maka-agent 0.2.0-dev.3.20260830 → 0.2.0-dev.31.20260913

package/node_modules/@maka/core/node_modules/intl-messageformat/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "intl-messageformat",
+  "version": "11.2.14",
+  "description": "Formats ICU Message strings with number, date, plural, and select placeholders to create localized messages.",
+  "keywords": [
+    "globalization",
+    "i18n",
+    "icu",
+    "internationalization",
+    "intl",
+    "localization",
+    "messageformat",
+    "parser",
+    "plural"
+  ],
+  "homepage": "https://github.com/formatjs/formatjs",
+  "bugs": "https://github.com/formatjs/formatjs/issues",
+  "license": "BSD-3-Clause",
+  "author": "Eric Ferraiuolo <eferraiuolo@gmail.com>",
+  "contributors": [
+    "Anthony Pipkin <a.pipkin@yahoo.com>",
+    "Caridy Patino <caridy@gmail.com>",
+    "Drew Folta <drew@folta.net>",
+    "Long Ho <holevietlong@gmail.com>"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git@github.com:formatjs/formatjs.git"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "types": "index.d.ts",
+  "exports": {
+    ".": "./index.js"
+  },
+  "dependencies": {
+    "@formatjs/fast-memoize": "3.1.7",
+    "@formatjs/icu-messageformat-parser": "3.5.17"
+  }
+}

package/node_modules/@maka/core/package.json

@@ -6,8 +6,13 @@
   "type": "module",
   "sideEffects": false,
   "exports": {
+    "./durable-tool-result-projection": "./dist/durable-tool-result-projection.js",
+    "./model-projection-transition": "./dist/model-projection-transition.js",
     "./canonical-runtime-event": "./dist/canonical-runtime-event.js",
+    "./canonical-json": "./dist/canonical-json.js",
     "./runtime-boundary": "./dist/runtime-boundary.js",
+    "./runtime-handoff": "./dist/runtime-handoff.js",
+    "./runtime-logical-execution": "./dist/runtime-logical-execution.js",
     "./runtime-event": "./dist/runtime-event.js",
     "./tool-args-identity": "./dist/tool-args-identity.js",
     "./tool-ledger-scanner": "./dist/tool-ledger-scanner.js",
@@ -27,9 +32,12 @@
     "./collaboration": "./dist/collaboration.js",
     "./orchestration": "./dist/orchestration.js",
     "./tool-mode": "./dist/tool-mode.js",
+    "./record-schema": "./dist/record-schema.js",
+    "./runtime-invocation": "./dist/runtime-invocation.js",
     "./plan": "./dist/plan.js",
     "./agent-run": "./dist/agent-run.js",
     "./subagent-workspace": "./dist/subagent-workspace.js",
+    "./model-failure": "./dist/model-failure.js",
     "./model-call-attempt": "./dist/model-call-attempt.js",
     "./model-call-usage-projection": "./dist/model-call-usage-projection.js",
     "./usage-ledger-merge": "./dist/usage-ledger-merge.js",
@@ -47,6 +55,7 @@
     "./user-question": "./dist/user-question.js",
     "./connections": "./dist/connections.js",
     "./context-offload": "./dist/context-offload.js",
+    "./tool-result-archive-evidence": "./dist/tool-result-archive-evidence.js",
     "./attachments": "./dist/attachments.js",
     "./artifacts": "./dist/artifacts.js",
     "./pet": "./dist/pet.js",
@@ -55,6 +64,7 @@
     "./e2e-fixture": "./dist/e2e-fixture.js",
     "./capabilities": "./dist/capabilities.js",
     "./capability-audit": "./dist/capability-audit.js",
+    "./client-capability-grant": "./dist/client-capability-grant.js",
     "./health": "./dist/health.js",
     "./search": "./dist/search.js",
     "./bot-events": "./dist/bot-events.js",
@@ -66,7 +76,7 @@
     "./agent-graph-topology": "./dist/agent-graph-topology.js",
     "./agent-graph-client-projection": "./dist/agent-graph-client-projection.js",
     "./agent-graph-supervisor-wake": "./dist/agent-graph-supervisor-wake.js",
-    "./task-ledger": "./dist/task-ledger.js",
+    "./session-todo": "./dist/session-todo.js",
     "./foreign-session": "./dist/foreign-session.js",
     "./external-session": "./dist/external-session.js",
     "./deep-research-run": "./dist/deep-research-run.js",
@@ -74,16 +84,21 @@
     "./daily-review": "./dist/daily-review.js",
     "./work-board": "./dist/work-board.js",
     "./deep-research": "./dist/deep-research.js",
+    "./session-start-mode": "./dist/session-start-mode.js",
     "./long-term-memory": "./dist/long-term-memory.js",
     "./local-memory": "./dist/local-memory.js",
     "./web-search": "./dist/web-search.js",
+    "./bounded-response": "./dist/bounded-response.js",
     "./incognito": "./dist/incognito.js",
     "./backend-types": "./dist/backend-types.js",
     "./codex-model-compatibility": "./dist/codex-model-compatibility.js",
     "./llm-connections": "./dist/llm-connections.js",
     "./provider-registry": "./dist/provider-registry.js",
     "./model-catalog": "./dist/model-catalog.js",
+    "./model-facts": "./dist/model-facts.js",
     "./model-metadata": "./dist/model-metadata.js",
+    "./models-dev-projection": "./dist/models-dev-projection.js",
+    "./models-dev-refresh": "./dist/models-dev-refresh.js",
     "./model-web-search": "./dist/model-web-search.js",
     "./model-thinking": "./dist/model-thinking.js",
     "./persisted-value": "./dist/persisted-value.js",
@@ -131,15 +146,19 @@
     "./task-submission-readiness": "./dist/task-submission-readiness.js",
     "./terminal-input": "./dist/terminal-input.js",
     "./terminal-mouse-input": "./dist/terminal-mouse-input.js",
+    "./text-sanitize": "./dist/text-sanitize.js",
     "./tool-activity-args": "./dist/tool-activity-args.js",
     "./tool-quiet-preview": "./dist/tool-quiet-preview.js",
     "./tool-result-record-schema": "./dist/tool-result-record-schema.js",
     "./tool-result-status": "./dist/tool-result-status.js",
     "./ui-locale": "./dist/ui-locale.js",
     "./unified-diff": "./dist/unified-diff.js",
-    "./dev-single-instance": "./dist/dev-single-instance.js"
+    "./dev-single-instance": "./dist/dev-single-instance.js",
+    "./maka-wordmark": "./dist/maka-wordmark.js",
+    "./workhub-action-result": "./dist/workhub-action-result.js",
+    "./workhub-routing": "./dist/workhub-routing.js"
   },
   "dependencies": {
-    "intl-messageformat": "11.2.12"
+    "intl-messageformat": "11.2.14"
   }
 }

