fraim 2.0.359 → 2.0.360-next.1

package/dist/src/core/utils/domain-rule-assembler.js

@@ -0,0 +1,206 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withRuleDeliveryTimeout = withRuleDeliveryTimeout;
+exports.assembleDomainRules = assembleDomainRules;
+exports.attachRuleAssembly = attachRuleAssembly;
+const crypto_1 = require("crypto");
+const catalog_1 = require("../../../registry/scripts/domains/catalog");
+const inheritance_parser_1 = require("./inheritance-parser");
+class RuleFetchTimeout extends Error {
+}
+class RuleSourceFault extends Error {
+    constructor(path, resolved) {
+        super('Rule source unavailable');
+        this.path = path;
+        this.resolved = resolved;
+    }
+}
+async function withRuleDeliveryTimeout(operation, timeoutMs = 5000) {
+    let timer;
+    try {
+        return await Promise.race([operation, new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new RuleFetchTimeout()), timeoutMs);
+            })]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+/** Independent loads deliberately retain available policy when any sibling fails. */
+async function assembleDomainRules(options) {
+    const timeoutMs = Math.max(1, Math.min(options.timeoutMs ?? 5000, 30000));
+    const metadata = {
+        domain: options.jobPath ? null : 'global', catalogVersion: null,
+        selection: options.jobPath ? 'unknown' : 'connect', artifacts: [], warnings: [], complete: false,
+    };
+    const warn = (code, path, message, source) => {
+        metadata.warnings.push({ code, path, ...(options.jobPath ? { jobPath: options.jobPath } : {}),
+            domain: metadata.domain, message,
+            ...(source ? { source: source.scope ?? source.source, hash: (0, crypto_1.createHash)('sha256').update(source.content).digest('hex') } : {}),
+            recovery: `Restore or sync ${path} in its effective source, then refresh the current job instructions. Record this incident and its recovery in bound job evidence.`,
+            resolved: false });
+    };
+    let paths = ['rules/constitution.md'];
+    // Connect has no job/domain selection. Its fixed constitution must not wait
+    // on an unrelated catalog read (or report a catalog failure as missing policy).
+    if (options.jobPath) {
+        try {
+            const resolved = await withRuleDeliveryTimeout(options.resolveFile('domains.json'), timeoutMs);
+            const value = JSON.parse(resolved.content);
+            if (!value || typeof value !== 'object' || value.schemaVersion !== 2
+                || !value.domains || typeof value.domains !== 'object'
+                || Array.isArray(value.domains))
+                throw new Error('Invalid domain catalog');
+            const catalog = value;
+            metadata.catalogVersion = Number.isInteger(catalog.mapVersion) && catalog.mapVersion >= 3 ? catalog.mapVersion : null;
+            Object.assign(metadata, (0, catalog_1.selectCatalogDomain)(catalog, options.jobPath));
+            if ((0, catalog_1.validateDomainCatalog)(value).length)
+                warn('CATALOG_INVALID', 'domains.json', 'Some domain configuration is invalid; retain the constitution and available safe rule paths.', resolved);
+            for (const warning of resolved.resolutionWarnings ?? [])
+                warn('CATALOG_SOURCE_FALLBACK', 'domains.json', warning, resolved);
+            for (const domain of new Set(options.jobPath ? ['global', ...(metadata.domain ? [metadata.domain] : [])] : [])) {
+                const rules = catalog.domains[domain]?.rules;
+                if (Array.isArray(rules))
+                    paths.push(...rules.filter(path => (0, catalog_1.isSafeRegistryPath)(path, 'rules')));
+            }
+            if (metadata.selection === 'unknown')
+                warn('DOMAIN_UNKNOWN', 'domains.json', 'The job folder has no configured domain; configure rules for that folder in domains.json.');
+        }
+        catch (error) {
+            warn(error instanceof RuleFetchTimeout ? 'CATALOG_FETCH_TIMEOUT' : 'CATALOG_UNAVAILABLE', 'domains.json', 'The effective domain catalog is unavailable or invalid; independently load the constitution.');
+        }
+    }
+    const resolveRule = async (path, ancestors = [], rootPath = path, deadline = Date.now() + timeoutMs) => {
+        if (!(0, catalog_1.isSafeRegistryPath)(path, 'rules') || ancestors.includes(path) || ancestors.length >= 10)
+            throw new RuleSourceFault(path);
+        let resolved;
+        try {
+            resolved = await withRuleDeliveryTimeout(options.resolveFile(path), Math.max(1, deadline - Date.now()));
+        }
+        catch (error) {
+            if (error instanceof RuleFetchTimeout)
