fix(build): warn instead of failing when a Resources apiKey is set

The Resources apiKey build guard hard-failed any player build when the
committed CoreAISettings asset had a non-empty apiKey. A harmless local
placeholder (e.g. the LM Studio key the server ignores) should not block a
build, so the guard now logs a warning and continues; a real secret is still
flagged in the console so it is not shipped unnoticed.

Restored the asset's 'lm-studio' placeholder (cleared in the previous commit
only to get past the old hard block). Builds now produce an APK/EXE directly.

Bump to 6.1.3.

Author: NeoXider

Assets/CoreAI/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [6.1.3] - 2026-07-23
+
+### Changed
+
+- `CoreAIResourcesApiKeyBuildGuard` now **warns instead of failing the build** when a Resources
+  `CoreAISettings` asset carries a non-empty `apiKey`/`secondaryApiKey`. WHY: a harmless local
+  placeholder (e.g. an LM Studio key the server ignores) should not hard-block a build; the console
+  warning still flags a real secret so it is not shipped by accident. The committed asset keeps its
+  `lm-studio` placeholder and now builds an APK/EXE directly.
+
 ## [6.1.2] - 2026-07-23
 
 ### Fixed

Assets/CoreAI/package.json

@@ -1,6 +1,6 @@
 {
   "name": "com.neoxider.coreai",
-  "version": "6.1.2",
+  "version": "6.1.3",
   "displayName": "CoreAI",
   "unity": "6000.0",
   "description": "Portable C# core for CoreAI \u2014 LLM agents that call your game code. Orchestration, function-calling tools, agent memory, AgentBuilder, SkillSet, and production resilience (retries, timeouts, rate limits), with no UnityEngine dependency. LLM and Lua are optional modules (COREAI_NO_LLM / COREAI_NO_LUA), so the core compiles without them \u2014 install only what your game uses. Unity integration ships in com.neoxider.coreaiunity.",

Assets/CoreAIBenchmark/package.json

@@ -1,6 +1,6 @@
 {
   "name": "com.neoxider.coreaibenchmark",
-  "version": "6.1.2",
+  "version": "6.1.3",
   "displayName": "CoreAI Benchmark",
   "unity": "6000.0",
   "description": "LLM game-creation benchmark harness and scenarios for CoreAI: drives execute_lua and world_command through real PlayMode scenarios (G1-G8), grades tool correctness, reasoning, instruction adherence, and determinism, and reports suite/role fitness scores. Depends on com.neoxider.coreai / com.neoxider.coreaiunity / com.neoxider.coreaimods.",

Assets/CoreAIHub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "com.neoxider.coreaihub",
-  "version": "6.1.2",
+  "version": "6.1.3",
   "displayName": "CoreAI Hub (UI Toolkit)",
   "unity": "6000.0",
   "description": "Optional UI Toolkit window for CoreAI: a tabbed Hub that renders pages registered into CoreAI's HubPageRegistry (Chat, Settings, Statistics, Mods, and C#/Lua-authored pages). Lazy per-tab content, live tab rebuild on register/unregister, semi-transparent runtime panel, and a future path to Unity 6.5 world-space PanelRenderer. Install this package only when you want the built-in Hub window; without it CoreAI still exposes the registry so you can render pages on your own uGUI/UITK canvas via the API. Depends on com.neoxider.coreai.",

Assets/CoreAIMcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "com.neoxider.coreaimcp",
-  "version": "6.1.2",
+  "version": "6.1.3",
   "displayName": "CoreAI MCP Server",
   "unity": "6000.0",
   "description": "Optional Model Context Protocol (MCP) server that runs INSIDE a live CoreAI game session (play mode or a build) so an external agent - Claude Code and any other MCP client - can drive the running game over a standard protocol. Exposes the in-game Command Bar surface (execute_lua, manage_mods, get_mod_logs, and, when present, world_command + screenshot) as MCP tools over localhost streamable HTTP. Off by default: drop a CoreAiMcpServer component into a scene (or call CoreAiMcpServer.StartServer). Localhost-only, opt-in, no auth - never expose beyond loopback. Depends on com.neoxider.coreaimods; world/screenshot tools register only when those services exist in the current composition.",