package/node_modules/@maka/eval/dist/experiment-directory.js

@@ -19,13 +19,14 @@
 import { randomUUID } from 'node:crypto';
 import { link, mkdir, open, readFile, unlink } from 'node:fs/promises';
 import { join } from 'node:path';
+import { stableJsonStringify } from '@maka/core/canonical-json';
 import { FileAttemptStore } from './attempt-store.js';
 import { parseExperimentSpec } from './spec.js';
 export async function openExperimentDirectory(root, spec) {
     await mkdir(root, { recursive: true });
     const specPath = join(root, 'experiment.json');
     const temporaryPath = join(root, `.experiment-${randomUUID()}.tmp`);
-    const canonical = `${canonicalJson(spec)}\n`;
+    const canonical = `${stableJsonStringify(spec)}\n`;
     const temporary = await open(temporaryPath, 'wx', 0o600);
     try {
         await temporary.writeFile(canonical);
@@ -37,8 +38,9 @@ export async function openExperimentDirectory(root, spec) {
         if (error.code !== 'EEXIST')
             throw error;
         const existing = parseExperimentSpec(JSON.parse(await readFile(specPath, 'utf8')));
-        if (canonicalJson(existing) !== canonicalJson(spec))
+        if (stableJsonStringify(existing) !== stableJsonStringify(spec)) {
             throw new Error('experiment spec differs');
+        }
     }
     finally {
         await temporary.close().catch(() => undefined);
@@ -46,14 +48,3 @@ export async function openExperimentDirectory(root, spec) {
     }
     return { root, specPath, attempts: new FileAttemptStore(join(root, 'attempts')) };
 }
-function canonicalJson(value) {
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJson).join(',')}]`;
-    if (value && typeof value === 'object') {
-        return `{${Object.entries(value)
-            .sort(([left], [right]) => left.localeCompare(right))
-            .map(([key, child]) => `${JSON.stringify(key)}:${canonicalJson(child)}`)
-            .join(',')}}`;
-    }
-    return JSON.stringify(value);
-}

