opencode-muse-auth 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 TheStreamCode
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,5 @@
+Flow parameters compatible with the published behavior of oh-my-pi
+(https://github.com/can1357/oh-my-pi), MIT-licensed (c) 2025 Mario Zechner,
+(c) 2025-2026 Can Bölük, (c) 2026 Stencil Labs, Inc. No oh-my-pi code is
+vendored here; the device-code exchange is an independent implementation.
+No oh-my-pi branding appears in the user experience.

package/README.md

@@ -0,0 +1,53 @@
+# opencode-muse-auth
+
+Use Meta **Muse Spark** in [opencode](https://opencode.ai) billed to your
+**Muse Code monthly subscription** — no pay-as-you-go API key, no third-party CLI.
+
+## Install
+
+```jsonc
+// opencode.json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": ["opencode-muse-auth"]
+}
+```
+
+Then run `/connect` in opencode, pick the `meta` provider and the
+*Muse Code subscription* method: it shows a Meta device page URL and a code.
+Enter the code in your browser (your own Meta account) and the login
+completes by itself.
+
+## Requirements
+
+- opencode with plugin support
+- A Meta account with an active Muse Code subscription
+
+## How it works
+
+The plugin registers an `auth` hook for the built-in `meta` provider
+(Routes through the Responses API, `meta.txt` system prompt applies
+automatically to `muse-*` model ids):
+
+- **Login** — Meta device-code exchange (RFC 8628) inside `/connect`, then
+  mints the stable account-bound inference key via the Model API. The key is
+  cached locally (`~/.config/opencode/muse-code-sub.json`, owner-only
+  permissions where supported) and never printed.
+- **Runtime** — an auth `loader` injects the cached key on every startup.
+  The mint endpoint is aggressively rate-limited, so the plugin never
+  re-mints on its own; re-run `/connect` only if access is revoked (401).
+
+Flow parameters are compatible with the published behavior of oh-my-pi (MIT);
+see [NOTICE](NOTICE).
+
+## Development
+
+```sh
+npm install
+npm run build
+npm test
+```
+
+## License
+
+MIT — see [LICENSE](LICENSE).

package/dist/auth.d.ts

@@ -0,0 +1,24 @@
+export declare const CLIENT_ID = "1031625952748946";
+export declare const DEVICE_URL = "https://auth.meta.com/oidc/device/authorization/";
+export declare const TOKEN_URL = "https://auth.meta.com/oidc/device/token/";
+export declare const KEY_URL = "https://api.meta.ai/muse-code/key";
+export declare const CACHE_PATH: string;
+export interface DeviceAuthorization {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete?: string;
+    interval: number;
+    expires_in: number;
+}
+export interface MintedCredential {
+    oauthAccessToken: string;
+    apiKey: string;
+    accountId: string;
+    email?: string;
+}
+export declare function readCache(path?: string): Promise<string>;
+export declare function writeCache(credentials: MintedCredential, path?: string): Promise<void>;
+export declare function deviceAuthorize(): Promise<DeviceAuthorization>;
+export declare function pollToken(deviceCode: string, intervalS: number, expiresInS: number): Promise<string>;
+export declare function mintKey(accessToken: string): Promise<MintedCredential>;

