@infinisys/fabric 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,73 @@
-# Temporary Holding Version
+# @infinisys/fabric
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+一个 bundle，把 Infinity Fabric 的全部插件按支持顺序装进同一个 profile。
+
+它自己不含任何 Host/Client 代码：`cordis.patch.yml` 是十二个成员包补丁的**生成结果**（`pnpm run meta` 生成，`scripts/check.mjs` 会拦住忘记重建的版本）。所以「装了什么」仍然由每个 `is-*` 包自己的补丁决定，这里只有一份顺序表和一个开关。
+
+## 它做了什么
+
+启用后，profile 里等价于同时启用了这十二个 bundle：
+
+| 顺序 | 包 | 作用 |
+| --- | --- | --- |
+| 1 | `@infinisys/is-identity` | 品牌与部署身份（纯文字 Infinity System，关闭原生 `ui-brand-official`） |
+| 2 | `@infinisys/is-settings` | Infinity 设置页与 `infinitySettings` 服务 |
+| 3 | `@infinisys/is-devops` | GitFox 面板与 `infinity_devops` / `infinity_git` 工具 |
+| 4 | `@infinisys/is-fabric-team` | 团队协作模式预设与 `infinityTeam` 服务（关闭原生 Team 工具/UI） |
+| 5 | `@infinisys/is-im` | IM 网关与「IM 网关」设置卡片 |
+| 6 | `@infinisys/is-team-language` | 团队语言桥与 `/infinity/translate` |
+| 7 | `@infinisys/is-update` | 版本与更新卡片 |
+| 8 | `@infinisys/is-offpeak` | 峰谷调度卡片 |
+| 9 | `@infinisys/is-toolchain-cache` | 构建缓存与 `TMPDIR` 重定向 |
+| 10 | `@infinisys/is-disk-guard` | 会话投影的写盘预算 |
+| 11 | `@infinisys/is-web-access` | 抓取放行（把 profile 的 `web` 行指到 `infinity-http`） |
+| 12 | `@infinisys/is-stream-guard` | SSE 帧错误重试 |
+
+顺序不是装饰：`is-settings` 要先于 `is-devops` 与 `is-fabric-team` 提供 `infinitySettings`，`is-identity` 要先关掉原生品牌行，`is-web-access` 要排在 `@deepseek-ai/dsh-web-app` 之后才有 `web` 行可改。
+
+## 为什么是一份生成文件，而不是指向兄弟包的路径清单
+
+`dsh.bundle.patch` 也接受路径数组，但那些路径是相对**包目录**拼出来的字符串。装到 profile 后包目录是 `node_modules/@infinisys/fabric`，兄弟包在 pnpm 的严格布局里可能不在同一层——路径清单在某些安装方式下会静默指向不存在的文件。一份跟着包走的 `cordis.patch.yml` 没有这个前提。
+
+改成员补丁后记得重建：
+
+```bash
+pnpm run meta     # 重新生成 packages/fabric/cordis.patch.yml
+pnpm run check    # 生成文件过期时这里会失败
+```
+
+## 安装
+
+成员包写在这份清单的 `dependencies` 里，每条是 `^<成员版本>`，所以从 registry 装一次就全了：
+
+```bash
+dsh plugin --profile web add @infinisys/fabric
+```
+
+想直接指向 checkout（发布前、或改代码即时生效）：
+
+```bash
+node scripts/link-meta.mjs --link   # 把 ^<版本> 换成 link:../is-*
+dsh plugin --profile web add /path/to/Fabric/packages/fabric /path/to/Fabric/packages/is-*
+```
+
+`--link` 只在本地用，提交前跑 `node scripts/link-meta.mjs --registry` 换回来（`scripts/check.mjs` 只接受 registry 形式）。`pnpm` 对 `link:` 依赖的处理随版本而异，可能不会替你把成员包搬进 profile，所以 checkout 装法要把十三个目录一起写进同一条命令。
+
+成员之间必须成套的关系只有三处（`is-devops` 要 `is-settings`，`is-fabric-team` 要 `is-settings` 加 `is-devops`，`is-disk-guard` 建议配 `is-stream-guard`），单个安装时的命令见 [依赖关系](../../docs/dependencies.md)。
+
+装完在 Plugins 页面启用 `@infinisys/fabric`（或把 `@infinisys/fabric` 加进 `$DSH_HOME/profiles/web/package.json` 的 `dsh.profile.bundles`），重启一次 Web。
+
+## 只想装一部分
+
+不要启用这个元包。按需单独启用对应的 `is-*` 包即可，每个包的补丁是独立的。
+
+反过来，一旦启用了元包，就不要再单独启用任何 `is-*` 包：同一个插件会被注册两次，重复的行 id 会让 profile 加载失败。
+
+想关掉其中某个插件但保留其余：在 profile 的 `cordis.patch.yml` 里追加一行覆盖，例如
+
+```yaml
+- id: is-im
+  disabled: true
+```
+