package/node_modules/@maka/eval/dist/external-subject.js

@@ -21,7 +21,7 @@ import { join } from 'node:path';
 import { meteringCheckpointMacMatches, readBoundedRegularFile } from './metering-checkpoint.js';
 import { deriveMetering } from './provider-metering.js';
 import { TOOLCHAIN_IDENTITIES, TOOLCHAIN_IDENTITY_ENV, isExternalProfile, verifyToolchainDirectory, } from './toolchain-verification.js';
-const BUNDLED_EXTERNAL_WRAPPER = '/opt/maka-agent/packages/eval/dist/harbor-external-subject.js';
+const BUNDLED_EXTERNAL_WRAPPER = '/opt/maka-agent/node_modules/@maka/eval/dist/harbor-external-subject.js';
 export function createExternalSubjectAdapter() {
     const verifiedToolchains = new Map();
     return {

package/node_modules/@maka/eval/dist/harbor-external-subject.js

@@ -28,6 +28,7 @@ import { decodePreverifiedToolchain, isExternalProfile, } from './toolchain-veri
 import { isInferenceAdmissionEvent } from './provider-admission.js';
 import { DEEPSEEK_V4_FLASH_COST, deriveMetering, } from './provider-metering.js';
 import { removeEvalWebTools } from './provider-web-tool-surface.js';
+import { terminateProcess } from './process-termination.js';
 import { takeRelayResultToken, writeRelayResult } from './relay-result-frame.js';
 const resultToken = takeRelayResultToken();
 // The profile directory this wrapper writes. `dsh` has no environment variable
@@ -44,7 +45,7 @@ const PROFILE_PREPARERS = {
     codex: async ({ env, home, root, proxyBaseUrl }) => {
         env.OPENAI_API_KEY = 'maka-eval-local';
         env.CODEX_HOME = home;
-        const catalog = rooted(root, '/opt/maka-agent/packages/eval/harbor/deepseek-codex-models.json');
+        const catalog = rooted(root, '/opt/maka-agent/node_modules/@maka/eval/harbor/deepseek-codex-models.json');
         await writeFile(join(home, 'config.toml'), [
             'model_provider = "maka-http"',
             `model_catalog_json = ${JSON.stringify(catalog)}`,
@@ -198,7 +199,7 @@ const PROFILE_PREPARERS = {
         env.DSH_HOME = join(home, 'dsh');
         const profile = join(env.DSH_HOME, 'profiles', DEEPSEEK_HARNESS_PROFILE);
         await mkdir(profile, { recursive: true, mode: 0o700 });
-        const source = rooted(root, '/opt/maka-agent/packages/eval/harbor/deepseek-harness-profile');
+        const source = rooted(root, '/opt/maka-agent/node_modules/@maka/eval/harbor/deepseek-harness-profile');
         for (const file of ['package.json', 'cordis.yml', 'cordis.patch.yml']) {
             await copyFile(join(source, file), join(profile, file));
         }
@@ -277,7 +278,7 @@ let stopped = false;
 const stop = (signal) => {
     stopped = true;
     removeCredential();
-    child?.kill(signal);
+    void terminateProcess(child, signal);
 };
 const terminate = () => stop('SIGTERM');
 const interrupt = () => stop('SIGINT');

