maka-agent 0.2.0-dev.4.20260830 → 0.2.0-dev.41.20260918

package/node_modules/@maka/eval/dist/harbor-external-subject.js

@@ -28,6 +28,7 @@ import { decodePreverifiedToolchain, isExternalProfile, } from './toolchain-veri
 import { isInferenceAdmissionEvent } from './provider-admission.js';
 import { DEEPSEEK_V4_FLASH_COST, deriveMetering, } from './provider-metering.js';
 import { removeEvalWebTools } from './provider-web-tool-surface.js';
+import { terminateProcess } from './process-termination.js';
 import { takeRelayResultToken, writeRelayResult } from './relay-result-frame.js';
 const resultToken = takeRelayResultToken();
 // The profile directory this wrapper writes. `dsh` has no environment variable
@@ -44,7 +45,7 @@ const PROFILE_PREPARERS = {
     codex: async ({ env, home, root, proxyBaseUrl }) => {
         env.OPENAI_API_KEY = 'maka-eval-local';
         env.CODEX_HOME = home;
-        const catalog = rooted(root, '/opt/maka-agent/packages/eval/harbor/deepseek-codex-models.json');
+        const catalog = rooted(root, '/opt/maka-agent/node_modules/@maka/eval/harbor/deepseek-codex-models.json');
         await writeFile(join(home, 'config.toml'), [
             'model_provider = "maka-http"',
             `model_catalog_json = ${JSON.stringify(catalog)}`,
@@ -198,7 +199,7 @@ const PROFILE_PREPARERS = {
         env.DSH_HOME = join(home, 'dsh');
         const profile = join(env.DSH_HOME, 'profiles', DEEPSEEK_HARNESS_PROFILE);
         await mkdir(profile, { recursive: true, mode: 0o700 });
-        const source = rooted(root, '/opt/maka-agent/packages/eval/harbor/deepseek-harness-profile');
+        const source = rooted(root, '/opt/maka-agent/node_modules/@maka/eval/harbor/deepseek-harness-profile');
         for (const file of ['package.json', 'cordis.yml', 'cordis.patch.yml']) {
             await copyFile(join(source, file), join(profile, file));
         }
@@ -277,7 +278,7 @@ let stopped = false;
 const stop = (signal) => {
     stopped = true;
     removeCredential();
-    child?.kill(signal);
+    void terminateProcess(child, signal);
 };
 const terminate = () => stop('SIGTERM');
 const interrupt = () => stop('SIGINT');

package/node_modules/@maka/eval/dist/harbor-maka-subject.js

@@ -16,11 +16,10 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { mkdir, writeFile } from 'node:fs/promises';
+import { mkdir } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { runHostedExecution } from '@maka/runtime-host/client';
 import { captureMakaRuntimeArtifacts, writeMakaArtifactCollectionError } from './maka-artifacts.js';
-import { makaEvalRuntimePolicyDocument } from './maka-runtime-policy.js';
 import { takeRelayResultToken, writeRelayResult } from './relay-result-frame.js';
 const resultToken = takeRelayResultToken();
 const payload = JSON.parse(Buffer.from(process.argv[2] ?? '', 'base64url').toString());
@@ -50,12 +49,23 @@ process.once('SIGTERM', stop);
 const runtimeHome = join(dirname(payload.rootPath), `${process.pid}-home`);
 await mkdir(payload.rootPath, { recursive: true });
 await mkdir(runtimeHome, { recursive: true, mode: 0o700 });
-await writeFile(join(payload.rootPath, 'runtime-policy.json'), `${JSON.stringify(makaEvalRuntimePolicyDocument(process.env.HTTPS_PROXY))}\n`, { flag: 'wx', mode: 0o600 });
 process.env.HOME = runtimeHome;
 process.env.DEEPSEEK_BASE_URL = payload.baseUrl;
 let result;
 try {
     result = await runHostedExecution({
+        initialization: {
+            incognito: true,
+            ...(process.env.HTTPS_PROXY ? { proxyUrl: process.env.HTTPS_PROXY } : {}),
+        },
+        ...(payload.connection
+            ? {
+                connection: {
+                    providerType: payload.connection.providerType,
+                    apiKey: process.env[payload.connection.apiKeyEnvironment] ?? '',
+                },
+            }
+            : {}),
         rootPath: payload.rootPath,
         baseUrl: payload.baseUrl,
         execution: payload.execution,