+                throw error;
+            throw new RuleSourceFault(path);
+        }
+        if (!resolved.content.trim())
+            throw new RuleSourceFault(path, resolved);
+        if (resolved.content.includes('\u0000') || resolved.content.includes('\ufffd'))
+            throw new RuleSourceFault(path, resolved);
+        const frontmatter = resolved.content.match(/^---\r?\n([\s\S]+?)\r?\n---/);
+        if (frontmatter?.[1].trim().startsWith('{')) {
+            try {
+                JSON.parse(frontmatter[1]);
+            }
+            catch {
+                throw new RuleSourceFault(path, resolved);
+            }
+        }
+        if (new inheritance_parser_1.InheritanceParser().parse(resolved.content).hasImports)
+            throw new RuleSourceFault(path, resolved);
+        const includes = [...resolved.content.matchAll(/\{\{\s*include:\s*([^}]+)\}\}/g)];
+        // Reject malformed directives before traversing or certifying this source's
+        // children. Its caller can then retain valid sibling fragments independently.
+        const literalContent = resolved.content.replace(/\{\{\s*include:\s*([^}]+)\}\}/g, '');
+        if (includes.some(match => !match[1].trim()) || /\{\{\s*(?:include|import)\s*:/.test(literalContent)) {
+            throw new RuleSourceFault(path, resolved);
+        }
+        if (!includes.length)
+            return resolved;
+        const expanded = await Promise.all(includes.map(async (match) => {
+            const childPath = match[1].trim();
+            try {
+                const child = await resolveRule(childPath, [...ancestors, path], rootPath, deadline);
+                (metadata.includedArtifacts ??= []).push({ path: childPath, source: child.source,
+                    ...(child.scope ? { scope: child.scope } : {}), inherited: child.inherited,
+                    hash: (0, crypto_1.createHash)('sha256').update(child.content).digest('hex') });
+                for (const warning of child.resolutionWarnings ?? []) {
+                    warn('RULE_SOURCE_FALLBACK', childPath, warning, child);
+                    metadata.warnings[metadata.warnings.length - 1].affectedPath = rootPath;
+                }
+                return child.content;
+            }
+            catch (error) {
+                const fault = error instanceof RuleSourceFault ? error : undefined;
+                warn(error instanceof RuleFetchTimeout ? 'RULE_FETCH_TIMEOUT' : 'RULE_UNAVAILABLE', fault?.path ?? childPath, 'Included rule source is missing, empty, invalid, cyclic or unavailable; available sibling guidance remains in force.', fault?.resolved);
+                metadata.warnings[metadata.warnings.length - 1].affectedPath = rootPath;
+                return '';
+            }
+        }));
+        let index = 0;
+        const content = resolved.content.replace(/\{\{\s*include:\s*([^}]+)\}\}/g, () => expanded[index++]);
+        if (!content.trim())
+            throw new RuleSourceFault(path, resolved);
+        return { ...resolved, content };
+    };
+    const results = await Promise.all([...new Set(paths)].map(async (path) => {
+        let resolved;
+        try {
+            resolved = await resolveRule(path);
+            if (/\{\{\s*(?:include|import)\s*:/.test(resolved.content)) {
+                throw new Error('Unresolved rule source');
+            }
+            return { path, resolved };
+        }
+        catch (error) {
+            return { path, error, resolved };
+        }
+    }));
+    const bodies = [];
+    for (const result of results) {
+        if ('error' in result) {
+            const fault = result.error instanceof RuleSourceFault ? result.error : undefined;
+            warn(result.error instanceof RuleFetchTimeout ? 'RULE_FETCH_TIMEOUT' : 'RULE_UNAVAILABLE', fault?.path ?? result.path, 'Rule source is missing, empty, invalid, cyclic or unavailable; other available rules remain in force.', fault?.resolved ?? result.resolved);
+            if (fault && fault.path !== result.path)
+                metadata.warnings[metadata.warnings.length - 1].affectedPath = result.path;
+            continue;
+        }
+        const resolved = result.resolved;
+        metadata.artifacts.push({ path: result.path, source: resolved.source, ...(resolved.scope ? { scope: resolved.scope } : {}),
+            inherited: resolved.inherited, hash: (0, crypto_1.createHash)('sha256').update(resolved.content).digest('hex') });
+        for (const warning of resolved.resolutionWarnings ?? [])
+            warn('RULE_SOURCE_FALLBACK', result.path, warning, resolved);
+        bodies.push(`### ${result.path}\n\n${resolved.content}`);
