[samheutmaker]

Managed subprocesses currently drop the host’s Go cache and toolchain settings. This prevents Go commands from using preloaded modules in offline environments.

Preserve the captured GOCACHE, GOMODCACHE, GOPATH, GOROOT, GOTOOLCHAIN, and GOFLAGS settings, while retaining explicit child overrides and excluding proxy/auth variables from implicit inheritance. Includes regression tests for the environment snapshot, overrides, credential exclusions, and an actual offline module lookup.

Extracted only commit 8884403 from #186, preserving Amar Singh’s authorship. The unrelated reasoning/protocol changes from that PR are excluded.

Validation: regression tests failed against unchanged development during triage; the focused process tests pass with the fix under Go 1.27.2 and the race detector. Full CI must pass before merging.

---

Note

Medium Risk
Expands which host environment variables managed children receive; mitigated by a narrow Go-toolchain allowlist and explicit exclusion of proxy/auth-related GO* variables.

Overview
Managed subprocesses now inherit a snapshot of six Go toolchain/cache variables (GOCACHE, GOMODCACHE, GOPATH, GOROOT, GOTOOLCHAIN, GOFLAGS) taken when ProcessManager starts, so go in managed children can use preloaded module caches offline. Per-process Env overrides still win (e.g. ChildEnvironment / ProcessOptions.Env).

The allowlist in allowedBaseEnvironment is extended deliberately without inheriting other GO* settings (e.g. GOPROXY, GOAUTH) that may carry credentials. docs/concurrency.md documents this behavior.

Tests cover snapshot vs post-snapshot host changes, credential exclusion, override precedence, and an integration test that runs go list -m all with downloads disabled using a fake module cache.

^{Reviewed by Cursor Bugbot for commit bee34d8. Bugbot is set up for automated code reviews on this repo. Configure here.}