Meta login reaches the Muse Code subscription: requests go to the address the key mint names (meta.ai only), the connection names the plan; contract 88bb560

Signed-off-by: Maxime Rivest <mrive052@gmail.com>

Author: MaximeRivest

CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## Unreleased
+
+- **The Meta login reaches the Muse Code subscription, Muse Wonder Full
+  included.** `auth.login("meta", "device", allow_unverified=True)` was
+  tested live on 2026-10-12 with a Power Usage plan: login, key, renewal,
+  then `complete` and `stream` on `meta:muse-wonder-full-1.0`. Requests now
+  go to the address Meta names when it hands out the key, and only to a
+  `meta.ai` address; any other address is refused before the key is sent.
+  The connection's `account_label` names the plan. The method stays
+  `unverified` because Meta's terms reserve this key for Muse Code
+  (`docs/managed-login.md` says what that risks). lm15-contract `88bb560`.
+
 ## 1.2.3 — 2026-10-10
 
 Two conveniences that make a first program work, and clearer messages

CONTRACT_PIN

@@ -1 +1 @@
-8eedbae4f13dc80666024503256149a7bbf39388
+88bb560118243bd6601cf33e6addcb586b568469

docs/managed-login.md

@@ -147,7 +147,8 @@ store.
 | ChatGPT / Codex | LM15-owned device login | Separate memory-only login and inference observed **2026-09-23**. Device persistence/renewal were not separately tested; permission and billing remain **unverified**. |
 | OpenRouter | Browser approval → API key | Key issuance, $1 limit inspection, model discovery, inference and fresh-process reuse observed **2026-09-23**. No refresh-token flow; broader support review remains pending. |
 | GitHub Copilot | Device login → Copilot token | github.com login, catalog, inference, fresh-process persistence and one early renewal observed **2026-09-23**. Uses the public Copilot Chat app registration; permission and billing remain **unverified**. |
-| Claude (loopback), Meta, Kimi Code | Other LM15-owned login methods | **unverified**: implemented, no live LM15 receipt; `login(..., allow_unverified=True)` to try |
+| Meta (Muse Code subscription) | Device login → the account's Muse Code key | Login, key mint, re-mint and inference on `muse-wonder-full-1.0` observed **2026-10-12** (Power Usage plan). Stays **unverified**: Meta's terms reserve this key for Muse Code (see below). |
+| Claude (loopback), Kimi Code | Other LM15-owned login methods | **unverified**: implemented, no live LM15 receipt; `login(..., allow_unverified=True)` to try |
 | Radius | — | **unavailable**: its model protocol is not in lm15-python |
 
 An unverified method is never offered by the default picker. Promotion to
@@ -180,6 +181,33 @@ and the wall clock were not falsified. This does not prove an unattended full
 expiry cycle, provider permission or included billing. Both methods still require
 `allow_unverified=True`, and the existing CLI credential route remains available.
 