+profile 补丁层永远在 bundle 层之后应用，所以这一行会生效。注意有些包除了插入自己的行，还改动了已有行（`is-identity` 关掉 `ui-brand-official`、`is-fabric-team` 关掉原生 Team 两行、`is-web-access` 改 `web` 行），只停用插入的行不会把这些改动还原，具体见 [安装与退回](../../docs/install.md)。

package/cordis.patch.yml

@@ -0,0 +1,632 @@
+# GENERATED FILE — do not edit.
+#
+# The Infinity Fabric one-bundle install: every member patch, in dependency
+# order, so one package (and one on/off switch) carries the whole stack.
+# Edit packages/<member>/cordis.patch.yml instead, then run `pnpm run meta`.
+# `scripts/check.mjs` fails while this file is stale.
+
+# ---- @infinisys/is-identity -------------------------------------------------
+- id: ui-brand-official
+  # The shipped wordmark/mark can never win the single brand seats: Infinity
+  # identity owns them and is text-only by design.
+  disabled: true
+- insert:
+    - id: is-identity
+      name: '@infinisys/is-identity'
+      config:
+        # Infinity Glass (the backdrop frost and the surface alpha that lets it
+        # show) is on by default. Set `frost: false` in the profile's own patch
+        # to give every surface back to the shell.
+        frost: true
+
+# ---- @infinisys/is-settings -------------------------------------------------
+- insert:
+    - id: is-settings
+      name: '@infinisys/is-settings'
+      config: {}
+
+# ---- @infinisys/is-devops ---------------------------------------------------
+- insert:
+    - id: is-devops
+      name: '@infinisys/is-devops'
+      config: {}
+
+# ---- @infinisys/is-fabric-team ----------------------------------------------
+# Infinity Fabric AI Team bundle.
+#
+# Adds four Agent presets that together make up Team Collaboration Mode:
+#
+#   fabric-team           Assistant/Lead  coordination only: no shell, no write
+#   fabric-team-worker    dev / test / ci implementation surface (guarded paths)
+#   fabric-team-readonly  qa / secure / hr review surface: read-only, no shell
+#   fabric-team-docs      docs seat: writes documentation paths, no shell
+#
+# The tool surface is structural: a role gets the preset that mounts exactly the
+# tools it may use, so an Assistant or Lead cannot do implementation work even
+# when Host provisioning fails. The Host row (`is-fabric-team`) registers the
+# `infinity_team` tool, the per-role git/write guards, the `/infinity/team/state`
+# snapshot and the GitFox-tracked governance state.
+#
+# This bundle requires the official Agent Teams profile bundle for its base
+# rows, but runs the Fabric team on the Subagent runtime: the native
+# tool-agent-team and ui-agent-team rows are disabled below so the session has
+# exactly one visible identity, the Assistant. Do NOT insert another
+# tool-agent-team row here.
+
+# The native Agent Teams root is hard-coded as the Lead. Fabric Team uses the
+# Subagent runtime instead and owns the Assistant identity, so the native Team
+# tools and roster UI stay off in this profile.