package/node_modules/@maka/eval/dist/harness-executor.js

@@ -28,6 +28,7 @@ import { decodeJsonObject } from './experiment.js';
 import { BUNDLED_HARNESS_RELAY_ROOT, createHarnessPreparationEnvironment, resolveRealPathWithinRoot, } from './harness-environment.js';
 import { preflightHarnessInstallation, } from './install-preflight.js';
 import { MAKA_RUNTIME_ARTIFACT_PATH, MAKA_SUBJECT_STDERR_PATH, MAKA_SUBJECT_STDOUT_PATH, } from './maka-artifacts.js';
+import { terminateProcess } from './process-termination.js';
 const PIER_FRAMEWORK_LOG_MOUNTS = Object.freeze([
     { directory: 'agent', target: '/logs/agent' },
     { directory: 'verifier', target: '/logs/verifier' },
@@ -911,7 +912,7 @@ async function waitForTrial(child, wait) {
             outcome: completed.code === 0 && completed.signal === null ? 'completed' : 'failed',
         };
     }
-    child.kill('SIGTERM');
+    await terminateProcess(child, 'SIGTERM');
     const terminated = await within(exit, wait.deadlineMs);
     if (terminated) {
         return {
@@ -921,7 +922,7 @@ async function waitForTrial(child, wait) {
             outcome: terminated.code === 0 && terminated.signal === null ? 'confirmed' : 'terminated',
         };
     }
-    child.kill('SIGKILL');
+    await terminateProcess(child, 'SIGKILL');
     const killed = await within(exit, KILL_SETTLEMENT_DEADLINE_MS);
     if (killed) {
         return {

package/node_modules/@maka/eval/dist/index.js

@@ -21,6 +21,9 @@ export * from './cli.js';
 export * from './experiment-directory.js';
 export * from './experiment.js';
 export * from './external-subject.js';
+export * from './fleet.js';
+export * from './fleet-store.js';
+export * from './fleet-worker.js';
 export * from './harness-executor.js';
 export * from './maka-subject.js';
 export * from './result.js';

