[ORESoftware]

Part of #378 — the "look on local disk for deps/packages" half of the requirement (the github.com half merged in #379).

Salvages feat/local-project-registry (3 commits from 2026-08-23, unmerged for ~3 weeks) onto current main with a real merge, no rebase.

What it adds

A machine-wide index of local project checkouts that zed install can resolve from, so a dependency that already exists as a directory on this filesystem needs no network at all:

• zed local register|list|unregister|scan|prune (src/local_cli.rs, src/local_registry.rs)
• index at <ZED_PKG_HOME>/local-registry/index.json, schema zed.local-registry.v1
• opt-in modes via --local-registry / ZED_PKG_LOCAL_REGISTRY (auto / only / off)
• registration is per path, not per package name: several checkouts of one package are legitimate, so a name-level tie that cannot be broken deterministically is a hard error, never a coin flip
• resolution is live (the manifest on disk wins; the recorded version is a drift-detection snapshot), and entries whose path vanished, whose manifest stopped parsing, or whose identity changed are reported unhealthy and never selected

State: WIP — 2 known failures, wiring incomplete

main refactored install resolution while this branch sat (#456, local_overrides), so the salvaged gate is no longer consulted on every path:

• local_registry_off_ignores_registrations_entirely — --local-registry off still resolves locally instead of consulting the remote registry
• local_registry_only_names_the_dependency_it_cannot_satisfy — --local-registry only falls through to the file registry instead of failing with the local-only diagnostic

Everything else passes: 653 lib tests, 16 adversarial, 15/17 CLI, plus portability and vs-remote suites compile and run. Conflicts resolved: src/lib.rs (keep local_cli + local_registry alongside main's local_overrides), and the salvaged fixtures gained main's new mirrors / signatures / signing_keys metadata fields.

Relationship to #381

#381 (DEN-3488-local-dev-repo-race) implements a different, automatic design: bounded discovery of checkouts under ~/codes, ~/code, ~/src … for non-frozen symlink installs. It is currently unmergeable (dirty) with 66 failing checks. This PR is the opt-in, explicitly registered counterpart that also covers copy mode. They are complementary, but the two resolution paths should be reconciled before both land.

Next

• Re-wire the gate into main's current resolver so the two failing tests pass.
• Then an offline end-to-end: register a checkout, install with the registry pointed at an unreachable URL and ZED_PKG_SOURCE_FALLBACK=0.

🤖 Generated with Claude Code

[ORESoftware]

Coordination note for DEN-3282 / merged zed-interfaces#138: local machine registrations must remain below explicit project-authored source authority. The resolver/materializer precedence should be documented and tested as:

1. explicit [overrides.path] for that dependency;
2. project-owned providers: ordinary [workspace].members and [interop.source-composition] entries with role = "workspace";
3. opt-in machine-local registry according to --local-registry policy;
4. remote registry/fallback.

A machine registration must never silently replace a manifest-authoritative source-composition workspace provider or an explicit path override. Conversely, local-registry=only may suppress remote access but should not disable already-declared project-local providers. Frozen mode must also retain DEN-3282's rule that mutable ordinary source-composition checkouts are refused until an immutable workspace-source lock exists; the machine registry's prefer mode must not be used to bypass that source-lock boundary.

Please add cross-feature tests before this PR leaves WIP, especially the same package present in [overrides.path], source composition, and the local registry.