@maci0/dsh-perf-review 0.10.0

package/NOTICE

@@ -0,0 +1,9 @@
+dsh-perf-review
+
+The bundled perf-review skill includes material adapted from the perf-review,
+webperf-review, concurrency, resource, database, and cache reviews in
+maci0/gauntlet (https://github.com/maci0/gauntlet), identified in this
+repository as AGPL-3.0 material. The distributed package is AGPL-3.0-only.
+
+The original MIT license notice for the DSH adapter is retained in LICENSE-MIT.
+Copyright (c) 2026 dsh-perf-review contributors.

package/README.md

@@ -0,0 +1,100 @@
+# dsh-perf-review
+
+"Make it faster" is a guess. This skill makes the agent measure first.
+
+Type `/perf-review` and it profiles the hot path you name, ranks the bottlenecks it finds by user-visible impact, changes one thing, and reports the p50/p95 delta. If it cannot measure a win, it says so instead of shipping one.
+
+The whole plugin is one skill: instructions the agent follows, not a profiler. It brings the method and the output format; your existing tools (`perf`, `hyperfine`, `lighthouse`, `heaptrack`, devtools) do the measuring.
+
+## What you get
+
+- **A resident performance engineer.** The agent gets a role and a success metric (perceived speed) plus hard rules: profile before changing, name the tool and the scenario and the baseline, benchmark every change that claims speed with p50/p95, keep behaviour identical unless a tradeoff is explicit and measured.
+- **A triage order.** Unbounded growth (no pagination, no bound) beats N+1 and redundant work, which beats hot-path allocations and per-iteration compilation, which beats cold-path issues. With no benchmark target, it fixes only categorically safe wins and skips anything whose benefit needs numbers to prove.
+- **Checklists for both halves.** Frontend: FPS, long tasks, input delay, layout thrash, forced reflow, giant unwindowed lists, work that belongs on a worker, compositor-friendly animation, then render-blocking critical path and deferred bytes. Backend: CPU and allocation profiles, cache misses, SoA over AoS, arena reuse, batched I/O, auto-vectorization blockers checked before anyone reaches for intrinsics.
+- **Deterministic perf tests, not flaky ones.** Every claimed win has to leave a test that still passes on a loaded machine: retired instructions or work counters first, then CPU time, then hardware-counter ratios. Wall clock is for the product-level p50/p95 and a coarse bound only; a wall-clock gate needs medians and a tolerance band, and says so.
+- **Runtime currency check.** It notes the version the code actually runs on and checks recent releases for speedups that touch the hot paths found, and recommends an upgrade only where a measured path gains.
+- **Named ownership boundaries.** It judges whether a cache should exist and owns app-side query call sites; it never owns schema or migrations. It will not trade correctness, accessibility, or content for speed.
+- **A fixed report shape.** Bottlenecks ranked by user-visible impact with confidence (confirmed / likely / potential), changes made with measured deltas, remaining hot paths, and what it refused to do because it was unmeasured or would not help.
+
+## Install
+
+> **Install it as a bundle.** `dsh plugin add …` mounts the row from the
+> package's own patch layer, which is what the settings editor can write to. A
+> row added with `--patch` is an overlay: it disappears at the next start.
+
+```sh
+dsh plugin --profile web add @maci0/dsh-perf-review@0.10.0
+```
+
+This installs the public npm package; no GitHub token or `~/.secrets` setup is needed.
+The version is pinned. To upgrade, run the same command with a newer version,
+then restart `dsh web` (bundle layers compose at boot).
+
+The package declares `dsh.bundle.patch`, so the CLI appends it to `dsh.profile.bundles` and its shipped `cordis.patch.yml` supplies the row. Do not paste that row into `~/.dsh/profiles/web/cordis.patch.yml` as well: the bundle layer already applies it, and a second row registers the plugin twice.
+
+Uninstall with the package name:
+
+```sh
+dsh plugin --profile web remove @maci0/dsh-perf-review
+```
+
+That drops the dependency and the bundle layer with it; nothing else to edit.