Assets/CoreAIMods/package.json

@@ -1,6 +1,6 @@
 {
   "name": "com.neoxider.coreaimods",
-  "version": "6.1.2",
+  "version": "6.1.3",
   "displayName": "CoreAI Mods (Lua)",
   "unity": "6000.0",
   "description": "Lua modding layer for CoreAI: the Lua-CSharp sandbox (managed, AOT-safe, WebGL/IL2CPP-ready — bundled, no external package), execute_lua and manage_mods tools, the Lua Modding skill, the mod runtime, persistent mod stores, gameplay bindings, and mod UI. Depends on com.neoxider.coreai / com.neoxider.coreaiunity. Install this package only when you want AI/player-authored Lua mods; without it CoreAI compiles Lua-free.",

Assets/CoreAiUnity/Editor/CoreAIResourcesApiKeyBuildGuard.cs

@@ -9,16 +9,16 @@
 namespace CoreAI.Editor
 {
     /// <summary>
-    /// Build-time guard that FAILS the build when a <see cref="CoreAISettingsAsset"/> that ships inside a
-    /// <c>Resources</c> folder carries a non-empty <c>apiKey</c> or <c>secondaryApiKey</c>.
+    /// Build-time guard that WARNS (does not fail the build) when a <see cref="CoreAISettingsAsset"/> that
+    /// ships inside a <c>Resources</c> folder carries a non-empty <c>apiKey</c> or <c>secondaryApiKey</c>.
     /// <para>
     /// Anything under a <c>Resources/</c> folder is packed into the player and is trivially recoverable from
     /// the shipped build (strings are not encrypted). A committed key in such an asset is therefore an
-    /// exposed secret. Keys must come from environment variables or secure runtime storage and be injected
-    /// at runtime — never from the committed Resources asset.
+    /// exposed secret. Prefer environment variables or secure runtime storage and inject the key at runtime.
     /// </para>
-    /// The committed asset is expected to ship with EMPTY keys, so a clean checkout builds fine; this guard
-    /// only triggers when a key was actually filled in.
+    /// This is intentionally a warning, not a hard block: a harmless local placeholder (e.g. an LM Studio
+    /// key the server ignores) should not stop a build. The console warning still flags a real key so it is
+    /// not shipped by accident.
     /// </summary>
     public sealed class CoreAIResourcesApiKeyBuildGuard : IPreprocessBuildWithReport
     {
@@ -49,12 +49,12 @@ public void OnPreprocessBuild(BuildReport report)
                         ? "apiKey"
                         : "secondaryApiKey";
 
-                throw new BuildFailedException(
+                Debug.LogWarning(
                     $"[CoreAI] The CoreAISettings asset at '{path}' lives under a Resources folder and has a " +
                     $"non-empty {which}. Resources assets are packed into the build and the key is recoverable " +
-                    "from the shipped player. Clear the key on the committed Resources asset and supply it at " +
-                    "runtime from an environment variable or secure storage (e.g. CoreAISettings.Instance / a " +
-                    "local-only config), then rebuild.");
+                    "from the shipped player. If this is a real secret, clear it on the committed Resources asset " +
+                    "and supply it at runtime from an environment variable or secure storage (e.g. " +
+                    "CoreAISettings.Instance / a local-only config). Building anyway.");
             }
         }
 

Assets/CoreAiUnity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "com.neoxider.coreaiunity",
-  "version": "6.1.2",
+  "version": "6.1.3",
   "displayName": "CoreAI Unity",
   "unity": "6000.0",
   "description": "Unity framework for LLM-powered NPCs and agents that call your game code \u2014 drop-in chat UI, function-calling tools, persistent memory, token-by-token streaming, and per-role LLM routing. Runs on a local GGUF model (via LLMUnity) or any OpenAI-compatible API; proven on a 4 GB local model. Unity layer for com.neoxider.coreai.",

Assets/Resources/CoreAISettings.asset

@@ -16,7 +16,7 @@ MonoBehaviour:
   executionMode: 2
   autoPriority: 0
   apiBaseUrl: http://127.0.0.1:1234/v1
-  apiKey: 
+  apiKey: lm-studio
   modelName: qwen3.5-4b-mtp
   visionSupport: 0
   enableTemperatureOverriding: 1