+### Meta: the Muse Code subscription (Muse Wonder Full)
+
+```python
+auth.login("meta", "device", ui=TerminalUI(), allow_unverified=True)
+router = LMRouter(RouterConfig(auth=auth))
+router.lm("meta:muse-wonder-full-1.0")
+```
+
+You approve a code at `auth.meta.com` with the Meta account that holds the
+Muse Code plan. Meta then hands out that account's Muse Code key. It is the
+same key every time, so lm15 renewing it daily never logs Muse Code out. The
+connection's `account_label` names the plan (for example "Muse Code Power
+Usage"), or says "no Muse Code subscription (pay-as-you-go)" when Meta
+bills the key per token. `muse-wonder-full-1.0` needs the Power or Maximum
+Usage plan; `muse-wonder-1.0` and the Muse Spark models work on every plan.
+Under a managed `Auth`, a `META_API_KEY` in the environment is not used, so
+requests stay on the plan. Today only the `meta:` route uses the connection.
+
+**Read this before using it.** Meta's Model API terms (updated 2026-10-09,
+§ 3.2) say the Muse Code key "may not be used to access the Services
+outside the coding harness". lm15 is not Muse Code, so this use is outside
+those terms. The account at risk is your Meta account, the one shared with
+Facebook, Instagram and WhatsApp. Subscription traffic is also in
+Contributor mode by default (§ 3.3): Meta may train on your prompts unless
+you turn that off in Muse Code's `/settings`. lm15 identifies itself as
+lm15 and does not imitate Muse Code.
+
 ### OpenRouter: no manual key handling, but still a key
 
 ```python

lm15/login/flows/meta.py

@@ -1,15 +1,26 @@
 """
-lm15.login.flows.meta — Meta (Muse subscription) device login + key mint.
+lm15.login.flows.meta — Meta (Muse Code subscription) device login + key mint.
 
 RFC 8628 device authorization against ``auth.meta.com`` (JSON replies);
 the identity token it returns is **not** accepted for inference, so it is
-exchanged at the Muse Code key-mint endpoint for a Model API key that
-lives about a day.  Renewal is a re-mint with the stored identity token
+exchanged at the Muse Code key-mint endpoint for the account's Muse Code
+Model API key.  Renewal is a re-mint with the stored identity token
 (``renewal="remint"``); the identity token itself is not renewable, so a
-401/403 from the mint is a permanent rejection (``needs_login``).  Pi
-0.87.0 ``oauth/meta.ts`` is the implementation reference.
-
-**Availability: unverified** (no live LM15 receipt).
+401/403 from the mint is a permanent rejection (``needs_login``).  Muse
+Code 1.4.6 is the reference (Pi 0.87.0 ``oauth/meta.ts`` was the first).
+
+Live 2026-10-12 (lm15-contract ``receipts/2026-10-12-muse-code/``): the
+mint answers the same key on every call, so a re-mint never revokes the
+key Muse Code itself holds; the reply also names the API address
+(``base_url``) and the subscription (``is_subs_active``,
+``subs_tier_name``).  The key serves all three Meta wires, and
+``muse-wonder-full-1.0`` (Power and Maximum Usage plans only) answers on
+it.  The address is used as given when it is an https ``meta.ai`` host and
+refused otherwise: the key is never sent anywhere else.
+
+**Availability: unverified.**  Meta's Model API terms (2026-10-09, § 3.2)
+say the Muse Code key "may not be used to access the Services outside the
+coding harness"; lm15 is not that harness.  The descriptor says so.
 """
 
 from __future__ import annotations
@@ -26,12 +37,17 @@
 DEVICE_AUTHORIZATION_URL = "https://auth.meta.com/oidc/device/authorization/"
 DEVICE_TOKEN_URL = "https://auth.meta.com/oidc/device/token/"
 KEY_MINT_URL = "https://api.meta.ai/muse-code/key"
-KEY_LIFETIME_S = 24 * 60 * 60.0
+KEY_LIFETIME_S = 24 * 60 * 60.0  # no expiry in the reply; a daily re-mint is free (same key, 2026-10-12)
+TERMS_NOTE = ("Meta's Model API terms (§ 3.2) reserve the Muse Code key for Muse Code; using it here is outside "
+              "those terms and puts the Meta account at risk. Subscription traffic is Contributor mode by default "
+              "(Meta may train on it).")
 
 METHOD_DEVICE = LoginMethod(
     id="device", label="Sign in with Meta (Muse subscription)", kind="account", flow="device_code",
-    availability="unverified", reason="no live receipt yet", delivery=("device",), subscription=True,