+
+## Use it
+
+Type the lag, not the fix:
+
+```
+/perf-review the file tree stalls for a beat when I expand a folder, profile it and tell me what to change
+```
+
+The agent then states the user-visible lag it is attacking, shows profile evidence (hot function, % time, scenario), proposes the smallest change that hits that hot path, implements it, re-runs the same scenario before and after, and keeps or reverts on the numbers.
+
+Give it a repo path, a trace, or a running local URL and it works from what exists. For a browser measurement it uses static files or an already-listening local URL. It never installs tools, never starts a server to get a measurement, and never hits a remote host. With no codebase in reach it first lists the exact files, traces, and benchmarks it needs.
+
+## Configure
+
+No config fields. The plugin reads one bundled skill and mounts it; behaviour is the skill text itself.
+
+| Frontmatter key | Effect |
+|---|---|
+| `name` | Skill id: `perf-review`, so the composer exposes `/perf-review`. |
+| `description` | What the model sees when deciding to load the skill. |
+
+Both invocation policies are always on (the provider emits `invocation: { modelInvocable: true, userInvocable: true }`), and any other frontmatter key is parsed and ignored.
+
+## How it works
+
+`index.js` is plain JavaScript, no build step. It hooks `ctx.skills.registerProvider()`, resolves its `skills/` directory with `fileURLToPath`, and reads the one bundled `skills/perf-review/SKILL.md` directly. Candidate summaries carry `rank: BUNDLED_SKILL_RANK`, so a project or user skill of the same name still takes precedence.
+
+Frontmatter is parsed with `yaml`, the same parser the harness's own filesystem skill provider uses, so plain scalars, `|`/`|-`/`>-` block scalars, and nested maps read as YAML says they do. An invalid skill name or a description-less file is skipped with a warning, never fatal. A missing root or a refused `SKILL.md` is reported as an **incomplete observation**, not an empty catalog, so the registry cannot cache a failed read as "no skills here".
+
+Runtime dependencies: `@deepseek-ai/dsh-skill` and `yaml`, both declared in `package.json`.
+
+## Limits
+
+- It is a skill plus instructions, not a profiler. Every number comes from a tool you already have; if nothing can measure the path, the change does not ship.
+- It does not own schema, indexes, or migrations, and it does not own caching correctness, only whether a cache should exist at all.
+- It adds no model tool, no slash command, and no browser half. A skill needs none of that.
+- The composer exposes user-invocable skills as `/<name>` on its own; this package does not draw UI.
+
+## Development
+
+```sh
+bun install --frozen-lockfile
+bun test           # tests/*.test.js: 60 tests, no build step
+```
+
+dsh loads plugins on Node `^22.19.0 || >=24.0.0`; development and tests run on bun. Tests cover the frontmatter parser, discovery, the provider's `list`/`get` contract, abort handling, incomplete-root reporting, and a real Cordis composition that mounts and disposes the provider.
+
+For local development, install the checkout as a bundle:
+
+```sh
+dsh plugin --profile <name> add <path-to-checkout>
+```
+
+## Licence
+
+AGPL-3.0-only. The bundled skill includes material adapted from
+[maci0/gauntlet](https://github.com/maci0/gauntlet). See `LICENSE` and `NOTICE`.
+The original MIT notice for the DSH adapter is retained in `LICENSE-MIT`.

package/cordis.patch.yml

@@ -0,0 +1,10 @@
+# The dsh-perf-review bundle patch: applied automatically when a profile lists
+# this bundle (`dsh plugin add`/`update` appends the package to
+# dsh.profile.bundles). Users override this row from their profile's own
+# cordis.patch.yml (live-watched; dsh.profile.bundles is frozen at boot) with a
+# `- id: perf-review` row, which replaces the row's whole `config`.
+# Do not also insert this same row into the profile patch: insert does not
+# dedupe ids, and a second row would register the plugin twice.
