feat(agent): add native Maple provider and authenticated web tools

[AnthonyRonning]

Summary

• replace Agent Mode's API-key-backed localhost completion proxy with a native OpenSecret provider that shares the signed-in Maple JWT lifecycle and reconciles SDK token refreshes back to the web app
• add built-in web_search and open_url tools over the authenticated OpenSecret SDK, with bounded untrusted output, normalized search provenance, cancellation-safe transport, and session-scoped state
• keep search-derived URLs automatic in Read only mode while classifying arbitrary URL fetches per call with Gemma and falling back to one-shot user approval; Auto mode remains automatic
• pin the unpublished OpenSecret Rust SDK by exact commit and bootstrap it as a sibling checkout for CI and ordinary development

Dependencies

• OpenSecret SDK draft: feat: harden Rust auth and add encrypted web APIs OpenSecret-SDK#88, pinned at b5a144f87b7929d37464f6aff3bd56a432d02f8d
• OpenSecret backend draft: Expose authenticated web search and extraction APIs opensecret#238
• Before release, replace the workspace-local SDK pin with the published SDK version.

Validation

• nix develop -c just rust-lint
• 166 Rust tests passed
• frontend formatting, production build, typecheck, and lint passed (0 errors; 12 existing warnings)
• 121 frontend tests passed
• OpenSecret SDK checkout safety test passed
• live macOS Maple GUI: search auto-approval, search-derived URL auto-open, arbitrary URL Deny and Allow Once on repeated calls, remote image markup absent from web evidence, and a structured uploaded image still rendered and reached the model
• independent auth, permission, and web-security reviews clean after fixes
• git diff --check

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 717a0a3c-1e11-403a-b2c6-d2f6a0397d90

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex-maple-native-provider-web-tools-maple

---

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	e481cbc
Status:	✅  Deploy successful!
Preview URL:	https://09c6de06.maple-ca8.pages.dev
Branch Preview URL:	https://codex-maple-native-provider.maple-ca8.pages.dev

View logs