chore(deps): bump the actions group across 1 directory with 6 updates

.github/workflows/ci.yml

@@ -196,7 +196,7 @@ jobs:
         with:
           go-version-file: go.mod
           cache: true
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24
           cache: npm
@@ -231,7 +231,7 @@ jobs:
       - run: node apps/web/scripts/performance.mjs
       - run: npm run test:example
       - name: Shared verified renderer for desktop and release consumers
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: ci-renderer
           if-no-files-found: error
@@ -240,7 +240,7 @@ jobs:
             apps/web/renderer-manifest.json
       - name: Browser acceptance evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: web-browser-evidence
           if-no-files-found: ignore
@@ -259,7 +259,7 @@ jobs:
         with:
           go-version-file: go.mod
           cache: true
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: '24'
           cache: npm
@@ -278,7 +278,7 @@ jobs:
       - run: npm run test:docs:browser
       - run: npm run build:storybook:docs
       - name: Static docs artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: docs-static
           if-no-files-found: error
@@ -311,7 +311,7 @@ jobs:
         with:
           go-version-file: go.mod
           cache: true
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24
           cache: npm
@@ -325,7 +325,7 @@ jobs:
           node scripts/backend-compat/run.mjs --candidate "$GITHUB_WORKSPACE" --base "$COMPATIBILITY_BASE" --output "$RUNNER_TEMP/backend-compat"
       - name: Compatibility evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: backend-compat-${{ runner.os }}
           path: |
@@ -404,7 +404,7 @@ jobs:
         with:
           go-version-file: go.mod
           cache: true
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: '24'
           cache: npm
@@ -415,7 +415,7 @@ jobs:
         run: |
           npm run generate
           npm run build
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: ci-renderer
           path: apps/web

.github/workflows/desktop-check.yml

@@ -19,7 +19,7 @@ jobs:
         with:
           go-version-file: go.mod
           cache: true
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: '24'
           cache: npm
@@ -32,7 +32,7 @@ jobs:
           npm run build
       - run: node node_modules/electron/install.js
       - run: npx playwright install ffmpeg
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: ${{ inputs.renderer-artifact }}
           path: apps/web
@@ -57,7 +57,7 @@ jobs:
         run: node apps/desktop/scripts/smoke.mjs
       - name: Desktop package and lifecycle evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: desktop-ci-evidence
           if-no-files-found: warn

.github/workflows/desktop-release.yml

@@ -45,7 +45,7 @@ jobs:
         with:
           go-version-file: go.mod
           cache: true
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: '24'
           cache: npm
@@ -68,7 +68,7 @@ jobs:
           npm run generate
           npm run build
       - run: node node_modules/electron/install.js
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: ${{ inputs.renderer-artifact }}
           path: apps/web
@@ -106,7 +106,7 @@ jobs:
             if (!(await stat(`${root}/${name}`)).size) throw new Error(`Missing final ${name}`);
           }
           NODE
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: desktop-release-arm64
           path: apps/desktop/out/release
@@ -115,7 +115,7 @@ jobs:
           compression-level: 0
       - name: Sanitized startup diagnostics (including failures)
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: desktop-startup-diagnostics-arm64
           path: apps/desktop/out/diagnostics/startup.json

.github/workflows/docs-deploy.yml

@@ -25,7 +25,7 @@ jobs:
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: '24'
           cache: npm
@@ -51,7 +51,7 @@ jobs:
           npm run build:docs
           (cd apps/docs && node scripts/package-deploy.mjs)
           node apps/docs/scripts/worker-test.mjs
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: docs-deploy-${{ github.sha }}
           path: apps/docs/dist/deploy
@@ -72,10 +72,10 @@ jobs:
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: '24'
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: docs-deploy-${{ github.sha }}
           path: apps/docs/dist/deploy
@@ -114,7 +114,7 @@ jobs:
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: '24'
           cache: npm

.github/workflows/mobile.yml

@@ -24,7 +24,7 @@ jobs:
         with:
           go-version-file: go.mod
           cache: true
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         with:
           node-version: 24
           cache: npm

