feat(oauth): add Muse Code subscription provider (muse-code-oauth) + fix muse-code apikey

[SIGTERM-015]

Summary

Adds a Muse Code subscription OAuth provider (muse-code-oauth) and fixes the existing muse-code API-key provider.

Included

• Device-flow OAuth provider (muse-code-oauth) against auth.meta.com using the public client_id (no secret).
• Mint of the subscription key via api.meta.ai/muse-code/key.
• Refresh = re-mint: access token is re-minted on 401/429 instead of a standard refresh-token exchange.
• Dual auth aliases: muse-code / mc plus muse-code-oauth / mco, with hiddenFromDashboard on the OAuth variant.
• Fix apikey baseUrl for muse-code: https://api.meta.ai/v1/responses; catalog entries corrected to the 5 muse-spark models.
• NO_PKCE handling for the device-flow provider; publicCreds and provider registry/consistency wiring updated.

Changed files

Production code in open-sse/ and src/; details:

• open-sse/config/providers/registry/muse-code/index.ts — apikey provider fix (baseUrl + model catalog)
• open-sse/config/providers/registry/muse/code/index.ts — new OAuth provider registration
• open-sse/services/tokenRefresh/providers/museCode.ts — re-mint refresh on 401/429
• src/lib/oauth/providers/muse-code.ts — device-flow implementation
• src/shared/constants/providers/oauth.ts, src/lib/oauth/constants/oauth.ts, registry/index wiring, src/app/api/v1/muse-code/models/route.ts, oauthTestConfig.ts

Related Issues

• N/A

Validation

• Change type: provider
• Focused tests and category gates from the golden path
• npm run lint (eslint clean)
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

Checks green before opening:

• Unit tests: 46/46 passing
• public-creds check: pass
• provider-consistency check: pass
• eslint: clean
• Frontier code review: APPROVED

Tests Added Or Updated

• tests/unit/muse-code-oauth-provider.test.ts (new — device flow + mint)
• tests/unit/muse-code-token-refresh.test.ts (new — re-mint on 401/429)
• tests/unit/muse-code-models.test.ts (updated — 5 muse-spark catalog)
• tests/unit/oauth-providers-config.test.ts (updated — dual-auth aliases, hiddenFromDashboard)
• tests/snapshots/provider/translate-path.json (updated snapshot)

Coverage Notes

All new production paths in src/lib/oauth/providers/muse-code.ts and open-sse/services/tokenRefresh/providers/museCode.ts are covered by the new unit tests above (device-flow start/poll, mint, re-mint on 401 and 429). No coverage decrease in touched files.

Reviewer Notes

• Public client_id only; nothing secret is committed — guarded by the public-creds check.
• muse-code-oauth is intentionally hiddenFromDashboard; use the dual auth aliases mc / mco.
• Refresh semantics deliberately differ from the standard refresh-token flow (re-mint); see museCode.ts.

[SIGTERM-015]

CI triage — every red below is pre-existing on release/v3.8.51 (4d1282b); none of the failing files is in this PR's diff. The review items raised here are already fixed in bcae7c3.

API Route Typecheck — src/app/api/v1/_shared/rerankProviderNodes.ts TS2677 and src/mitm/handlers/antigravity.ts TS2677 (baseline 0 → live 1 each).

Fast Quality Gates — 3 gates:

• mutation-test-coverage: 6 covering unit tests missing from stryker.conf.json for open-sse/services/accountFallback.ts, src/sse/services/auth.ts, open-sse/utils/error.ts, src/shared/utils/circuitBreaker.ts, open-sse/services/combo/comboStructure.ts, open-sse/handlers/chatCore/semanticCache.ts.
• pack-policy: httpClientAbortGuard.mjs missing from APP_STAGING_ALLOWED_EXACT_PATHS / PACK_ARTIFACT_REQUIRED_PATHS.
• check:dashboard-typecheck: proxySaveRefresh.test.tsx TS2698, src/mitm/handlers/antigravity.ts TS2677, src/shared/components/Sidebar.tsx TS2339 — all baseline 0 → live 1.