+    }
+    metadata.complete = metadata.warnings.length === 0;
+    const warnings = metadata.warnings.map(warning => `- ${warning.code}: ${warning.message} ${warning.recovery}`);
+    return { text: ['## Applicable rules', ...bodies, ...(warnings.length ? ['### Rule delivery warnings', ...warnings] : [])].join('\n\n'), metadata };
+}
+/** Replace only the advertised rule block; keep phase content and warning history. */
+function attachRuleAssembly(response, assembly) {
+    const content = [...(response.content ?? [])];
+    const previous = response.structuredContent?.ruleAssembly;
+    const warnings = [...assembly.metadata.warnings];
+    const incidentKey = (warning) => `${warning.code}:${warning.path}:${warning.hash ?? ''}`;
+    const priorWarnings = Array.isArray(previous?.warnings) ? previous.warnings : [];
+    const validWarning = (warning) => !!warning && typeof warning === 'object'
+        && ['code', 'path', 'message', 'recovery'].every(key => typeof warning[key] === 'string')
+        && typeof warning.resolved === 'boolean';
+    if (previous && (!Array.isArray(previous.warnings) || priorWarnings.some(warning => !validWarning(warning)))) {
+        warnings.push({ code: 'ASSEMBLY_METADATA_INVALID', path: 'ruleAssembly.warnings', domain: assembly.metadata.domain,
+            message: 'Prior rule delivery incident metadata is invalid; available rules remain in force.',
+            recovery: 'Refresh the current instructions and retain the invalid delivery incident in bound job evidence.', resolved: false });
+    }
+    for (const prior of priorWarnings.filter(validWarning)) {
+        if (warnings.some(warning => incidentKey(warning) === incidentKey(prior)))
+            continue;
+        const recovered = prior.path === 'domains.json'
+            ? assembly.metadata.catalogVersion !== null && assembly.metadata.selection !== 'unknown'
+                && !assembly.metadata.warnings.some(warning => warning.path === prior.path)
+            : (prior.affectedPath
+                ? assembly.metadata.artifacts.some(artifact => artifact.path === prior.affectedPath)
+                    && (assembly.metadata.includedArtifacts ?? []).some(artifact => artifact.path === prior.path)
+                : assembly.metadata.artifacts.some(artifact => artifact.path === prior.path))
+                && !assembly.metadata.warnings.some(warning => warning.path === prior.path);
+        warnings.push({ ...prior, resolved: prior.resolved || recovered });
+    }
+    const previousIndex = previous?.contentBlockIndex;
+    const index = Number.isInteger(previousIndex) && previousIndex >= 0 && previousIndex < content.length ? previousIndex : content.length;
+    const retained = warnings.filter(warning => !assembly.metadata.warnings.includes(warning));
+    const history = retained.length ? '\n\n### Prior rule delivery incidents\n' + retained.map(warning => `- ${warning.code} (${warning.resolved ? 'recovered' : 'unresolved'}): ${warning.path}. ${warning.recovery}`).join('\n') : '';
+    content[index] = { type: 'text', text: assembly.text + history };
+    return { ...response, content, structuredContent: { ...response.structuredContent,
+            ruleAssembly: { ...assembly.metadata, warnings,
+                complete: assembly.metadata.complete && warnings.every(warning => warning.resolved),
+                contentBlockIndex: index } } };
+}

package/dist/src/core/utils/local-registry-resolver.js

@@ -46,6 +46,7 @@ const path_1 = require("path");
 const inheritance_parser_1 = require("./inheritance-parser");
 const job_parser_1 = require("./job-parser");
 const project_fraim_paths_1 = require("./project-fraim-paths");
+const catalog_1 = require("../../../registry/scripts/domains/catalog");
 class LocalRegistryResolver {
     constructor(options) {
         this.workspaceRoot = options.workspaceRoot;
@@ -54,6 +55,18 @@ class LocalRegistryResolver {
         this.remoteContentResolver = options.remoteContentResolver;
         this.parser = new inheritance_parser_1.InheritanceParser(options.maxDepth);
         this.shouldFilter = options.shouldFilter;
+        if (options.onLocalDependency)
+            this.onLocalDependency = (...args) => {
+                if (this.dependencyFailure)
+                    throw this.dependencyFailure.error;
+                try {
+                    options.onLocalDependency(...args);
+                }
+                catch (error) {
+                    this.dependencyFailure = { error };
+                    throw error;
+                }
+            };
         // Issue #1002: default the manager's writable home to the configured contentRoot.