package/node_modules/@maka/eval/dist/install-preflight.js

@@ -21,6 +21,7 @@ import { constants } from 'node:fs';
 import { access, lstat, stat } from 'node:fs/promises';
 import { dirname, isAbsolute, resolve } from 'node:path';
 import { BUNDLED_HARNESS_RELAY_ROOT, createHarnessPreparationEnvironment, resolvePathWithinRoot, resolveRealPathWithinRoot, } from './harness-environment.js';
+import { terminateProcess } from './process-termination.js';
 const PREFLIGHT_TIMEOUT_MS = 10_000;
 const PREFLIGHT_OUTPUT_LIMIT_BYTES = 16 * 1024;
 const PYTHON_FRAMEWORK_PROBE = [
@@ -105,21 +106,49 @@ export async function preflightHarnessInstallation(input, dependencies = {}) {
 async function runCheckedCommand(command, args, environment, cwd, signal) {
     signal?.throwIfAborted();
     await new Promise((resolvePromise, rejectPromise) => {
-        execFile(command, [...args], {
-            env: environment,
-            cwd,
-            timeout: PREFLIGHT_TIMEOUT_MS,
-            killSignal: 'SIGKILL',
-            maxBuffer: PREFLIGHT_OUTPUT_LIMIT_BYTES,
-            encoding: 'utf8',
-            ...(signal ? { signal } : {}),
-        }, (error, _stdout, stderr) => {
+        let settled = false;
+        let timeout;
+        let child;
+        const onAbort = () => {
+            void terminateProcess(child, 'SIGTERM');
+        };
+        const settle = (error, stderr = '') => {
+            if (settled)
+                return;
+            settled = true;
+            if (timeout)
+                clearTimeout(timeout);
+            signal?.removeEventListener('abort', onAbort);
             if (!error) {
                 resolvePromise();
                 return;
             }
             rejectPromise(new Error(stderr.trim() || error.message));
-        });
+        };
+        try {
+            child = execFile(command, [...args], {
+                env: environment,
+                cwd,
+                killSignal: 'SIGTERM',
+                maxBuffer: PREFLIGHT_OUTPUT_LIMIT_BYTES,
+                encoding: 'utf8',
+            }, (error, _stdout, stderr) => {
+                settle(error ?? undefined, stderr);
+            });
+        }
+        catch (error) {
+            settle(error instanceof Error ? error : new Error(String(error)));
+            return;
+        }
+        timeout = setTimeout(() => {
+            void terminateProcess(child, 'SIGKILL');
+        }, PREFLIGHT_TIMEOUT_MS);
+        if (signal) {
+            if (signal.aborted)
+                onAbort();
+            else
+                signal.addEventListener('abort', onAbort, { once: true });
+        }
     });
 }
 async function requirePath(path, label, expected) {

package/node_modules/@maka/eval/dist/maka-artifacts.js

@@ -33,24 +33,33 @@ export async function captureMakaRuntimeArtifacts(input) {
         await mkdir(stagingRoot, { recursive: true, mode: 0o700 });
         const sourcePath = join(stateRoot, 'runtime.sqlite');
         const destinationPath = join(stagingRoot, 'runtime.sqlite');
-        const source = new DatabaseSync(sourcePath, { readOnly: true });
         try {
-            await backup(source, destinationPath);
-        }
-        finally {
-            source.close();
-        }
-        const snapshot = new DatabaseSync(destinationPath);
-        try {
-            snapshot.exec('PRAGMA wal_checkpoint(TRUNCATE)');
-            snapshot.exec('PRAGMA journal_mode=DELETE');
+            await stat(sourcePath);
+            const source = new DatabaseSync(sourcePath, { readOnly: true });
+            try {
+                await backup(source, destinationPath);
+            }
+            finally {
+                source.close();
+            }
+            const snapshot = new DatabaseSync(destinationPath);
+            try {
+                snapshot.exec('PRAGMA wal_checkpoint(TRUNCATE)');
+                snapshot.exec('PRAGMA journal_mode=DELETE');
+            }
+            finally {
+                snapshot.close();
+            }
+            await chmod(destinationPath, 0o600);
         }
-        finally {
-            snapshot.close();
+        catch (error) {
+            await rm(destinationPath, { force: true });
+            if (error.code !== 'ENOENT') {
+                await writeMakaArtifactCollectionError(stagingRoot, error);
+            }
         }
         await rm(`${destinationPath}-wal`, { force: true });
         await rm(`${destinationPath}-shm`, { force: true });
-        await chmod(destinationPath, 0o600);
         for (const name of ['runtime-host-candidate.log', 'runtime-policy.json']) {
             const source = join(stateRoot, name);
             try {
@@ -66,7 +75,12 @@ export async function captureMakaRuntimeArtifacts(input) {
                     throw error;
             }
         }
-        const files = await Promise.all(['runtime.sqlite', 'runtime-host-candidate.log', 'runtime-policy.json'].map((name) => describeFile(join(stagingRoot, name), name)));
+        const files = await Promise.all([
+            'runtime.sqlite',
+            'runtime-host-candidate.log',
+            'runtime-policy.json',
+            'collection-error.json',
+        ].map((name) => describeFile(join(stagingRoot, name), name)));
         const manifest = {
             schemaVersion: 'maka.eval.runtime_artifacts.v1',
             reason: input.reason,

