feat: add Muse (Meta) provider - #2936
Conversation
- Adds UsageProvider.muse with API-key auth (MUSE_API_KEY / META_API_KEY / META_MUSE_API_KEY) - Balance-only provider with flexible billing probe (billing/usage, me/balance, credits) falling back to /v1/models validation - Supports custom base URL via MUSE_API_URL or Settings for proxies/self-hosted gateways - Registers descriptor, fetch strategy, settings UI, icon, and docs/muse.md - Regenerates manifests (ProviderManifest, ProviderImplementationManifest, provider-ids) Fixes: Muse API not visible in CodexBar. Pricing is $1.25/4.25 per 1M tokens via api.meta.ai; this provider validates the key and shows balance where the API exposes it.
|
🦞👀 Pull request received. I will update this pull request when review starts. |
- widgetFingerprint 16873014858015536126 -> 1384715300343528903 - burnDownFingerprint 8686456525451224704 -> 5817880812814024010 - balanceOnly set now includes .muse alongside deepseek/deepinfra/mistral/moonshot/poe
clawsweeper
Bot
added
merge-risk: 🚨 security-boundary
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3bc93d6c2d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| widgetSelectable: false, | ||
| isPrimaryProvider: false, | ||
| usesAccountFallback: false, | ||
| balanceOnly: true, |
There was a problem hiding this comment.
Setting balanceOnly here adds .muse to descriptors.filter(\.metadata.balanceOnly), but ProviderArchitectureGatekeeperTests.swift:196-198 still asserts the exact set without Muse, so the full test suite will deterministically fail. Update that fixture and add focused Muse coverage alongside the new provider.
AGENTS.md reference: AGENTS.md:L20-L24
Useful? React with 👍 / 👎.
| primary: nil, | ||
| secondary: nil, | ||
| tertiary: nil, | ||
| providerCost: nil, |
There was a problem hiding this comment.
When a billing endpoint returns a balance, this snapshot leaves all rate/detail fields nil and stores the value only in identity.loginMethod. StatusItemController.menuBarDisplayText has explicit extraction branches for every existing balance-only provider but none for .muse, so it falls through with no percent window and returns no balance text when Muse is selected in the menu bar. Add a Muse balance extractor or represent the balance in a field consumed by the generic renderer.
Useful? React with 👍 / 👎.
| } catch { | ||
| if let last = lastError { throw last } | ||
| throw error |
There was a problem hiding this comment.
If any speculative billing endpoint first returns a non-404 error or an unparseable 2xx response, lastError is populated; if the authoritative models probe then returns 401/403, this catch discards its explicit “invalid API key” error and reports the stale billing error instead. This misdiagnoses invalid credentials whenever an earlier optional billing probe failed, so authentication errors from the fallback probe should take precedence.
Useful? React with 👍 / 👎.
clawsweeper
Bot
added
rating: 🦪 silver shellfish
|
Codex review: needs changes before merge. Reviewed August 26, 2026, 2:33 AM ET / 06:33 UTC. ClawSweeper reviewWhat this changesThis PR adds a Meta Muse provider with direct API balance/model checks and optional dev.meta.ai Team-usage retrieval. Merge readinessKeep open: the latest commit resolves the prior web-only availability blocker, but API-key users still cannot select the implemented Off mode to prevent automatic browser-session imports. Priority: P1 Review scores
Verification
How this fits togetherCodexBar turns provider credentials or browser sessions into usage snapshots, then shows those snapshots in the menu bar and provider settings. Muse adds a web-dashboard path plus a direct Meta API fallback to that shared provider pipeline. flowchart LR
A[Provider settings] --> B[Muse source selection]
B --> C[Dashboard session fetch]
B --> D[Meta API probe]
C --> E[Usage snapshot]
D --> E
E --> F[Menu bar and settings views]
Before merge
Findings
Agent review detailsSecurityNeeds attention: The PR safely filters imported cookies, but its settings UI does not let API-key users disable automatic browser-session access. Review metrics
Merge-risk optionsMaintainer options:
Copy recommended automerge instructionTechnical reviewBest possible solution: Expose an API-only/Off cookie-source choice, keep Chrome import explicitly optional, then rebase and verify both API-only and session-backed refreshes. Do we have a high-confidence way to reproduce the issue? Yes (source-reproducible): the settings picker excludes Off while auto mode runs web before API and can import Chrome cookies; no live account access was used in this review. Is this the best way to solve the issue? No: the provider already implements Off handling, so exposing that mode is the narrowest way to preserve an API-only flow without redesigning the fetch pipeline. Full review comments:
Overall correctness: patch is incorrect AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against dfc176cdf945. LabelsLabel changes:
Label justifications:
EvidenceSecurity concerns:
Acceptance criteria:
What I checked:
Likely related people:
Rank-up movesOptional improvements that raise the rating; they are not merge blockers.