package/node_modules/@maka/eval/dist/harness-executor.js

@@ -28,6 +28,7 @@ import { decodeJsonObject } from './experiment.js';
 import { BUNDLED_HARNESS_RELAY_ROOT, createHarnessPreparationEnvironment, resolveRealPathWithinRoot, } from './harness-environment.js';
 import { preflightHarnessInstallation, } from './install-preflight.js';
 import { MAKA_RUNTIME_ARTIFACT_PATH, MAKA_SUBJECT_STDERR_PATH, MAKA_SUBJECT_STDOUT_PATH, } from './maka-artifacts.js';
+import { terminateProcess } from './process-termination.js';
 const PIER_FRAMEWORK_LOG_MOUNTS = Object.freeze([
     { directory: 'agent', target: '/logs/agent' },
     { directory: 'verifier', target: '/logs/verifier' },
@@ -911,7 +912,7 @@ async function waitForTrial(child, wait) {
             outcome: completed.code === 0 && completed.signal === null ? 'completed' : 'failed',
         };
     }
-    child.kill('SIGTERM');
+    await terminateProcess(child, 'SIGTERM');
     const terminated = await within(exit, wait.deadlineMs);
     if (terminated) {
         return {
@@ -921,7 +922,7 @@ async function waitForTrial(child, wait) {
             outcome: terminated.code === 0 && terminated.signal === null ? 'confirmed' : 'terminated',
         };
     }
-    child.kill('SIGKILL');
+    await terminateProcess(child, 'SIGKILL');
     const killed = await within(exit, KILL_SETTLEMENT_DEADLINE_MS);
     if (killed) {
         return {

package/node_modules/@maka/eval/dist/install-preflight.js

@@ -21,6 +21,7 @@ import { constants } from 'node:fs';
 import { access, lstat, stat } from 'node:fs/promises';
 import { dirname, isAbsolute, resolve } from 'node:path';
 import { BUNDLED_HARNESS_RELAY_ROOT, createHarnessPreparationEnvironment, resolvePathWithinRoot, resolveRealPathWithinRoot, } from './harness-environment.js';
+import { terminateProcess } from './process-termination.js';
 const PREFLIGHT_TIMEOUT_MS = 10_000;
 const PREFLIGHT_OUTPUT_LIMIT_BYTES = 16 * 1024;
 const PYTHON_FRAMEWORK_PROBE = [
@@ -105,21 +106,49 @@ export async function preflightHarnessInstallation(input, dependencies = {}) {
 async function runCheckedCommand(command, args, environment, cwd, signal) {
     signal?.throwIfAborted();
     await new Promise((resolvePromise, rejectPromise) => {
-        execFile(command, [...args], {
-            env: environment,
-            cwd,
-            timeout: PREFLIGHT_TIMEOUT_MS,
-            killSignal: 'SIGKILL',
-            maxBuffer: PREFLIGHT_OUTPUT_LIMIT_BYTES,
-            encoding: 'utf8',
-            ...(signal ? { signal } : {}),
-        }, (error, _stdout, stderr) => {
+        let settled = false;
+        let timeout;
+        let child;
+        const onAbort = () => {
+            void terminateProcess(child, 'SIGTERM');
+        };
+        const settle = (error, stderr = '') => {
+            if (settled)
+                return;
+            settled = true;
+            if (timeout)
+                clearTimeout(timeout);
+            signal?.removeEventListener('abort', onAbort);
             if (!error) {
                 resolvePromise();
                 return;
             }
             rejectPromise(new Error(stderr.trim() || error.message));
-        });
+        };
+        try {
+            child = execFile(command, [...args], {
+                env: environment,
+                cwd,
+                killSignal: 'SIGTERM',
+                maxBuffer: PREFLIGHT_OUTPUT_LIMIT_BYTES,
+                encoding: 'utf8',
+            }, (error, _stdout, stderr) => {
+                settle(error ?? undefined, stderr);
+            });
+        }
+        catch (error) {
+            settle(error instanceof Error ? error : new Error(String(error)));
+            return;
+        }
+        timeout = setTimeout(() => {
+            void terminateProcess(child, 'SIGKILL');
+        }, PREFLIGHT_TIMEOUT_MS);
+        if (signal) {
+            if (signal.aborted)
+                onAbort();
+            else
+                signal.addEventListener('abort', onAbort, { once: true });
+        }
     });
 }
 async function requirePath(path, label, expected) {

