feat(agent): restack Maple on master

Cargo.toml

@@ -22,6 +22,7 @@ thiserror = "1.0.63"
 async-trait = "0.1.81"
 jsonwebtoken = { version = "10.3.0", features = ["aws_lc_rs"] }
 jwt-compact = { version = "0.9.0-beta.1", features = ["es256k"] }
+dspy-rs = { git = "https://github.com/OpenSecretCloud/DSRs.git", branch = "main" }
 diesel = { version = "=2.2.3", features = [
     "postgres",
     "postgres_backend",
@@ -33,6 +34,7 @@ diesel = { version = "=2.2.3", features = [
 ] }
 diesel-derive-enum = { version = "2.1.0", features = ["postgres"] }
 chrono = { version = "0.4.26", features = ["serde"] }
+chrono-tz = "0.10"
 dotenv = "0.15.0"
 aes-gcm = "0.10.1"
 aes-siv = "0.7"
@@ -42,13 +44,15 @@ cbc = "0.1.2"
 secp256k1 = { version = "0.29.0", features = ["rand"] }
 hyper = { version = "0.14", features = ["full"] }
 hyper-tls = "0.5.0"
-reqwest = { version = "0.11", features = ["json"] }
+reqwest = { version = "0.11", features = ["json", "native-tls-alpn"] }
 futures = "0.3.30"
 uuid = { version = "1.10.0", features = ["v4", "serde"] }
 tokio-stream = "0.1"
 async-stream = "0.3"
 bytes = "1.0"
 sha2 = { version = "0.10", default-features = false }
+p256 = { version = "0.13", features = ["ecdh", "pkcs8"] }
+hkdf = "0.12"
 hex = "0.4.3"
 base64 = "0.22.1"
 vsock = "0.5.1"
@@ -74,6 +78,7 @@ lazy_static = "1.4.0"
 subtle = "2.6.1"
 tiktoken-rs = "0.5"
 once_cell = "1.19"
+unicode-segmentation = "1.12"
 
 [dev-dependencies]
 openssl = "0.10.78"