+- insert:
+    - id: perf-review
+      name: '@maci0/dsh-perf-review'

package/icon.svg

@@ -0,0 +1,5 @@
+<svg width="36" height="36" viewBox="0 0 36 36" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path d="M8 23.5a10 10 0 1 1 20 0" stroke="#F2AF63" stroke-width="2.4" stroke-linecap="round"/>
+  <path d="M18 23.5L24.2 15" stroke="#C47B2B" stroke-width="2.2" stroke-linecap="round"/>
+  <circle cx="18" cy="23.5" r="2.1" fill="#C47B2B"/>
+</svg>

package/index.js

@@ -0,0 +1,381 @@
+/**
+ * dsh-perf-review: performance review skill for DeepSeek Harness.
+ *
+ * One capability: the bundled `perf-review` skill becomes a `ctx.skills`
+ * provider, so it loads through the `skill` tool and appears as
+ * `/perf-review` in the composer. No settings, no tool, no command, no
+ * browser half: a skill needs none of that.
+ *
+ * Skill content: the user's perf prompt, plus the hot-path/SIMD/data-layout
+ * material from gauntlet's perf-review and the critical-path/delivery
+ * material from its webperf-review (maci0/gauntlet), plus fix-order and
+ * ownership-boundary lines from the adjacent concurrency/resource/db/cache
+ * reviews.
+ *
+ * `package.json` declares `dsh.bundle.patch`, so `dsh plugin add` mounts this
+ * package as a profile layer and cordis.patch.yml supplies the row.
+ */
+
+import { readFile } from 'node:fs/promises'
+import { basename, dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { BUNDLED_SKILL_RANK, isSkillName } from '@deepseek-ai/dsh-skill'
+
+/** Plugin name as it appears in the loader. */
+export const name = 'perf-review'
+
+/** Service this plugin needs; `ctx.skills` is ready when `apply` runs. */
+export const inject = ['skills']
+
+/**
+ * Read and parse one skill file. Shared by discovery and direct loads so a
+ * single file enforces the name/description/frontmatter rules everywhere.
+ */
+async function readSkillFile(path, onWarn, entryName, signal) {
+  if (signal?.aborted) return undefined
+
+  let source
+  try {
+    source = await readFile(path, { encoding: 'utf8', signal })
+  } catch (error) {
+    // An aborted read is the caller withdrawing, not a broken skill.
+    if (!signal?.aborted) onWarn?.(`cannot read ${path}: ${error instanceof Error ? error.message : String(error)}`)
+    return undefined
+  }
+
+  let parsed
+  try {
+    // The flat reader covers every header this package ships. Its refusal is
+    // what selects the real YAML parser, so the fallback stays the contract.
+    parsed = parseFrontmatter(source)
+    if (parsed === undefined) parsed = await parseFrontmatterWithYaml(source)
+  } catch (error) {
+    onWarn?.(`skipping ${path}: ${error instanceof Error ? error.message : String(error)}`)
+    return undefined
+  }
+
+  const fallback = entryName ?? basename(path)
+  const skillName = String(parsed.data.name ?? fallback).trim()
+  const description = String(parsed.data.description ?? '').trim()
+  if (!isSkillName(skillName)) {
+    onWarn?.(`skipping ${path}: "${skillName}" is not a valid kebab-case skill name`)
+    return undefined
+  }
+  if (description === '') {
+    onWarn?.(`skipping ${path}: frontmatter has no description`)
+    return undefined
+  }
+
+  return {
+    name: skillName,
+    description,
+    content: parsed.body.trim(),
+    path,
+    directory: dirname(path),
+  }
+}
+
+/** `key: value` at column zero, with nothing but horizontal space around the colon. */
+const ENTRY = /^([^\s:#][^\s:#]*?)[ \t]*:([ \t]+[^\r\n]*|)$/
+/** A plain scalar with no leading indicator, no `#`, no `: ` mapping, no reserved start. */