-    billing_note="Minted Model API keys are tied to the Muse subscription; verify entitlement on your account.",
+    availability="unverified", reason="login, mint and inference observed 2026-10-12; " + TERMS_NOTE,
+    delivery=("device",), subscription=True,
+    billing_note="Billed to the Muse Code plan when it is active (muse-wonder-full-1.0 needs Power or Maximum "
+                 "Usage); without one, Meta bills the key pay-as-you-go.",
 )
 
 DESCRIPTOR = ProviderDescriptor(
@@ -55,7 +71,36 @@ def _positive(value: Any) -> float | None:
     return float(value) if isinstance(value, (int, float)) and not isinstance(value, bool) and value > 0 else None
 
 
-def _mint(ctx: LoginContext, identity_token: str) -> Material:
+def _api_base(value: Any) -> str | None:
+    """The mint's ``base_url`` when the key may go there: https, a
+    ``meta.ai`` host, no credentials in the URL.  ``None`` when absent."""
+    if value is None:
+        return None
+    parsed = urllib.parse.urlsplit(value) if isinstance(value, str) else None
+    host = (parsed.hostname or "") if parsed else ""
+    if parsed is None or parsed.scheme != "https" or parsed.username or parsed.password or parsed.query \
+            or not (host == "meta.ai" or host.endswith(".meta.ai")):
+        raise LoginDenied("Meta named an API address outside meta.ai for the minted key; refusing to send it there")
+    return value.rstrip("/")
+
+
+def _plan(body: dict[str, Any]) -> str | None:
+    """Display text for the account's plan; ``None`` when the reply is silent."""
+    active = body.get("is_subs_active")
+    if active is True:
+        tier = body.get("subs_tier_name")
+        return tier if isinstance(tier, str) and tier else "Muse Code subscription"
+    if active is False:
+        return "no Muse Code subscription (pay-as-you-go)"
+    return None
+
+
+def _result(material: Material, body: dict[str, Any]) -> LoginResult:
+    return LoginResult(material=material, label="Meta (Muse subscription)", account_label=_plan(body),
+                       renewal="remint")
+
+
+def _mint(ctx: LoginContext, identity_token: str) -> tuple[Material, dict[str, Any]]:
     ctx.notify(ProgressNotice(stage="exchange", message="Enabling Meta Model API access…"))
     reply = http_json(ctx, KEY_MINT_URL, {}, headers={
         "Authorization": f"Bearer {identity_token}", "x-api-version": "1.0.0",
@@ -68,9 +113,13 @@ def _mint(ctx: LoginContext, identity_token: str) -> Material:
     if not isinstance(key, str) or not key:
         action = _http_url(reply.body.get("action_url"))
         raise LoginDenied("Meta did not issue an API key" + (f"; complete setup at {action}" if action else ""))
+    base_url = _api_base(reply.body.get("base_url"))
     now_ms = int(ctx.wall_clock() * 1000)
-    return {"type": "oauth", "access": key, "refresh": identity_token, "issued_at": now_ms,
-            "lifetime_s": KEY_LIFETIME_S, "expires": int(now_ms + KEY_LIFETIME_S * 1000)}
+    material: Material = {"type": "oauth", "access": key, "refresh": identity_token, "issued_at": now_ms,
+                          "lifetime_s": KEY_LIFETIME_S, "expires": int(now_ms + KEY_LIFETIME_S * 1000)}
+    if base_url is not None:
+        material["base_url"] = base_url
+    return material, reply.body
 
 
 class MetaFlow(ProviderFlow):
@@ -111,13 +160,15 @@ def poll() -> DeviceStep:
             raise LoginDenied(f"Meta device token request failed (HTTP {reply.status})")
 
         identity = run_device_flow(ctx, poll, interval_s=interval, expires_in_s=expires_in)
-        return LoginResult(material=_mint(ctx, identity), label="Meta (Muse subscription)", renewal="remint")
+        return _result(*_mint(ctx, identity))
 
     def renew(self, ctx: LoginContext, material: Material, settings: dict[str, str]) -> LoginResult:
         identity = material.get("refresh")
         if not isinstance(identity, str) or not identity:
             raise LoginDenied("Meta credential has no identity token to re-mint with")
-        return LoginResult(material=_mint(ctx, identity), label="Meta (Muse subscription)", renewal="remint")
+        return _result(*_mint(ctx, identity))
 
     def request_auth(self, material: Material, settings: dict[str, str]) -> RequestAuth:
-        return RequestAuth(credential=ApiKey(material["access"]))
