Add Muse Code subscription usage windows

[audreyt]

Summary

Adds Muse Code as provider #70 with subscription visualization (the 5-hour and weekly windows Meta added for Everyday / High / Power Usage). Existing Muse PRs do not cover this:

• [codex] Add Muse browser usage, spend, and token display #2936 dashboard PAYG spend
• Add Muse provider (Meta Muse) #3340 / feat(provider): add Muse local token usage #3371 local session tokens, no quota

Closes the gap called out on #3409 and #3340.

How it works

muse login stores a device-code dca: token in Keychain (ai.meta.dev.credentials / meta). CodexBar reads it with KeychainNoUIQuery (no prompt) and POSTs https://api.meta.ai/muse-code/key. The mint payload includes is_subs_active, subs_tier_name, and subs_usage.{window,weekly} (used_percent, window_duration_mins, resets_at).

Dashboard LLM_ keys and Muse-minted LLM| inference keys 401 on that mint endpoint and are not used.

Live proof (this desk)

codexbar usage --provider muse --json --source oauth
provider=muse source=oauth
plan=Muse Code Power Usage
5h=96% windowMinutes=300
weekly=96% windowMinutes=10080
dataConfidence=exact

Card last-four is not displayed.

Tests

swift test --filter 'MuseUsageFetcherTests|ProviderArchitectureGatekeeperTests' — 51 passed.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T08:52:33.190319Z	16eb517	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approval recommended

The Muse provider integration is self-contained, covered by focused tests, and the only feedback is a minor improvement to diagnostic detail.

Pull request overview

Adds first-class Muse Code support focused on subscription usage visualization (rolling 5-hour + weekly windows) by minting quota data from Meta’s /muse-code/key endpoint using the Muse CLI’s device-code (dca:) token, and updates project docs/site copy to reflect the new provider count.

Changes:

• Added Muse provider plumbing (descriptor, credentials reader, OAuth fetch strategy, usage fetcher + snapshot mapping).
• Added focused Swift Testing coverage for Muse mint parsing/credential handling and updated architecture fingerprints.
• Updated docs/site/changelog to include Muse and bump “69 → 70 providers”.

File summaries

File	Description
Tests/CodexBarTests/ProviderArchitectureGatekeeperTests.swift	Updates expected provider/branding fingerprints for the new provider set.
Tests/CodexBarTests/MuseUsageFetcherTests.swift	Adds parsing + transport + credential-safety tests for Muse subscription minting.
Sources/CodexBarCore/Providers/Providers.swift	Registers new UsageProvider.muse case.
Sources/CodexBarCore/Providers/ProviderManifest.swift	Adds Muse descriptor to the core manifest.
Sources/CodexBarCore/Providers/ProviderInstanceIDAliases.generated.swift	Adds .muse instance ID alias.
Sources/CodexBarCore/Providers/Muse/MuseUsageFetcher.swift	Implements mint request/validation + response parsing into a usage snapshot.
Sources/CodexBarCore/Providers/Muse/MuseProviderDescriptor.swift	Defines Muse metadata/branding and OAuth-only fetch pipeline.
Sources/CodexBarCore/Providers/Muse/MuseCredentials.swift	Reads Muse login state/token from auth.json + Keychain (no-UI query).
Sources/CodexBar/Resources/ProviderIcon-muse.svg	Adds Muse provider icon resource.
Sources/CodexBar/Providers/Shared/ProviderImplementationManifest.swift	Registers Muse provider implementation in the app layer.
Sources/CodexBar/Providers/Muse/MuseProviderImplementation.swift	Adds app-layer availability/presentation wiring for Muse.
README.md	Adds Muse to provider list and updates “70 providers” marketing copy.
docs/social.html	Updates landing-page provider count to 70.
docs/site-locales.mjs	Updates localized provider-count strings across supported locales.
docs/providers.md	Updates provider count and adds Muse fetch-strategy row.
docs/provider-ids.md	Adds muse to the documented provider ID list.
docs/muse.md	New provider doc describing auth, data shown, and privacy notes.
docs/llms.txt	Updates provider count in LLM-readable summary.
docs/index.html	Updates meta/og copy and on-page provider count to 70.
CHANGELOG.md	Adds unreleased entry for Muse subscription windows.

Review details

• Files reviewed: 19/20 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[clawsweeper]

Codex review: needs changes before merge. Reviewed September 8, 2026, 4:51 PM ET / 20:51 UTC (Revision 6).

ClawSweeper review

What this changes

Adds Muse Code subscription tracking through the CLI login, showing five-hour and weekly usage windows in CodexBar.

Merge readiness

⛔ Needs changes before merge - 2 items remain

This remains a useful, distinct contribution with sufficient live proof. Earlier functional findings are addressed; one minor release-note placement issue remains.

