devkit-quality 0.1.0 → 0.1.1

package/dist/reporters.js

@@ -28,56 +28,111 @@ const SEVERITY_RANK = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, INFO: 0 };
 function severityRank(severity) {
     return SEVERITY_RANK[severity] ?? 0;
 }
+const CONFIDENCE_RANK = { CERTAIN: 3, HIGH: 2, MEDIUM: 1, LOW: 0 };
+function confidenceRank(confidence) {
+    return CONFIDENCE_RANK[confidence] ?? 0;
+}
 const MAX_DETAILED_FINDINGS = 6;
-function formatTerminal(summary) {
+const SEVERITIES = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFO'];
+function plural(count, word) {
+    return `${count} ${word}${count === 1 ? '' : 's'}`;
+}
+function displayPath(repository) {
+    const home = process.env.HOME;
+    return home && repository.startsWith(home) ? `~${repository.slice(home.length)}` : repository;
+}
+function renderHeader(summary, width) {
+    const title = `${terminal_1.color.bold(terminal_1.color.cyan('DevKit'))} ${terminal_1.color.dim(terminal_1.glyph.bullet)} ${terminal_1.color.bold('Repository Quality Scan')}`;
+    return (0, terminal_1.renderBox)([title, terminal_1.color.dim((0, terminal_1.truncateMiddle)(displayPath(summary.repository), width - 6))], width);
+}
+function renderScore(summary, width) {
     const lines = [];
-    lines.push(terminal_1.color.bold('DevKit Repository Scan'));
-    lines.push(terminal_1.color.dim(summary.repository));
-    lines.push('');
-    lines.push(`  ${terminal_1.color.bold(summary.score.toFixed(1))}${terminal_1.color.dim('/10')}  ${(0, terminal_1.scoreColor)(summary.score, (0, terminal_1.scoreLabel)(summary.score))}`);
-    lines.push(`  ${(0, terminal_1.renderScoreBar)(summary.score)}`);
-    lines.push('');
-    const categoryEntries = Object.entries(summary.categoryScores);
-    const nameWidth = Math.max(...categoryEntries.map(([category]) => humanizeCategory(category).length)) + 2;
-    for (const [category, score] of categoryEntries) {
-        const label = (0, terminal_1.pad)(humanizeCategory(category), nameWidth);
-        const scoreText = (0, terminal_1.padStart)(score.toFixed(1), 4);
-        lines.push(`  ${terminal_1.color.dim(label)}${(0, terminal_1.scoreColor)(score, scoreText)}`);
+    const grade = (0, terminal_1.scoreColor)(summary.score, terminal_1.color.bold(` ${(0, terminal_1.scoreGrade)(summary.score)} `));
+    const scoreText = `${terminal_1.color.bold((0, terminal_1.scoreColor)(summary.score, summary.score.toFixed(1)))}${terminal_1.color.dim(' / 10')}`;
+    lines.push(`  ${scoreText}   ${terminal_1.color.dim('grade')} ${grade}  ${(0, terminal_1.scoreColor)(summary.score, (0, terminal_1.scoreLabel)(summary.score))}`);
+    lines.push(`  ${(0, terminal_1.renderScoreBar)(summary.score, Math.min(48, width - 4))}`);
+    if (summary.securityCapped) {
+        lines.push(`  ${terminal_1.color.red(`${terminal_1.glyph.warn} Capped at ${scoring_1.SECURITY_CAP}`)} ${terminal_1.color.dim('— a high-confidence security finding outweighs code quality. Fix it first.')}`);
     }
-    const securityLabel = (0, terminal_1.pad)('Security', nameWidth);
-    const securityScoreText = (0, terminal_1.padStart)(summary.securityScore.toFixed(1), 4);
-    lines.push(`  ${terminal_1.color.dim(securityLabel)}${(0, terminal_1.scoreColor)(summary.securityScore, securityScoreText)} ${terminal_1.color.dim('(reported separately)')}`);
-    lines.push('');
-    lines.push(terminal_1.color.dim('─'.repeat(50)));
-    if (summary.findings.length === 0) {
-        lines.push('');
-        lines.push(terminal_1.color.green('No findings. The repository looks clean.'));
-        lines.push('');
-        return lines.join('\n');
+    if (summary.coverage && summary.coverage.analyzedFiles === 0) {
+        lines.push(`  ${terminal_1.color.yellow(`${terminal_1.glyph.warn} No JavaScript/TypeScript files were analyzed, so this score means nothing.`)}`);