         // contentRoot = join(resolvePackHome('manager').root, 'personalized-employee') for all backends.
         this.managerLocalRoot = options.managerLocalRoot ?? (0, path_1.join)((0, project_fraim_paths_1.getUserFraimDirPath)(), 'personalized-employee');
@@ -82,12 +95,15 @@ class LocalRegistryResolver {
         if (this.effectiveFraimDir)
             return (0, path_1.join)(this.effectiveFraimDir, role, type);
         const machineRoot = (0, path_1.join)((0, project_fraim_paths_1.getUserFraimDirPath)(), role, type);
+        this.onLocalDependency?.(machineRoot, 'directory');
         return (0, fs_1.existsSync)(machineRoot) ? machineRoot : this.getFraimPath(role, type);
     }
     /**
      * Check if a local override exists for the given path
      */
     hasLocalOverride(path) {
+        if (!this.userLevelOnly)
+            this.onLocalDependency?.(this.getOverridePath(path), 'file');
         return !this.userLevelOnly && (0, fs_1.existsSync)(this.getOverridePath(path));
     }
     /** Whether an effective personalized layer should replace a remote baseline response. */
@@ -185,12 +201,20 @@ class LocalRegistryResolver {
         const normalizedPath = path.replace(/\\/g, '/').replace(/^\/+/, '');
         const parts = normalizedPath.split('/');
         const type = parts[0];
+        if (normalizedPath === 'domains.json') {
+            if (this.effectiveFraimDir)
+                return (0, path_1.join)(this.effectiveFraimDir, 'domains.json');
+            const machineCatalog = (0, path_1.join)((0, project_fraim_paths_1.getUserFraimDirPath)(), 'domains.json');
+            this.onLocalDependency?.(machineCatalog, 'file');
+            return (0, fs_1.existsSync)(machineCatalog) ? machineCatalog : this.getFraimPath('domains.json');
+        }
         if (type === 'jobs' || type === 'workflows') {
             if (parts.length >= 3 && (parts[1] === 'ai-employee' || parts[1] === 'ai-manager')) {
                 return (0, path_1.join)(this.getSyncedCatalogRoot(parts[1], type), ...parts.slice(2));
             }
             for (const role of ['ai-employee', 'ai-manager']) {
                 const candidate = (0, path_1.join)(this.getSyncedCatalogRoot(role, type), ...parts.slice(1));
+                this.onLocalDependency?.(candidate, 'file');
                 if ((0, fs_1.existsSync)(candidate))
                     return candidate;
             }
@@ -212,7 +236,10 @@ class LocalRegistryResolver {
      */
     readLocalOverride(path) {
         try {
-            return (0, fs_1.readFileSync)(this.getOverridePath(path), 'utf-8');
+            const file = this.getOverridePath(path);
+            const content = (0, fs_1.readFileSync)(file, 'utf-8');
+            this.onLocalDependency?.(file, 'file', content);
+            return content;
         }
         catch (error) {
             throw new Error(`Failed to read local override: ${path}. ${error.message}`);
@@ -223,11 +250,14 @@ class LocalRegistryResolver {
      */
     readSyncedLocalFile(path) {
         const syncedPath = this.getSyncedFilePath(path);
+        if (syncedPath)
+            this.onLocalDependency?.(syncedPath, 'file');
         if (!syncedPath || !(0, fs_1.existsSync)(syncedPath)) {
             return null;
         }
         try {
             const content = (0, fs_1.readFileSync)(syncedPath, 'utf-8');
+            this.onLocalDependency?.(syncedPath, 'file', content);
             if (this.shouldFilter && this.shouldFilter(content)) {
                 return null;
             }
@@ -251,15 +281,15 @@ class LocalRegistryResolver {
      * Security: same canonical-path containment guard as the other overlay
      * readers, so a crafted path can never escape the home directory.