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
HistoryReview history (19 earlier review cycles; latest 8 shown)
|
…uard - P1: add museBalanceDisplayText and menuBarDisplayText branch for .muse so balance/probe result from loginMethod is rendered (mirrors moonshot/poe). Fixes empty menu-bar text. - P2: preserve authoritative 401/403 from /v1/models probe over stale billing lastError. - P2/security: validate base URL — require https, allow only http://localhost/127.0.0.1/::1 for local proxy, reject insecure hosts before sending Bearer token.
clawsweeper
Bot
added
rating: 🧂 unranked krab
- StatusItemController+Animation.swift:923 now clusters mistral+kiro+cursor (3) instead of kiro+cursor (2) after inserting muse branch at 917; add Provider-specific by design comment to justify the expanded window. - Tests: update AllowedProviderConstruct at 926->923, anchor kiro->mistral, fingerprint [kiro@0,cursor@8]/2 -> [mistral@0,kiro@9,cursor@17]/3. Gatekeeper now 38/38 pass.
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. |
clawsweeper
Bot
added
merge-risk: 🚨 auth-provider
- parseModelsCount now throws parseFailed when data/models array is missing instead of returning nil and incorrectly reporting 'API key valid'.
- ClawSweeper auth-provider finding: prevents {} from being accepted as successful validation.
- MuseUsageFetcher: require numeric balance for billing success (currency-only now correctly falls through to models probe instead of false 'API key valid'). Fixes P2 at 253-254.
- Tests: add MuseUsageFetcherTests (12 cases) covering balance parsing, empty/currency-only rejection, models count and rejection of {} / missing array, Bearer/Accept/timeout headers, https guard (evil.com blocked, localhost allowed), 401 precedence over 500, balance preferred over fallback, and missing key. Provides controlled-transport coverage for the 319-line fetcher.
- README, docs/providers.md, docs/social.html, docs/llms.txt, docs/index.html, docs/site-locales.mjs: 69 -> 70 providers after Muse addition (check-site-locales.mjs requires exact count) - docs/providers.md: add Muse table row + detailed section - MuseUsageFetcher: refactor Generic decode + fallback scan to nil-coalescing to satisfy statement_position lint, fix multiline_parameters for fetchBalance - MuseProviderDescriptor: split noDataMessage for line_length - MuseSettingsReader: explicit self (redundantSelf) - MuseUsageFetcherTests: fix encoded delimiter test to use %2F (hostHasNoEncodedDelimiters only rejects %2f/%40 etc, not %2e), fix fatalError message - ProviderArchitectureGatekeeperTests: line 923->924 after comment wrap (line_length) shifted mistral anchor - StatusItemController+Animation: comment wrap from swiftformat make check: PASS (0 violations), swift build PASS, swift test MuseUsageFetcherTests 15/15 PASS, ProviderArchitectureGatekeeper 38/38 PASS
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
clawsweeper
Bot
added
the
rating: 🐚 platinum hermit
Replace generic total_tokens search with parseTeamUsage that sums categorical_data for num_requests/num_prompt_tokens/ num_completion_tokens/usage_billable_cost (amount_with_offset cents->dollars) per verified 2026-08-15 GraphQL response (4814 req / 589M prompt / .59). Produces Team usage snapshot with cost.
ff10147 to
ddc68d3
Compare
Manual cookie (llm_sess+datr) harvests no team_id/fb_dtsg from HTML, causing 1357004. Use verified HAR fallbacks swTyN9fDdqKU_GTgO9R99v / NAfztM7dBcJpLZ... for GraphQL.