+- id: tool-agent-team
+  disabled: true
+
+- id: ui-agent-team
+  disabled: true
+
+# The Assistant + Lead + eight roles are 10 members; allow enough live children
+# for the auto-provisioned tree (root -> lead -> eight teammates).
+- id: subagent
+  config:
+    maxActiveSubagents: 16
+    maxDepth: 3
+
+- insert:
+    - id: is-fabric-team
+      name: '@infinisys/is-fabric-team'
+      config: {}
+
+    # ---------------------------------------------------------------- coordinator
+    # The session root (Assistant) and the Lead. Coordination and read-only
+    # inspection only: the shell and the write/edit tools are not mounted at all.
+    - id: preset-fabric-team
+      name: '@deepseek-ai/dsh-agent-preset'
+      config:
+        id: fabric-team
+        name: 团队协作模式
+        description: >-
+          Infinity Fabric 团队协作模式：助手先提取需求并由 Lead 带队；QA、后端、前端与安全必须一致投票；
+          所有会议、决策与工作流都通过 GitFox 跟踪；HR 管理长期身份。
+          助手与 Lead 只有协调与只读工具，结构上没有 shell 和写文件能力。
+        order: 5
+        plugins:
+          - id: persona
+            name: '@deepseek-ai/dsh-persona'
+            config:
+              prefix: >-
+                You are the coordinator of the Infinity Fabric AI Team, powered by the {{model}} model.
+                The session root is the Assistant: it owns user intake and the final answer. The Lead
+                teammate turns tracked requirements into plans, decisions and assigned tasks. You have
+                no shell and no file-writing tools by construction: never implement work yourself,
+                never decide without unanimous votes, never work untracked, and never claim a gate
+                passed without a successful infinity_team result.
+          - id: agent-instructions
+            name: '@deepseek-ai/dsh-agent-instructions'
+            config:
+              maxBytes: 65536
+          - id: time-context
+            name: '@deepseek-ai/dsh-time-context'
+          - id: fabric-team-mode
+            name: '@infinisys/is-fabric-team/mode'
+            config:
+              role: coordinator
+          # Read-only filesystem: no write, no edit tool is ever registered.
+          - id: tool-fs
+            name: '@deepseek-ai/dsh-tool-fs'
+            config:
+              read: true
+              readImage: true
+              write: false
+              edit: false
+          - id: tool-fs-search
+            name: '@deepseek-ai/dsh-tool-fs-search'
+            config:
+              sampleOverCapGlobResults: false
+          - id: tool-web
+            name: '@deepseek-ai/dsh-tool-web'
+            config:
+              fetch: true
+              searchTimeoutMs: 60000
+          - id: tool-ask-user
+            name: '@deepseek-ai/dsh-tool-ask-user'
+          - id: tool-todo
+            name: '@deepseek-ai/dsh-tool-todo'
+            config:
+              allowParallelInProgress: true
+          - id: command-goal
+            name: '@deepseek-ai/dsh-command-goal'
+          - id: tool-goal
+            name: '@deepseek-ai/dsh-tool-goal'
+          - id: present
+            name: '@deepseek-ai/dsh-tool-present'
+          - id: planning
+            name: cordis:group
+            group: true
+            isolate:
+              planMode: true
+            config:
+              - id: plan-mode
+                name: '@deepseek-ai/dsh-plan-mode'
+                config:
+                  section: |
+                    You are in plan mode. Stay in plan mode until the user approves your plan through exit_plan_mode or switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+                    Explore first. Use non-mutating reads, searches and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan.
+
+                    A plan is only complete when it names the tracked requirement, the decision that needs unanimous votes, every affected boundary, the tests and the evidence each workflow gate expects. Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices that inspection cannot answer. Submit the plan through exit_plan_mode.
