You are viewing a potentially older version of this package. View all versions.
Jokers-BoneAI-3.3.0 icon

BoneAI

BoneAI v3.3: four-stage beta voice recognition with free-tier web fallbacks, Codex model picker, and game tools.

Date uploaded a day ago
Version 3.3.0
Download link Jokers-BoneAI-3.3.0.zip
Downloads 103
Dependency string Jokers-BoneAI-3.3.0

This mod requires the following mods to function

LavaGang-MelonLoader-0.7.3 icon
LavaGang-MelonLoader

The World's First Universal Mod Loader for Unity Games compatible with both Il2Cpp and Mono

Preferred version: 0.7.3
bonelib-BoneLib-3.2.2 icon
bonelib-BoneLib

A BONELAB mod for making life easier for other mod creators.

Preferred version: 3.2.2
Lakatrazz-Fusion-1.14.2 icon
Lakatrazz-Fusion

A multiplayer mod for BONELAB, taking advantage of its physical interaction.

Preferred version: 1.14.2

README

BoneAI

BoneAI logo

Talk to BONELAB. BoneAI looks around, understands your request, and uses real game actions to carry it out.

Ask normal questions or give commands such as:

Spawn a Ford in front of me.

Find the nearest pistol, bring it to my right hand, and reload it.

Follow player 2.

Change me to my Morty avatar and make me stronger.

BoneAI v3.3 ships as one ZIP for both PCVR and standalone Quest/LemonLoader. It uses the same managed BoneAI.dll on both. Quest Codex account mode additionally uses the included Android ARM64 native App Server library from the BoneAI build branch of the Codex fork. PCVR users leave that Android file unused. The library runs inside BONELAB, so no PC or Python bridge is needed while playing on Quest. Quest can still use OpenRouter Free or another supported API provider without the native library.

For native source provenance and the security boundary, see native/README.md. The pinned Rust workspace and Android build inputs are included in native/codex-android-source-v3.zip, so Quest source is available directly from BoneAI as well as its fork. Release builders can package a successful native CI artifact with the compiled DLL using scripts/package-v3.ps1.

Start here

What you need

  • BONELAB PCVR 1.744.58126
  • MelonLoader 0.7.3 using the .NET 6 runtime
  • BoneLib 3.2.2
  • Internet access and either Codex account sign-in or a key for a supported API provider
  • Codex CLI/App Server on PCVR only if you choose account sign-in; Quest account mode uses the bundled Android native library
  • LabFusion 1.14.2 for multiplayer features (optional for offline play)
  • No SpawnLab installation is needed. BoneAI reads the game's live Marrow spawnable warehouse and uses BONELAB spawning offline or Fusion's network spawner online.

The unified v3.3 ZIP includes BoneAI's DLL and the Android native App Server library. BoneLib, Fusion, and BONELAB belong to their respective authors and must be installed separately. SpawnLab is neither bundled nor required.

Install BoneAI

  1. Download the latest BoneAI-v*.zip from Releases.
  2. Copy BoneAI.dll into BONELAB's Mods folder. For Quest Codex account mode also copy libcodex_app_server.so and its .sha256 file into LemonLoader's UserLibs folder.
  3. Use this exact same DLL for PCVR MelonLoader or Quest LemonLoader.
  4. On Quest, no PC-side BoneAI software is required. On PCVR, install Codex only if you want ChatGPT/Codex account login.
  5. Start BONELAB.
  6. For Quest Codex, open Preferences → BoneAI → AI Provider → Codex account sign-in, then Codex Account → Sign In With Codex. Finish the device-code flow and return to BONELAB.
  7. For the free-model option, choose Free OpenRouter, enter your own OpenRouter key, and reconnect.
  8. Open Assistant · Home, type into Ask BoneAI, and select Send prompt.

Quest Codex uses the native library inside the game; PCVR starts a locally installed Codex App Server. API providers connect directly over HTTPS. Python and a bridge script are not required.

Your BONELAB folder should contain:

BONELAB/
├─ Mods/
│  ├─ BoneLib.dll
│  ├─ LabFusion.dll                 (optional, for multiplayer)
│  └─ BoneAI.dll
└─ UserLibs/
   ├─ libcodex_app_server.so       (Quest Codex only)
   └─ libcodex_app_server.so.sha256

AI providers

Use Preferences → BoneAI → AI Provider, choose Change Provider, edit Model if desired, and select Reconnect. Provider selection and model names are saved in UserData/MelonPreferences.cfg.