+        lines.push(`  ${terminal_1.color.dim('  Check that you ran devkit from the project root, and your scan.include / .devkitignore settings.')}`);
     }
-    const bySeverityCount = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0, INFO: 0 };
+    return lines;
+}
+function renderCoverage(summary, width) {
+    const coverage = summary.coverage;
+    if (!coverage)
+        return [];
+    const lines = ['', (0, terminal_1.sectionHeading)('Scan coverage', width, `${(0, terminal_1.formatDuration)(coverage.durationMs)} · via ${coverage.discoveryMethod === 'git' ? 'git (respects .gitignore)' : 'filesystem walk'}`)];
+    const stat = (value, label) => `${terminal_1.color.bold(String(value))} ${terminal_1.color.dim(label)}`;
+    lines.push(`  ${stat(coverage.discoveredFiles, 'files found')}   ${stat(coverage.analyzedFiles, 'analyzed as JS/TS')}   ${stat(coverage.textFilesScanned, 'other files secret-scanned')}`);
+    const skipped = [];
+    if (coverage.generatedFilesSkipped > 0)
+        skipped.push(plural(coverage.generatedFilesSkipped, 'generated file'));
+    if (coverage.tooLargeFilesSkipped.length > 0)
+        skipped.push(`${plural(coverage.tooLargeFilesSkipped.length, 'oversized file')}`);
+    if (coverage.binaryFilesSkipped > 0)
+        skipped.push(plural(coverage.binaryFilesSkipped, 'binary file'));
+    lines.push(`  ${terminal_1.color.dim('Lines of code:')} ${summary.metrics.sourceLOC.toLocaleString()} ${terminal_1.color.dim('source ·')} ${summary.metrics.testLOC.toLocaleString()} ${terminal_1.color.dim('test')}${skipped.length ? `   ${terminal_1.color.dim(`Skipped: ${skipped.join(', ')}`)}` : ''}`);
+    const languages = Object.entries(coverage.languages)
+        .sort((a, b) => b[1] - a[1])
+        .slice(0, 8)
+        .map(([extension, count]) => `${extension} ${terminal_1.color.dim(String(count))}`)
+        .join(terminal_1.color.dim('  ·  '));
+    if (languages)
+        lines.push(`  ${terminal_1.color.dim('Files:')} ${languages}`);
+    return lines;
+}
+function renderCategories(summary, width) {
+    const counts = new Map();
+    const worst = new Map();
     for (const finding of summary.findings) {
-        bySeverityCount[finding.severity] += 1;
+        counts.set(finding.category, (counts.get(finding.category) ?? 0) + 1);
+        const previous = worst.get(finding.category);
+        if (!previous || severityRank(finding.severity) > severityRank(previous))
+            worst.set(finding.category, finding.severity);
     }
-    const severitySummary = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFO']
-        .filter((severity) => bySeverityCount[severity] > 0)
-        .map((severity) => (0, terminal_1.severityColor)(severity, `${bySeverityCount[severity]} ${severity.toLowerCase()}`))
-        .join(terminal_1.color.dim(' · '));
-    lines.push('');
-    lines.push(`  ${terminal_1.color.bold(String(summary.findings.length))} findings  ${terminal_1.color.dim('(')}${severitySummary}${terminal_1.color.dim(')')}`);
-    const findingsByCategory = new Map();
-    for (const finding of summary.findings) {
-        if (!findingsByCategory.has(finding.category))
-            findingsByCategory.set(finding.category, []);
-        findingsByCategory.get(finding.category).push(finding);
+    const categories = Object.keys(CATEGORY_LABELS).filter((category) => category in summary.categoryScores);
+    if (!categories.includes('security'))
+        categories.push('security');
+    const nameWidth = Math.max(...categories.map((category) => humanizeCategory(category).length)) + 2;
+    const barWidth = Math.max(10, Math.min(30, width - nameWidth - 30));
+    const lines = ['', (0, terminal_1.sectionHeading)('Categories', width)];