      */
-    readManagerLocalOverlayFile(path) {
-        return this.readContainedOverlayFile(this.managerLocalRoot, path);
+    readManagerLocalOverlayFile(path, warnings) {
+        return this.readContainedOverlayFile(this.managerLocalRoot, path, warnings);
     }
     /**
      * Shared overlay read with a canonical-path containment guard. Extracted so
      * every overlay root uses one implementation of the guard rather than each
      * repeating it (the manager cache and org cache readers below delegate here).
      */
-    readContainedOverlayFile(root, path) {
+    readContainedOverlayFile(root, path, warnings) {
         const normalized = path.replace(/\\/g, '/').replace(/^\/+/, '');
         const destination = (0, path_1.join)(root, ...normalized.split('/'));
         const resolved = (0, path_1.resolve)(destination);
@@ -267,15 +297,18 @@ class LocalRegistryResolver {
         if (!resolved.startsWith(rootResolved + path_1.sep) && resolved !== rootResolved) {
             return null;
         }
+        this.onLocalDependency?.(destination, 'file');
         if (!(0, fs_1.existsSync)(destination))
             return null;
         try {
             const content = (0, fs_1.readFileSync)(destination, 'utf-8');
+            this.onLocalDependency?.(destination, 'file', content);
             if (this.shouldFilter && this.shouldFilter(content))
                 return null;
             return content;
         }
         catch {
+            warnings?.push('Manager local source could not be read; available lower-precedence content used.');
             return null;
         }
     }
@@ -287,7 +320,7 @@ class LocalRegistryResolver {
      * paths; we defensively resolve and check the canonical path stays inside
      * the cache root to guard against future path-traversal bugs in sync.
      */
-    readManagerOverlayFile(path) {
+    readManagerOverlayFile(path, warnings) {
         const normalized = path.replace(/\\/g, '/').replace(/^\/+/, '');
         const destination = (0, path_1.join)(this.managerCacheRoot, ...normalized.split('/'));
         // Guard: resolved path must stay within the manager cache root.
@@ -296,15 +329,18 @@ class LocalRegistryResolver {
         if (!resolved.startsWith(cacheResolved + path_1.sep) && resolved !== cacheResolved) {
             return null;
         }
+        this.onLocalDependency?.(destination, 'file');
         if (!(0, fs_1.existsSync)(destination))
             return null;
         try {
             const content = (0, fs_1.readFileSync)(destination, 'utf-8');
+            this.onLocalDependency?.(destination, 'file', content);
             if (this.shouldFilter && this.shouldFilter(content))
                 return null;
             return content;
         }
         catch {
+            warnings?.push('Manager source could not be read; available lower-precedence content used.');
             return null;
         }
     }
@@ -315,7 +351,7 @@ class LocalRegistryResolver {
      * Precedence: project > manager > org > synced baseline > registry > remote.
      * Security: same canonical-path containment guard as readManagerOverlayFile.
