Maple 3.4.4

Maple 3.4.4 adds per-model thinking controls and improves native sign-in, with Maple Proxy 0.4.2 included.

• Choose a thinking level for supported chat models. Maple remembers your preference and offers only levels the selected model supports.
• See progress while signing in. Native production OAuth now starts at auth.maple.ai, with improved Apple sign-in configuration and clearer handling of failed callbacks.
• Handle sign-in callbacks and supported deep links received while the native app is starting.
• Android now supports using existing subscriptions and credits, viewing plan information, and redeeming passes, with purchase and subscription-management controls removed from the app.
• Maple Proxy 0.4.2 adds POST /v1/systemone for structured yes/no, choice, and score decisions, preserving backend response statuses and error details.
• Refresh bundled trusted enclave measurements for the current and verified rollback Dev/Prod backends. Native app and proxy bundles retain those two approvals per environment; signed-history support remains available.

System One server validation and confidence updates, along with Maple account emails, were already delivered in the separate OpenSecret backend deployment.

What's Changed

• Document existing Dev web host and Agent provenance jobs by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1076
• Make proxy build cache export best effort by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1080
• Size Agent disk images explicitly before hdiutil creation by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1081
• Stabilize Agent session-isolation test on shared CI runners by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1083
• Prepare Maple Research 3.4.4 build train by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1082
• Pin fixed perl-base in OpenSecret parent helpers by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1086
• sdk: bump transitive source-map-js past GHSA-68fv-2mgg-jv7q by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1085
• Add POST /v1/systemone: typed decisions on Continuum GLM-5.3-Flash (MVP) by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1045
• proxy: 0.4.2, the first version serving POST /v1/systemone by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1088
• Make Android consumption-only for subscriptions and credits by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1100
• Publish and validate per-model thinking levels (#1087) by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1089
• Approve dev OpenSecret EIF from master 63646d4f by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1101
• Add isolated Auth Dev deployment and PR previews by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1103
• Use backend-selected Apple Services ID in browser sign-in by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1110
• ci: use standard runners for development Pages builds by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1111
• ci: unblock auth rollout validation with standard runners by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1113
• Route GLM-5.3 Flash exclusively through PrivateMode by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1108
• Show loading feedback during web OAuth sign-in by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1112
• Integrate Agent hosted handoff and isolated Research Dev desktop by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1105
• ci: move OpenSecret ARM64 EIF jobs to Blacksmith by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1116
• Approve OpenSecret Dev and Prod EIF measurements from 2fca3c7 by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1117
• ci: reduce trusted EIF builders to Blacksmith ARM8 by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1118
• ci: pilot unsigned Windows packaging on Blacksmith by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1120
• ci: restore Apple builders and hosted Agent signing by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1119
• ci: move heavy Linux builds to Blacksmith by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1121
• ci: unblock remaining macOS and iOS workflows by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1122
• ci: report sccache stats from the build server by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1126
• fix: handle deep links that launch the app by @doowta in https://github.com/MaplePrivacyLabs/Maple/pull/1024
• ci: reuse master ONNX cache for iOS builds by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1127
• ci: build Agent master packages only for outstanding input changes by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1129
• fix: pin Dev TestFlight Auth origin by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1128
• ci: cancel superseded unsigned Research PR builds by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1130
• fix: show native OAuth progress and safe callback codes by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1131
• fix: build Linux RPM once with correct updater identity by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1132
• feat(agent): use production Auth with loopback sign-in by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1133
• fix(auth): refresh hosted sign-in and completion branding by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1134
• Return to Agent after one account-confirmation click by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1136
• Keep native auth progress steady and concise by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1137
• Use Auth for Research production native sign-in by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1141
• Redesign Maple account emails (takes over #1114) by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1142
• System One: TypeSafe confidence formulas, strict schema 422s, bounded token counting by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1143
• Approve OpenSecret Dev and Prod EIF measurements by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1144
• Keep current and rollback PCR0s in Research and SDK bundles by @AnthonyRonning in https://github.com/MaplePrivacyLabs/Maple/pull/1146

Full Changelog: https://github.com/MaplePrivacyLabs/Maple/compare/v3.4.3...v3.4.4