+const PLAIN = /^[^\s!&*\-?{}[\],#|>@`"'%:][^#:]*$/
+/** A double-quoted scalar with no backslash escape in it. */
+const SIMPLE_DOUBLE = /^[^\\]*$/
+/** A single-quoted scalar with no `''` escape in it. */
+const SIMPLE_SINGLE = /^[^']*$/
+/** The block scalar header this reader reads: style plus an optional strip flag. */
+const BLOCK_HEADER = /^([|>])(-)?$/
+/** A plain scalar YAML types as an integer: `0x10`, `0o17`, `+5`, `-0`, `007`, `1_000`. */
+const TYPED_INT = /^[-+]?(?:0[xX][0-9a-fA-F_]+|0[oO][0-7_]+|0[bB][01_]+|[0-9][0-9_]*)$/
+/** A plain scalar YAML types as a special float: `.inf`, `.nan`, either sign, any case. */
+const TYPED_SPECIAL = /^[-+]?\.(?:inf|nan)$/i
+/** A plain scalar YAML types as a float: a leading `+`, leading zeros, a `.5`/`1.` body. */
+const TYPED_FLOAT = /^(?:[-+]?[0-9][0-9_]*\.[0-9_]*|[-+]?\.[0-9][0-9_]*)$/i
+/** The decimal scalars this reader converts itself, with no YAML-only spelling. */
+const SAFE_INT = /^-?(?:0|[1-9]\d*)$/
+const SAFE_FLOAT = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][-+]?\d+)?$/
+/** Keys YAML resolves to a non-string: `null` becomes `''` and `True` becomes `'true'`. */
+const RESOLVED_KEY = /^(?:~|null|Null|NULL|true|True|TRUE|false|False|FALSE)$/
+/** Keys that would not survive `data[key] = value` on an object literal. */
+const UNSAFE_KEY = new Set(['__proto__'])
+/** A key this reader can prove `yaml` resolves to the same string. */
+const SAFE_KEY = /^[A-Za-z_][A-Za-z0-9_.-]*$/
+/** Code points JS `trim` strips but YAML counts as content: indentation is unprovable. */
+const JS_ONLY_SPACE = /[\u000B\u000C\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000\uFEFF]/
+
+/** The delimiter line, exactly as the pre-change reader tested it. */
+const DELIMITER = /^---[ \t]*$/
+
+/** Split a data block into lines. `parseFrontmatter` refuses any `\r`, so `\n` is the only break. */
+function toLines(text) {
+  return text.split('\n')
+}
+
+/**
+ * Split one document into its leading frontmatter block and the body, the way
+ * the pre-change reader did: line by line, so the string handed to `yaml` is
+ * byte-identical to what it parsed before the fast path existed.
+ * @param {string} source - the file's contents.
+ * @returns {{ block: string, body: string, present: boolean }} the parts.
+ */
+function splitDocument(source) {
+  const text = String(source).replace(/^\uFEFF/, '')
+  const lines = text.split(/\r?\n/)
+  if (lines[0] === undefined || !DELIMITER.test(lines[0])) return { block: '', body: text, present: false }
+  let closing = -1
+  for (let index = 1; index < lines.length; index += 1) {
+    if (DELIMITER.test(lines[index] ?? '')) {
+      closing = index
+      break
+    }
+  }
+  if (closing === -1) return { block: '', body: text, present: false }
+  return { block: lines.slice(1, closing).join('\n'), body: lines.slice(closing + 1).join('\n'), present: true }
+}
+
+/**
+ * Count the spaces a line starts with. YAML indentation is spaces; a tab or a
+ * code point JS treats as blank is not this reader's to interpret.
+ * @param {string} line - one line of the block.
+ * @returns {number} the number of leading spaces.
+ */
+function leadingSpaces(line) {
+  let count = 0
+  while (count < line.length && line.charCodeAt(count) === 32) count += 1
+  return count
+}
+
+/**
+ * Read one block scalar: same-indent lines only, chomping as YAML defines it.
+ * @returns the scalar and the index one past the block, or `undefined` when the
+ *   block has a deeper-indented line, an interior blank line, or no content.