+    for (const category of categories) {
+        const score = category === 'security' ? summary.securityScore : summary.categoryScores[category];
+        const count = counts.get(category) ?? 0;
+        const countText = count === 0 ? terminal_1.color.green(`${terminal_1.glyph.check} clean`) : (0, terminal_1.severityColor)(worst.get(category) ?? 'LOW', plural(count, 'finding'));
+        lines.push(`  ${(0, terminal_1.pad)(humanizeCategory(category), nameWidth)}${(0, terminal_1.scoreColor)(score, (0, terminal_1.padStart)(score.toFixed(1), 4))}  ${(0, terminal_1.renderScoreBar)(score, barWidth)}  ${countText}`);
     }
-    lines.push('');
-    const categoryCountWidth = Math.max(...[...findingsByCategory.keys()].map((category) => humanizeCategory(category).length)) + 2;
-    for (const [category, categoryFindings] of [...findingsByCategory.entries()].sort((a, b) => b[1].length - a[1].length)) {
-        const worst = categoryFindings.reduce((max, finding) => (severityRank(finding.severity) > severityRank(max.severity) ? finding : max));
-        lines.push(`  ${(0, terminal_1.pad)(humanizeCategory(category), categoryCountWidth)} ${terminal_1.color.dim('›')} ${(0, terminal_1.severityColor)(worst.severity, `${categoryFindings.length} finding${categoryFindings.length === 1 ? '' : 's'}`)}`);
+    if (!('architecture' in summary.categoryScores)) {
+        lines.push(`  ${(0, terminal_1.pad)(humanizeCategory('architecture'), nameWidth)}${terminal_1.color.dim(' n/a')}  ${terminal_1.color.dim('not scored — add "architecture.layers" to .devkitrc.json')}`);
     }
-    const severityRankedFindings = [...summary.findings].sort((a, b) => severityRank(b.severity) - severityRank(a.severity));
+    return lines;
+}
+function renderSeverity(summary, width) {
+    const bySeverity = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0, INFO: 0 };
+    for (const finding of summary.findings)
+        bySeverity[finding.severity] += 1;
+    const legend = SEVERITIES.filter((severity) => bySeverity[severity] > 0)
+        .map((severity) => `${(0, terminal_1.severityColor)(severity, terminal_1.glyph.dot)} ${bySeverity[severity]} ${severity.toLowerCase()}`)
+        .join('   ');
+    const bar = (0, terminal_1.renderStackedBar)(SEVERITIES.map((severity) => ({ value: bySeverity[severity], paint: (text) => (0, terminal_1.severityColor)(severity, text) })), Math.min(60, width - 4));
+    return ['', (0, terminal_1.sectionHeading)('Findings', width, `${summary.findings.length} total`), `  ${bar}`, `  ${legend}`];
+}
+function renderHotspots(summary, width) {
+    const hotspots = (0, scoring_1.summarizeHotspots)(summary.findings);
+    if (hotspots.length === 0)
+        return [];
+    const fileWidth = Math.min(Math.max(...hotspots.map((hotspot) => hotspot.file.length)) + 2, width - 30);
+    const lines = ['', (0, terminal_1.sectionHeading)('Hotspots', width, 'files that cost the most points')];
+    for (const hotspot of hotspots) {
+        lines.push(`  ${(0, terminal_1.severityColor)(hotspot.worst, terminal_1.glyph.dot)} ${terminal_1.color.cyan((0, terminal_1.pad)((0, terminal_1.truncateMiddle)(hotspot.file, fileWidth - 2), fileWidth))}${(0, terminal_1.padStart)(plural(hotspot.count, 'finding'), 12)}  ${terminal_1.color.dim(`worst: ${hotspot.worst.toLowerCase()}`)}`);
+    }
+    return lines;
+}
+function renderTopIssues(summary, width) {
+    const severityRankedFindings = [...summary.findings].sort((a, b) => severityRank(b.severity) - severityRank(a.severity) || confidenceRank(b.confidence) - confidenceRank(a.confidence));
     // One representative per category (its worst finding) so the detail section reads as a
     // scannable cross-section of the repository rather than six variations of the same rule.