.github/workflows/publish-cli.yml

@@ -122,7 +122,7 @@ jobs:
         with:
           go-version-file: go.mod
           cache: true
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: '24'
           cache: npm
@@ -131,7 +131,7 @@ jobs:
         run: |
           npm run generate
           npm run build
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: ci-renderer
           path: apps/web
@@ -154,7 +154,7 @@ jobs:
             -o "dist/release/$ASSET" ./cmd/whip
       - name: Accept the packaged binary from a fresh home with the tested renderer
         run: python3 scripts/test-distributions.py --binary "dist/release/$ASSET" --version "$RELEASE_TAG"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: whipcode-bin-${{ matrix.goos }}-${{ matrix.goarch }}
           path: dist/release/${{ matrix.asset }}
@@ -182,22 +182,22 @@ jobs:
         with:
           ref: ${{ needs.metadata.outputs.source }}
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: '24'
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: ci-renderer
           path: apps/web
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: whipcode-bin-linux-amd64
           path: linux
       - name: Accept the exact standalone Linux bytes, never rebuild
         run: |
           chmod +x linux/whipcode-linux-x64
           node apps/desktop/scripts/linux-smoke.mjs linux/whipcode-linux-x64
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: release-linux-evidence
           path: linux/linux-runtime.json
@@ -218,23 +218,23 @@ jobs:
         with:
           ref: ${{ needs.metadata.outputs.source }}
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: '24'
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: go.mod
           cache: true
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           pattern: whipcode-bin-*
           path: candidate
           merge-multiple: true
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: desktop-release-arm64
           path: candidate
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: release-linux-evidence
           path: candidate
@@ -254,7 +254,7 @@ jobs:
         uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
         with:
           subject-path: candidate/*
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: release-candidate
           path: candidate
@@ -290,7 +290,7 @@ jobs:
           ref: ${{ needs.metadata.outputs.source }}
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: '24'
           cache: npm
@@ -305,7 +305,7 @@ jobs:
         run: |
           npm run generate
           npm run build
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: release-candidate
           path: candidate

.github/workflows/security.yml

@@ -56,11 +56,11 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ github.sha }}
-      - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           languages: go
           queries: security-and-quality
-      - uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
-      - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+      - uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           category: "/language:go"

docs/concurrency.md

@@ -248,6 +248,13 @@ Shell and kernel subprocesses run in managed process groups. This is
 operational containment, not a security sandbox against another hostile
 process already running as the same OS user.
 
+Managed host processes inherit the Go build settings `GOCACHE`, `GOMODCACHE`,
+`GOPATH`, `GOROOT`, `GOTOOLCHAIN`, and `GOFLAGS` captured when the process manager
+starts. This preserves preloaded modules and toolchains in offline environments.
+Explicit child-process settings take precedence over that snapshot. Other Go
+variables, including credential-bearing proxy/auth settings, are not implicitly
+inherited; the allowlist is in `internal/capability/process.go`.
+
 ## Gateway process ownership
 
 The socket-only daemon owns execution; `internal/webgateway` owns HTTP/WS

internal/agent/agent.go

@@ -1223,8 +1223,32 @@ func (a *Agent) ManualCompact(ctx context.Context, ev Events) error {
 
 // finalAnswer makes one last completion with tools disabled, so a run that hit
 // the tool-turn cap still returns the model's best answer instead of an error.
-// A system nudge tells the model to stop calling tools and answer now.
+// The capped answer goes through the same final-message check the loop runs
+// on a no-tools reply: a definition's output contract is a property of the
+// turn, not of how it ended. One correction round is allowed, as in the loop;
+// a second miss fails the turn.
 func (a *Agent) finalAnswer(ctx context.Context, ev Events) (string, error) {
+	text, err := a.cappedAnswer(ctx, ev)
+	if err != nil || ev.CheckFinal == nil {
+		return text, err
+	}
+	retry, err := ev.CheckFinal(text)
+	if err != nil || !retry {
+		return text, err
+	}
+	if text, err = a.cappedAnswer(ctx, ev); err != nil {
+		return text, err
+	}
+	if _, err := ev.CheckFinal(text); err != nil {
+		return "", err
+	}
+	return text, nil
+}
+
+// cappedAnswer is one tools-disabled completion. A system nudge tells the
+// model to stop calling tools and answer now; the turn's ephemeral notices
+// (an output-contract correction among them) ride along as usual.
+func (a *Agent) cappedAnswer(ctx context.Context, ev Events) (string, error) {
 	msgs := append(slices.Clone(withEphemeralSystem(a.Messages, ev.ephemeral())),
 		llm.Message{Role: "system", Content: "You have reached the tool-call limit. Do NOT request any more tools. Give your final answer now using only what you have already gathered."})
 	client := *a.Client