+ */
+function readBlockScalar(lines, header, headerValue) {
+  const style = headerValue[0]
+  const modifier = headerValue.slice(1)
+  const first = lines[header + 1]
+  if (first === undefined) return undefined
+  // Indentation is spaces only: a tab is a YAML parse error there, so a
+  // tab-led or unindented first line leaves the block to `yaml`.
+  const indent = leadingSpaces(first)
+  if (indent === 0) return undefined
+
+  const content = []
+  let index = header + 1
+  let closed = false
+  for (; index < lines.length; index += 1) {
+    const line = lines[index]
+    if (leadingSpaces(line) < indent) { closed = true; break }
+    if (line.length === indent) {
+      // An interior blank line folds differently; only a trailing run may stay.
+      if (index + 1 < lines.length && lines[index + 1].length >= indent) return undefined
+      content.push('')
+      continue
+    }
+    if (leadingSpaces(line) > indent) return undefined
+    if (line.charCodeAt(indent) === 9) return undefined
+    content.push(line.slice(indent, line.length))
+  }
+  // A block that runs to the end of the document is closed there.
+  if (!closed && index >= lines.length) closed = true
+  if (!closed) return undefined
+  if (content.length === 0) return undefined
+
+  let last = content.length
+  while (last > 0 && content[last - 1] === '') last -= 1
+  const kept = content.slice(0, last)
+  if (kept.length === 0) return undefined
+
+  const body = style === '|' ? kept.join('\n') : kept.join(' ')
+  if (modifier.includes('-')) return { value: body, next: index }
+  return { value: `${body}\n`, next: index }
+}
+
+/**
+ * Read one scalar value.
+ * @returns the value, or `undefined` when it needs the real YAML parser.
+ */
+function readScalar(raw) {
+  // A `#` needs YAML's comment rules (one only after whitespace) to read: refuse.
+  if (raw.includes('#')) return undefined
+  // `.inf` / `.nan` are YAML's special floats, in any case and either sign.
+  if (TYPED_SPECIAL.test(raw)) return undefined
+  if (raw === '' || raw === '~' || raw === 'null' || raw === 'Null' || raw === 'NULL') return { value: null }
+  if (raw === 'true' || raw === 'True' || raw === 'TRUE') return { value: true }
+  if (raw === 'false' || raw === 'False' || raw === 'FALSE') return { value: false }
+  if (/[0-9]/.test(raw)) {
+    // A digit anywhere means YAML may type this scalar; only the spellings this
+    // reader converts identically may pass, every other form goes to `yaml`.
+    if (SAFE_INT.test(raw) || SAFE_FLOAT.test(raw)) return { value: Number(raw) }
+    // Any other exponent spelling is YAML's floatExp, whose mantissa may be
+    // `.5`, `1.`, or zero-padded (`01e9`, `00e0`), none of which this reader
+    // converts, so it must not claim the block.
+    if (/[eE]/.test(raw)) return undefined
+    if (TYPED_INT.test(raw) || TYPED_FLOAT.test(raw) || /^[-+]/.test(raw) || raw.includes('_')) return undefined
+  }
+
+  const first = raw.charCodeAt(0)
+  if (first === 34) {
+    if (!SIMPLE_DOUBLE.test(raw.slice(1))) return undefined
+    const closing = raw.indexOf('"', 1)
+    if (closing === -1 || raw.slice(closing + 1).trim() !== '') return undefined
+    return { value: raw.slice(1, closing) }
+  }
+  if (first === 39) {
+    if (!SIMPLE_SINGLE.test(raw.slice(1))) return undefined
+    const closing = raw.indexOf("'", 1)
+    if (closing === -1 || raw.slice(closing + 1).trim() !== '') return undefined
+    return { value: raw.slice(1, closing) }
+  }
+  if (!PLAIN.test(raw)) return undefined
+  return { value: raw }
+}
+
+/**
+ * Read a flat block of `key: value` entries.
+ * @returns the mapping, or `undefined` when any line needs the real YAML parser.