package/node_modules/@maka/eval/dist/process-termination.js

@@ -0,0 +1,83 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { spawn } from 'node:child_process';
+const WINDOWS_TASKKILL_TIMEOUT_MS = 2_000;
+/**
+ * Terminates a child using the platform's process lifecycle semantics.
+ * Windows does not implement POSIX signals, so every termination request must
+ * include descendants. Otherwise the root can exit before forced escalation
+ * and leave its workers running.
+ */
+export function terminateProcess(child, signal, options = {}) {
+    if (!child || child.exitCode !== null || child.signalCode !== null)
+        return Promise.resolve(false);
+    const platform = options.platform ?? process.platform;
+    if (platform === 'win32') {
+        const pid = child.pid;
+        if (typeof pid !== 'number' || !Number.isSafeInteger(pid) || pid <= 0) {
+            return killChild(child);
+        }
+        return (options.runTaskkill ?? killWindowsTree)(pid).then((killed) => killed ? true : killChild(child));
+    }
+    return killChild(child, signal);
+}
+function killChild(child, signal) {
+    try {
+        // Omitting the signal is intentional on Windows: Node uses its native
+        // graceful termination path instead of trying to emulate a POSIX signal.
+        return Promise.resolve(signal === undefined ? child.kill() : child.kill(signal));
+    }
+    catch {
+        return Promise.resolve(false);
+    }
+}
+function killWindowsTree(pid) {
+    return new Promise((resolve) => {
+        let settled = false;
+        let timeout;
+        const finish = (succeeded) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timeout)
+                clearTimeout(timeout);
+            resolve(succeeded);
+        };
+        try {
+            const killer = spawn('taskkill.exe', ['/PID', String(pid), '/T', '/F'], {
+                stdio: 'ignore',
+                windowsHide: true,
+            });
+            killer.once('error', () => finish(false));
+            killer.once('close', (code) => finish(code === 0));
+            timeout = setTimeout(() => {
+                try {
+                    killer.kill();
+                }
+                catch {
+                    /* taskkill already exited */
+                }
+                finish(false);
+            }, WINDOWS_TASKKILL_TIMEOUT_MS);
+        }
+        catch {
+            finish(false);
+        }
+    });
+}

package/node_modules/@maka/eval/dist/toolchain-verification.js

@@ -60,7 +60,7 @@ export const TOOLCHAIN_IDENTITIES = {
     'deepseek-harness': {
         root: '/opt/maka-deepseek-harness-toolchain',
         version: '0.1.0-rc.6',
-        fingerprint: 'sha256:a0882b448718ddfb7b64e33a12369c92b0064baf8388fe08a8ff64fe3dd98896',
+        fingerprint: 'sha256:5314e15659d4c35381ce15ca4802933d61bc3af718d7eeb8260f4fa32ccf5860',
     },
 };
 // The identity table is the profile registry: a profile without a pinned

package/node_modules/@maka/eval/harbor/egress-proxy/entrypoint.sh

@@ -59,4 +59,5 @@ exec mitmdump \
   --set block_global=false \
   --set rawtcp=false \
   --set confdir="$STATE_DIR" \
-  --scripts /opt/maka-eval/egress_filter.py
+  --scripts /opt/maka-eval/egress_filter.py \
+  "$@"

package/node_modules/@maka/eval/node_modules/undici/docs/docs/api/Client.md

@@ -147,6 +147,10 @@ added: v1.0.0
       WebSocket messages. Applied to uncompressed messages, compressed frame
       payloads, and decompressed (`permessage-deflate`) messages. Set to `0` to
       disable the limit. **Default:** `134217728`.
+  * `eventSource` {Object} (optional) EventSource-specific configuration.
+    * `maxEventSize` {number} The maximum allowed event size, in bytes, for
+      EventSource messages. Set to `0` to disable the limit.
+      **Default:** `buffer.kStringMaxLength`.
 * Returns: {Client}
 
 Instantiating a `Client` does not open a connection; the connection is

package/node_modules/@maka/eval/node_modules/undici/docs/docs/api/EnvHttpProxyAgent.md

@@ -25,8 +25,9 @@ it is used only for HTTPS requests.
 proxied. Each entry may include a leading dot or `*.` wildcard (for example
 `.example.com`) to match subdomains, and an optional `:port` suffix to restrict
 the match to a specific port. A request bypasses the proxy when its host equals
-an entry or is a subdomain of one. Setting `no_proxy` to `*` bypasses the proxy
-for every request.
+an entry or is a subdomain of one. A trailing dot is ignored on both sides, so
+`example.com.` and `example.com` match each other. Setting `no_proxy` to `*`
+bypasses the proxy for every request.
 
