feat(meta): integrate Muse Code through the shipped Meta provider

AGENTS.md

@@ -10,12 +10,14 @@ sibling Muse plugins (`hermes-muse-code`, `openclaw-muse-code`, `opencode-muse-a
 
 ## Layout
 
-- `src/` — bundle source: provider route wiring, device-code login, credential handling.
+- `src/` — bundle source: route declaration in the `llm-pi-ai` settings section, the
+  `/muse-login` command, and the Client half's Settings → Models hint.
 - `lib/` — compiled output, committed because DSH bundle installs from Git may not run a build.
   Regenerate with `npm run build`; never edit by hand.
 - `test/` — `node:test` suite; new behavior needs a test.
-- `cordis.patch.yml` — bundle patch that inserts the model route and the auth plugin.
-- `AUTH_CONTRACT.md` — pinned device-flow and key-mint contract shared with the sibling plugins.
+- `cordis.patch.yml` — bundle patch that inserts the single integration row.
+- `AUTH_CONTRACT.md` — pinned device-flow and key-mint contract shared with the sibling plugins;
+  DeepSeek Harness implements it, the bundle does not.
 - `.github/workflows/` — CI; do not weaken checks, pins, or permissions.
 
 ## Commands
@@ -35,6 +37,10 @@ any local credential file.
 
 - Keep changes focused; no drive-by refactors, no new runtime dependencies without a stated
   reason.
+- The provider route and the device-code flow are DeepSeek Harness features: declare the shipped
+  `meta` route and run the shipped `llm-pi-ai/meta` flow. Never insert a second
+  `@deepseek-ai/dsh-llm-pi-ai` instance — every instance declares the whole provider catalog and
+  the extra row cannot activate.
 - Public documentation, comments, and commit messages are in English.
 - Do not change `LICENSE`, `DISCLAIMER.md`, `AUTH_CONTRACT.md`, `SECURITY.md`,
   `CODE_OF_CONDUCT.md`, or release metadata unless the task is about them.

AUTH_CONTRACT.md

@@ -1,7 +1,9 @@
 # Muse auth contract (v1)
 
-This bundle implements the same Meta device-code flow as the other Muse Code
-plugins. Change this file and the pinned constants/tests together:
+DeepSeek Harness implements this Meta device-code contract in its shipped pi-ai Meta
+provider (`llm-pi-ai/meta`); this bundle relies on that implementation. The sibling Muse Code
+plugins implement the same flow themselves, so change this file and the pinned values together
+with:
 
 - `opencode-muse-auth`
 - `hermes-muse-code`
@@ -20,14 +22,19 @@ plugins. Change this file and the pinned constants/tests together:
 | Credential reference | `MUSE_CODE_SUB_TOKEN` |
 | Inference base URL | `https://api.meta.ai/v1` |
 
+DeepSeek Harness stores the same sign-in as the OAuth credential record `llm-pi-ai/meta` and
+re-mints its short-lived key, because the pi-ai adapter owns that flow. The pinned
+`MUSE_CODE_SUB_TOKEN` reference describes the sibling plugins' credential, not DSH's.
+
 ## Behaviour
 
 - Device flow: request a device code, poll the token endpoint, accept
   `authorization_pending`, increase the interval on `slow_down`, stop on a
   terminal error or at `expires_in`.
 - Key mint: exchange the OAuth access token for the account-bound inference
   key; reject an inactive subscription or a pending payment.
-- Persistence: the key is stored through the DSH credential seam under
-  `MUSE_CODE_SUB_TOKEN`; the OAuth access token stays in memory.
-- Any change to this contract bumps `AUTH_CONTRACT_VERSION` in the code and
+- Persistence: the sibling plugins store the key through the DSH credential seam under
+  `MUSE_CODE_SUB_TOKEN` and keep the OAuth access token in memory. DeepSeek Harness stores the
+  sign-in as the `llm-pi-ai/meta` credential record and renews the key from it.
+- Any change to this contract bumps the version constant in the implementations' code and
   requires updating the pinned tests in all four repositories.

CHANGELOG.md

@@ -5,6 +5,48 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.0] - 2026-10-26
+
+### Changed
+
+- Integrate Muse Code through the `meta` provider that DeepSeek Harness ships, instead of
+  inserting a second `@deepseek-ai/dsh-llm-pi-ai` instance. DSH declares every provider catalog
+  per instance, so the second instance could not activate
+  (`configurable provider "amazon-bedrock" is already declared`) and the `muse-code` route never
+  existed.
+
+### Added
+
+- `/muse-login` command that runs the shipped `llm-pi-ai/meta` device-code flow and prints the
+  verification URL and user code.
+- **Sign in** control under **Settings → Models**, backed by an exact local
+  `POST /muse-code/login` route: DSH exposes no Remote method for provider OAuth flows, so the
+  Host starts the flow and answers the page with the code and instructions.
+- The Host opens the verification page in the default browser for both entry points.
+- Automatic declaration of the `meta` route in the `llm-pi-ai` settings section, so the provider
+  appears under **Settings → Models** and in the model picker labeled
+  **Muse Code (Meta subscription)**.
+- Client half that adds the sign-in control and its footer hint under **Settings → Models**.
+
+### Removed
+
+- The hand-written `muse-code` route, its `MUSE_CODE_SUB_TOKEN` credential handling, and the
+  bundle's own device-code client. DSH's Meta provider owns the sign-in, the credential record,
+  and key renewal.
+- The `muse-wonder` model ids: models now follow the catalog DeepSeek Harness advertises for the
+  Meta provider (`muse-spark-1.1`, `muse-spark-1.2`, `muse-spark-1.3`, and the `-contributor`
+  variants).
+
+### Fixed
+
+- Read the authorization seam's neutral notice (`{ message, url, code }`), not the raw pi-ai
+  event shape. The previous reader never recognized the device-code notice, so `/muse-login`
+  reported "did not answer in time" while the flow was waiting normally.
+- Ship the Client half as a browser classic script (`client/client.js`, outside the TypeScript
+  output). The Web UI concatenates client artifacts into plain script bundles, so the `export {}`
+  that `tsc` emitted for `lib/client.js` broke the whole bundle with
+  `Uncaught SyntaxError: Unexpected token 'export'` and aborted the Web boot.
+
 ## [0.1.0] - 2026-10-21
 
 ### Added
@@ -21,3 +63,4 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Unofficial-use risk notice for Meta subscription credentials (`DISCLAIMER.md`).
 
 [0.1.0]: https://github.com/TheStreamCode/dsh-muse-code/releases/tag/v0.1.0
+[0.2.0]: https://github.com/TheStreamCode/dsh-muse-code/releases/tag/v0.2.0

CITATION.cff

@@ -1,15 +1,16 @@
 cff-version: 1.2.0
 message: "If you use this software, please cite it as below."
 title: "dsh-muse-code"
-version: 0.1.0
-date-released: "2026-10-21"
+version: 0.2.0
+date-released: "2026-10-26"
 url: "https://github.com/TheStreamCode/dsh-muse-code"
 repository-code: "https://github.com/TheStreamCode/dsh-muse-code"
 license: MIT
 abstract: >-
-  Unofficial DeepSeek Harness bundle that serves Meta Muse Code models through
-  a Muse Code subscription credential, with a native Meta device-code login
-  flow and the minted key stored in the DSH credential store.
+  Unofficial DeepSeek Harness bundle that integrates Meta Muse Code models through
+  the subscription: it declares the shipped Meta provider route for Settings > Models
+  and the model picker, and adds the /muse-login command for the built-in device-code
+  sign-in.
 keywords:
   - deepseek-harness
   - dsh-plugin