Provider Authentication Default endpoint
Codex (PCVR/Quest beta) ChatGPT/Codex device-code sign-in; no API key in BoneAI Local Codex App Server
OpenRouter Free (PCVR/Quest) User-provided OpenRouter key; free model router https://openrouter.ai/api/v1/chat/completions with openrouter/free
OpenAI (PCVR/Quest) OpenAI API key entered in-game or OPENAI_API_KEY https://api.openai.com/v1/responses
Claude ANTHROPIC_API_KEY https://api.anthropic.com/v1/messages
Grok XAI_API_KEY https://api.x.ai/v1/chat/completions
DeepSeek DEEPSEEK_API_KEY https://api.deepseek.com/chat/completions
OpenRouter OPENROUTER_API_KEY https://openrouter.ai/api/v1/chat/completions
Ollama No secret required http://127.0.0.1:11434/v1/chat/completions
Custom BONEAI_API_KEY Set Custom Base URL

Enter a key under AI Provider → API Key (saved securely). BoneAI immediately clears the visible field and saves only encrypted data: current-user DPAPI on Windows and authenticated device-bound encryption on Quest. The selected key remains available after restarts until Clear Current API Key is chosen. PCVR users may alternatively set the provider's environment variable before starting BONELAB. OpenAI uses the Responses API; Claude uses Anthropic's native Messages/tool-use protocol. Grok, DeepSeek, OpenRouter, Ollama, and Custom use their documented OpenAI-compatible function-calling protocol. The chosen model must support tools.

OpenRouter Free does not mean anonymous access: create an OpenRouter key and enter it in BoneAI, but select the openrouter/free router so inference is routed to currently available free models. Availability and rate limits belong to OpenRouter and the upstream free providers. Codex is the only provider that uses account login. Consumer Claude/Grok/DeepSeek logins are not reused because their official third-party API authentication uses API keys.

Codex browser sign-in

BoneAI uses Codex App Server's official chatgptDeviceCode login flow. The game receives only a verification URL and one-time code. Your password, ChatGPT session, and resulting OAuth tokens remain inside Codex App Server and are never returned to or stored by BoneAI.

  1. Open Preferences → BoneAI → Codex Account.
  2. Choose Sign In With Codex.
  3. BoneAI copies the code and opens the official Codex device sign-in page in the system browser.
  4. Finish signing in and return to BONELAB. The status changes to Connected: Codex without a restart.

Use Open Sign-In Page Again if the browser was closed. Codex App Server securely saves and refreshes the account login, so it remains signed in across BONELAB restarts. Sign Out calls the official Codex logout operation and clears that Codex-owned login. BoneAI never copies or stores the OAuth tokens.

Standalone Quest setup — no PC

  1. Install the universal BoneAI.dll with LemonLoader and Quest-compatible BoneLib/Fusion versions matching your BONELAB patch. SpawnLab is not required.
  2. For Codex account mode, place the bundled libcodex_app_server.so and libcodex_app_server.so.sha256 in LemonLoader's UserLibs folder. This beta needs roughly 260 MB for the library plus space for a private runtime copy.
  3. Start BONELAB and open Preferences → BoneAI → AI Provider.
  4. Choose Codex account sign-in and then Codex Account → Sign In With Codex. Complete the code in the browser and return to BONELAB.
  5. Alternatively, choose Free OpenRouter and enter your key in API Key (saved securely).
  6. Open Assistant · Home.

All inference requests and tool-call loops run from the headset. A PC, Python bridge, remote WebSocket host, and Codex CLI are not used in this mode. The universal DLL is managed AnyCPU; exact Quest compatibility still depends on matching BONELAB, LemonLoader, BoneLib, and Fusion versions.

Quest Codex account mode uses a community-built Android port of Codex App Server from the pinned fork commit. This feature is experimental, not an official OpenAI Android distribution. The native server requires a random per-session WebSocket token, keeps account state in BONELAB's private Android files directory, and exposes only BoneAI's dynamic game tools to the model. Browser sign-in is the device-code ceremony; the native App Server continues to run inside BONELAB. Quest still defaults to OpenRouter Free on existing and new installations until you select Codex.