+ */
+function parseFlatBlock(block) {
+  // `trim`/`trimStart` in this reader would measure indentation through these
+  // and YAML would not: the real parser has to decide.
+  if (JS_ONLY_SPACE.test(block)) return undefined
+  const lines = toLines(block)
+  const data = {}
+  const seen = new Set()
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index]
+    if (line === '' || line.charCodeAt(0) === 35) continue
+    const entry = ENTRY.exec(line)
+    if (entry === null) return undefined
+
+    const key = entry[1].trimEnd()
+    if (key !== entry[1]) return undefined
+    // Only a key that is provably its own string: that excludes quoted keys,
+    // flow keys, keys starting with an indicator (`@a`, `|a`, `[a]`), typed
+    // keys (`0x10`), and the words YAML resolves to `null`/`true`/`false`.
+    if (!SAFE_KEY.test(key)) return undefined
+    if (RESOLVED_KEY.test(key)) return undefined
+    // `yaml` rejects a duplicate key and a `__proto__` key does not survive a
+    // plain object assignment; both need the real parser.
+    if (seen.has(key) || UNSAFE_KEY.has(key)) return undefined
+    seen.add(key)
+    const raw = entry[2].replace(/^[ \t]+/, '').replace(/[ \t]+$/, '')
+    if (raw === '') {
+      // A value on following lines is a nested map or a sequence.
+      const next = lines[index + 1]
+      if (next !== undefined && next.trimStart() !== '' && next.charCodeAt(0) !== 35) return undefined
+      data[key] = null
+      continue
+    }
+    if (raw.charCodeAt(0) === 124 || raw.charCodeAt(0) === 62) {
+      // Only clip and strip chomping are read here; `+` keeps every trailing
+      // line break, which this line-based reader does not count.
+      if (BLOCK_HEADER.exec(raw) === null) return undefined
+      const scalar = readBlockScalar(lines, index, raw)
+      if (scalar === undefined) return undefined
+      data[key] = scalar.value
+      index = scalar.next - 1
+      continue
+    }
+    const scalar = readScalar(raw)
+    if (scalar === undefined) return undefined
+    data[key] = scalar.value
+  }
+  return data
+}
+
+/**
+ * Parse leading frontmatter from a markdown document, for the flat subset only.
+ * @param {string} source - full file contents.
+ * @returns {{ data: Record<string, unknown>, body: string }|undefined} the read,
+ *   or `undefined` when the block needs the real YAML parser.
+ */
+export function parseFrontmatter(source) {
+  // `\r` is a line break to YAML and not to this reader: hand the whole file,
+  // CRLF included, to the real parser instead of claiming the block.
+  if (String(source).includes('\r')) return undefined
+  const { block, body, present } = splitDocument(source)
+  if (!present) return { data: {}, body }
+  const data = parseFlatBlock(block)
+  if (data === undefined) return undefined
+  return { data, body }
+}
+
+/**
+ * Parse leading `---` frontmatter with `yaml`, the parser the harness's own
+ * filesystem skill provider uses. Frontmatter with no closing `---` is not
+ * frontmatter, and the body is then the whole source. The extraction is the
+ * pre-change reader's line-by-line split, so `yaml` sees the same bytes.
+ * @param {string} source - full file contents.
+ * @returns {Promise<{ data: Record<string, unknown>, body: string }>} the read.
+ */
+export async function parseFrontmatterWithYaml(source) {
+  const { block, body, present } = splitDocument(source)
+  if (!present) return { data: {}, body }
+  const { parse: parseYaml } = await import('yaml')
+  const parsed = parseYaml(block)
+  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+    // Empty or non-mapping frontmatter: no keys, but the body still loads.
+    return { data: {}, body }
+  }
+  return { data: parsed, body }
+}
+/**
+ * Read this package's one bundled skill. No directory walk: the package ships
+ * exactly one `SKILL.md`, and `get()` already loads a locator directly.
+ * @returns `{ candidates, complete }`; `complete: false` means re-read, not "no skills".