 The uppercase variants `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` are also
 honored. When both the lowercase and uppercase forms of a variable are set, the

package/node_modules/@maka/eval/node_modules/undici/docs/docs/api/EventSource.md

@@ -66,6 +66,9 @@ added: v6.5.0
       wait before re-establishing a dropped connection. The server may override
       this value with a `retry` field. **Default:** `3000`.
 
+EventSource-specific limits can be configured on the dispatcher using the
+`eventSource` option. See [`Client`][] for details.
+
 Creates a new `EventSource` and immediately begins connecting to `url`. The
 request is sent with the `Accept: text/event-stream` header, a cache mode of
 `no-store`, and an initiator type of `other`.
@@ -349,6 +352,7 @@ eventSource.onerror = () => {
 ```
 
 [WHATWG-conformant]: https://html.spec.whatwg.org/multipage/server-sent-events.html#server-sent-events
+[`Client`]: Client.md#new-clienturl-options
 [`Dispatcher`]: Dispatcher.md#class-dispatcher
 [`addEventListener()`]: https://developer.mozilla.org/en-US/docs/Web/API/EventTarget/addEventListener
 [server-sent events]: https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events

package/node_modules/@maka/eval/node_modules/undici/lib/cache/memory-cache-store.js

@@ -179,7 +179,7 @@ class MemoryCacheStore extends EventEmitter {
 
           // Perform eviction
           for (const [key, entries] of store.#entries) {
-            for (const entry of entries.splice(0, entries.length / 2)) {
+            for (const entry of entries.splice(0, Math.ceil(entries.length / 2))) {
               store.#size -= entry.size
               store.#count -= 1
             }

package/node_modules/@maka/eval/node_modules/undici/lib/dispatcher/agent.js

@@ -1,7 +1,7 @@
 'use strict'
 
 const { InvalidArgumentError, MaxOriginsReachedError } = require('../core/errors')
-const { kBusy, kClients, kConnected, kRunning, kClose, kDestroy, kDispatch, kUrl } = require('../core/symbols')
+const { kBusy, kClients, kConnected, kRunning, kPending, kClose, kDestroy, kDispatch, kUrl } = require('../core/symbols')
 const DispatcherBase = require('./dispatcher-base')
 const Pool = require('./pool')
 const Client = require('./client')
@@ -97,7 +97,12 @@ class Agent extends DispatcherBase {
           return
         }
 
-        if (dispatcher[kConnected] > 0 || dispatcher[kBusy]) {
+        // A GOAWAY detaches the HTTP/2 session before requeued requests are
+        // dispatched on a replacement connection. At that point the pool has
+        // no connected clients and is not busy, but it still has pending work.
+        // Closing it here lets the replacement Client finish those requests
+        // and then destroys that new connection with ClientDestroyedError.
+        if (dispatcher[kConnected] > 0 || dispatcher[kBusy] || dispatcher[kPending] > 0) {
           return
         }
 

package/node_modules/@maka/eval/node_modules/undici/lib/dispatcher/balanced-pool.js

@@ -54,7 +54,7 @@ class BalancedPool extends PoolBase {
       throw new InvalidArgumentError('factory must be a function.')
     }
 
-    super()
+    super(opts)
 
     this[kOptions] = { ...util.deepClone(opts) }
     this[kIndex] = -1

package/node_modules/@maka/eval/node_modules/undici/lib/dispatcher/client-h1.js

@@ -1052,7 +1052,7 @@ function onSocketClose () {
 
 function clearIdleSocketValidation (socket) {
   if (socket[kIdleSocketValidationTimeout]) {
-    clearTimeout(socket[kIdleSocketValidationTimeout])
+    clearImmediate(socket[kIdleSocketValidationTimeout])
     socket[kIdleSocketValidationTimeout] = null
   }
 
@@ -1061,15 +1061,23 @@ function clearIdleSocketValidation (socket) {
 
 function scheduleIdleSocketValidation (client, socket) {
   socket[kIdleSocketValidation] = 1
-  socket[kIdleSocketValidationTimeout] = setTimeout(() => {
