[M7b] Default static registry that lousho add uses out of the box

[LinuxDevil]

Goal

npx lousho add --list works with no flags: it reads a default registry of a few useful tools, skills and a channel maintained in this repository and published as static JSON. Today it fails with "no registry configured; there is no hosted registry yet". Flips the second half of the "Registry" row (AUDIT-2 section 2, our-report row 45: "there is no hosted registry, so lousho add has nothing to install from"). Hosting is an owner decision (PLAN-2 "Owner decisions" item 3).

Current state

• src/cli/registry.ts:103-110 (registrySource): options.registry ?? (options.env ?? process.env).LOUSHO_REGISTRY; without either it throws 'lousho add: no registry configured; there is no hosted registry yet.' (LOUSHO_CONFIG_INVALID) with a hint. No config-file key (src/agentDir/readConfig.ts:40-49 has no registry).
• readSource (75-87) accepts http(s) URLs and local paths; 15 s timeout (13); 2,000,000-character cap (15, 85); loadItem resolves url/path relative to the index (117-136).
• No registry content in the repository (no registry/ folder, no index.json data file); no build script in scripts/ (generate-llms-txt.ts, llmsTxt.ts, pack-smoke.ts, verify-docs-snippets.ts).
• docs/registry.md:10-12: "There is no hosted registry yet. Point lousho add at one with --registry or the LOUSHO_REGISTRY environment variable". CHANGELOG.md:63 says the same.
• The docs site (https://lousho.com) is Mintlify, built from E:\agent-sdk-docs (docs.json $schema https://mintlify.com/docs.json, package.json scripts mint dev, mint broken-links); it is not a general static file host.
• Channel and tool building blocks exist for items: webhookChannel() (src/channels/webhookChannel.ts:60), httpChannel() (src/channels/httpChannel.ts:29), defineTool, defineSkill.

Owner decision required

Question for the owner: where is the default registry served from?

• (a) https://registry.lousho.com/index.json: GitHub Pages deployed by a workflow in this repository, with a registry.lousho.com CNAME you add at the DNS provider. Stable across the planned repository rename.
• (b) https://linuxdevil.github.io/agent-sdk/registry/index.json: GitHub Pages with no DNS change; the URL changes if the repository is renamed to lousho.
• (c) https://github.com/ghraw/LinuxDevil/agent-sdk/main/registry/dist/index.json: no hosting at all; served from the default branch.

Recommendation: (a). Until the owner answers, implement everything below with the URL in one constant, DEFAULT_REGISTRY, set to option (a), and do not merge the Pages workflow; record the answer in the issue before merging. Enabling GitHub Pages on the repository is an owner action (repository settings).

Scope

In:

• registry/ folder in this repository: one source folder per item with its files and an item.json (name, type, description, permissions, dependencies). Starter items, each passing M7a's manifest check:
  • tool open-meteo-weather: current weather by city through api.open-meteo.com (network: ['api.open-meteo.com', 'geocoding-api.open-meteo.com'], no key);
  • tool github-issues: list and create issues through api.github.com (network: ['github.com/ghapi'], env: ['GITHUB_TOKEN'], needsApproval: true on create);
  • skill changelog: write a CHANGELOG entry from a diff;
  • skill code-review: review a diff for bugs and style;
  • channel generic-webhook: a webhookChannel() with signature verification from an env secret (env: ['WEBHOOK_SECRET']).
• scripts/build-registry.ts (npm run registry:build): reads registry/*/, validates each item with the schemas in src/cli/registry.ts and M7a's checkItem(), and writes registry/dist/index.json plus registry/dist/items/<name>.json (item documents with file contents inlined). Deterministic output (sorted). npm run registry:check fails when registry/dist is stale (same pattern as docs:llms:check); add it to the ci job in .github/workflows/ci.yml after docs:llms:check.
• registry/dist/ is committed (so option (c) and local testing work with no deploy).
• src/cli/registry.ts: export const DEFAULT_REGISTRY = '<chosen URL>'; registrySource returns --registry, else LOUSHO_REGISTRY, else DEFAULT_REGISTRY. --registry none (or LOUSHO_REGISTRY=none) restores today's error, for offline or locked-down use. The "no registry configured" error is kept for none.
• Each item's files are tested: one src/cli/defaultRegistry.test.ts loads registry/dist/index.json from disk (never the network), installs every item into a temp agent directory with runAdd, and loads the directory with resolveAgentDir() (tools and skills resolve, the channel module default-exports a channel).
• Pages workflow .github/workflows/registry.yml (only if the owner chose (a) or (b)): on push to main with paths: ['registry/dist/**'], deploy registry/dist with actions/upload-pages-artifact and actions/deploy-pages; for (a), a CNAME file containing registry.lousho.com in the artifact.
• Docs docs/registry.md: replace lines 10-12 with the default registry, its URL, the item list (as a table: name, type, permissions), --registry none, and how to contribute an item (registry/<name>/, npm run registry:build). README feature line updated. CHANGELOG entry.

Out:

• Manifest enforcement and the receipt: M7a.
• Third-party submissions, review process, signatures: not in this ticket.
• Serving the registry from the Mintlify docs site: not possible as a general static host; not planned.
• A docs-site page listing the items: G9 picks up the docs/registry.md change through the normal sync.

Acceptance criteria

• Owner's hosting answer recorded in the issue before merge.
• registry/ with the five items, registry/dist/ built and committed; npm run registry:build and npm run registry:check scripts; registry:check in the ci job.
• src/cli/defaultRegistry.test.ts passes offline; add.test.ts covers the default source (with an injected fetch returning the committed index.json), --registry none, and that --registry and LOUSHO_REGISTRY still override.
• Docs, README, CHANGELOG updated; docs:verify-snippets, docs:llms:check pass.
• The Pages workflow is present only if the owner chose (a) or (b).
• All BRIEF-2.md verification commands pass; npm run pack-smoke passes (registry/ must not ship in the npm tarball: check files in package.json does not include it; do not edit files).

Live test

None: this ticket spends nothing.

Dependencies

M7a must merge first (checkItem() and the --allow flag). Conflicts: src/cli/registry.ts, src/cli/add.ts, docs/registry.md with M7a; .github/workflows/ci.yml with M8 (both add steps; rebase, do not reorder).

Notes for the implementer

• Keep items small and dependency-free (only zod and @lousho/build-ai-agent); dependencies in item.json lists zod if a tool imports it.
• The github-issues create tool must set needsApproval: true in its defineTool call, matching its manifest.
• The tests must not call open-meteo or GitHub; they only install and load the items.
• files in package.json is publish configuration: do not change it. If registry/ would ship, report it instead.

---

Round 2 ticket M7b. Before starting, read the agent brief (worktree rules, verification list, live-test budget) and the plan. One ticket is one pull request; put Closes #<this issue> in it.

[LinuxDevil]

Starting work on this ticket (Devin agent, 2026-10-30). Implementing with DEFAULT_REGISTRY set to option (a) https://registry.lousho.com/index.json per the ticket's recommendation; the Pages workflow is not included since the owner's hosting answer is still pending — it will be recorded here before merge.