package/node_modules/@maka/eval/dist/maka-subject.js

@@ -17,6 +17,8 @@
  * under the License.
  */
 import { randomUUID } from 'node:crypto';
+import { PROVIDER_REGISTRY } from '@maka/core/llm-connections';
+import { isThinkingLevel } from '@maka/core/model-thinking';
 import { isSessionToolProfile } from '@maka/core/session';
 import { decodeHostedExecutionProjection } from '@maka/runtime-host/protocol';
 import { MAKA_RUNTIME_ARTIFACT_PATH, MAKA_SUBJECT_STDERR_PATH, MAKA_SUBJECT_STDOUT_PATH, } from './maka-artifacts.js';
@@ -24,7 +26,14 @@ import { deepSeekCostUsd } from './provider-metering.js';
 export function createMakaSubjectAdapter() {
     return {
         kind: 'maka',
-        validate: (cell) => decodeConfig(cell.subject.config),
+        validate: (cell) => {
+            const config = decodeConfig(cell.subject.config);
+            if (config.apiKeyEnvironment &&
+                !cell.subject.credentials.includes(config.apiKeyEnvironment)) {
+                throw new Error('Maka apiKeyEnvironment must name a declared subject credential');
+            }
+            return config;
+        },
         async execute({ cell, context }) {
             const config = decodeConfig(cell.subject.config);
             const executionId = randomUUID();
@@ -37,7 +46,7 @@ export function createMakaSubjectAdapter() {
                         connectionSlug: config.connectionSlug,
                         model: config.model,
                     },
-                    thinkingLevel: config.thinkingLevel,
+                    ...(config.thinkingLevel === undefined ? {} : { thinkingLevel: config.thinkingLevel }),
                     permissionMode: config.permissionMode,
                     collaborationMode: config.collaborationMode,
                     orchestrationMode: config.orchestrationMode,
@@ -50,6 +59,14 @@ export function createMakaSubjectAdapter() {
                 rootPath: `${config.runtimeHostsPath}/${executionId}`,
                 artifactRoot: MAKA_RUNTIME_ARTIFACT_PATH,
                 baseUrl: config.baseUrl,
+                ...(config.providerType
+                    ? {
+                        connection: {
+                            providerType: config.providerType,
+                            apiKeyEnvironment: config.apiKeyEnvironment,
+                        },
+                    }
+                    : {}),
                 hostSettlementTimeoutMs: config.hostSettlementTimeoutMs,
                 execution: input,
             })).toString('base64url');
@@ -219,7 +236,8 @@ function decodeConfig(value) {
         'baseUrl',
         'connectionSlug',
         'model',
-        'thinkingLevel',
+        ...(Object.hasOwn(value, 'providerType') ? ['providerType', 'apiKeyEnvironment'] : []),
+        ...(Object.hasOwn(value, 'thinkingLevel') ? ['thinkingLevel'] : []),
         'permissionMode',
         'collaborationMode',
         'orchestrationMode',
@@ -227,6 +245,13 @@ function decodeConfig(value) {
         'toolProfile',
     ];
     const config = exact(value, fields);
+    if (config.providerType !== undefined &&
+        !Object.hasOwn(PROVIDER_REGISTRY, String(config.providerType))) {
+        throw new Error('Maka config.providerType is invalid');
+    }
+    if (config.thinkingLevel !== undefined && !isThinkingLevel(config.thinkingLevel)) {
+        throw new Error('Maka config.thinkingLevel is invalid');
+    }
     if (!URL.canParse(String(config.baseUrl)))
         throw new Error('Maka baseUrl is invalid');
     const hostSettlementTimeoutMs = positiveInteger(config.hostSettlementTimeoutMs, 'Maka config.hostSettlementTimeoutMs');

