[LinuxDevil]

Fixes audit finding DX-13 (Vercel competitor audit, 2026-10-19).

What was wrong

lousho add had no registry at all when the host did not resolve, GitHub was unreachable or the version's tag was never pushed (offline, outage).

What changed

• package.json files now includes registry/dist (index + item documents).
• openRegistry falls back to the bundled registry/dist/index.json (found via findSdkRoot()) after the network URLs fail, printing a one-line stderr notice that the bundled (possibly older) registry is used. Items resolve relative to the local index path, so they load from the bundle too.
• Only the default registry falls back; explicit --registry / LOUSHO_REGISTRY still throw LOUSHO_REGISTRY_UNREACHABLE.
• Fallback logic split out of openRegistry into openDefaultFallback (fallow complexity). docs/registry.md updated, llms regenerated.
• Package size delta: +115 KB of JSON unpacked (9 files); npm pack --dry-run lists registry/dist/index.json. size-check passes (12.62 MB vs 15.15 MB budget), budget untouched.

Tests

src/cli/add.test.ts: with fetch failing for every URL, --list and add code-review succeed from the bundled path with the notice and receipt pointing at the bundled index; explicit --registry failure still gives LOUSHO_REGISTRY_UNREACHABLE with no bundled notice. Ran tsc, typecheck:tests, lint, test:coverage (needed --retry on Windows for load-flaky tests) and fallow (exit 0), docs:llms:check, size-check.

Changelog: lousho add falls back to the registry bundled in the npm package when the default registry and its GitHub fallbacks are unreachable.

🤖 Generated with Claude Code