docs/nitro-deploy.md

@@ -530,6 +530,103 @@ A restart of this should not be needed but if you need to:
 sudo systemctl restart vsock-apple-proxy.service
 ```
 
+## Vsock APNs and FCM proxies
+Create vsock proxy services so that enclave program can talk to push providers:
+
+First configure the endpoints into their allowlist:
+
+```
+sudo vim /etc/nitro_enclaves/vsock-proxy.yaml
+```
+
+Add these lines:
+```
+- {address: api.push.apple.com, port: 443}
+- {address: api.sandbox.push.apple.com, port: 443}
+- {address: fcm.googleapis.com, port: 443}
+```
+
+#### APNs Production
+Now create a service that spins this up automatically:
+
+```
+sudo vim /etc/systemd/system/vsock-apns-prod-proxy.service
+```
+
+```
+[Unit]
+Description=Vsock APNs Production Proxy Service
+After=network.target
+
+[Service]
+User=root
+ExecStart=/usr/bin/vsock-proxy 8024 api.push.apple.com 443
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
+```
+
+#### APNs Sandbox
+```
+sudo vim /etc/systemd/system/vsock-apns-sandbox-proxy.service
+```
+
+```
+[Unit]
+Description=Vsock APNs Sandbox Proxy Service
+After=network.target
+
+[Service]
+User=root
+ExecStart=/usr/bin/vsock-proxy 8025 api.sandbox.push.apple.com 443
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
+```
+
+#### FCM
+```
+sudo vim /etc/systemd/system/vsock-fcm-proxy.service
+```
+
+```
+[Unit]
+Description=Vsock FCM Proxy Service
+After=network.target
+
+[Service]
+User=root
+ExecStart=/usr/bin/vsock-proxy 8029 fcm.googleapis.com 443
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
+```
+
+Activate services:
+
+```
+sudo systemctl daemon-reload
+sudo systemctl enable vsock-apns-prod-proxy.service
+sudo systemctl start vsock-apns-prod-proxy.service
+sudo systemctl status vsock-apns-prod-proxy.service
+sudo systemctl enable vsock-apns-sandbox-proxy.service
+sudo systemctl start vsock-apns-sandbox-proxy.service
+sudo systemctl status vsock-apns-sandbox-proxy.service
+sudo systemctl enable vsock-fcm-proxy.service
+sudo systemctl start vsock-fcm-proxy.service
+sudo systemctl status vsock-fcm-proxy.service
+```
+
+A restart of these should not be needed but if you need to:
+```
+sudo systemctl restart vsock-apns-prod-proxy.service
+sudo systemctl restart vsock-apns-sandbox-proxy.service
+sudo systemctl restart vsock-fcm-proxy.service
+```
+
 ## Vsock Resend proxy
 Create a vsock proxy service so that enclave program can talk to resend:
 

entrypoint.sh

@@ -325,6 +325,12 @@ log "Added Google OAuth domains to /etc/hosts"
 echo "127.0.0.15 appleid.apple.com" >> /etc/hosts
 log "Added Apple OAuth domain to /etc/hosts"
 
+# Add push provider hostnames to /etc/hosts
+echo "127.0.0.21 api.push.apple.com" >> /etc/hosts
+echo "127.0.0.22 api.sandbox.push.apple.com" >> /etc/hosts
+echo "127.0.0.20 fcm.googleapis.com" >> /etc/hosts
+log "Added APNs and FCM domains to /etc/hosts"
+
 # Add AWS SQS hostname to /etc/hosts
 echo "127.0.0.13 sqs.us-east-2.amazonaws.com" >> /etc/hosts
 log "Added AWS SQS domain to /etc/hosts"
@@ -459,6 +465,16 @@ run_forever tf_os_flags python3 /app/traffic_forwarder.py 127.0.0.18 443 3 8028
 log "Starting Apple OAuth traffic forwarder"
 run_forever tf_apple_oauth python3 /app/traffic_forwarder.py 127.0.0.15 443 3 8018 &
 
+# Start the traffic forwarders for push providers in the background
+log "Starting APNs production traffic forwarder"
+run_forever tf_apns_prod python3 /app/traffic_forwarder.py 127.0.0.21 443 3 8024 &
+
+log "Starting APNs sandbox traffic forwarder"
+run_forever tf_apns_sandbox python3 /app/traffic_forwarder.py 127.0.0.22 443 3 8025 &
+
+log "Starting FCM traffic forwarder"
+run_forever tf_fcm python3 /app/traffic_forwarder.py 127.0.0.20 443 3 8029 &
+
 # Start the traffic forwarders for Tinfoil proxy in the background
 log "Starting Tinfoil GitHub proxy traffic forwarder"
 run_forever tf_tinfoil_github_proxy python3 /app/traffic_forwarder.py 127.0.0.16 443 3 8019 &
@@ -657,6 +673,28 @@ else
     log "Apple OAuth connection failed"
 fi
 
+# Test the connections to push providers
+log "Testing connection to APNs production:"
+if timeout 5 bash -c '</dev/tcp/127.0.0.21/443'; then
+    log "APNs production connection successful"
+else
+    log "APNs production connection failed"
+fi
+
+log "Testing connection to APNs sandbox:"
+if timeout 5 bash -c '</dev/tcp/127.0.0.22/443'; then
+    log "APNs sandbox connection successful"
+else
+    log "APNs sandbox connection failed"
+fi
+
+log "Testing connection to FCM:"
+if timeout 5 bash -c '</dev/tcp/127.0.0.20/443'; then
+    log "FCM connection successful"
+else
+    log "FCM connection failed"
+fi
+
 # Test the connections to Tinfoil proxy services
 log "Testing connection to Tinfoil GitHub proxy:"
 if timeout 5 bash -c '</dev/tcp/127.0.0.16/443'; then

flake.nix

@@ -27,6 +27,10 @@
         rustToolchain = builtins.fromTOML (builtins.readFile ./rust-toolchain.toml);
         rustChannel = rustToolchain.toolchain.channel;
         rustAnalyzer = pkgs.rust-bin.stable."${rustChannel}".rust-analyzer;
+        rustPlatform = pkgs.makeRustPlatform {
+          cargo = rust;
+          rustc = rust;
+        };
 
         commonInputs = [
           rust
@@ -227,7 +231,7 @@
         };
 
         # Build the main Rust package
-        opensecret = pkgs.rustPlatform.buildRustPackage {
+        opensecret = rustPlatform.buildRustPackage {
           pname = "opensecret";
           version = "0.1.0";
           src = pkgs.lib.cleanSourceWith {
@@ -250,6 +254,11 @@
           };
           cargoLock = {
             lockFile = ./Cargo.lock;
+            outputHashes = {
+              "baml-ids-0.0.1" = "sha256-wjgwOcZvZIWEAjpq0gZwtZccQ+FupudBzpxR4+udKEQ=";
+              "minijinja-2.16.0" = "sha256-55Zo8mVgMhCgYzE6662oTXfn7W908LplZv6ys/aHveY=";
+              "rig-core-0.26.0" = "sha256-/1C2/UTuJrre4IYNW7i1pYaOGy0dxzhLyogR+5NL1nk=";
+            };
           };
           nativeBuildInputs = [
             pkgs.pkg-config