Add Muse Code subscription usage windows

[audreyt]

Summary

Adds Muse Code as provider #70 with subscription visualization (the 5-hour and weekly windows Meta added for Everyday / High / Power Usage). Existing Muse PRs do not cover this:

• [codex] Add Muse browser usage, spend, and token display #2936 dashboard PAYG spend
• Add Muse provider (Meta Muse) #3340 / feat(provider): add Muse local token usage #3371 local session tokens, no quota

Closes the gap called out on #3409 and #3340.

How it works

muse login stores a device-code dca: token in Keychain (ai.meta.dev.credentials / meta). CodexBar reads it with KeychainNoUIQuery (no prompt) and POSTs https://api.meta.ai/muse-code/key. The mint payload includes is_subs_active, subs_tier_name, and subs_usage.{window,weekly} (used_percent, window_duration_mins, resets_at).

Dashboard LLM_ keys and Muse-minted LLM| inference keys 401 on that mint endpoint and are not used.

Live proof (this desk)

codexbar usage --provider muse --json --source oauth
provider=muse source=oauth
plan=Muse Code Power Usage
5h=96% windowMinutes=300
weekly=96% windowMinutes=10080
dataConfidence=exact

Card last-four is not displayed.

Tests

swift test --filter 'MuseUsageFetcherTests|ProviderArchitectureGatekeeperTests' — 51 passed.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T08:52:33.190319Z	16eb517	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approval recommended

The Muse provider integration is self-contained, covered by focused tests, and the only feedback is a minor improvement to diagnostic detail.

Pull request overview

Adds first-class Muse Code support focused on subscription usage visualization (rolling 5-hour + weekly windows) by minting quota data from Meta’s /muse-code/key endpoint using the Muse CLI’s device-code (dca:) token, and updates project docs/site copy to reflect the new provider count.

Changes:

• Added Muse provider plumbing (descriptor, credentials reader, OAuth fetch strategy, usage fetcher + snapshot mapping).
• Added focused Swift Testing coverage for Muse mint parsing/credential handling and updated architecture fingerprints.
• Updated docs/site/changelog to include Muse and bump “69 → 70 providers”.

File summaries

File	Description
Tests/CodexBarTests/ProviderArchitectureGatekeeperTests.swift	Updates expected provider/branding fingerprints for the new provider set.
Tests/CodexBarTests/MuseUsageFetcherTests.swift	Adds parsing + transport + credential-safety tests for Muse subscription minting.
Sources/CodexBarCore/Providers/Providers.swift	Registers new UsageProvider.muse case.
Sources/CodexBarCore/Providers/ProviderManifest.swift	Adds Muse descriptor to the core manifest.
Sources/CodexBarCore/Providers/ProviderInstanceIDAliases.generated.swift	Adds .muse instance ID alias.
Sources/CodexBarCore/Providers/Muse/MuseUsageFetcher.swift	Implements mint request/validation + response parsing into a usage snapshot.
Sources/CodexBarCore/Providers/Muse/MuseProviderDescriptor.swift	Defines Muse metadata/branding and OAuth-only fetch pipeline.
Sources/CodexBarCore/Providers/Muse/MuseCredentials.swift	Reads Muse login state/token from auth.json + Keychain (no-UI query).
Sources/CodexBar/Resources/ProviderIcon-muse.svg	Adds Muse provider icon resource.
Sources/CodexBar/Providers/Shared/ProviderImplementationManifest.swift	Registers Muse provider implementation in the app layer.
Sources/CodexBar/Providers/Muse/MuseProviderImplementation.swift	Adds app-layer availability/presentation wiring for Muse.
README.md	Adds Muse to provider list and updates “70 providers” marketing copy.
docs/social.html	Updates landing-page provider count to 70.
docs/site-locales.mjs	Updates localized provider-count strings across supported locales.
docs/providers.md	Updates provider count and adds Muse fetch-strategy row.
docs/provider-ids.md	Adds muse to the documented provider ID list.
docs/muse.md	New provider doc describing auth, data shown, and privacy notes.
docs/llms.txt	Updates provider count in LLM-readable summary.
docs/index.html	Updates meta/og copy and on-page provider count to 70.
CHANGELOG.md	Adds unreleased entry for Muse subscription windows.

Review details

• Files reviewed: 19/20 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 7, 2026, 12:11 PM ET / 16:11 UTC.