package/dist/auth.js

@@ -0,0 +1,149 @@
+// Shared Meta device-login logic (no third-party CLI).
+// Flow parameters are compatible with the published behavior of oh-my-pi
+// (MIT-licensed; see NOTICE).
+import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
+export const CLIENT_ID = "1031625952748946";
+export const DEVICE_URL = "https://auth.meta.com/oidc/device/authorization/";
+export const TOKEN_URL = "https://auth.meta.com/oidc/device/token/";
+export const KEY_URL = "https://api.meta.ai/muse-code/key";
+export const CACHE_PATH = join(homedir(), ".config", "opencode", "muse-code-sub.json");
+const HEADERS = {
+    Accept: "application/json",
+    "x-api-version": "1.0.0",
+};
+const REQUEST_TIMEOUT_MS = 25_000;
+const MIN_INTERVAL_S = 1;
+const SLOW_DOWN_STEP_S = 5;
+export async function readCache(path = CACHE_PATH) {
+    try {
+        const blob = (await readFile(path, "utf8").then(JSON.parse));
+        return typeof blob?.apiKey === "string" && blob.apiKey.trim() ? blob.apiKey.trim() : "";
+    }
+    catch {
+        return "";
+    }
+}
+export async function writeCache(credentials, path = CACHE_PATH) {
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, JSON.stringify(credentials, null, 2));
+    try {
+        await chmod(path, 0o600);
+    }
+    catch {
+        /* Windows ACLs inherit profile permissions */
+    }
+}
+async function postForm(url, params) {
+    const res = await fetch(url, {
+        method: "POST",
+        headers: { ...HEADERS, "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams(params).toString(),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    const text = await res.text();
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status} ${text.slice(0, 200)}`.trim());
+    return JSON.parse(text);
+}
+export async function deviceAuthorize() {
+    const body = (await postForm(DEVICE_URL, { client_id: CLIENT_ID }));
+    const { device_code, user_code, verification_uri, interval, expires_in } = body;
+    if (typeof device_code !== "string" ||
+        !device_code ||
+        typeof user_code !== "string" ||
+        !user_code ||
+        typeof verification_uri !== "string" ||
+        !verification_uri ||
+        typeof interval !== "number" ||
+        typeof expires_in !== "number") {
+        throw new Error("device authorization response is missing fields");
+    }
+    const complete = body.verification_uri_complete;
+    return {
+        device_code,
+        user_code,
+        verification_uri,
+        ...(typeof complete === "string" && complete ? { verification_uri_complete: complete } : {}),
+        interval,
+        expires_in,
+    };
+}
+export async function pollToken(deviceCode, intervalS, expiresInS) {
+    let interval = Math.max(MIN_INTERVAL_S, Number(intervalS) || 5);
+    const deadline = Date.now() + Number(expiresInS || 600) * 1000;
+    let slowDowns = 0;
+    while (Date.now() < deadline) {
+        // The token endpoint answers HTTP errors (e.g. 400 authorization_pending)
+        // as part of the normal flow: never throw here, classify instead.
+        let body = null;
+        try {
+            const res = await fetch(TOKEN_URL, {
+                method: "POST",
+                headers: { ...HEADERS, "Content-Type": "application/x-www-form-urlencoded" },
+                body: new URLSearchParams({
+                    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                    client_id: CLIENT_ID,
+                    device_code: deviceCode,
+                }).toString(),
+                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            });
+            try {
+                body = (await res.json());
+            }
+            catch {
+                body = null;
+            }
+        }
+        catch {
+            body = null;
+        }
+        if (body && !body.error) {
+            if (typeof body.access_token !== "string" || !body.access_token) {
+                throw new Error("token response has no access_token");
+            }
+            return body.access_token;
+        }
+        if (body?.error === "slow_down") {
+            slowDowns += 1;
+            interval = Math.max(MIN_INTERVAL_S, interval + SLOW_DOWN_STEP_S);
+        }
+        else if (body?.error !== "authorization_pending") {
+            throw new Error(`login failed: ${body?.error || "unreadable token response"}`);
+        }
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+            break;
+        const { promise, resolve } = Promise.withResolvers();
+        setTimeout(resolve, Math.min(interval, remaining) * 1000);
+        await promise;
+    }
+    throw new Error(slowDowns ? "login timed out after slow_down responses" : "login timed out waiting for approval");
+}
+export async function mintKey(accessToken) {
+    const res = await fetch(KEY_URL, {
+        method: "POST",
+        headers: { ...HEADERS, "Content-Type": "application/json", Authorization: `Bearer ${accessToken}` },
+        body: JSON.stringify({ onboard: true }),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    const text = await res.text();
+    if (!res.ok)
+        throw new Error(`key exchange failed: HTTP ${res.status} ${text.slice(0, 200)}`.trim());
+    const body = JSON.parse(text);
+    if (body.is_subs_active === false)
+        throw new Error("Muse Code subscription is inactive for this account");
+    if (typeof body.api_key !== "string" || !body.api_key.trim()) {
+        const action = String(body.action_url || body.require_payment_action_url || "").trim();
+        if (body.require_payment === true || action) {
+            throw new Error(`Muse Code subscription is required${action ? ": " + action : ""}`);
+        }
+        throw new Error("key response is missing api_key");
+    }
+    const email = String(body.user_email || "").trim().toLowerCase() || undefined;
+    const accountId = String(body.user_id || "").trim() || email;
+    if (!accountId)
+        throw new Error("key response is missing account identity");
+    return { oauthAccessToken: accessToken, apiKey: body.api_key.trim(), accountId, email };
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+import type { Plugin } from "@opencode-ai/plugin";
+export declare const MuseCodeAuth: Plugin;

package/dist/index.js

@@ -0,0 +1,38 @@
+import { readCache, writeCache, deviceAuthorize, pollToken, mintKey } from "./auth.js";
+export const MuseCodeAuth = async () => {
+    return {
+        auth: {
+            provider: "meta",
+            methods: [
+                {
+                    type: "oauth",
+                    label: "Muse Code subscription (Meta device login)",
+                    async authorize() {
+                        const device = await deviceAuthorize();
+                        const url = device.verification_uri_complete || device.verification_uri;
+                        return {
+                            url,
+                            method: "auto",
+                            instructions: `Open ${url}\nEnter code: ${device.user_code}`,
+                            callback: async () => {
+                                try {
+                                    const access = await pollToken(device.device_code, device.interval, device.expires_in);
+                                    const minted = await mintKey(access);
+                                    await writeCache(minted);
+                                    return { type: "success", key: minted.apiKey };
+                                }
+                                catch {
+                                    return { type: "failed" };
+                                }
+                            },
+                        };
+                    },
+                },
+            ],
+            loader: async () => {
+                const key = await readCache();
+                return key ? { apiKey: key } : {};
+            },
+        },
+    };
+};

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "opencode-muse-auth",
+  "version": "0.1.0",
+  "description": "Muse Spark in opencode billed to the Muse Code monthly subscription (Meta device login, no API key)",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "type": "module",
+  "license": "MIT",
+  "author": "TheStreamCode",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/TheStreamCode/opencode-muse-auth.git"
+  },
+  "homepage": "https://github.com/TheStreamCode/opencode-muse-auth#readme",
+  "bugs": {
+    "url": "https://github.com/TheStreamCode/opencode-muse-auth/issues"
+  },
+  "keywords": [
+    "opencode",
+    "opencode-plugin",
+    "meta",
+    "muse",
+    "muse-spark",
+    "subscription",
+    "oauth",
+    "auth",
+    "plugin"
+  ],
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "node --test --test-concurrency=1 \"tests/*.test.ts\"",
+    "prepublishOnly": "npm run build"
+  },
+  "devDependencies": {
+    "@opencode-ai/plugin": "^1.18.31",
+    "@types/node": "^22.20.3",
+    "typescript": "^7.0.2"
+  }
+}