package/node_modules/@maka/eval/dist/metering-checkpoint.js

@@ -27,10 +27,10 @@ let atomicWriteSequence = 0;
 // The checkpoint is read by a different process after this one may have died
 // mid-write, so it is renamed into place rather than written in place: a reader
 // sees either the previous snapshot or the next one, never a truncated file.
-// /logs/agent is created under umask 077, which silently downgrades the
-// writeFile mode to 0600. chmod the temporary file before rename so the
-// published inode is already 0644; a host that races the rename must not see
-// a 0600 file it cannot read.
+// The container runtime picks the subject's umask and this package cannot set
+// it, so writeFile's mode is only a request. chmod the temporary file before
+// rename so the published inode is already 0644; a host that races the rename
+// must not see a file it cannot read.
 export async function writeJsonAtomic(path, value) {
     const temporary = `${path}.tmp-${process.pid}-${atomicWriteSequence++}`;
     await writeFile(temporary, `${JSON.stringify(value)}\n`, { mode: 0o644 });

package/node_modules/@maka/eval/dist/process-termination.js

@@ -0,0 +1,83 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { spawn } from 'node:child_process';
+const WINDOWS_TASKKILL_TIMEOUT_MS = 2_000;
+/**
+ * Terminates a child using the platform's process lifecycle semantics.
+ * Windows does not implement POSIX signals, so every termination request must
+ * include descendants. Otherwise the root can exit before forced escalation
+ * and leave its workers running.
+ */
+export function terminateProcess(child, signal, options = {}) {
+    if (!child || child.exitCode !== null || child.signalCode !== null)
+        return Promise.resolve(false);
+    const platform = options.platform ?? process.platform;
+    if (platform === 'win32') {
+        const pid = child.pid;
+        if (typeof pid !== 'number' || !Number.isSafeInteger(pid) || pid <= 0) {
+            return killChild(child);
+        }
+        return (options.runTaskkill ?? killWindowsTree)(pid).then((killed) => killed ? true : killChild(child));
+    }
+    return killChild(child, signal);
+}
+function killChild(child, signal) {
+    try {
+        // Omitting the signal is intentional on Windows: Node uses its native
+        // graceful termination path instead of trying to emulate a POSIX signal.
+        return Promise.resolve(signal === undefined ? child.kill() : child.kill(signal));
+    }
+    catch {
+        return Promise.resolve(false);
+    }
+}
+function killWindowsTree(pid) {
+    return new Promise((resolve) => {
+        let settled = false;
+        let timeout;
+        const finish = (succeeded) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timeout)
+                clearTimeout(timeout);
+            resolve(succeeded);
+        };
+        try {
+            const killer = spawn('taskkill.exe', ['/PID', String(pid), '/T', '/F'], {
+                stdio: 'ignore',
+                windowsHide: true,
+            });
+            killer.once('error', () => finish(false));
+            killer.once('close', (code) => finish(code === 0));
+            timeout = setTimeout(() => {
+                try {
+                    killer.kill();
+                }
+                catch {
+                    /* taskkill already exited */
+                }
+                finish(false);
+            }, WINDOWS_TASKKILL_TIMEOUT_MS);
+        }
+        catch {
+            finish(false);
+        }
+    });
+}

package/node_modules/@maka/eval/dist/toolchain-verification.js

@@ -60,7 +60,7 @@ export const TOOLCHAIN_IDENTITIES = {
     'deepseek-harness': {
         root: '/opt/maka-deepseek-harness-toolchain',
         version: '0.1.0-rc.6',
-        fingerprint: 'sha256:a0882b448718ddfb7b64e33a12369c92b0064baf8388fe08a8ff64fe3dd98896',
+        fingerprint: 'sha256:5314e15659d4c35381ce15ca4802933d61bc3af718d7eeb8260f4fa32ccf5860',
     },
 };
 // The identity table is the profile registry: a profile without a pinned

package/node_modules/@maka/eval/harbor/egress-proxy/entrypoint.sh

@@ -59,4 +59,5 @@ exec mitmdump \
   --set block_global=false \
   --set rawtcp=false \
   --set confdir="$STATE_DIR" \
-  --scripts /opt/maka-eval/egress_filter.py
+  --scripts /opt/maka-eval/egress_filter.py \
+  "$@"

package/node_modules/@maka/eval/harbor/relay_agent.py

@@ -100,6 +100,7 @@ class RelayAgent(BaseAgent):
         if not isinstance(teardown_timeout_ms, int) or teardown_timeout_ms <= 0:
             raise RuntimeError("Maka Eval teardown timeout is invalid")
         self._teardown_timeout = teardown_timeout_ms / 1000
+        self._subject_owner: str | None = None
 
     @staticmethod
     def name() -> str:
@@ -109,7 +110,35 @@ class RelayAgent(BaseAgent):
         return "1"
 
     async def setup(self, environment: Any) -> None:
-        return None
+        identity = await environment.exec('printf "%s:%s" "$(id -u)" "$(id -g)"')
+        owner = str(identity.stdout or "").strip()
+        if identity.return_code != 0 or re.fullmatch(r"[0-9]+:[0-9]+", owner) is None:
+            raise RuntimeError("Maka Eval could not resolve the task user")
+        prepared = await environment.exec(
+            "mkdir -p /logs/agent /logs/artifacts && "
+            f"chown {owner} /logs/agent /logs/artifacts && "
+            "chmod 700 /logs/agent /logs/artifacts",
+            user="root",
+        )
+        if prepared.return_code != 0:
+            raise RuntimeError("Maka Eval could not prepare task-owned artifact directories")
+        # Storage coordinates by the system account home, not the subject's
+        # temporary HOME. Provision an absent home without changing task identity
+        # or taking ownership of an existing directory.
+        uid = owner.split(":", 1)[0]
+        home_script = (
+            f"set -eu; account=$(getent passwd {uid}); "
+            "task_home=$(printf '%s' \"$account\" | cut -d: -f6) && "
+            'case "$task_home" in /*) ;; *) exit 1 ;; esac; '
+            'if [ ! -e "$task_home" ] && [ ! -L "$task_home" ]; then '
+            f'mkdir -p -- "$task_home" && chown {owner} "$task_home" && '
+            'chmod 700 "$task_home" || exit 1; fi; '
+            'test -d "$task_home"'
+        )
+        prepared_home = await environment.exec(home_script, user="root")
+        if prepared_home.return_code != 0:
+            raise RuntimeError("Maka Eval could not prepare the task account home")
+        self._subject_owner = owner
 
     async def run(self, instruction: str, environment: Any, context: Any) -> None:
         reader, writer = await asyncio.open_connection(self._host, self._port)
@@ -145,7 +174,9 @@ class RelayAgent(BaseAgent):
                 raise RelayTransportClosed("Maka Eval relay transport closed before ready")
             request = await _receive(reader)
             _require_message(request, self._token, "execute")
-            command = await _prepare_command(environment, request, self._token, scope_path)
+            command = await _prepare_command(
+                environment, request, self._token, scope_path, self._subject_owner
+            )
             execution = asyncio.create_task(environment.exec(command, cwd=cwd))
             decision = asyncio.create_task(_receive(reader))
             done, _ = await asyncio.wait({execution, decision}, return_when=asyncio.FIRST_COMPLETED)
@@ -278,6 +309,7 @@ async def _prepare_command(
     request: dict[str, Any],
     token: str,
     scope_path: str,
+    subject_owner: str | None = None,
 ) -> str:
     credentials = request.get("credentials")
     public_environment = request.get("environment", {})
@@ -317,6 +349,14 @@ async def _prepare_command(
             }.items():
                 secret.write(f"export {key}={shlex.quote(value)}\n")
         await environment.upload_file(secret_path, container_path)
+        if subject_owner is not None:
+            prepared = await environment.exec(
+                f"chown {subject_owner} {shlex.quote(container_path)} && "
+                f"chmod 600 {shlex.quote(container_path)}",
+                user="root",
+            )
+            if prepared.return_code != 0:
+                raise RuntimeError("Maka Eval could not prepare task-owned credentials")
     finally:
         if secret_path is not None:
             secret_path.unlink(missing_ok=True)
@@ -324,8 +364,7 @@ async def _prepare_command(
     output_redirect = "" if capture_stdout else " >/dev/null"
     scope_error = shlex.quote(f"{SCOPE_ERROR_PREFIX} {result_token}\\n")
     inner = (
-        "umask 077; "
-        f"{{ echo $$ > {shlex.quote(scope_path)}; }} 2>/dev/null || "
+        f"( umask 077 && echo $$ > {shlex.quote(scope_path)} ) 2>/dev/null || "
         f"{{ printf {scope_error}; exit 111; }}; "
         f". {shlex.quote(container_path)}; command -p rm -f {shlex.quote(container_path)}; "
         f"exec {subject}{output_redirect}"

package/node_modules/@maka/eval/node_modules/undici/docs/docs/api/Client.md

@@ -147,6 +147,10 @@ added: v1.0.0
       WebSocket messages. Applied to uncompressed messages, compressed frame
       payloads, and decompressed (`permessage-deflate`) messages. Set to `0` to
       disable the limit. **Default:** `134217728`.
+  * `eventSource` {Object} (optional) EventSource-specific configuration.
+    * `maxEventSize` {number} The maximum allowed event size, in bytes, for
+      EventSource messages. Set to `0` to disable the limit.
+      **Default:** `buffer.kStringMaxLength`.
 * Returns: {Client}
 
 Instantiating a `Client` does not open a connection; the connection is

package/node_modules/@maka/eval/node_modules/undici/docs/docs/api/EnvHttpProxyAgent.md

@@ -25,8 +25,9 @@ it is used only for HTTPS requests.
 proxied. Each entry may include a leading dot or `*.` wildcard (for example
 `.example.com`) to match subdomains, and an optional `:port` suffix to restrict
 the match to a specific port. A request bypasses the proxy when its host equals
-an entry or is a subdomain of one. Setting `no_proxy` to `*` bypasses the proxy
-for every request.
+an entry or is a subdomain of one. A trailing dot is ignored on both sides, so
+`example.com.` and `example.com` match each other. Setting `no_proxy` to `*`
+bypasses the proxy for every request.
 
 The uppercase variants `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` are also
 honored. When both the lowercase and uppercase forms of a variable are set, the

package/node_modules/@maka/eval/node_modules/undici/docs/docs/api/EventSource.md

@@ -66,6 +66,9 @@ added: v6.5.0
       wait before re-establishing a dropped connection. The server may override
       this value with a `retry` field. **Default:** `3000`.
 
+EventSource-specific limits can be configured on the dispatcher using the
+`eventSource` option. See [`Client`][] for details.
+
 Creates a new `EventSource` and immediately begins connecting to `url`. The
 request is sent with the `Accept: text/event-stream` header, a cache mode of
 `no-store`, and an initiator type of `other`.
@@ -349,6 +352,7 @@ eventSource.onerror = () => {
 ```
 
 [WHATWG-conformant]: https://html.spec.whatwg.org/multipage/server-sent-events.html#server-sent-events
+[`Client`]: Client.md#new-clienturl-options
 [`Dispatcher`]: Dispatcher.md#class-dispatcher
 [`addEventListener()`]: https://developer.mozilla.org/en-US/docs/Web/API/EventTarget/addEventListener
 [server-sent events]: https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events

package/node_modules/@maka/eval/node_modules/undici/docs/docs/api/Interceptors.md

@@ -101,8 +101,8 @@ body yourself.
 
 * `opts` {Object} (optional)
   * `maxSize` {number} Maximum number of bytes to read and discard. Responses
-    whose `Content-Length` exceeds this value are aborted. **Default:**
-    `1_048_576` (1 MiB).
+    whose declared or received body size exceeds this value are aborted.
+    **Default:** `1_048_576` (1 MiB).
 
 Per-request override: set `dumpMaxSize` on the dispatch options to override
 the global `maxSize` for a specific request.
@@ -210,6 +210,9 @@ Automatically decompresses response bodies encoded with `gzip`, `x-gzip`,
     skipped. **Default:** `[204, 304]`.
   * `skipErrorResponses` {boolean} When `true`, responses with a status code
     >= 400 are not decompressed. **Default:** `true`.
+  * `maxSize` {number} Maximum decompressed response size in bytes. The request
+    fails with a `ResponseExceededMaxSizeError` if the decoded body exceeds
+    this limit. **Default:** `67108864` (64 MiB).
 
 **Returns:** {Dispatcher.DispatcherComposeInterceptor}
 
@@ -221,7 +224,8 @@ import { Agent, interceptors } from 'undici'
 const agent = new Agent().compose(
   interceptors.decompress({
     skipStatusCodes: [204, 304],
-    skipErrorResponses: false // decompress error bodies too
+    skipErrorResponses: false, // decompress error bodies too
+    maxSize: 16 * 1024 * 1024 // limit decoded bodies to 16 MiB
   })
 )
 ```