ClawSweeper review

What this changes

Adds Muse Code subscription usage through the CLI login, with five-hour and weekly windows, provider registration, documentation, and regression tests.

Merge readiness

✅ Ready for maintainer review

This remains a useful, distinct subscription-quota integration absent from current main. The earlier findings are addressed, the supplied live CLI proof covers the central behavior, and no remaining blocking defect was identified.

Priority: P2
Reviewed head: 47ab8a02de6f38dc0359956313149ff5e459b678

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused integration with relevant live proof, resolved prior findings, and clearly disclosed validation limits.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The captured live CLI run exercises Muse’s OAuth credential, subscription fetch, and snapshot path on the contributor’s setup and reports both real usage windows; focused tests supplement the corrected numeric guards.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The captured live CLI run exercises Muse’s OAuth credential, subscription fetch, and snapshot path on the contributor’s setup and reports both real usage windows; focused tests supplement the corrected numeric guards.
Evidence reviewed	8 items	Repository policy and review scope: Read the full root AGENTS.md; a repository-wide search found no nested AGENTS.md, and .agents contains no maintainer-notes directory. Applied provider isolation, prompt-free credential access, and focused-validation guidance. No builds, tests, or provider probes were executed during this read-only review. Distinct capability remains absent from main: A current-main search for Muse, muse-code, and api.meta.ai found no provider implementation or documentation. The v0.56.7 tree also has no Muse provider directory. The supplied related PRs implement dashboard spending or local token history rather than subscription windows. Prior findings addressed: The current parser uses checked Int conversion and bounds reset dates; regression tests cover oversized durations and both reset windows through countdown formatting. The descriptor registers OAuth diagnostics, and docs/muse.md explains inline-token precedence. The earlier reviewed SHA was unavailable locally, so direct revision continuity could not be verified; the current fixes were inspected independently.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar’s provider pipeline reads account credentials and fetches usage for both the menu-bar app and CLI. The Muse integration converts Meta’s subscription response into the existing usage-window and provider-identity displays.

flowchart LR
  A[Muse CLI login] --> B[Auth file or prompt-free Keychain read]
  B --> C[Device token validation]
  C --> D[Meta subscription endpoint]
  D --> E[Subscription and window parsing]
  E --> F[Usage windows and Muse identity]
  F --> G[Menu bar and CLI]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	Production +577/-0; tests +321/-2	Production growth adds the new provider and icon; tests cover parsing, authentication, registration, and the previously reported numeric failures.

Technical review

Best possible solution:

Keep subscription quotas in the existing provider pipeline, preserving Muse-only identity and leaving dashboard spending and local token history as separate capabilities.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction: this adds a provider capability, and the supplied live CLI output demonstrates the requested subscription windows.

Is this the best way to solve the issue?

Yes. A provider-local OAuth strategy using the shared credential and HTTP helpers is a narrow fit for the existing architecture; the related spending and token-history integrations do not supply these quotas.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 170a4d41c6d6.

Labels

Label justifications:

• P2: This is a bounded provider integration adding useful subscription visibility without an established urgent regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The captured live CLI run exercises Muse’s OAuth credential, subscription fetch, and snapshot path on the contributor’s setup and reports both real usage windows; focused tests supplement the corrected numeric guards.
• proof: sufficient: Contributor real behavior proof is sufficient. The captured live CLI run exercises Muse’s OAuth credential, subscription fetch, and snapshot path on the contributor’s setup and reports both real usage windows; focused tests supplement the corrected numeric guards.

Evidence

What I checked:

• Repository policy and review scope: Read the full root AGENTS.md; a repository-wide search found no nested AGENTS.md, and .agents contains no maintainer-notes directory. Applied provider isolation, prompt-free credential access, and focused-validation guidance. No builds, tests, or provider probes were executed during this read-only review. (AGENTS.md:1, 47ab8a02de6f)
• Distinct capability remains absent from main: A current-main search for Muse, muse-code, and api.meta.ai found no provider implementation or documentation. The v0.56.7 tree also has no Muse provider directory. The supplied related PRs implement dashboard spending or local token history rather than subscription windows. (Sources/CodexBarCore/Providers/ProviderManifest.swift, 170a4d41c6d6)
• Prior findings addressed: The current parser uses checked Int conversion and bounds reset dates; regression tests cover oversized durations and both reset windows through countdown formatting. The descriptor registers OAuth diagnostics, and docs/muse.md explains inline-token precedence. The earlier reviewed SHA was unavailable locally, so direct revision continuity could not be verified; the current fixes were inspected independently. (Sources/CodexBarCore/Providers/Muse/MuseUsageFetcher.swift:220, 47ab8a02de6f)
• Real subscription behavior proof: The supplied complete PR body, captured under sourceRevision cb00e8f507d021ab0248188fcc57b8f380f099d1e71bf00a744b5aa05c7ce738, reports a real codexbar usage --provider muse --json --source oauth run showing Muse Code Power Usage, 96% in both windows, durations of 300 and 10080 minutes, and exact confidence. This exercises the credential-to-fetch-to-snapshot path. The later packaging and launch report is supplemental, not the basis for subscription proof.
• Credential and network boundary: Muse reads a specific Keychain service/account through KeychainSecurity with KeychainNoUIQuery applied, accepts device-code tokens, and sends them to a fixed HTTPS Meta endpoint. The shared production HTTP client rejects cross-origin and non-HTTPS redirects. Returned inference keys and payment-method data are not projected into the usage snapshot. (Sources/CodexBarCore/Providers/Muse/MuseCredentials.swift:86, 47ab8a02de6f)
• Existing architecture supports this implementation: The provider authoring guide specifies descriptor-owned credentials, shared app/CLI fetch strategies, generated registration, and provider-local identity. This PR follows that integration shape, adds a disabled-by-default provider, and does not rewrite existing preferences or introduce a persisted schema. (docs/provider.md:1, 47ab8a02de6f)

Likely related people:

• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (4 earlier review cycles)

• reviewed 2026-09-05T08:59:13.099Z sha ce6791a :: blocked before merge. :: [P2] Check duration bounds before converting to Int | [P3] Register Muse login detection with the credential adapter | [P3] Document the auth file’s actual credential precedence
• reviewed 2026-09-05T19:51:34.300Z sha 0b131e7 :: blocked before merge. :: [P2] Bound reset timestamps before creating dates
• reviewed 2026-09-05T20:05:04.054Z sha c080982 :: needs maintainer review before merge. :: none
• reviewed 2026-09-07T08:36:28.857Z sha 7fb3d4c :: needs maintainer review before merge. :: none

[audreyt]

@clawsweeper re-review

Published fixes at 0b131e7 address all three findings: checked Int conversion rejects oversized duration values; an OAuth-only credential adapter reports prompt-free login diagnostics; auth documentation now states inline-token precedence over Keychain. Also fixed the SwiftFormat trailing blank line.

Verification: make check passed; all 12 Muse tests and ProviderArchitectureGatekeeperTests passed. The full make test run passed 78 groups before UsageStoreCachedTokenHydrationTests timed out. All remaining selections were then run successfully (1,020 of 1,021 selections passed overall). The identical isolated hydration-suite command also timed out after 180 seconds on clean PR base 4d27bb1, with Keychain access suppressed; this is not being reported as a fully green make test.

Please reassess the duration crash, login diagnostics, and documentation findings against the new published head.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[audreyt]

@clawsweeper re-review

Fixed the additional reset-timestamp finding in c080982. Both windows now omit reset timestamps beyond Date.distantFuture while preserving valid usage percentages. A parser → UsageSnapshot → countdown regression covers window and weekly independently: both cases failed before the fix and pass after it; the unaffected window retains its countdown.

The requested focused Muse/diagnose/diagnostic-export/architecture suites passed, as did make check. The full final-tree make test is running again; the previously documented hydration-suite timeout also reproduced on the exact PR base. Release bundle will be rebuilt and installed from this final head.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[audreyt]

Final verification for c080982: make check passed; the focused Muse/diagnose/diagnostic-export/architecture tests passed, including both new parser-to-countdown cases. The full make test again passed 78 groups and then hit the previously baseline-reproduced UsageStoreCachedTokenHydrationTests timeout. All 84 remaining non-hydration selections were subsequently run successfully. Full make test is not claimed green.

Release packaging succeeded, including strict ad-hoc code-signature verification, bundled CLI/resource probes with the source checkout inaccessible, and a six-second app launch smoke. Installed the final release build in /Applications/CodexBar.app; installed app and CLI SHA-256 hashes match the packaged build and the installed CLI reports 0.56.6.

Thanks for the re-review confirming all four findings addressed and no remaining blockers.