Muse Spark in OpenClaw via OAuth

# Muse Spark in OpenClaw — via OAuth, no API key

Use Meta's **Muse Spark** models inside [OpenClaw](https://openclaw.ai) authenticated by
**Muse Code's browser login**, instead of pasting a Meta Model API key.

No plugin required. No patched build. Just provider config.

## Why this exists

Meta ships two separate things with **different auth**:

| | auth | what it is |
| --- | --- | --- |
| **Muse Spark** (the model) | API key — `Bearer $MODEL_API_KEY` | what you'd select as a model |
| **Muse Code** (the CLI agent) | `muse login` — browser OAuth | a coding agent |

The documented way to get Muse Spark into a client is an API key. But **`muse login` already
mints a working Model API credential** and writes it to disk. This repo uses that.

## The discovery

After `muse login`, `~/.config/muse/auth.json` contains:

```json
{
  "providers": {
    "meta": {
      "api_base_url": "https://api.meta.ai/v1",
      "api_key": "LLM|<id>|<secret>",
      "access_token": "dca:...",
      "mechanism": "oauth",
      "obtained_via": "device_code"
    }
  }
}
```

Two findings worth knowing:

* **`api_key` works** as a bearer token against `https://api.meta.ai/v1/chat/completions` → `200`.
* **`access_token` does not** — it returns `401 invalid_api_key`. Use `api_key`.

The endpoint is OpenAI-compatible, so **no provider plugin is needed** — a plain
`models.providers.*` entry is enough.

## Setup

```sh
curl -fsSL https://dev.meta.ai/install.sh | bash   # installs Muse Code
muse login                                         # browser OAuth
./scripts/setup-muse-openclaw.sh                   # wire it into OpenClaw
```

The script reads the key from *your* `auth.json`, stores it **write-only** in OpenClaw's
secret store, and references it from config. The key is never written to `openclaw.json`
in plaintext and is never printed.

## The config it writes

```json5
{
  models: {
    providers: {
      muse: {
        baseUrl: "https://api.meta.ai/v1",
        api: "openai-completions",          // REQUIRED — see gotchas
        apiKey: { source: "store", provider: "default", id: "META_MODEL_API_KEY" },
        models: [
          { name: "Muse Spark 1.3", id: "muse-spark-1.3",
            reasoning: true, maxTokens: 32000, contextWindow: 1048576 },
        ],
      },
    },
  },
}
```

Models must also be approved in `agents.defaults.modelPolicy.allow` as
`muse/muse-spark-