Home / Guides / Muse Spark 1.3

Published August 20, 2026 · updated September 3, 2026 for Muse Spark 1.3 · applies to pgup-ai/jbot-review-action v0

Meta's Muse Spark 1.3, released on 2026-09-02, can review pull requests at $0 through OpenCode's contributor route, with a 1,048,576-token context window, tool calling, and about 20% fewer tool calls per coding task than 1.2. The model ids and prices below were read from the live model catalog on 2026-09-03, the day after release; the model has not yet been rerun end to end on a real J-Bot review. Still on 1.2? Its ids are further down.

OpenCode setup in three steps

1. Create an OpenCode API key. Save it as the repository secret OPENCODE_API_KEY (Settings → Secrets and variables → Actions).
2. Commit the workflow. Add the file below as .github/workflows/jbot-review.yml. The -contributor-free suffix names the zero-cost contributor route, and the opencode/ prefix selects the provider, so no separate provider input is needed.
3. Open a pull request. J-Bot reads the base…head diff and posts diff-anchored findings with a verdict. Blocking findings are checked by a second session before they post.

name: J-Bot Code Review
on:
  pull_request: { types: [opened, reopened, ready_for_review, synchronize] }

concurrency:
  group: jbot-review-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: write
  issues: write
  checks: read

jobs:
  review:
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with: { fetch-depth: 0 }
      - uses: pgup-ai/jbot-review-action@v0
        with:
          model: opencode/muse-spark-1.3-contributor-free
          opencode-api-key: ${{ secrets.OPENCODE_API_KEY }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

Five routes, five exact model ids

Pick the route where you already manage credentials. The first segment of each id selects the provider, so the Action's deprecated provider input can stay unset. Prices are the provider's list rates per million tokens, read from the live catalog on 2026-09-03; quotas and contributor eligibility remain provider-controlled. Kilo and OpenRouter also list meta/muse-spark-1.3-contributor at $0.10 / $0.20 under the same contributor terms as the OpenCode route. Command Code added 1.3 to its seat on release day, 2026-09-02, and J-Bot's Command Code model table was probed against it the same day.

What changed from 1.2

Meta released Muse Spark 1.3 on 2026-09-02, its fourth Muse Spark release in five months. The changes it describes map directly onto what a reviewer does.

• Fewer tool calls, fewer tokens. Meta reports about 20% fewer tool calls and about 25% fewer tokens per coding task than 1.2. J-Bot's review is a loop of file reads and self-checks, so fewer calls mean a shorter wall clock, and on a metered route fewer tokens mean a smaller bill.
• Stronger prompt-injection resistance. A pull request is untrusted input to the reviewer. Meta lists improved adversarial robustness and better calibration on irreversible actions among 1.3's agentic gains.
• Longer-horizon agentic work. Meta says 1.3 sustains multi-step tasks better and maps them out more reliably, which is what a multi-shard review of a large diff asks of a model.
• Same window, same modes. The context window stays at 1,048,576 tokens and the catalog output limit on the OpenCode route at 131,072. The reasoning modes 1.2 offered are available today; Meta's max reasoning mode is due after further safety testing. On Command Code the model rejects the effort flag, so J-Bot omits it.

Still on 1.2? OpenCode still lists opencode/muse-spark-1.2-contributor-free at $0 and the metered opencode/muse-spark-1.2 at $1.25 / $4.25, and OpenCode Go lists opencode-go/muse-spark-1.2-contributor at $0.10 / $0.20. Change the version in the model id and the rest of this page applies.

Why Muse Spark 1.3 fits review work

• The context window holds the whole change. The catalog lists 1,048,576 input tokens with up to 131,072 output tokens on the OpenCode routes. That holds a large base…head diff plus the surrounding files J-Bot reads for context, with no shard-by-shard truncation.
• It calls tools. Review is an agentic loop, not a single completion. J-Bot reads files and challenges its own blocking findings mid-session. The catalog advertises tool calling and reasoning on every Muse Spark 1.3 route listed above.
• Caching cuts the metered routes. Kilo and OpenRouter list cached input at $0.15 per million against $1.25 uncached. J-Bot keeps the expensive shared prefix stable across shards, so a multi-shard review reuses it.
• J-Bot adds $0. The Action is MIT-licensed, with no reviewer service and no per-seat fee. On the contributor route your remaining cost is normal GitHub Actions minutes.

When the runner's egress is the problem

Some providers decide what a caller may reach based on the IP it arrives from, and a GitHub-hosted runner egresses from address ranges you do not pick. If your account is provisioned for a route your CI cannot reach, the optional opencode-proxy-url input sends OpenCode's traffic through a proxy you control: a static-IP egress your platform team already runs, or a host in a region your account is provisioned for.

      - uses: pgup-ai/jbot-review-action@v0
        with:
          model: opencode/muse-spark-1.3-contributor-free
          opencode-proxy-url: ${{ secrets.OPENCODE_PROXY_URL }}
          opencode-api-key: ${{ secrets.OPENCODE_API_KEY }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

A proxy that quietly breaks should not cost you a review, so the wiring is cautious:

• Verified before it is trusted. J-Bot performs an egress check through the proxy and requires a valid IP back. Only then does it inject the proxy environment and pin SDK sessions to OpenCode.
• It fails open. An absent secret is logged as information; a failed verification is logged as a warning. Either way J-Bot continues on the direct route and the review still runs.
• Fork pull requests never use it. The proxy is skipped for fork-head PRs, so the credential is not exposed to code you have not merged.
• It is scoped to the OpenCode child. No global proxy is exported, and loopback is excluded by default so the local SDK listener is never intercepted.
• Use a dedicated low-privilege credential. An authenticated proxy URL is inherited by OpenCode and the processes it spawns. Treat it as a CI-only secret, and rotate it like any other.

A proxy changes where your request appears to come from, not what you are entitled to. Check your provider's terms before using one to reach a route your account is not provisioned for.

Where the diff goes

• The $0 route is a contributor route. OpenCode lists Muse Spark 1.3 Contributor Free for a limited time as heavily discounted pricing in exchange for permission to use your prompts and completions to train future Meta models. Meta's own model page marks the contributor tier as used to improve its products and the standard tier as not. Send private code through a standard route such as kilo/meta/muse-spark-1.3 or openrouter/meta/muse-spark-1.3, which keeps it off Meta's contributor terms. The gateway you pick still receives the diff under its own retention and training policy, so read that policy before sending private code.
• Your runner stays in control. The review session runs headless on your GitHub Actions runner with read-only repository access.
• The route determines the destination. Each provider uses its corresponding account or authenticated CLI backend. J-Bot does not proxy the diff through a hosted reviewer service.
• A configured proxy is one more hop. If you set opencode-proxy-url, OpenCode's traffic transits a host you chose. Point it at infrastructure inside your own trust boundary.
• Fork PRs cannot read the key. GitHub does not pass repository secrets to pull_request workflows from forks.
• Blocking findings are verified. A second model session challenges each blocking finding before J-Bot posts it; nits are demoted.

FAQ

Related