+        base_url = material.get("base_url")
+        return RequestAuth(credential=ApiKey(material["access"]),
+                           base_url=base_url if isinstance(base_url, str) and base_url else None)

tests/test_login.py

@@ -856,3 +856,70 @@ def test_external_claude_cli_source_reads_in_place(sandbox: Path, monkeypatch: p
     assert auth.request_auth("claude-code").credential.value == ACCESS
     auth.logout("claude-code")
     assert json.loads(claude.read_text(encoding="utf-8"))["claudeAiOauth"]["accessToken"] == ACCESS  # the tool's file is untouched
+
+
+# ─── Meta (Muse Code subscription): the mint reply decides address and plan ──
+
+
+class FakeMeta:
+    """auth.meta.com device endpoints and the Muse Code key mint, shaped as
+    observed live 2026-10-12 (lm15-contract receipts/2026-10-12-muse-code/)."""
+
+    def __init__(self, mint: dict) -> None:
+        self.mint = mint
+        self.calls: list[str] = []
+
+    def __call__(self, request: urllib.request.Request, timeout: float):
+        url = request.full_url
+        self.calls.append(url)
+        if url.endswith("/oidc/device/authorization/"):
+            return _Reply(200, {"device_code": f"{SENTINEL}-device", "user_code": "ABCD-1234",
+                                "verification_uri": "https://auth.meta.com/oauth/device/", "interval": 1,
+                                "expires_in": 600})
+        if url.endswith("/oidc/device/token/"):
+            return _Reply(200, {"access_token": f"{SENTINEL}-identity", "token_type": "Bearer"})
+        if url == "https://api.meta.ai/muse-code/key":
+            return _Reply(200, self.mint)
+        raise AssertionError(f"unexpected request {url}")
+
+
+def test_meta_subscription_key_goes_where_the_mint_says(sandbox: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    clock = Clock()
+    server = FakeMeta({"api_key": ACCESS, "base_url": "https://eu.api.meta.ai/v1/", "is_subs_active": True,
+                       "subs_tier_name": "Muse Code Power Usage"})
+    auth = make_auth(sandbox, clock, server)
+    connection = auth.login("meta", "device", ui=ScriptUI(), allow_unverified=True)
+    assert connection.account_label == "Muse Code Power Usage"
+    no_secret(connection, auth.status("meta"))
+    # The environment key is never a fallback under a managed Auth (AUTH-15):
+    # a subscriber's requests stay on the plan.
+    transport = FakeTransport([FakeResponse(200, json.dumps({
+        "id": "r", "object": "response", "status": "completed", "model": "muse-wonder-full-1.0",
+        "output": [{"type": "message", "role": "assistant", "content": [{"type": "output_text", "text": "OK"}]}],
+        "usage": {"input_tokens": 1, "output_tokens": 1, "total_tokens": 2}}).encode())])
+    router = LMRouter(RouterConfig(auth=auth, env={"META_API_KEY": "payg"}, transport=transport))
+    lm = router.lm("meta:muse-wonder-full-1.0")
+    assert "managed connection" in lm.credential_origin()
+    from lm15 import Request
+
+    assert lm.complete(Request(model="muse-wonder-full-1.0", messages=(Message.user("hi"),))).text == "OK"
+    sent = transport.requests[0]
+    assert sent.url == "https://eu.api.meta.ai/v1/responses"
+    assert {k.lower(): v for k, v in sent.headers}["authorization"] == f"Bearer {ACCESS}"
+
+
+@pytest.mark.parametrize("base_url", ["http://api.meta.ai/v1", "https://api.meta.ai.example.com/v1",
+                                      "https://user:pw@api.meta.ai/v1", 42])
+def test_meta_mint_address_outside_meta_ai_is_refused(sandbox: Path, base_url: object) -> None:
+    auth = make_auth(sandbox, Clock(), FakeMeta({"api_key": ACCESS, "base_url": base_url}))
+    with pytest.raises(AuthOperationError) as info:
+        auth.login("meta", "device", ui=ScriptUI(), allow_unverified=True)
+    no_secret(info.value)
+    assert auth.status("meta").presence == "absent"
+
+
+def test_meta_without_a_plan_says_pay_as_you_go(sandbox: Path) -> None:
+    auth = make_auth(sandbox, Clock(), FakeMeta({"api_key": ACCESS, "base_url": "https://api.meta.ai/v1",
+                                                 "is_subs_active": False}))
+    connection = auth.login("meta", "device", ui=ScriptUI(), allow_unverified=True)
+    assert connection.account_label == "no Muse Code subscription (pay-as-you-go)"