clawsweeper
Bot
added
rating: 🦪 silver shellfish
|
Verified via ```
$ curl https://dev.meta.ai/api/graphql/ -b "datr=...; llm_sess=..." --data-raw "doc_id=27710687895239709&variables={"team_id":"3747295692075251",...}" $ codexbar config dump --show-secrets | grep muse Fallback remains Branch |
Build dailyPoints from categorical_data (prompt+output tokens + cost per day) and expose as ProviderDetailSection Daily usage table in UsageSnapshot.details for the Muse detail sheet.
clawsweeper
Bot
added
proof: sufficient
Use UsageFormatter.tokenCountString for tokens (623M vs 622576992) and NumberFormatter decimal/currency for requests and cost per Locale.current. Applies to main snapshot, fallback parseUsageAPI and daily detail rows.
clawsweeper
Bot
added
rating: 🦪 silver shellfish
- Cookie isolation: filter imported cookies to dev.meta.ai destination URL (domain/path/secure) per RFC 6265, avoiding cross-origin forwarding of unrelated facebook.com cookies to dev.meta.ai - Default automatic import to Chrome only (P2), matching repo policy AGENTS.md:48 and other browser-web providers - Add MuseCookieImporterTests covering P1/P2 regressions Addresses ClawSweeper P1/P2 on PR steipete#2936 (05aa359)
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
- Scope: filter BrowserCookieRecord by scope before converting to HTTPCookie, hostOnly cookies only sent to exact host (dev.meta.ai), domain cookies allow suffix. Preserves BrowserCookieRecord.scope per ZoomMate precedent and SweetCookieKit 0.5.2. Adds isSendable/isPathApplicable and hostOnly regression test. - Web: remove hard-coded HAR fallback LSD/DTSG and Comet params (av, __rev, __hs etc) from MuseWebUsageFetcher GraphQL body. Only use tokens extracted from active HTML session; otherwise omit and fall back to API probe per review. Addresses ClawSweeper P1s on PR steipete#2936 (5556c11) - scope + HAR.
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. |
clawsweeper
Bot
added
rating: 🦐 gold shrimp
- isAvailable now checks configured web mode (auto/manual) without importing browser cookies, so a user with dev.meta.ai session but no API key is not hidden before MuseWebFetchStrategy runs. - Adds MuseProviderImplementationTests covering auto/manual/off. Addresses ClawSweeper P1 on PR steipete#2936 (b284ee8) - web-only availability.
|
@clawsweeper re-review fix(muse): allow web-only sessions to enable provider (138c5d8) — isAvailable now respects configured cookie source (auto/manual) without importing browser cookies, so a user with dev.meta.ai session but no API key is not hidden before MuseWebFetchStrategy runs. Added MuseProviderImplementationTests (5 cases). Lint fix (blankLinesBetweenImports). Pushed b284ee8..138c5d8. |
|
🦞🧹 I asked ClawSweeper to review this item again. |
clawsweeper
Bot
added
merge-risk: 🚨 security-boundary
2 participants
Summary
Adds native Muse (Meta) support to CodexBar — previously un-tracked. Muse's Meta Model API (
https://api.meta.ai, modelmuse-spark-1.1, pricing$1.25/$4.25per 1M) had no provider; users proxying via OpenRouter paid the 5.5% credit fee and lost direct visibility.Provider design
MUSE_API_KEY/META_API_KEY/META_MUSE_API_KEYenv or~/.codexbar/config.json(museapiKey). Projects toMUSE_API_KEYfor CLI (codexbar usage --provider muse).https://api.meta.ai, overridable via Settings → Providers → Muse → API base URL orMUSE_API_URL(enables LiteLLM/self-hosted proxies while keeping visibility). Validated viaProviderEndpointOverrideValidator().validatedURLAllowingLoopbackHTTP— requireshttps://, allows onlyhttp://localhost/127.0.0.1/::1for local proxy, rejects user info (user:pass@host), encoded host delimiters (%2f/%40etc.), missing/unsafe hosts, before sendingAuthorization: Bearer. Covered by focused