+          - id: compaction
+            name: cordis:group
+            group: true
+            isolate:
+              compaction: true
+              toolResultPruner: true
+            config:
+              - id: compaction-basic
+                name: '@deepseek-ai/dsh-compaction-basic'
+              - id: command-compact
+                name: '@deepseek-ai/dsh-command-compact'
+              - id: tool-result-pruner
+                name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+                config:
+                  thresholdChars: 8192
+                  headChars: 4096
+                  tailChars: 1024
+          - id: tool-plugin-manager
+            name: '@deepseek-ai/dsh-plugin-manager/tools'
+            disabled: true
+          - id: tool-plugin-market
+            name: '@deepseek-ai/dsh-plugin-market/tools'
+            disabled: true
+
+    # ---------------------------------------------------------------- watchdog
+    # The Lead's peer. Read-only, no team tools: its only control surface is
+    # infinity_watchdog, registered by the Host at creation.
+    - id: preset-fabric-team-watchdog
+      name: '@deepseek-ai/dsh-agent-preset'
+      config:
+        id: fabric-team-watchdog
+        name: 团队监督员
+        description: >-
+          Lead 的同级监督员：读团队事件流与账本，判断是否真的在推进；可暂停/恢复团队、
+          关闭陈旧条目、向 Lead 或人类升级。没有 shell、写文件、投票或实施工具。
+        order: 6
+        plugins:
+          - id: persona
+            name: '@deepseek-ai/dsh-persona'
+            config:
+              prefix: >-
+                You are the Watchdog of the Infinity Fabric AI Team, the Lead's peer. You judge
+                whether the team is making real progress, and you intervene when it is not. You
+                cannot implement, vote, intake, merge or write files: your only control surface is
+                the infinity_watchdog tool. Read the team's language; do not reduce your judgement
+                to a status code.
+          - id: agent-instructions
+            name: '@deepseek-ai/dsh-agent-instructions'
+            config:
+              maxBytes: 65536
+          - id: time-context
+            name: '@deepseek-ai/dsh-time-context'
+          - id: tool-fs
+            name: '@deepseek-ai/dsh-tool-fs'
+            config:
+              read: true
+              readImage: false
+              write: false
+              edit: false
+          - id: tool-fs-search
+            name: '@deepseek-ai/dsh-tool-fs-search'
+            config:
+              sampleOverCapGlobResults: false
+          - id: tool-web
+            name: '@deepseek-ai/dsh-tool-web'
+            config:
+              fetch: true
+              searchTimeoutMs: 60000
+          - id: tool-ask-user
+            name: '@deepseek-ai/dsh-tool-ask-user'
+          - id: tool-todo
+            name: '@deepseek-ai/dsh-tool-todo'
+            config:
+              allowParallelInProgress: false
+          - id: compaction
+            name: cordis:group
+            group: true
+            isolate:
+              compaction: true
+              toolResultPruner: true
+            config:
+              - id: compaction-basic
+                name: '@deepseek-ai/dsh-compaction-basic'
+              - id: command-compact
+                name: '@deepseek-ai/dsh-command-compact'
+              - id: tool-result-pruner
+                name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+                config:
+                  thresholdChars: 8192
+                  headChars: 4096
+                  tailChars: 1024
+
+    # ------------------------------------------------------------------- worker
+    # Implementation seats: backend, frontend, delivery/CI and test. A shell is
+    # present, but direct git is refused and write/edit stays inside the role's
+    # write scopes (enforced by the Host git/write guards).
+    - id: preset-fabric-team-worker
+      name: '@deepseek-ai/dsh-agent-preset'
+      config:
+        id: fabric-team-worker
+        name: 团队协作模式（执行成员）
+        description: >-
+          团队执行席位（后端、前端、交付/CI、测试）。在 Lead 分配的 claim 内实现并写测试；
+          直接 git 被禁用，只能使用 infinity_git；写路径受角色白名单约束。
+        order: 6
+        plugins:
+          - id: persona
+            name: '@deepseek-ai/dsh-persona'
+            config:
+              prefix: >-
+                You are an implementation seat of the Infinity Fabric AI Team, powered by the {{model}}
+                model. Implement only inside the claim the Lead assigned and inside your role's write
+                scopes; write tests before production code; never approve your own work; drive git only
+                through infinity_git; a denied tool call is final.