      */
-    readOrgOverlayFile(path) {
+    readOrgOverlayFile(path, warnings) {
         const normalized = path.replace(/\\/g, '/').replace(/^\/+/, '');
         const destination = (0, path_1.join)(this.orgCacheRoot, ...normalized.split('/'));
         const resolved = (0, path_1.resolve)(destination);
@@ -323,15 +359,18 @@ class LocalRegistryResolver {
         if (!resolved.startsWith(cacheResolved + path_1.sep) && resolved !== cacheResolved) {
             return null;
         }
+        this.onLocalDependency?.(destination, 'file');
         if (!(0, fs_1.existsSync)(destination))
             return null;
         try {
             const content = (0, fs_1.readFileSync)(destination, 'utf-8');
+            this.onLocalDependency?.(destination, 'file', content);
             if (this.shouldFilter && this.shouldFilter(content))
                 return null;
             return content;
         }
         catch {
+            warnings?.push('Organization source could not be read; available lower-precedence content used.');
             return null;
         }
     }
@@ -345,11 +384,13 @@ class LocalRegistryResolver {
         const rootResolved = (0, path_1.resolve)(registryRoot);
         if (!resolved.startsWith(rootResolved + path_1.sep) && resolved !== rootResolved)
             return null;
+        this.onLocalDependency?.(registryPath, 'file');
         if (!(0, fs_1.existsSync)(registryPath)) {
             return null;
         }
         try {
             const content = (0, fs_1.readFileSync)(registryPath, 'utf-8');
+            this.onLocalDependency?.(registryPath, 'file', content);
             if (this.shouldFilter && this.shouldFilter(content)) {
                 return null;
             }
@@ -361,7 +402,7 @@ class LocalRegistryResolver {
     }
     normalizeRegistryPath(path) {
         const normalized = path.trim().replace(/\\/g, '/').replace(/^\/+/, '');
-        return normalized.endsWith('.md') ? normalized : `${normalized}.md`;
+        return /\.(md|json)$/.test(normalized) ? normalized : `${normalized}.md`;
     }
     stripTypePrefix(path) {
         return path.replace(/^(jobs|workflows|skills|rules|templates)\//, '');
@@ -459,6 +500,8 @@ class LocalRegistryResolver {
                             includeMetadata: false,
                             stripMcpHeader: true
                         }, false);
+                        if (res.resolutionWarnings?.length)
+                            throw new inheritance_parser_1.InheritanceError('Parent inheritance could not be resolved', targetPath);
                         if (res.personalized)
                             personalizedPaths.add(normalized);
                         return res.content;
@@ -503,32 +546,104 @@ class LocalRegistryResolver {
      * @param path - Registry path (e.g., "workflows/product-building/spec.md")
      * @returns Resolved file with metadata
      */
+    async resolveDomainCatalog() {
+        const path = 'domains.json';
+        const localBaseline = this.readSyncedLocalFile(path) ?? this.readWorkspaceRegistryFile(path);
+        let content = localBaseline ?? await this.fetchRemoteWithFallback(path);
+        let source = localBaseline === null ? 'remote' : 'local';
+        let scope;
+        let catalog = JSON.parse(content);
+        const resolutionWarnings = [];
+        let projectContent = null;
+        if (this.hasLocalOverride(path)) {
+            try {
+                const candidate = this.readLocalOverride(path);
+                if (!this.shouldFilter || !this.shouldFilter(candidate))
+                    projectContent = candidate;
+            }
+            catch {
+                resolutionWarnings.push('Project domain configuration could not be read; available earlier configuration retained.');
+            }
+        }
+        const layers = [
+            { content: this.readOrgOverlayFile(path, resolutionWarnings), scope: 'org' },
+            { content: this.readManagerOverlayFile(path, resolutionWarnings), scope: 'manager' },
+            ...(this.managerLocalRoot !== this.managerCacheRoot ? [{ content: this.readManagerLocalOverlayFile(path, resolutionWarnings), scope: 'manager' }] : []),
+            { content: projectContent, scope: 'project' },
+        ];
+        for (const layer of layers) {
+            if (layer.content === null)
+                continue;
+            try {
+                catalog = (0, catalog_1.mergeDomainCatalog)(catalog, JSON.parse(layer.content));
+            }
+            catch {
+                resolutionWarnings.push('Invalid ' + layer.scope + ' domain configuration; available earlier configuration retained.');
+                continue;
+            }
+            content = JSON.stringify(catalog);
+            source = 'local';
+            scope = layer.scope;
+        }