Priority: P2
Reviewed head: 54af11d3f7c56bea319bd157dbc5a0be58938dce

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused provider implementation with relevant live output and regression coverage; one minor documentation correction remains.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The captured PR body shows the real OAuth CLI entrypoint returning both subscription windows from a Muse account; the core credential, descriptor, and fetcher blobs remain identical to the previous reviewed head.
Patch quality	🐚 platinum hermit (4/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The captured PR body shows the real OAuth CLI entrypoint returning both subscription windows from a Muse account; the core credential, descriptor, and fetcher blobs remain identical to the previous reviewed head.
Evidence reviewed	11 items	Applicable repository policy: Read the full root AGENTS.md. A repository-wide search found no nested AGENTS.md files, and .agents contains no maintainer-notes directory. Applied provider isolation, prompt-free Keychain access, and focused validation guidance. Still necessary on main and in the latest release: Whole-word Muse searches found no provider implementation in fetched main or v0.57.0. The introduced delta adds its descriptor, implementation, credentials, fetcher, and registrations. Prior findings addressed: The current parser uses Int(exactly:) for duration conversion and bounds reset timestamps by Date.distantFuture. The descriptor registers OAuth diagnostics, and the provider documentation explains inline-token precedence. Focused regression cases cover the earlier numeric failures.
Findings	1 actionable finding	[P3] [P3] Move the Muse entry into the current Unreleased section
Security	None	None.

How this fits together

CodexBar’s provider pipeline reads Muse credentials and requests subscription usage from Meta. It converts the response into the shared usage model consumed by the CLI and menu-bar app.

flowchart LR
  A[Muse CLI login] --> B[Credential selection]
  C[Optional auth file] --> B
  B --> D[Meta subscription endpoint]
  D --> E[Validate subscription windows]
  E --> F[Shared usage snapshot]
  F --> G[CLI and menu bar]

Loading

Before merge

• [P3] Move the Muse entry into the current Unreleased section (P3) - This entry advertises Muse support in already-published 0.56.6, although the provider is absent even from v0.57.0. Release automation reads the current changelog section, so the entry would also be missing from the release that ships it. Move it under the current Unreleased heading. This is a late discovery: the same misplaced entry was visible at the previous reviewed head.
• Complete next step (P2) - Move the Muse release note into the current Unreleased section.

Findings

• [P3] [P3] Move the Muse entry into the current Unreleased section — CHANGELOG.md:92-93

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test growth	Production Swift +573; tests +361/-2; icon +3	Growth implements a new provider with dedicated credential, parsing, transport, and registration coverage.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #3409
Summary: This PR is a candidate for the subscription-window portion of the broader Muse support request.

Members:

• canonical: Support Meta Muse Code (Muse Spark) #3409 - Requests Muse support including subscription request windows.
• adjacent_distinct: [codex] Add Muse browser usage, spend, and token display #2936 - Tracks dashboard spend and tokens rather than subscription quota.
• adjacent_distinct: Add Muse provider (Meta Muse) #3340 - Tracks local token history without subscription windows.
• adjacent_distinct: feat(provider): add Muse local token usage #3371 - Closed unmerged local-token implementation, not a replacement for this quota path.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

Keep the focused subscription provider on the shared pipeline and document its availability in the release that first ships it.

Do we have a high-confidence way to reproduce the issue?

Not applicable to the provider addition; the supplied live CLI output demonstrates the new behavior. The release-note placement defect is directly verifiable from source and release metadata.

Is this the best way to solve the issue?

Yes, the implementation follows the shared provider architecture and supplies a CLI credential path unavailable to local plugins; only the release-note placement needs correction.

Full review comments:

• [P3] [P3] Move the Muse entry into the current Unreleased section — CHANGELOG.md:92-93
  This entry advertises Muse support in already-published 0.56.6, although the provider is absent even from v0.57.0. Release automation reads the current changelog section, so the entry would also be missing from the release that ships it. Move it under the current Unreleased heading. This is a late discovery: the same misplaced entry was visible at the previous reviewed head.
  Confidence: 0.99
  Late finding: first raised on code an earlier review cycle already covered.

Overall correctness: patch is correct
Overall confidence: 0.92

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 928166f89947.

Labels

Label justifications:

• P2: Adds useful subscription visibility for one provider with a limited product footprint.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The captured PR body shows the real OAuth CLI entrypoint returning both subscription windows from a Muse account; the core credential, descriptor, and fetcher blobs remain identical to the previous reviewed head.
• proof: sufficient: Contributor real behavior proof is sufficient. The captured PR body shows the real OAuth CLI entrypoint returning both subscription windows from a Muse account; the core credential, descriptor, and fetcher blobs remain identical to the previous reviewed head.

Evidence

Acceptance criteria:

• [P1] git diff --check.
• [P1] git diff -- CHANGELOG.md.
• [P1] rg -n '^## |^### Added|Muse Code:' CHANGELOG.md.