+          - id: agent-instructions
+            name: '@deepseek-ai/dsh-agent-instructions'
+            config:
+              maxBytes: 65536
+          - id: time-context
+            name: '@deepseek-ai/dsh-time-context'
+          - id: fabric-team-mode
+            name: '@infinisys/is-fabric-team/mode'
+            config:
+              role: worker
+          - id: tool-bash
+            name: '@deepseek-ai/dsh-tool-bash'
+            disabled: !!js process.platform === 'win32'
+          - id: tool-pwsh
+            name: '@deepseek-ai/dsh-tool-pwsh'
+            disabled: !!js process.platform !== 'win32'
+          - id: tool-fs
+            name: '@deepseek-ai/dsh-tool-fs'
+          - id: tool-fs-search
+            name: '@deepseek-ai/dsh-tool-fs-search'
+            config:
+              sampleOverCapGlobResults: false
+          - id: tool-jobs
+            name: '@deepseek-ai/dsh-tool-jobs'
+          - id: skill-filesystem
+            name: '@deepseek-ai/dsh-skill-filesystem'
+          - id: tool-skill
+            name: '@deepseek-ai/dsh-tool-skill'
+          - id: tool-web
+            name: '@deepseek-ai/dsh-tool-web'
+            config:
+              fetch: true
+              searchTimeoutMs: 60000
+          - id: tool-ask-user
+            name: '@deepseek-ai/dsh-tool-ask-user'
+          - id: tool-todo
+            name: '@deepseek-ai/dsh-tool-todo'
+            config:
+              allowParallelInProgress: true
+          - id: present
+            name: '@deepseek-ai/dsh-tool-present'
+          - id: planning
+            name: cordis:group
+            group: true
+            isolate:
+              planMode: true
+            config:
+              - id: plan-mode
+                name: '@deepseek-ai/dsh-plan-mode'
+                config:
+                  section: |
+                    You are in plan mode. Plan only: no edits, no builds that rewrite tracked files, no commits. A plan names the claim, the failing test written first, and the evidence the next gate expects. Submit it through exit_plan_mode.
+          - id: compaction
+            name: cordis:group
+            group: true
+            isolate:
+              compaction: true
+              toolResultPruner: true
+            config:
+              - id: compaction-basic
+                name: '@deepseek-ai/dsh-compaction-basic'
+              - id: command-compact
+                name: '@deepseek-ai/dsh-command-compact'
+              - id: tool-result-pruner
+                name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+                config:
+                  thresholdChars: 8192
+                  headChars: 4096
+                  tailChars: 1024
+
+    # ----------------------------------------------------------------- readonly
+    # Review seats: QA, Security and HR. No shell and no write/edit tool at all.
+    - id: preset-fabric-team-readonly
+      name: '@deepseek-ai/dsh-agent-preset'
+      config:
+        id: fabric-team-readonly
+        name: 团队协作模式（评审成员）
+        description: >-
+          团队评审席位（QA、安全、HR）。结构上只有只读工具：不实现、不写文件、不起 shell，
+          只验证、评审和投票，证据必须可追踪。
+        order: 7
+        plugins:
+          - id: persona
+            name: '@deepseek-ai/dsh-persona'
+            config:
+              prefix: >-
+                You are a review seat of the Infinity Fabric AI Team, powered by the {{model}} model.
+                You have read-only tools by construction: never implement or modify files, only verify,
+                review and vote with tracked evidence. Never approve delivery on behalf of the Lead,
+                and never trade a finding for schedule pressure.