     const representativeByCategory = new Map();
@@ -87,34 +142,49 @@ function formatTerminal(summary) {
         }
     }
     const topFindings = [...representativeByCategory.values()].slice(0, MAX_DETAILED_FINDINGS);
-    if (topFindings.length > 0) {
-        lines.push('');
-        lines.push(terminal_1.color.dim('─'.repeat(50)));
+    if (topFindings.length === 0)
+        return [];
+    const lines = ['', (0, terminal_1.sectionHeading)('Top issues', width, 'worst finding per category')];
+    for (const finding of topFindings) {
+        const rail = (0, terminal_1.severityColor)(finding.severity, terminal_1.glyph.rail);
         lines.push('');
-        lines.push(terminal_1.color.bold('Top issues'));
+        lines.push(`  ${(0, terminal_1.severityBadge)(finding.severity)} ${terminal_1.color.bold(finding.message)}  ${terminal_1.color.dim(`${humanizeCategory(finding.category)} · ${finding.ruleId}`)}`);
+        lines.push(`  ${rail} ${finding.description}`);
+        lines.push(`  ${rail} ${terminal_1.color.green(terminal_1.glyph.arrow)} ${finding.suggestion}`);
+        lines.push(`  ${rail} ${terminal_1.color.cyan(`${finding.file}:${finding.line}`)}${finding.confidence === 'LOW' ? terminal_1.color.dim('  (low confidence)') : ''}`);
+        lines.push(...(0, terminal_1.renderCodeFrame)(summary.repository, finding.file, finding.line, finding.column, finding.severity));
     }
-    for (const finding of topFindings) {
+    return lines;
+}
+function formatTerminal(summary) {
+    const width = (0, terminal_1.terminalWidth)();
+    const lines = [];
+    lines.push(...renderHeader(summary, width));
+    lines.push('');
+    lines.push(...renderScore(summary, width));
+    lines.push(...renderCoverage(summary, width));
+    lines.push(...renderCategories(summary, width));
+    if (summary.findings.length === 0) {
         lines.push('');
-        lines.push(`  ${terminal_1.color.dim(`${humanizeCategory(finding.category)}:`)} ${(0, terminal_1.severityColor)(finding.severity, finding.message)} ${terminal_1.color.dim(`[${finding.ruleId}]`)}`);
-        lines.push(`  ${finding.description}`);
-        lines.push(`  ${terminal_1.color.dim('→')} ${finding.suggestion}`);
-        lines.push(`  ${terminal_1.color.cyan(`${finding.file}:${finding.line}`)}`);
+        lines.push(`  ${terminal_1.color.green(`${terminal_1.glyph.check} No findings.`)} ${terminal_1.color.dim('The repository looks clean.')}`);
         lines.push('');
-        for (const frameLine of (0, terminal_1.renderCodeFrame)(summary.repository, finding.file, finding.line, finding.column, finding.severity)) {
-            lines.push(frameLine);
-        }
+        return lines.join('\n');
     }
-    const remaining = summary.findings.length - topFindings.length;
-    lines.push('');
-    lines.push(terminal_1.color.dim('─'.repeat(50)));
+    lines.push(...renderSeverity(summary, width));
+    lines.push(...renderHotspots(summary, width));
+    lines.push(...renderTopIssues(summary, width));
+    const shown = Math.min(MAX_DETAILED_FINDINGS, new Set(summary.findings.map((finding) => finding.category)).size);
+    const remaining = summary.findings.length - shown;
     lines.push('');
+    lines.push((0, terminal_1.sectionHeading)('Next steps', width));
     if (remaining > 0) {
-        lines.push(terminal_1.color.dim(`  + ${remaining} more finding${remaining === 1 ? '' : 's'} not shown above.`));