What I checked:

• Applicable repository policy: Read the full root AGENTS.md. A repository-wide search found no nested AGENTS.md files, and .agents contains no maintainer-notes directory. Applied provider isolation, prompt-free Keychain access, and focused validation guidance. (AGENTS.md:1, 54af11d3f7c5)
• Still necessary on main and in the latest release: Whole-word Muse searches found no provider implementation in fetched main or v0.57.0. The introduced delta adds its descriptor, implementation, credentials, fetcher, and registrations. (Sources/CodexBarCore/Providers/ProviderManifest.swift:7, 928166f89947)
• Prior findings addressed: The current parser uses Int(exactly:) for duration conversion and bounds reset timestamps by Date.distantFuture. The descriptor registers OAuth diagnostics, and the provider documentation explains inline-token precedence. Focused regression cases cover the earlier numeric failures. (Sources/CodexBarCore/Providers/Muse/MuseUsageFetcher.swift:255, 54af11d3f7c5)
• Real subscription proof: The supplied complete PR body, captured under sourceRevision cb00e8f507d021ab0248188fcc57b8f380f099d1e71bf00a744b5aa05c7ce738, records a real OAuth CLI run returning Muse Code Power Usage, 96% for both windows, and durations of 300 and 10080 minutes. This exercises the new credential-to-fetch-to-snapshot path. The author separately reports focused tests, packaging, and installed-bundle verification; the full suite was explicitly not claimed green because a hydration timeout also reproduced on the base.
• Re-review continuity: GitHub contents reads at the previous reviewed head and current head returned identical blobs for all three core Muse files: credentials 67fded857d5d9d9d0a6b49a7e2cdd9d69415e09a, descriptor 9c2bcd553caa4fdefe4265809b661261a2b01dbb, and fetcher 49642929ddddc833af8218b423284ed5b3cbbbad. Local historical comparison failed fetching unavailable objects with HTTP 403; exact-revision GitHub reads supplied the relevant continuity evidence. (Sources/CodexBarCore/Providers/Muse/MuseUsageFetcher.swift:1, 54af11d3f7c5)
• Credential and transport boundary: Credentials are read through the existing no-UI Keychain helper, and only a device-code token is sent to the fixed HTTPS Meta endpoint. The shared HTTP client rejects cross-origin and non-HTTPS redirects. Minted inference keys and payment details are not retained in the usage model. (Sources/CodexBarCore/ProviderHTTPClient.swift:231, 54af11d3f7c5)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Move the Muse changelog entry from 0.56.6 into the current Unreleased section.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-09-05T08:59:13.099Z sha ce6791a :: blocked before merge. :: [P2] Check duration bounds before converting to Int | [P3] Register Muse login detection with the credential adapter | [P3] Document the auth file’s actual credential precedence
• reviewed 2026-09-05T19:51:34.300Z sha 0b131e7 :: blocked before merge. :: [P2] Bound reset timestamps before creating dates
• reviewed 2026-09-05T20:05:04.054Z sha c080982 :: needs maintainer review before merge. :: none
• reviewed 2026-09-07T08:36:28.857Z sha 7fb3d4c :: needs maintainer review before merge. :: none
• reviewed 2026-09-07T16:11:48.055Z sha 47ab8a0 :: needs maintainer review before merge. :: none

[audreyt]

@clawsweeper re-review

Published fixes at 0b131e7 address all three findings: checked Int conversion rejects oversized duration values; an OAuth-only credential adapter reports prompt-free login diagnostics; auth documentation now states inline-token precedence over Keychain. Also fixed the SwiftFormat trailing blank line.

Verification: make check passed; all 12 Muse tests and ProviderArchitectureGatekeeperTests passed. The full make test run passed 78 groups before UsageStoreCachedTokenHydrationTests timed out. All remaining selections were then run successfully (1,020 of 1,021 selections passed overall). The identical isolated hydration-suite command also timed out after 180 seconds on clean PR base 4d27bb1, with Keychain access suppressed; this is not being reported as a fully green make test.

Please reassess the duration crash, login diagnostics, and documentation findings against the new published head.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[audreyt]

@clawsweeper re-review

Fixed the additional reset-timestamp finding in c080982. Both windows now omit reset timestamps beyond Date.distantFuture while preserving valid usage percentages. A parser → UsageSnapshot → countdown regression covers window and weekly independently: both cases failed before the fix and pass after it; the unaffected window retains its countdown.

The requested focused Muse/diagnose/diagnostic-export/architecture suites passed, as did make check. The full final-tree make test is running again; the previously documented hydration-suite timeout also reproduced on the exact PR base. Release bundle will be rebuilt and installed from this final head.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[audreyt]

Final verification for c080982: make check passed; the focused Muse/diagnose/diagnostic-export/architecture tests passed, including both new parser-to-countdown cases. The full make test again passed 78 groups and then hit the previously baseline-reproduced UsageStoreCachedTokenHydrationTests timeout. All 84 remaining non-hydration selections were subsequently run successfully. Full make test is not claimed green.

Release packaging succeeded, including strict ad-hoc code-signature verification, bundled CLI/resource probes with the source checkout inaccessible, and a six-second app launch smoke. Installed the final release build in /Applications/CodexBar.app; installed app and CLI SHA-256 hashes match the packaged build and the installed CLI reports 0.56.6.

Thanks for the re-review confirming all four findings addressed and no remaining blockers.