+          - id: agent-instructions
+            name: '@deepseek-ai/dsh-agent-instructions'
+            config:
+              maxBytes: 65536
+          - id: time-context
+            name: '@deepseek-ai/dsh-time-context'
+          - id: fabric-team-mode
+            name: '@infinisys/is-fabric-team/mode'
+            config:
+              role: worker
+          - id: tool-fs
+            name: '@deepseek-ai/dsh-tool-fs'
+            config:
+              read: true
+              readImage: true
+              write: false
+              edit: false
+          - id: tool-fs-search
+            name: '@deepseek-ai/dsh-tool-fs-search'
+            config:
+              sampleOverCapGlobResults: false
+          - id: tool-web
+            name: '@deepseek-ai/dsh-tool-web'
+            config:
+              fetch: true
+              searchTimeoutMs: 60000
+          - id: tool-ask-user
+            name: '@deepseek-ai/dsh-tool-ask-user'
+          - id: tool-todo
+            name: '@deepseek-ai/dsh-tool-todo'
+            config:
+              allowParallelInProgress: false
+          - id: planning
+            name: cordis:group
+            group: true
+            isolate:
+              planMode: true
+            config:
+              - id: plan-mode
+                name: '@deepseek-ai/dsh-plan-mode'
+                config:
+                  section: |
+                    You are in plan mode. Plan only: no edits, no builds that rewrite tracked files, no commits. A plan names the claim, the failing test written first, and the evidence the next gate expects. Submit it through exit_plan_mode.
+          - id: compaction
+            name: cordis:group
+            group: true
+            isolate:
+              compaction: true
+              toolResultPruner: true
+            config:
+              - id: compaction-basic
+                name: '@deepseek-ai/dsh-compaction-basic'
+              - id: command-compact
+                name: '@deepseek-ai/dsh-command-compact'
+              - id: tool-result-pruner
+                name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+                config:
+                  thresholdChars: 8192
+                  headChars: 4096
+                  tailChars: 1024
+
+    # --------------------------------------------------------------------- docs
+    # Documentation seat: may write documentation paths, never a shell.
+    - id: preset-fabric-team-docs
+      name: '@deepseek-ai/dsh-agent-preset'
+      config:
+        id: fabric-team-docs
+        name: 团队协作模式（文档成员）
+        description: >-
+          团队文档席位。只能写文档路径（docs/、README、包内 README），没有 shell；
+          不实现生产代码，不投票技术决策。
+        order: 8
+        plugins:
+          - id: persona
+            name: '@deepseek-ai/dsh-persona'
+            config:
+              prefix: >-
+                You are the Documentation seat of the Infinity Fabric AI Team, powered by the {{model}}
+                model. You may write documentation paths only and you have no shell: never implement
+                production code, never vote on technical decisions, and keep README, architecture and
+                user-facing copy aligned with the shipped behavior.
+          - id: agent-instructions
+            name: '@deepseek-ai/dsh-agent-instructions'
+            config:
+              maxBytes: 65536
+          - id: time-context
+            name: '@deepseek-ai/dsh-time-context'
+          - id: fabric-team-mode
+            name: '@infinisys/is-fabric-team/mode'
+            config:
+              role: worker
+          - id: tool-fs
+            name: '@deepseek-ai/dsh-tool-fs'
+          - id: tool-fs-search
+            name: '@deepseek-ai/dsh-tool-fs-search'
+            config:
+              sampleOverCapGlobResults: false
+          - id: tool-web
+            name: '@deepseek-ai/dsh-tool-web'
+            config:
+              fetch: true
+              searchTimeoutMs: 60000
+          - id: tool-ask-user
+            name: '@deepseek-ai/dsh-tool-ask-user'
+          - id: tool-todo
+            name: '@deepseek-ai/dsh-tool-todo'
+            config:
+              allowParallelInProgress: false
+          - id: present
+            name: '@deepseek-ai/dsh-tool-present'
+          - id: planning
+            name: cordis:group
+            group: true
+            isolate:
+              planMode: true
+            config:
+              - id: plan-mode
+                name: '@deepseek-ai/dsh-plan-mode'
+                config:
+                  section: |
+                    You are in plan mode. Plan only: no edits, no builds that rewrite tracked files, no commits. A plan names the claim, the failing test written first, and the evidence the next gate expects. Submit it through exit_plan_mode.