Updating

Install new versions through Thunderstore/r2modman or download a newer GitHub release and replace BoneAI's files manually.

First conversation

BoneAI enables game actions by default. For a quick check:

  1. Open Preferences → BoneAI → Assistant.
  2. Confirm Connection Status says connected.
  3. Enter: Tell me my current avatar and what I am holding.
  4. Select Send. The prompt box clears immediately.
  5. Try: Find the nearest grabbable object and bring it to my right hand.

BoneAI now has its own top-level Preferences button instead of appearing inside BoneMenu. Its interface includes Assistant, Saved Conversations, Voice AI (Beta), AI Provider, Game Permissions, and Diagnostics pages. AI requests, movement/follow state, and wake-word listening run independently of the interface and continue when Preferences is closed.

Choose a Codex model

After signing in, open BoneAI → Codex Account → Choose Codex Model → Refresh available models. BoneAI asks your running Codex App Server for the actual model catalog; it does not hard-code model names. Search by name, browse pages, and enable Include older / hidden to see entries the server hides from its default picker. Selecting a model saves it for future requests and uses that model's advertised default reasoning effort. Use Codex default clears the override. An older or small model appears only if your server/account returns it, and the server may still reject a model that is no longer usable. This setting is separate from the API-provider model field.

Voice AI beta

Voice is optional and off by default. There are two modes:

  • Browser Voice opens a localhost page in Edge, Chrome, or Quest Browser. Automatic tries four distinct routes in order: (1) the browser's on-device engine where available, (2) the browser's online speech service, (3) Groq Whisper's free tier if a Groq key is saved, and (4) Cloudflare Whisper's free allocation if its token and Account ID are saved. The first two need no STT key. The last two require your own free accounts, have rate/usage limits, and send recorded audio to those services. BoneAI keeps the keys in its protected store, not in the web page. Open On-Device Voice starts directly in local-only mode; its browser language model may require a one-time download. A typed-command field works even when all speech services fail.
  • In-game microphone voice records through Unity, uses OpenAI transcription, and optionally reads replies using OpenAI text-to-speech. This mode requires an OpenAI API key.
  1. Open Preferences → BoneAI → Voice AI (Beta) and edit Wake Word if desired (default: Hey BoneAI).
  2. Choose Open Free Browser Voice, allow microphone access in the browser, press Start listening, and keep that page open. For additional web fallbacks, save a Groq key and/or a Cloudflare token plus its 32-character Account ID in this Voice menu, then reopen the browser page. These are separate from the AI chat provider key.
  3. Say the wake word followed by a command, or say the command within eight seconds after the wake word.
  4. For the original in-game mode, enter an OpenAI key, enable Voice AI Beta, and optionally enable Speak AI Replies.

Browser wake-word detection is transcript-gated by the browser, not offline keyword spotting inside the DLL. The local bridge binds only to loopback and uses a fresh 256-bit session token. On standalone Quest, switching between BONELAB and Quest Browser may suspend one application; continuous background listening therefore depends on the headset/browser version and remains beta. A voice failure does not stop text chat or gameplay tools.

If the browser's speech service reports a network error, Automatic tries the configured Groq and Cloudflare routes. If none are configured or available, select On-device where supported or use the typed-command field. Groq and Cloudflare failures can be caused by bad credentials, free-tier limits, or an internet outage; BoneAI reports failure rather than claiming transcription worked. In-game microphone transcription remains a separate OpenAI-key mode.

What BoneAI can do

BoneAI exposes over 350 structured game tools. The catalog combines high-level actions with component-specific world queries, built-in spawn presets, verified interaction invocations, directional physics, combat strengths, player presets, and radius scans. Codex receives the full namespaced catalog. Providers with documented tool-count limits receive a prompt-relevant subset plus tools.search, so they can discover and call anything in the full catalog without exceeding their API limit. The DLL never treats free-form text as a completed game action.

Large spawn catalogs now warm up over multiple frames. A search immediately after startup or spawn.refresh may return pending; retry once loading finishes. BoneAI limits gameplay work per frame and logs a warning when an individual tool takes 12 ms or longer. Ask for diagnostics.performance when reporting a hitch. Continuous move/follow still uses periodic player teleports rather than native joystick input, so it remains collision-unaware and needs in-headset testing. Gun requests attempt at most three shots per call; the tool result states when a larger request was capped.