+  // Yield to the check phase (after poll) so unsolicited bytes / FIN / RST
+  // already pending on this idle keep-alive socket are processed before the
+  // next request is written (GHSA-35p6-xmwp-9g52).
+  //
+  // setTimeout(0) pays Node's ~1ms timer floor on every sequential reuse
+  // (#5493). setImmediate avoids that, but an *unref'd* Immediate lets poll
+  // block for ~500ms when the event loop is otherwise idle (#5600 / #5606).
+  // A ref'd Immediate both keeps the pending request alive and makes poll
+  // return immediately — the hybrid those issues asked for.
+  socket[kIdleSocketValidationTimeout] = setImmediate(() => {
     socket[kIdleSocketValidationTimeout] = null
     socket[kIdleSocketValidation] = 2
 
     if (client[kSocket] === socket && !socket.destroyed) {
       client[kResume]()
     }
-  }, 0)
-  socket[kIdleSocketValidationTimeout].unref?.()
+  })
 }
 
 /**

package/node_modules/@maka/eval/node_modules/undici/lib/dispatcher/client-h2.js

@@ -10,7 +10,8 @@ const {
   InformationalError,
   InvalidArgumentError,
   HeadersTimeoutError,
-  BodyTimeoutError
+  BodyTimeoutError,
+  ResponseExceededMaxSizeError
 } = require('../core/errors.js')
 const {
   kUrl,
@@ -39,7 +40,8 @@ const {
   kRemoteSettings,
   kHTTP2Stream,
   kHTTP2SessionState,
-  kHTTP2Options
+  kHTTP2Options,
+  kMaxResponseSize
 } = require('../core/symbols.js')
 const { channels } = require('../core/diagnostics.js')
 
@@ -1022,9 +1024,11 @@ function writeH2 (client, request) {
   const state = {
     abort: null,
     body: request.body,
+    bytesRead: 0,
     client,
     contentLength: null,
     expectsPayload: false,
+    maxResponseSize: client[kMaxResponseSize],
     request,
     headersTimeout,
     bodyTimeout,
@@ -1260,6 +1264,7 @@ function writeH2 (client, request) {
   // become unreachable once the stream closes, so plain `on` avoids the
   // per-listener `once` wrapper allocation.
   stream.on('response', onResponse)
+  stream.on('headers', onInterimResponse)
   stream.on('end', onEnd)
   stream.on('error', onError)
   stream.on('frameError', onFrameError)
@@ -1280,6 +1285,7 @@ function removeRequestStreamListeners (stream) {
   stream.off('error', noop)
   stream.off('continue', writeBodyH2)
   stream.off('response', onResponse)
+  stream.off('headers', onInterimResponse)
   stream.off('end', onEnd)
   stream.off('error', onError)
   stream.off('frameError', onFrameError)
@@ -1322,17 +1328,51 @@ function onData (chunk) {
     return
   }
 
-  const { request } = state
+  const { request, maxResponseSize } = state
 
   if (request.aborted || request.completed) {
     return
   }
 
+  if (maxResponseSize > -1 && state.bytesRead + chunk.length > maxResponseSize) {
+    // Unlike HTTP/1.1, which destroys the socket because it cannot abandon one
+    // response without losing framing, resetting the offending stream leaves
+    // the session usable for its siblings.
+    state.abort(new ResponseExceededMaxSizeError())
+    return
+  }
+
+  state.bytesRead += chunk.length
+
   if (request.onResponseData(chunk) === false) {
     stream.pause()
   }
 }
 
+function onInterimResponse (headers) {
+  const stream = this
+  const state = stream[kRequestStreamState]
+
+  if (state == null) {
+    return
+  }
+
+  const { request } = state
+
+  if (request.aborted || request.completed) {
+    return
+  }
+
+  // node http2 emits 'headers' for interim (1xx) informational responses,
+  // while the final response arrives via 'response'. Forward these to the
+  // handler so that onInfo is invoked, matching the HTTP/1 behaviour and the
+  // documented onInfo contract.
+  const statusCode = headers[HTTP2_HEADER_STATUS]
+  delete headers[HTTP2_HEADER_STATUS]
+
+  request.onResponseStart(Number(statusCode), headers, noop, '')
+}
+
 function onResponse (headers) {
   const stream = this
   const state = stream[kRequestStreamState]