+ */
+export async function discoverSkills(skillsDir, onWarn, signal) {
+  if (signal?.aborted) return { candidates: [], complete: false }
+  const skill = await readSkillFile(join(skillsDir, name, 'SKILL.md'), onWarn, name, signal)
+  // A failed read is an incomplete observation, so the registry re-reads
+  // instead of caching a broken skill as an empty catalog.
+  return skill === undefined ? { candidates: [], complete: false } : { candidates: [skill], complete: true }
+}
+
+/** Summary for one bundled skill. Every SKILL.md this package ships is invocable by both the model and the user. */
+function summaryOf(skill) {
+  return {
+    path: skill.path,
+    name: skill.name,
+    description: skill.description,
+    invocation: { modelInvocable: true, userInvocable: true },
+    source: 'bundled',
+    provider: 'perf-review',
+    resourceBase: { kind: 'directory', path: skill.directory },
+  }
+}
+
+/** Build the provider the skill registry mounts. */
+export function createSkillProvider({ skillsDir, onWarn }) {
+  return {
+    name: 'perf-review',
+    async list(lookup) {
+      const { candidates, complete } = await discoverSkills(skillsDir, onWarn, lookup?.signal)
+      const skills = candidates.map((skill) => ({ ...summaryOf(skill), rank: BUNDLED_SKILL_RANK, locator: skill.path }))
+      // Array shorthand on a complete read; an explicit observation otherwise, so the registry cannot cache a failed read as an empty catalog.
+      return complete ? skills : { candidates: skills, complete: false }
+    },
+    async get(candidate, lookup) {
+      if (typeof candidate.locator !== 'string') return undefined
+      // Read the locator directly: one file instead of a full re-discovery.
+      // The directory name is the fallback identity a name-less SKILL.md is
+      // listed under; the name check keeps a stale candidate (path reused by
+      // another skill) from loading under the wrong identity.
+      const skill = await readSkillFile(candidate.locator, onWarn, basename(dirname(candidate.locator)), lookup?.signal)
+      if (skill === undefined || skill.name !== candidate.name) return undefined
+      return { ...summaryOf(skill), content: skill.content }
+    },
+  }
+}
+
+/** Mount the plugin: skills provider only. `inject` above already made the fiber wait for `ctx.skills`. */
+export function apply(ctx) {
+  const warn = (message) => {
+    if (ctx.logger?.warn) ctx.logger.warn(`[perf-review] ${message}`)
+    else console.warn(`[perf-review] ${message}`)
+  }
+  ctx.skills.registerProvider(() =>
+    createSkillProvider({ skillsDir: fileURLToPath(new URL('./skills', import.meta.url)), onWarn: warn }),
+  )
+}

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Performance review",
+    "description": "Perceived speed first: profile before changing, and keep behavior the same."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "性能审查",
+    "description": "体感速度优先：先测量再改，并保持行为不变。"
+  }
+}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@maci0/dsh-perf-review",
+  "version": "0.10.0",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "type": "module",
+  "main": "index.js",
+  "description": "Performance review skill for DeepSeek Harness: perceived speed above all: profile before changing, benchmark every claim, keep behavior identical.",
+  "license": "AGPL-3.0-only",
+  "exports": {
+    ".": "./index.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./locale/*.json": "./locale/*.json",
+    "./package.json": "./package.json"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "compatibility": {
+      "dsh": ">=0.2.0-rc.2 <0.3.0"
+    }
+  },
+  "files": [
+    "icon.svg",
+    "locale/*.json",
+    "index.js",
+    "skills",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE",
+    "LICENSE-MIT",
+    "NOTICE"
+  ],
+  "scripts": {
+    "test": "bun test",
+    "test:node": "node --test tests/*.test.*"
+  },
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "dependencies": {
+    "@deepseek-ai/dsh-skill": "0.2.1-alpha.1",
+    "yaml": "2.9.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.5-alpha.1",
+    "@deepseek-ai/dsh-scope": "0.2.1-alpha.1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/maci0/dsh-perf-review.git"
+  },
+  "icon": "./icon.svg"
+}