom Gradle convention plugins in build-logic/convention
• Persistence: SQLite / Room (AppDatabase), MMKV (per-module)
• Network & images: Retrofit / OkHttp, Coil

Paths beginning with com.t8rin.* are inherited from upstream ImageToolbox and left unchanged on purpose, so the diff against upstream stays reviewable. Everything written for this project lives under com.wanbaohe.* / com.shifenmiao.*.

• App entry: app/src/main/java/com/shifenmiao/app/AppActivity.kt
• Runtime navigation root: feature/app/src/main/java/com/t8rin/imagetoolbox/feature/root/presentation/screenLogic/RootComponent.kt
• Route definitions: core/ui/src/main/kotlin/com/t8rin/imagetoolbox/core/ui/utils/navigation/Screen.kt
• Child factory wiring: feature/app/.../navigation/ChildProvider.kt
• Child composable wrappers: feature/app/.../navigation/NavigationChild.kt
• Top-level shell selector: feature/app/src/main/java/com/wanbaohe/app/screen/ScreenSelector.kt
• Adaptive navigation layout: feature/app/src/main/java/com/wanbaohe/app/navigation/AdaptiveNavigationLayout.kt

• Use the bundled Gradle Wrapper 9.7.0
• JDK 17 (build-logic and CI target it)
• Android targets: Compile SDK 37 / Target SDK 37 / Min SDK 24
• Toolchain: Kotlin 2.4.0 / AGP 9.3.1
• When in doubt, gradle/libs.versions.toml and gradle/wrapper/gradle-wrapper.properties are the source of truth

The repository carries a lot of binary assets, so a full clone is large. For building, a shallow clone is enough:

git clone --depth=1 https://github.com/wangzhishou/OneBox.git

./gradlew :app:assembleGoogleArm64Debug       # single-variant debug APK (google = default channel)
./gradlew tasks --group=assemble              # list all assemble tasks
./gradlew :app:tasks

The app module uses two flavor dimensions:

• app: xiaomi / yyb / oppo / vivo / huawei / onebox / google / foss (foss is the fully-FOSS build: no GMS, Firebase, WeChat or Alipay SDKs; this is the variant CI verifies)
• abi: arm64 (64-bit only)

Build and verify with the google (overseas / Play) flavor by default; pick a domestic flavor only when it is actually needed. Task names combine the two dimensions, e.g.:

• :app:assembleGoogleArm64Debug
• :app:assembleGoogleArm64Release
• :app:assembleHuaweiArm64Debug

See run.md for more command examples.

The project syncs and builds without any key files:

• release signing falls back to placeholder values (not for production use)
• debug builds fall back to AGP's default debug signing
• third-party service keys (AI providers, Google Places, etc.) are empty and the corresponding features stay disabled

To customize, copy the root templates and fill in real values:

• keystore.properties.template → keystore.properties: release signing + service keys
• keystore-google.properties.template → keystore-google.properties: dedicated signing for the google flavor

Both target files are git-ignored; never commit real values.

build_release.sh builds 7 channels × 1 ABI (arm64, 64-bit only) = 7 release APKs into release/ with a release/manifest.txt summary. Examples:

./build_release.sh                                # all 7
./build_release.sh --channel xiaomi huawei        # selected channels
./build_release.sh --abi arm64                    # 64-bit only
./build_release.sh --no-offline --clean           # fetch deps online + clean first
./build_release.sh --skip-build                   # re-collect artifacts only

A real keystore.properties is required for release packaging (the script exits early without it).

.github/workflows/android.yml defines the tag-based release pipeline: Ubuntu runner, JDK 17, assembleRelease, then APK signing and release upload.