Area Capabilities
Player Read state, teleport, heal/damage, set health, strength, speed, agility/jump, vitality, and restore runtime overrides
Avatars Search installed avatar catalogs, inspect catalog status, refresh, and switch by name or barcode
World Inspect the scene, raycast what you are looking at, find nearby NPCs, weapons, grips, seats, buttons, doors, and other objects
Spawning Search the game's loaded base-game and installed-mod spawnables, spawn by unique name or barcode, choose a position, check callback status, and despawn; a manual Spawn Catalog page is available in BoneAI Preferences
Interaction Grab, release, pull to hand, bring objects over, use, activate, press, pull, open, close, push, and throw
Combat Aim, shoot, reload, damage, punch, kick, hit, attack nearby targets, attack Fusion players, and throw objects at targets
Movement Move to positions or objects, go to players, follow, stop, turn, and jump
Physics Apply force/impulse, set velocity, move rigidbodies, and rotate rigidbodies
Vehicles Enter and exit standard Marrow seats
Fusion Read session/player state, find and follow players, switch avatars, attack through Fusion's damage sender, and report sync behavior
Diagnostics List loaded mods/capabilities, read recent MelonLoader errors, and show headset notifications

Every action has an ID and returns success, failed, cancelled, or pending. pending means the game accepted a request but BoneAI cannot yet confirm its outcome; it is not a completed action. After spawning, use spawn.status with the returned action ID to check for a local callback, and inspect the world or a second client if needed. A cancelled action is skipped if it has not started; cancellation after execution begins cannot undo a game-side effect.

Avatar discovery

The catalog provider built into BoneAI.dll builds a unified avatar list from the live Marrow warehouse, installed pallet manifests, and WristHub's generated avatar index when WristHub is present. WristHub is not required. Results are deduplicated and searchable by display name or barcode.

If the list is empty, ask BoneAI to run avatar.catalog_status and avatar.refresh and verify that installed content is visible to the game.

Fusion multiplayer

BoneAI uses BONELAB/Fusion paths and checks local ownership before direct mutation of registered network entities. Calling a game or Fusion API does not, by itself, prove that a peer observed the outcome. Confirm important actions from a second client; pending responses must not be presented as synchronized success.

Action Multiplayer behavior BoneAI needed by other players?
Spawn BoneAI uses Fusion's NetworkAssetSpawner server route online and checks Fusion's local spawn-gun permission first. spawn.status reports a local callback and network entity ID when available, not peer confirmation. Offline it uses BONELAB's AssetSpawner callback. No custom BoneAI protocol; peer test required
Grab/release Marrow hand/grip path; hand attachment is checked locally No custom BoneAI protocol; peer test required
Gun fire Real gun firing path; resulting hit/peer state is not synchronously confirmed No custom BoneAI protocol; peer test required
Seat enter/exit Marrow seat path; local seat state is checked No custom BoneAI protocol; peer test required
Avatar swap Fusion LocalAvatar.SwapAvatarCrate request online No custom BoneAI protocol; peer test required
Fusion-player damage Fusion PlayerSender.SendPlayerDamage request with a Marrow attack No custom BoneAI protocol; peer test required
Prop/NPC state Direct mutation is blocked for registered entities not locally owned; ownership alone does not prove replication Depends on underlying game/Fusion path; peer test required
Local health/stat boosts Intentionally local only Not synchronized
Conversation and menu Local only Not synchronized

BoneAI does not accept remote AI commands. Other players, player names, chat, map text, object names, and mod descriptions are context—not trusted instructions.

Connection and privacy

On PCVR, BoneAI locates the installed Codex executable and directly starts an owned App Server on a random loopback-only port, equivalent to:

codex app-server --listen ws://127.0.0.1:<random-port>

and stops it when BONELAB exits. Codex connections are localhost-only. Account authentication remains inside Codex. BoneAI sees device-login status but never reads, stores, or logs passwords or OAuth tokens. Built-in provider keys can only be sent to their provider's official HTTPS host; logs automatically redact loaded secrets.

BoneAI's tool surface is limited to its registered BONELAB actions. It does not provide prompts with shell access, arbitrary process execution, arbitrary filesystem access, credential access, DLL loading, or unrestricted web requests.

Troubleshooting

Connection says unavailable

  • Open BoneAI → Codex Sign-In and choose Sign In With Codex.
  • Confirm the Codex desktop app or CLI is installed.
  • Select Reconnect in Preferences → BoneAI → Codex Sign-In.
  • Search MelonLoader/Latest.log for [BoneAI].

The Codex App Server exits

Install/open Codex, then restart BONELAB. BoneAI searches the system PATH and standard Codex desktop installation folders under %LOCALAPPDATA%. Account sign-in can be completed afterward from BoneAI's Codex Sign-In page.

Spawning fails

Wait until the level and Marrow warehouse have loaded, then use spawn.refresh or spawn.list. Ask for an exact barcode if a name is ambiguous. An accepted request returns pending; call spawn.status with its action ID to check local completion. In Fusion, spawning is blocked when the level is not networked or lobby/gamemode spawn permissions deny it, rather than silently creating a local-only object.

An object command fails

Ask BoneAI to look at the object or search nearby again. Object handles are deliberately invalidated when an object is destroyed or a level changes. Some modded doors/buttons expose no safe public interaction method; BoneAI reports that limitation and can often manipulate the object's rigidbody instead.

Fusion action appears local

Ask BoneAI for fusion.get_sync_report. Local player stat changes, UI, conversation state, and movement assistance are local by design.

Known limitations

  • Voice is beta. Browser voice requires browser SpeechRecognition support and may pause when Quest Browser is backgrounded; in-game voice still requires an OpenAI API key. Text remains fully supported.
  • Navigation is collision-unaware incremental movement, not full navmesh pathfinding.
  • Climbing, crouching, and generalized vehicle steering are not automated.
  • Modded interaction components vary widely; unsupported controls fail cleanly.
  • Fusion's spawn callback confirms an object on the initiating client, not that every peer loaded or saw it. If no callback arrives within two minutes, BoneAI marks it unconfirmed and releases its callback registration; a slow peer may still finish later. Similar game input requests may be pending when there is no safe outcome callback.
  • The Android native library is reused from the verified v3.0.0 build; v3.3 changes managed code and the browser page. Automated tests and compilation do not replace physical Quest, browser microphone, and two-client Fusion testing. See the test checklist.
  • The exact supported game stack matters because BONELAB uses generated IL2CPP assemblies.

Build from source

Install the .NET 6 SDK and point the build at a compatible BONELAB installation:

dotnet build BoneAI.csproj -c Release -p:BONELAB_DIR="D:\Games\BONELAB"

Output: bin/Release/net6.0/BoneAI.dll. This one managed DLL contains the catalog provider and is packaged unchanged for PCVR and Quest.

The code is separated into Codex communication, tool dispatch, game controllers, Fusion compatibility, BoneMenu UI, avatar catalogs, and infrastructure. Version-sensitive reflection is isolated in the relevant compatibility adapters.

Provider transports follow the official Codex App Server, Anthropic tool use, xAI function calling, DeepSeek function calling, OpenRouter tool calling, and Ollama tool calling documentation.

License

BoneAI source code is available under the MIT License. BONELAB, BoneLib, LabFusion, SpawnLab, and Codex are separate projects and are not redistributed here. BoneAI's new spawn implementation is its own code; the third-party SpawnLab DLL and decompiled source are not included.

The built-in spawner was prompted by SpawnLab by ChappieStudios. SpawnLab remains an independent project and may still be installed for its own menu; BoneAI no longer calls or requires it.

CHANGELOG

Changelog

3.3.0 — More voice paths

  • Browser Voice Automatic mode now tries on-device recognition, the browser speech service, Groq Whisper, then Cloudflare Whisper where configured. Typed commands remain available after all voice paths fail.
  • Added separate Groq and Cloudflare STT credentials in the Voice menu, stored through BoneAI's protected key store. Cloudflare also requires an Account ID. Credentials are not exposed to the browser page.
  • Added bounded WAV microphone capture in the browser, server-side transcription over documented HTTPS endpoints, status/error reporting, and tests for the fallback sequence.
  • Groq and Cloudflare offer limited free tiers, not unlimited or anonymous usage. The web fallbacks need user accounts/keys and send recorded audio to those providers. No autoupdater; the Quest native App Server library is unchanged.

3.2.0 — Model choice, voice fallback, and smoother game actions

  • Added an in-game Codex model browser backed by the App Server's paginated model/list response, including optional older/hidden entries. A selected model and its supported default effort are saved; an explicit Codex-default option clears the override.
  • Browser voice now defaults to automatic on-device-first recognition when supported, with browser-service and typed-command fallbacks. Added a direct Open On-Device Voice control. An offline STT engine is not bundled; on-device availability depends on the browser.
  • Limited queued main-thread work per frame, reduced automatic nearby-world context, reused a bounded physics-overlap buffer, and avoided child-component scans for routine object descriptions. The live spawn catalog now refreshes in small batches instead of rescanning the entire warehouse during an action. Slow tools now log their execution time.
  • Moved avatar manifest refresh and WAV encoding off the game thread, bounded recent-log reads, and throttled repeated movement teleports. Jump targets the verified PhysicsRig.rbFeet body instead of every rig rigidbody. Rapid gun calls and extreme physics/avatar values are bounded.
  • Added model-catalog, dispatcher-budget, and browser-voice fallback tests. No autoupdater.

3.1.1 — Browser voice recovery

  • Stopped the browser voice page from endlessly restarting after a fatal speech-service network error. It now reports the browser-side failure and lets the player retry deliberately.
  • Added feature-detected on-device speech recognition with browser-managed language-model installation, where supported. Browsers without the experimental API keep the browser-service option.
  • Added a typed-command fallback on the same localhost page so a speech outage does not block commands; the field clears after submission.
  • Embedded the page as a separate, testable asset and added browser-behavior tests and safer JSON escaping for the wake word.
  • No autoupdater and no change to the pinned Quest Codex native library.

3.1.0 — Built-in spawning

  • Removed the SpawnLab runtime and Thunderstore dependency. BoneAI now indexes the loaded Marrow warehouse itself, including base-game and installed-mod spawnables.
  • Added exact-barcode and unique-name resolution, ambiguity errors, a selectable spawn position/rotation, spawn.status for local callback results, and a manual Spawn Catalog Preferences page.
  • Offline spawning uses BONELAB's AssetSpawner. Fusion sessions use the verified NetworkAssetSpawner server request, with a local permission/gamemode check; requests are blocked rather than silently spawning only locally when network synchronization is unavailable.
  • Time-bounded unanswered Fusion callback registrations and kept peer visibility explicitly unconfirmed without a second-client observation.
  • Added spawn-catalog matching tests. No third-party SpawnLab code or DLL is redistributed, and there is no autoupdater.
  • The Android native Codex library is unchanged from v3; physical Quest and two-client Fusion testing are still required.

3.0.1 — Reliability and truthful action results

  • Fixed cancellation of queued game actions so they cannot run after cancellation; actions already executing now return their real result rather than a misleading cancelled result.
  • Added pending results for fire-and-forget SpawnLab, input, combat, and network requests. The assistant is instructed to verify the game world instead of claiming completion prematurely.
  • Added local Fusion entity ownership checks before direct manipulation of registered network objects and made synchronization reports distinguish local acceptance from peer confirmation.
  • Replaced wrong-best-match spawning with exact/unique catalog resolution and an ambiguity error when multiple spawnables match.
  • Added typed argument schemas for core actions, improved tool selection, and bounded recent action history.
  • Added automated dispatcher/schema smoke tests, source CI, a physical-device checklist, and release checksums. No autoupdater.
  • Reuses the same pinned Android native Codex App Server library as v3.0.0. Physical Quest and two-client Fusion behavior still require user testing.

3.0.0 — Native Quest Codex

  • Integrated an Android ARM64 Codex App Server from the BoneAI branch of the user's Codex fork. Quest can start it inside BONELAB and use persistent ChatGPT/Codex device-code sign-in without a PC or API key.
  • Kept one managed BoneAI.dll for PCVR and Quest. The Quest package additionally contains the native .so and checksum under UserLibs; the native source remains in the pinned Codex fork.
  • Restricted the embedded App Server to BoneAI's dynamic game tools and added a random per-session bearer token to its localhost WebSocket.
  • Added checksum validation, native ABI version checking, private Android storage for Codex state, bounded startup readiness checks, and clean failure status.
  • Reorganized the in-game BoneAI pages with clearer assistant, provider, voice, account, and runtime status controls.
  • Kept OpenRouter Free, other API providers, voice beta, SpawnLab, Fusion, saved conversations, and the existing tool catalog.
  • Android ARM64 build validation is available; physical Quest/LemonLoader gameplay testing remains necessary.
  • No autoupdater.

2.7.0 — Free Voice

  • Added OpenRouter Free, backed by the official openrouter/free router. Users bring their own OpenRouter key, while the router selects a currently available free model that supports the requested features, including tool calling when available.
  • Made OpenRouter Free the default provider for new Quest installations. Existing provider selections are preserved.
  • Added Free Browser Voice (Beta). BoneAI hosts a localhost-only speech page, opens it in Edge/Chrome/Quest Browser, waits for the configurable wake word, and sends recognized commands back through a random per-session capability token.
  • Browser voice requires no speech API key and BoneAI imposes no usage quota. Recognition availability, privacy, networking, and limits are controlled by the selected browser and its speech service.
  • Added bounded HTTP parsing, body limits, CSP, no-store/no-referrer headers, constant-time token checks, and loopback-only binding to the browser voice bridge.
  • Added bounded retry with jitter for temporary provider rate-limit and availability errors, plus official OpenRouter attribution headers.
  • Removed the obsolete insecure-remote-Codex preference and improved Quest Codex errors so the mod no longer tries a nonexistent local App Server.
  • Revalidated the official Codex boundary: browser/device-code login still requires a running Codex App Server. OpenAI does not publish an Android App Server target, so v2.7.0 does not copy private OAuth behavior or falsely claim standalone Quest Codex login.
  • Contains no updater and does not modify an existing installed DLL during release creation.

2.6.2 — Secure Persistence

  • Codex account sign-in now explicitly reuses and refreshes the official Codex App Server login across game restarts; Sign Out clears that Codex-owned login.
  • Provider API keys entered in-game are now saved until cleared. Windows uses current-user DPAPI; Quest uses authenticated device-bound encryption. Plaintext keys are never written to preferences or logs.
  • Added an explicit Clear Current API Key action that removes the selected provider key from memory and protected storage.
  • Restricted Codex App Server connections to loopback and launch an owned server on a random local port, removing remote transport-token and insecure-LAN controls.
  • Restricted built-in provider keys to each provider's official HTTPS host. Custom endpoints require HTTPS except for explicit localhost development; Ollama is localhost-only.
  • Validates Codex browser-login URLs, caps WebSocket/API/voice response sizes, bounds pending requests and timeouts, and cleans up cancelled/disconnected requests.
  • Added automatic secret redaction to logs and log-query tool results.
  • Contains no updater.

2.6.1 — Quest Standalone Fix

  • Added true no-PC Quest operation through direct HTTPS provider connections from the headset.
  • Added OpenAI Responses API support with structured BoneAI tool calling and gpt-5.3-codex as the default standalone OpenAI model.
  • Added in-game provider API-key entry. Keys are session-only, cleared from the visible field, never written to disk, and never logged.
  • Added a one-click Quest Standalone OpenAI setup option and made OpenAI direct mode the default for new Quest installations.
  • Made the same in-game key path available to Claude, Grok, DeepSeek, OpenRouter, Custom, and Voice AI.
  • Corrected the documentation: Codex account/browser login remains PCVR-only because the official App Server has no supported Android/Quest runtime.
  • Still uses one universal BoneAI.dll, contains no Python bridge, and contains no updater.

2.6.0 — Compatibility Extended

  • Replaced separate PCVR and Quest mod binaries with one AnyCPU BoneAI.dll used unchanged on both platforms.
  • Folded the avatar/pallet catalog provider into BoneAI.dll; BoneAI.Catalogs.dll and the UserLibs install step are no longer required.
  • Removed the Python bridge requirement. On PCVR, BoneAI directly launches the installed official Codex App Server; on Quest it connects to the configured remote App Server.
  • Made installed-content discovery use Unity's platform-correct persistent data directory on both Windows and Android.
  • Kept official browser/device-code Codex sign-in, all 350 tools, Fusion, SpawnLab, saved conversations, providers, performance work, and Voice AI beta.
  • Contains no updater.

2.5.0

  • Added official Codex device-code authentication from inside BONELAB: BoneAI copies the one-time code, opens the system browser, and detects completion automatically.
  • Added a dedicated Codex Sign-In page with reconnect, sign-out, sign-in-page reopening, remote App Server address, and session-only transport-token entry.
  • Added standalone Quest runtime detection. Quest never attempts to launch Python and instead connects to a securely hosted Codex App Server.
  • Added authenticated remote App Server support using bearer transport tokens and secure wss:// enforcement by default.
  • Changed the mod assembly to AnyCPU for PCVR/Quest managed-runtime compatibility; no auto-updater is included.
  • Retains the complete v2.4 performance, 350-tool, Fusion, SpawnLab, saved-conversation, provider, and Voice AI beta feature set.

2.4.0

  • Removed the updater and all updater packaging; BoneAI updates are installed manually or through Thunderstore/r2modman.
  • Reworked nearby-world queries with a short-lived, movement-aware cache, squared-distance filtering, and scene-change invalidation.
  • Moved stale object-handle pruning off the per-frame path and removed its normal-case temporary allocations.
  • Reduced repeated Unity/IL2CPP component traversal by describing NPCs, interactables, and component types from one cached scan per object.
  • Cached Fusion player snapshots and SpawnLab catalog reflection results to avoid repeating expensive reflection work during multi-step actions.
  • Precomputed tool-search text and cached the legacy catalog JSON, eliminating repeated concatenation and serialization across the 350-tool registry.
  • Bounded provider tool-selection context to the current prompt and recent history instead of serializing the entire conversation every round.
  • Cached saved-conversation menu snapshots so the closed/open Preferences refresh loop no longer continually sorts and clones history.
  • Reused the voice activity polling buffer and throttled missing-key retries, reducing allocations in the beta microphone loop.
  • Fixed cancellation-token lifetime races during overlapping cancel/send operations and serialized concurrent connection attempts.
  • Added defensive reporting for providers that return HTML or other non-JSON errors.
  • Added diagnostics.performance for physical world-scan counts, cache hit rate, average scan time, and cached-object count.
  • Kept the complete v2.3 feature set: exactly 350 tools, standalone Preferences UI, saved conversations, voice beta, wake word, multi-provider support, SpawnLab, and Fusion integration.

2.3.0

  • Includes the v2.2 AI providers: Claude, Grok, DeepSeek, OpenRouter, Ollama, and Custom.
  • Expanded BoneAI to exactly 350 internal structured gameplay tools, with searchable discovery and provider-aware subsets for APIs with lower tool limits.
  • Added a standalone BoneAI button to BONELAB Preferences, based on the verified Fusion 1.14.2 Preferences injection lifecycle.
  • Redesigned the in-game interface into Assistant, Saved Conversations, Voice AI (Beta), AI Provider, Game Permissions, and Diagnostics pages.
  • Added persistent saved-conversation metadata and one-click resume for Codex and direct API providers.
  • Added opt-in microphone transcription, configurable transcript-gated wake word, listen-once mode, and optional AI speech replies.
  • Kept AI work, follow/movement state, and voice polling independent of the open/closed Preferences menu.
  • Simplified the release package to the main mod, bridge, and catalog library; new versions are installed manually or through Thunderstore/r2modman.

2.2.0

  • Added official tool-calling adapters for Anthropic Claude, xAI Grok, DeepSeek, OpenRouter, and local Ollama.
  • Added a configurable OpenAI-compatible provider for other services.
  • Kept Codex App Server as the default and only login-based provider; API-provider secrets are read exclusively from environment variables.
  • Added provider, model, and custom endpoint controls to BoneMenu.

2.1.1

  • Added a valid Thunderstore manifest.json with current BONELAB dependencies.
  • Added an exact 256×256 icon.png based on the official BoneAI logo.
  • Added the full-resolution logo to the repository and README.
  • Rebuilt the release archive with all required Thunderstore files at its root.

2.1.0

  • Renamed the project, assemblies, menu, settings, bridge, and logs to BoneAI.
  • Added the first-time-player installation package and redesigned README.
  • Published the complete source and compiled release under the MIT License.