package/node_modules/@maka/eval/node_modules/undici/docs/docs/api/Socks5ProxyAgent.md

@@ -60,6 +60,11 @@ added: v7.23.0
     a password embedded in `proxyUrl`. **Default:** the URL password, if any.
   * `connect` {Function} Custom connector used to open the socket to the proxy.
     **Default:** a connector built from `proxyTls`.
+  * `connectTimeout` {number} Maximum time in milliseconds for each proxy
+    connection, SOCKS5 negotiation, and target TLS negotiation stage. A value of
+    `0` disables these stage timeouts. `proxyTls.timeout` and
+    `requestTls.timeout` override it for their respective TLS stages.
+    **Default:** `5000`.
   * `proxyTls` {BuildOptions} TLS options for the connection to the proxy itself
     (SOCKS5 over TLS). When set, the proxy connection is established over TLS and
     `servername` defaults to the proxy host name.
@@ -69,7 +74,8 @@ added: v7.23.0
     host name.
 
 Throws an `InvalidArgumentError` if `proxyUrl` is missing or does not use the
-`socks5:` or `socks:` protocol.
+`socks5:` or `socks:` protocol, or if `connectTimeout`, `proxyTls.timeout`, or
+`requestTls.timeout` is not a finite, non-negative number.
 
 ```mjs
 import { Socks5ProxyAgent } from 'undici'

package/node_modules/@maka/eval/node_modules/undici/lib/cache/memory-cache-store.js

@@ -87,7 +87,7 @@ class MemoryCacheStore extends EventEmitter {
   }
 
   /**
-   * @param {import('../../types/cache-interceptor.d.ts').default.CacheKey} req
+   * @param {import('../../types/cache-interceptor.d.ts').default.CacheKey} key
    * @returns {import('../../types/cache-interceptor.d.ts').default.GetResult | undefined}
    */
   get (key) {
@@ -179,7 +179,7 @@ class MemoryCacheStore extends EventEmitter {
 
           // Perform eviction
           for (const [key, entries] of store.#entries) {
-            for (const entry of entries.splice(0, entries.length / 2)) {
+            for (const entry of entries.splice(0, Math.ceil(entries.length / 2))) {
               store.#size -= entry.size
               store.#count -= 1
             }

package/node_modules/@maka/eval/node_modules/undici/lib/core/symbols.js

@@ -5,6 +5,8 @@ module.exports = {
   kDestroy: Symbol('destroy'),
   kDispatch: Symbol('dispatch'),
   kUrl: Symbol('url'),
+  kRequestOrigin: Symbol('request origin'),
+  kOriginless: Symbol('originless'),
   kWriting: Symbol('writing'),
   kResuming: Symbol('resuming'),
   kQueue: Symbol('queue'),