The "Open Source Project" row under Profile → About shows the latest release (plus a tab badge on Profile when a newer version exists). A startup dialog can be enabled from the remote config:

"appUpdate": { "dialogEnabled": true, "dialogForVersionBelow": 150, "dialogCooldownHours": 24 }

The version source depends on the flavor: overseas (google / foss) reads GitHub Releases, the six domestic channels read the GitCode OpenAPI. GitCode mirrors only branches/tags/commits — not releases — so domestic builds need an extra publish step:

export GITCODE_TOKEN=xxx          # https://gitcode.com/setting/token-classic
git push gitcode --tags           # the tag must exist: it is used as target_commitish
./scripts/publish_gitcode_release.py --tag 1.4.0 --dir release --abi arm64

Tag pushes do this automatically: CI additionally builds the six domestic channels (arm64, appended via matrix.include) and publishes them to GitCode — requires the GITCODE_TOKEN secret and the tag being pushed to GitCode (the script uses the tag as target_commitish). The GitHub Release keeps the overseas packages only. The GitCode repository has to be public, otherwise the anonymous API returns 403.

AI features are composed from several modules:

• feature/ai/: AI chat, agent loop, tool-call execution, interactive tool bridging
• feature/common/: AI engine catalog, engine sync, shared managers
• feature/settings/: AI engine, model and working-mode configuration UI

The tool-calling chain is built on ToolCallTaskManager, AgentLoopExecutor and AppDatabase.

• No production secrets in this repo: payment (WeChat Pay / Alipay), AI provider and Google Places keys are injected via the optional keystore.properties or kept server-side.
• Backend domains and guest tokens are not in source: API base URLs and read-only guest tokens are injected from keystore.properties at build time, so builds from this repository never contact the production servers and hosted content stays empty. To enable connected features, point the app to your own backend (core/r/**/UrlConstantsFlavor.kt).
• WeChat appId / WeCom corpId are public identifiers; the WeChat platform verifies callers by package name + signature, so third-party builds cannot impersonate the official app.
• Forks & redistribution: change the applicationId (com.shifenmiao.app is taken), replace app/src/google/assets/google-services.json with your own Firebase configuration, and point the app to your own backend (API domains in core/r/**/UrlConstantsFlavor.kt).

• run.md: build / install / lint commands
• docs/modules.md: module catalog (Chinese)
• CONTRIBUTING.md: setup, conventions, and what will not be merged
• SECURITY.md: how to report a vulnerability privately, and what is deliberately public
• docs/database-migrations.en.md: database migration rules (中文)

OneBox is built and maintained by a one-person company (OPC), with a limited budget for servers and AI resources. If it helps you:

• In-app donation: in the app, go to Profile → Buy Me a Coffee (points-based)
• Partnership & sponsorship: AI providers, cloud vendors and partners willing to sponsor tokens or resources are very welcome — reach us at support@oneboxable.com

Every bit of support turns directly into better features and a more stable service.

The same links are in the app under Profile → Join Community (overseas builds show Discord / X / YouTube, domestic builds show the QQ and WeChat groups):

• Discord: discord.gg/7j4hEBYGWv — chat, show & tell, early builds
• X (Twitter): @OneBoxAndroid
• YouTube: @OneBoxAndroid — intro videos and feature demos
• Bug reports & feature requests: GitHub Issues
• Questions, ideas, show & tell: GitHub Discussions
• Security problems: report them privately, see SECURITY.md — please do not open a public issue
• 中文用户:QQ 群 / 微信群见中文版 README

OneBox is a one-person project and its surface area is now much larger than one person can cover. Help here is genuinely welcome, not a polite formality.

The most useful contributions right now, roughly in order:

1. Translations. The app and the Play listing ship in 13 locales. If your language reads wrong, only you can tell us. See fastlane/metadata/android/<locale>/.
2. Device testing. Confirm a build actually works on your OEM ROM, and report what broke.
3. The open good first issue and help wanted list — start here.
4. The agent's tool choices. 90+ tools are exposed to the agent; telling us which tool it picks badly, and what it should have picked instead, is real feedback.

Start with CONTRIBUTING.md. No keystores, API keys or backend access are needed to build.

Apache-2.0, see LICENSE. The project is a fork of ImageToolbox (T8RIN, Apache-2.0): the image-processing core deliberately stays close to upstream so the diff stays reviewable, and upstream copyright notices are preserved in the files they came from.

One box, everything AI. Fully open source, free to use, and your data stays on-device — 18 cards to see what OneBox can do: