BONE 0.4.0

Configuration and credentials, rebuilt for static Linux releases

BONE 0.4.0 replaces the mixed SQLite/keyring configuration stack with explicit, versioned files and ships statically linked musl binaries for Linux.

Highlights

• User settings and provider profiles now live in ~/.bone/config.toml.
• Workspace overrides live in <workspace>/.bone/config.toml and use an explicit trust flow.
• Session overrides, project-config trust records, and other runtime state remain in SQLite.
• API keys now live in the private user file ~/.bone/credentials.toml; ChatGPT OAuth data lives separately under ~/.bone/providers/.
• BONE_HOME can replace ~/.bone with an explicit absolute directory.
• Configuration precedence is now Session > Project > User.
• /reload-config reloads files explicitly without a background file watcher.
• Linux downloads are static musl builds for x86_64 and aarch64. Both are checked with readelf and smoke-tested in Alpine.

Breaking upgrade notes

This release intentionally does not migrate old user/workspace configuration from SQLite or API keys from the operating-system keyring. Recreate your profiles and enter API keys again after upgrading. Existing session overrides may remain in SQLite, and old keyring entries are left untouched for you to remove if desired.

Environment-based API-key injection and bone run --api-key-env have been removed. For automation, provision a key through stdin before running:

printf '%s\n' "$API_KEY" | bone credentials set \
  --provider openai-responses \
  --profile my-profile \
  --base-url https://api.openai.com/v1

Workspace configuration never stores credentials or provider endpoints. Headless runs reject an untrusted project configuration; review it and pass --trust-project-config to persist trust for its current content digest.

Full changelog: v0.3.3...v0.4.0