+        lines.push(terminal_1.color.dim(`  ${plural(remaining, 'more finding')} not shown above.`));
     }
-    lines.push(`  ${terminal_1.color.dim('devkit scan --format json')}      full machine-readable output`);
-    lines.push(`  ${terminal_1.color.dim('devkit scan --category <name>')}  focus on one category`);
-    lines.push(`  ${terminal_1.color.dim('devkit explain <RULE_ID>')}       why a rule exists and how to fix it`);
-    lines.push(`  ${terminal_1.color.dim('devkit fix')}                    preview findings marked safe to fix`);
+    const hint = (command, text) => `  ${terminal_1.color.cyan((0, terminal_1.pad)(command, 32))}${terminal_1.color.dim(text)}`;
+    lines.push(hint('devkit scan --category <name>', 'focus on one category (e.g. security, dead-code)'));
+    lines.push(hint('devkit scan --format markdown', 'full report with every finding'));
+    lines.push(hint('devkit explain <RULE_ID>', 'why a rule exists and how to fix it'));
+    lines.push(hint('devkit fix', 'preview findings marked safe to fix'));
     lines.push('');
     return lines.join('\n');
 }
@@ -126,8 +196,12 @@ function formatMarkdown(summary) {
     lines.push('# DevKit Scan Report');
     lines.push('');
     lines.push(`- Repository: ${summary.repository}`);
-    lines.push(`- Overall score: ${summary.score.toFixed(1)} / 10`);
-    lines.push(`- Security score (reported separately): ${summary.securityScore.toFixed(1)} / 10`);
+    lines.push(`- Overall score: ${summary.score.toFixed(1)} / 10 (grade ${(0, terminal_1.scoreGrade)(summary.score)}, ${(0, terminal_1.scoreLabel)(summary.score)})`);
+    lines.push(`- Security score: ${summary.securityScore.toFixed(1)} / 10${summary.securityCapped ? ` — overall score capped at ${scoring_1.SECURITY_CAP} by a high-confidence security finding` : ''}`);
+    if (summary.coverage) {
+        const coverage = summary.coverage;
+        lines.push(`- Coverage: ${coverage.discoveredFiles} files found, ${coverage.analyzedFiles} analyzed as JS/TS, ${coverage.textFilesScanned} other files secret-scanned, ${coverage.generatedFilesSkipped} generated skipped (${(0, terminal_1.formatDuration)(coverage.durationMs)})`);
+    }
     lines.push('');
     lines.push('## Category scores');
     lines.push('');
@@ -136,6 +210,9 @@ function formatMarkdown(summary) {
     for (const [category, score] of Object.entries(summary.categoryScores)) {
         lines.push(`| ${humanizeCategory(category)} | ${score.toFixed(1)} |`);
     }
+    if (!('architecture' in summary.categoryScores)) {
+        lines.push('| Architecture | n/a (no layers configured) |');
+    }
     lines.push('');
     lines.push('## Main deductions');
     lines.push('');
@@ -212,47 +289,58 @@ function formatSarif(summary) {
 }
 function formatMetrics(summary) {
     const metrics = summary.metrics;
-    const lines = [];
-    lines.push(terminal_1.color.bold('Repository metrics'));
-    lines.push(terminal_1.color.dim(summary.repository));
-    lines.push('');
-    lines.push(`  totalFiles            ${terminal_1.color.bold(String(metrics.totalFiles))}`);
-    lines.push(`  sourceFiles           ${metrics.sourceFiles}`);
-    lines.push(`  testFiles             ${metrics.testFiles}`);
-    lines.push(`  totalLOC              ${metrics.totalLOC}`);
-    lines.push(`  sourceLOC             ${metrics.sourceLOC}`);
-    lines.push(`  testLOC               ${metrics.testLOC}`);
-    lines.push(`  commentLOC            ${metrics.commentLOC}`);