+          - id: compaction
+            name: cordis:group
+            group: true
+            isolate:
+              compaction: true
+              toolResultPruner: true
+            config:
+              - id: compaction-basic
+                name: '@deepseek-ai/dsh-compaction-basic'
+              - id: command-compact
+                name: '@deepseek-ai/dsh-command-compact'
+              - id: tool-result-pruner
+                name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+                config:
+                  thresholdChars: 8192
+                  headChars: 4096
+                  tailChars: 1024
+
+# ---- @infinisys/is-im -------------------------------------------------------
+- insert:
+    - id: is-im
+      name: '@infinisys/is-im'
+      config: {}
+
+# ---- @infinisys/is-team-language --------------------------------------------
+# Team language bridge: the English record, the user-language translation,
+# and the settings card that chooses the translation engine.
+#
+# The Fabric AI Team keeps working in English. This row adds the prompt section
+# that makes every user-facing artifact carry a translation into the user's
+# language, without touching the tracked English record.
+- insert:
+    - id: is-team-language
+      name: '@infinisys/is-team-language'
+      config: {}
+
+# ---- @infinisys/is-update ---------------------------------------------------
+- insert:
+    - id: is-update
+      name: '@infinisys/is-update'
+      config: {}
+
+# ---- @infinisys/is-offpeak --------------------------------------------------
+- insert:
+    - id: is-offpeak
+      name: '@infinisys/is-offpeak'
+      config: {}
+
+# ---- @infinisys/is-toolchain-cache ------------------------------------------
+- insert:
+    - id: is-toolchain-cache
+      name: '@infinisys/is-toolchain-cache'
+      config: {}
+
+# ---- @infinisys/is-disk-guard -----------------------------------------------
+# Infinity disk guard.
+#
+# A projection checkpoint is one whole per-session document replaced atomically
+# (temp + fsync + rename + directory fsync), and a team session writes one per
+# agent. Measured on a live profile: 8.3 MB of whole-document rewrite per two
+# minutes against 0.7 MB of genuinely new data, 93% of it this cache — a parity
+# RAID turns each of those into read-modify-write of the stripes.
+#
+# Three things make that cache cheap, in the order they cost:
+#
+# 1. It stays a cache. One checkpoint per minute (or per two thousand events)
+#    instead of per five seconds, and a turn end flushes the session log without
+#    rewriting the whole document — the next throttled checkpoint carries it.
+#    A stale cache costs replay time on the next start, never a message.
+# 2. It stops carrying history it can refold. The context timeline, the context
+#    headers and the turn outline grow with the conversation, so the same bytes
+#    were rewritten for the rest of a session's life. The cache keeps a recent
+#    window; the session log keeps all of it.
+# 3. Session creation and disposal still checkpoint immediately: a new document
+#    and a session going cold have no later checkpoint to fall back on.
+# 4. The same disease one process over. The context-compression proxy in front of
+#    the model keeps every session twice — a SQLite index it reads, plus a legacy
+#    JSON envelope it still rewrites whole — and on the measured machine that one
+#    process wrote 11 MB/s and read 107 MB/s of its own state while the disk sat
+#    at 96%. The guard passes it a slower save cadence, a larger journal window
+#    and more sessions kept in memory when the host launches it; `envelope: off`
+#    drops the duplicate copy and `quickCheck: off` skips the whole-index
+#    integrity scan every start pays for.
+# 5. And it stops the save itself from carrying the whole row. One save is a
+#    single upsert over every column of `sessions`, the multi-megabyte state
+#    blobs included, so a save that only moves `updated_at` still drags them
+#    along. A preload attached at launch compares each save with the previous one
+#    and writes only the columns that moved; a save that carries nothing new
+#    writes nothing. It hooks the proxy's own SQLite binding at runtime — no file
+#    of the proxy is edited, and an unfamiliar statement shape is passed through
+#    unchanged.
+# 6. And it stops a burst of saves from paying a burst of fsyncs. SQLite commits
+#    every statement on its own, so the proxy's thousands of small rows a minute
+#    became thousands of tiny writes a second — measured with `iostat -x`: 1,100
+#    to 1,400 writes/s of 4 to 24 KB, 70 to 120 ms each, the device 96 to 100 %
+#    busy while the CPU sat at 1 %. The hook now holds the burst in one
+#    transaction and commits it on a short window (200 ms), so the same saves pay
+#    one fsync per window instead of one per row. A crash can lose at most that
+#    window, which the proxy regenerates from its own journal.
+- insert:
+    - id: is-disk-guard
+      name: '@infinisys/is-disk-guard'
+      config:
+        projectionCache:
+          writeIntervalMs: 60000
+          writeEveryEvents: 2000
+        coalesceTurnEnd: true
+        rows:
+          contextTimeline:
+            surface: 300
+            requests: 80
+            commands: 120
+            events: 200
+          contextHeaders:
+            headers: 2
+          turnOutline:
+            turns: 30
+        proxy:
+          debounceMs: 15000        # 每 15 秒才落一次盘；一次保存是整份状态重写，间隔直接决定写盘量
+          walJournalSizeLimitBytes: 67108864
+          residentMaxBytes: 2147483648
+          envelope: off            # 索引已是唯一读取路径；旧信封文件留在盘上不动
+          watermark: on            # 把代理的水印带回下一轮请求，命中重发快路径（换掉每回合的整段解析）
+          quickCheck: off          # 开机全库自检要读完整索引（实测 688MB）；要保留就写 on
+          batchMs: 200             # 一批保存合成一个事务，一次 fsync；0 关闭批提交（20 – 2000）
+
+# ---- @infinisys/is-web-access -----------------------------------------------
+# The Infinity web access bundle.
+#
+# `web` names which fetch provider `ctx.web.fetch` resolves, and a patch
+# replaces the targeted row's whole `config` — so every key the base row owns is
+# restated here, including the search provider this bundle does not change.
+#
+# `infinity-http` is the provider registered below. It keeps the shipped
+# retrieval rules (HTTP(S) only, no credentials, same-origin redirects, size and
+# character caps) and adds the one thing the shipped provider hard-codes: whether
+# a destination that resolves to a non-public address is refused. That answer is
+# a user setting, read per request, so flipping the switch needs no restart.
+- id: web
+  config:
+    searchProvider: deepseek-official
+    fetchProvider: infinity-http
+
+- insert:
+    - id: is-web-access
+      name: '@infinisys/is-web-access'
+      config: {}
+
+# ---- @infinisys/is-stream-guard ---------------------------------------------
+- insert:
+    - id: is-stream-guard
+      name: '@infinisys/is-stream-guard'
+      config: {}

package/package.json

@@ -1,6 +1,43 @@
 {
   "name": "@infinisys/fabric",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "One bundle that applies every Infinity Fabric plugin in the supported order.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitfox.studio/infinity/Fabric.git",
+    "directory": "packages/fabric"
+  },
+  "engines": {
+    "node": ">=22.13.0",
+    "dsh": ">=0.2.2-rc.1 <0.3.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "dependencies": {
+    "@infinisys/is-identity": "^0.2.0",
+    "@infinisys/is-settings": "^0.1.0",
+    "@infinisys/is-devops": "^0.1.0",
+    "@infinisys/is-fabric-team": "^0.1.0",
+    "@infinisys/is-im": "^0.1.0",
+    "@infinisys/is-team-language": "^0.1.0",
+    "@infinisys/is-update": "^0.1.0",
+    "@infinisys/is-offpeak": "^0.1.0",
+    "@infinisys/is-toolchain-cache": "^0.1.0",
+    "@infinisys/is-disk-guard": "^0.7.0",
+    "@infinisys/is-web-access": "^0.1.0",
+    "@infinisys/is-stream-guard": "^0.1.0"
+  },
+  "files": [
+    "cordis.patch.yml",
+    "README.md",
+    "package.json"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  }
+}