No new ESLint warnings — src/shared/services/cliRuntime.ts:5 (execFileSync unused), tests/unit/arena-elo-sync-redesign.test.ts:40,79, tests/unit/compression/compressionAnalyticsWriterFlatRate.test.ts:14, tests/unit/waitForServer-slow-first-response.test.mjs:30.

Docs Gates (fast-path) — docs/i18n/*/llm.txt must be byte-identical to root llm.txt. On base all 65 mirrors already differ (git show upstream/release/v3.8.51:docs/i18n/vi/llm.txt != base llm.txt). Root provider count goes 359 → 360 here, so the mirrors need the regen workflow either way.

Merge integrity — check:agent-skills-sync dry-run reports + omni-version-manager as GENERATED (exit 2). No skill surface is touched by this PR.

Unit Tests (4/4 shards) — all pre-existing:

• handleChat emergency-fallback on budget exhaustion (2 cases)
• i18n: pt-BR missing sidebar.pinItem / unpinItem / pinnedSection, vi key parity
• maxWaitMs=0 Bottleneck execution expiry
• provider-detail browser bundle: esbuild fails on EditConnectionModal.tsx:55 importing claudeConnectionFieldPatch / claudeConnectionFieldValues which ClaudeConnectionFields.tsx no longer exports
• pack-artifact / prepublish prune allowlists for httpClientAbortGuard.mjs and server-ws.mjs
• cliRuntime npm global prefix, qodercli.cmd under %APPDATA%\npm
• Node runner better-sqlite3, Qwen Code JSON parse
• .env.example drift: BRIDGE_PORT, CERT_DIR, OPENWA_SERVICE_PORT, ROUTER_URL
• t06 body validation: src/app/api/v1/responses/input_tokens/route.ts
• case-collision fix(startup): webpack casing collision (ReasoningControls.tsx / reasoningControls.ts) breaks build #6584, retired-asset reference, T28 Gemini Flash default, mimo-v2.5 heuristic, unslop phrase removal

Fixed in bcae7c3: provider registry flags + reserved-prefix guard test, docs counts (359 → 360 across README / llm.txt / provider reference), file-complexity cap on the new OAuth module, and the Meta ToS notice for muse-code-oauth (riskNoticeVariant: "oauth" plus authHint) so the connection modal warns before the unofficial path. Vitest (fast-path) and Change Classification are green, and the muse-code unit tests pass inside the failing shards — the shard reds come from the unrelated tests listed above.

[diegosouzapw]

This is a clean implementation and the way it reuses the central tokenRefresh.ts abstraction
(case "muse-code-oauth" alongside codex/kiro/copilot) is exactly the "reuse the existing
subscription-CLI abstractions" approach the issue asked for — and separating a mint-endpoint 401
(OIDC token dead, force re-login) from a 429 (transient, keep the key) is the right contract call.

We're landing #13634 as the base for this feature: it was opened a few days earlier, implements the
same mint + remint lifecycle, and has since been live-verified end to end against real Meta servers.
So this would be closed as subsumed once that merges rather than merged itself. Two things worth
fixing regardless of the outcome: the branch is currently in a conflicting state and needs a rebase,
and CI is flagging real (not base-inherited) new ESLint warnings plus a missing changelog fragment
for the Merge-integrity gate — the other red gates you see are inherited from base-red #14496. One
cosmetic note if you do rebase: the registry directory reads registry/muse/code/ where the
convention would be registry/muse-code-oauth/.

[diegosouzapw]

Re-homed to release/v3.8.52: v3.8.51 entered its release freeze, so the branch now belongs to the release captain and development continues on the next cycle. Nothing is wrong with this PR — it just needed a live base. No action needed from you; CI will re-run against the new base.

[diegosouzapw]

Thanks @SIGTERM-015 — the Muse Code OAuth implementation (device flow, re-mint refresh, ToS notice, resolvePublicCred usage) was solid. The Muse Code device login has since landed on the release branch via #14329 (same provider id for API-key and OAuth), so this PR is now redundant. Closing as superseded by #14329. Thank you for the contribution.