+        return { content, source, ...(scope ? { scope } : {}), personalized: !!scope, inherited: !!scope, ...(resolutionWarnings.length ? { resolutionWarnings } : {}) };
+    }
+    assertDependenciesObserved() {
+        if (this.dependencyFailure)
+            throw this.dependencyFailure.error;
+    }
     async resolveFile(path, options = {}) {
-        return this.resolveFileInternal(path, options, true);
+        this.assertDependenciesObserved();
+        try {
+            return await this.resolveFileInternal(path, options, true);
+        }
+        finally {
+            this.assertDependenciesObserved();
+        }
     }
     async resolveFileInternal(path, options, applyInheritance) {
+        const warnings = [];
+        const resolved = await this.resolveFileWithWarnings(path, options, applyInheritance, warnings);
+        return warnings.length ? { ...resolved, resolutionWarnings: [...warnings, ...(resolved.resolutionWarnings ?? [])] } : resolved;
+    }
+    async resolveFileWithWarnings(path, options, applyInheritance, warnings) {
+        if (this.normalizeRegistryPath(path) === 'domains.json')
+            return this.resolveDomainCatalog();
         const includeMetadata = options.includeMetadata ?? true;
         const stripMcpHeader = options.stripMcpHeader ?? false;
         const resolveContent = (content, personalized = true) => applyInheritance
             ? this.resolveInheritance(content, path, personalized)
             : Promise.resolve({ content, imports: [] });
-        const baselineResult = async (rawContent, source) => {
+        const baselineResult = async (rawContent, source, localPath) => {
             const content = stripMcpHeader ? this.stripMcpHeader(rawContent) : rawContent;
             const resolved = await resolveContent(content, false);
             return {
                 content: resolved.content,
                 source,
+                ...(localPath ? { localPath } : {}),
                 personalized: false,
                 inherited: resolved.imports.length > 0,
                 imports: resolved.imports.length > 0 ? resolved.imports : undefined
             };
         };
-        // Check for local override
-        if (!this.hasLocalOverride(path)) {
+        // Unreadable or intentionally filtered Project content is unavailable,
+        // just like a missing override. Retain the normal precedence chain rather
+        // than skipping configured Manager/Organization and cached local sources.
+        let localContent = null;
+        if (this.hasLocalOverride(path)) {
+            try {
+                const candidate = this.readLocalOverride(path);
+                if (!this.shouldFilter || !this.shouldFilter(candidate))
+                    localContent = candidate;
+            }
+            catch {
+                warnings.push('Project source could not be read; available lower-precedence content used.');
+            }
+        }
+        if (localContent === null) {
             // Issue #1002: the manager's writable home (precedence 2 — above the
             // synced manager cache, so a just-authored capability resolves before any
             // publish or sync and resolves at all under `single-machine`).
-            const managerLocalContent = this.readManagerLocalOverlayFile(path);
+            const managerLocalContent = this.readManagerLocalOverlayFile(path, warnings);
             if (managerLocalContent !== null) {
                 // Issue #1867: apply inheritance so an extends-based override merges with its parent.
                 let resolvedManagerLocal;
@@ -548,7 +663,7 @@ class LocalRegistryResolver {
                 };
             }
             // Issue #869: manager overlay (precedence 3 — the synced cross-machine copy)
-            const managerOverlayContent = this.readManagerOverlayFile(path);
+            const managerOverlayContent = this.readManagerOverlayFile(path, warnings);
             if (managerOverlayContent !== null) {
                 // Issue #1867: apply inheritance so an extends-based override merges with its parent.
                 let resolvedManagerOverlay;
@@ -568,7 +683,7 @@ class LocalRegistryResolver {
                 };
             }
             // Issue #869 Phase 2: org overlay (precedence 3 — after manager, before synced baseline)
-            const orgOverlayContent = this.readOrgOverlayFile(path);
+            const orgOverlayContent = this.readOrgOverlayFile(path, warnings);
             if (orgOverlayContent !== null) {
                 // Issue #1867: apply inheritance so an extends-based override merges with its parent.
                 let resolvedOrgOverlay;
@@ -590,11 +705,11 @@ class LocalRegistryResolver {
             const syncedLocalContent = this.readSyncedLocalFile(path);
             if (syncedLocalContent !== null) {
                 // Synced machine baseline, not personalized.
