zooqueenandHanzo Dev 3604c02717 lsp: set GOROOT + disable telemetry so gopls actually runs in the jail
The shipped go is -trimpath (no compiled-in GOROOT), and the jail binds a host
allow-list with no /proc, so os.Executable fails and go/gopls die with 'cannot
find GOROOT directory' — every query answered null. Set GOROOT=/usr/local/go
(present via the /usr/local bind) and GOTELEMETRY=off (its counter child also
readlinks the absent /proc/self/exe). /v1/code/lsp answers Go queries after this.

Bump 0.1.2 -> 0.1.3.

Co-authored-by: Hanzo Dev <[email protected]>
2026-08-06 11:53:01 -07:00

lsp

The jailed language-server daemon. It holds immutable per-(org, repo, commit) working trees, runs a language server over each one inside a jail with no network, and answers position questions about them.

The answer it exists for is a definition that leaves the repository and lands in a dependency — which a static symbol index structurally cannot give you.

POST /root       {org, repo, rev, files}       → {ready, cold, langs}
POST /root/warm  same body, only for a held repo
POST /ask        {org, repo, rev, op, path, line, character, relation}
                                               → the answer, or 409 {"need":"tree"}
GET  /healthz    liveness
GET  /readyz     readiness — green only once the jail proved out on this host

Everything else — the wire contract in full, the two-phase security model, the deployment, and what phase 2 is — is in LLM.md.

S
Description
Jailed language-server daemon: immutable per-(org,repo,commit) roots, gopls behind a seccomp jail with no network. Backs /v1/code/lsp.
Readme Apache-2.0
192 KiB
Languages
Go 93%
Dockerfile 7%