tests.MuseAPIFetchStrategy(.apionly) →MuseUsageFetcher:/v1/billing/usage,/v1/me/balance,/v1/billing/subscription,/v1/credits— flexible JSON parser handlesavailable_balance/balance/total_balance(string or number) in root ordataenvelope. Rejects currency-only payloads (requires numeric balance).GET /v1/modelsvalidation — returnsAPI key valid · N models availablewhen billing is not yet exposed. Both paths useAuthorization: Bearer <key>, 15s timeout, 404 tries next, 401/403 surfaces as invalid key (models-probe 401 now takes precedence over stale billing lastError). Rejects malformed{}withparseFailed: Models response missing data/models arrayinstead of incorrectly reportingAPI key valid.balanceOnly: true(identity-only, no rate windows) — pay-as-you-go API, consistent with Moonshot/DeepSeek billing-only providers.https://ai.developer.meta.com/. Branding: Meta blue#0064E0, confetti[#0064E0, #0469FF, #7B61FF], iconProviderIcon-muse.svg. AddedmuseBalanceDisplayText+menuBarDisplayTextbranch for.museso balance renders (mirrorsmoonshot/poe).Files
Sources/CodexBarCore/Providers/Muse/MuseProviderDescriptor.swift— descriptor +MuseAPIFetchStrategy+ProviderConfig.baseURLextension (nowpublic)Sources/CodexBarCore/Providers/Muse/MuseUsageFetcher.swift— HTTP + parsers for balance + models count, shared validator, preserved 401 handling, malformed{}rejectionSources/CodexBarCore/Providers/Muse/MuseSettingsReader.swift— env resolution for keys + base URLSources/CodexBarCore/Providers/Muse/MuseProviderSettings.swift—MuseProviderSettings+MuseProviderSettingsKeySources/CodexBar/Providers/Muse/MuseProviderImplementation.swift— UI hooks, availability, settings fieldsSources/CodexBar/Providers/Muse/MuseSettingsStore.swift—SettingsStoreextension for token + baseURLSources/CodexBar/Resources/ProviderIcon-muse.svg— iconSources/CodexBar/StatusItemController+Animation.swift—museBalanceDisplayText+ menu-bar branch, plus// Provider-specific by designfor expandedmistral+kiro+cursorclusterdocs/muse.md— provider docs (data sources, endpoints, key files, CLI)docs/providers.md— added Muse row + detailed section (70 providers total)Sources/CodexBarCore/Providers/Providers.swift—case museProviderManifest.swift,ProviderImplementationManifest.swift,ProviderInstanceIDAliases.generated.swift,docs/provider-ids.mdviaScripts/regenerate-provider-manifests.shREADME.md,docs/social.html,docs/llms.txt,docs/index.html,docs/site-locales.mjs(69->70) percheck-site-locales.mjsTests/CodexBarTests/ProviderArchitectureGatekeeperTests.swift— updatedwidgetFingerprint/burnDownFingerprintandbalanceOnly+ allowlisted cluster (mistral@0,kiro@9,cursor@17at 924)Tests/CodexBarTests/MuseUsageFetcherTests.swift— 15 tests: balance shapes, currency-only rejection, models count, malformed{}, Bearer header, https guard, user-info/encoded/missing-host rejection, http localhost allowed, 401 precedence, balance 200 preferredVerification
make check— PASS (0 violations, 0 serious in 1882 files)swift build— passswift test --filter ProviderArchitectureGatekeeper— 38/38 passswift test --filter MuseUsageFetcherTests— 15/15 passScripts/regenerate-provider-manifests.sh --check—Provider manifests are current (70 providers)Follow-ups
Meta billing endpoint is not publicly documented in
ai.developer.meta.com/docs; parser is intentionally lenient and the models-probe fallback guarantees the provider is useful on day one.Fixes: adds Muse alongside existing
openrouter/litellmoptions so users no longer need to pay OpenRouter 5.5% just for visibility.Contribution guide compliance
UsageProvidercase, descriptor inCodexBarCore, implementation inCodexBar,regenerate-provider-manifests.sh, icon, widgetSelectable false, focused tests,docs/muse.md+docs/providers.mdentrymake check(SwiftFormat + SwiftLint) — 0 violations