-                return baselineResult(syncedLocalContent, 'local');
+                return baselineResult(syncedLocalContent, 'local', this.getSyncedFilePath(path));
             }
             const workspaceRegistryContent = this.readWorkspaceRegistryFile(path);
             if (workspaceRegistryContent !== null) {
-                return baselineResult(workspaceRegistryContent, 'local');
+                return baselineResult(workspaceRegistryContent, 'local', (0, path_1.join)(this.workspaceRoot, 'registry', path.replace(/\\/g, '/').replace(/^\/+/, '')));
             }
             // No useful override or synced content, fetch from remote
             try {
@@ -605,21 +720,6 @@ class LocalRegistryResolver {
                 throw new Error(`Failed to fetch from remote: ${path}. ${error.message}`);
             }
         }
-        // Read local override
-        let localContent;
-        try {
-            localContent = this.readLocalOverride(path);
-            if (this.shouldFilter && this.shouldFilter(localContent)) {
-                console.warn(`[LocalRegistryResolver] Local override for ${path} filtered (e.g. stub), falling back to remote.`);
-                throw new Error('CONTENT_FILTERED');
-            }
-        }
-        catch (error) {
-            // If local read fails, fall back to remote
-            console.warn(`Local override read failed, falling back to remote: ${path}`);
-            const rawContent = await this.fetchRemoteWithFallback(path);
-            return baselineResult(rawContent, 'remote');
-        }
         // Resolve inheritance
         let resolved;
         try {
@@ -627,7 +727,10 @@ class LocalRegistryResolver {
         }
         catch (error) {
             const rawContent = await this.fetchRemoteWithFallback(path);
-            return baselineResult(rawContent, 'remote');
+            return {
+                ...await baselineResult(rawContent, 'remote'),
+                resolutionWarnings: ['Personalized inheritance failed; available remote baseline used.']
+            };
         }
         // Build result — a local override hit means this came from the
         // personalized-employee layer (the manager taught/customized it).

package/dist/src/local-mcp-server/agent-token-prices.js

@@ -9,7 +9,9 @@
  * `agent-token-prices.test.ts` lint fails CI if any entry exceeds 180 days
  * since `verifiedOn` so this table is reviewed at least quarterly.
  *
- * Prices are USD per million tokens.
+ * Prices are standard-tier USD per million tokens. Anthropic cache creation
+ * uses five-minute writes; long-context and other service-tier premiums are
+ * not represented by this fallback table.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AGENT_TOKEN_PRICES = void 0;
@@ -85,6 +87,28 @@ exports.AGENT_TOKEN_PRICES = [
         source: 'https://developers.openai.com/api/docs/models/gpt-5.5',
         verifiedOn: '2026-10-27',
     },
+    // Codex CLI ~0.155–0.162 emits `gpt-6-astra`; ~0.163+ emits `gpt-6.1-sol`.
+    // cacheCreationPerMTok is 0 because the CLI hardcodes cache_write_input_tokens=0.
+    {
+        agent: 'codex',
+        model: 'gpt-6-astra',
+        inputPerMTok: 10.00,
+        outputPerMTok: 50.00,
+        cacheReadPerMTok: 1.00,
+        cacheCreationPerMTok: 0,
+        source: 'https://developers.openai.com/api/docs/pricing',
+        verifiedOn: '2026-11-01',
+    },
+    {
+        agent: 'codex',
+        model: 'gpt-6.1-sol',
+        inputPerMTok: 2.00,
+        outputPerMTok: 10.00,
+        cacheReadPerMTok: 0.10,
+        cacheCreationPerMTok: 0,
+        source: 'https://developers.openai.com/api/docs/pricing',
+        verifiedOn: '2026-11-01',
+    },
     // Google — Gemini CLI. Standard paid-tier text/image/video token rates.
     // Context caching maps to cache reads; the published storage-hour price
     // cannot be derived from the CLI token stats and is intentionally omitted.