-    lines.push(`  functionCount         ${metrics.functionCount}`);
-    lines.push(`  classCount            ${metrics.classCount}`);
-    lines.push(`  dependencyCount       ${metrics.dependencyCount}`);
-    lines.push(`  averageFunctionSize   ${metrics.averageFunctionSize.toFixed(1)}`);
-    lines.push(`  duplicationPercentage ${metrics.duplicationPercentage.toFixed(1)}%`);
-    lines.push(`  deadCodePercentage    ${metrics.deadCodePercentage.toFixed(1)}%`);
-    lines.push(`  testToSourceRatio     ${metrics.testToSourceRatio.toFixed(2)}`);
+    const width = (0, terminal_1.terminalWidth)();
+    const lines = [...(0, terminal_1.renderBox)([terminal_1.color.bold('Repository metrics'), terminal_1.color.dim((0, terminal_1.truncateMiddle)(displayPath(summary.repository), width - 6))], width)];
+    const row = (key, value, note = '') => `  ${terminal_1.color.dim((0, terminal_1.pad)(key, 24))}${(0, terminal_1.pad)(value, 12)}${terminal_1.color.dim(note)}`;
+    lines.push('', (0, terminal_1.sectionHeading)('Size', width));
+    lines.push(row('totalFiles', terminal_1.color.bold(String(metrics.totalFiles)), `${metrics.sourceFiles} source · ${metrics.testFiles} test`));
+    lines.push(row('sourceLOC', metrics.sourceLOC.toLocaleString()));
+    lines.push(row('testLOC', metrics.testLOC.toLocaleString()));
+    lines.push(row('commentLOC', metrics.commentLOC.toLocaleString()));
+    lines.push(row('dependencyCount', String(metrics.dependencyCount)));
+    if (summary.coverage) {
+        lines.push(row('otherFilesSecretScanned', String(summary.coverage.textFilesScanned)));
+        lines.push(row('generatedFilesSkipped', String(summary.coverage.generatedFilesSkipped)));
+    }
+    lines.push('', (0, terminal_1.sectionHeading)('Structure', width));
+    lines.push(row('functionCount', String(metrics.functionCount), `avg ${metrics.averageFunctionSize.toFixed(1)} lines`));
+    lines.push(row('classCount', String(metrics.classCount)));
+    const distribution = metrics.complexityDistribution;
+    lines.push(`  ${terminal_1.color.dim((0, terminal_1.pad)('complexity', 24))}${(0, terminal_1.renderStackedBar)([
+        { value: distribution.low, paint: terminal_1.color.green },
+        { value: distribution.medium, paint: terminal_1.color.yellow },
+        { value: distribution.high, paint: terminal_1.color.red }
+    ], 30)}  ${terminal_1.color.green(`${distribution.low} low`)} ${terminal_1.color.dim('·')} ${terminal_1.color.yellow(`${distribution.medium} medium`)} ${terminal_1.color.dim('·')} ${terminal_1.color.red(`${distribution.high} high`)}`);
+    lines.push('', (0, terminal_1.sectionHeading)('Health', width));
+    const percent = (value, invert = false) => {
+        const score = invert ? 10 - value / 10 : value / 10;
+        return (0, terminal_1.scoreColor)(score, `${value.toFixed(1)}%`);
+    };
+    lines.push(row('duplicationPercentage', percent(metrics.duplicationPercentage, true)));
+    lines.push(row('deadCodePercentage', percent(metrics.deadCodePercentage, true)));
+    lines.push(row('testToSourceRatio', metrics.testToSourceRatio.toFixed(2), metrics.testToSourceRatio < 0.3 ? 'low test coverage by volume' : ''));
     if (metrics.largestFunctions.length > 0) {
-        lines.push('');
-        lines.push(terminal_1.color.bold('Largest functions'));
+        lines.push('', (0, terminal_1.sectionHeading)('Largest functions', width));
         for (const fn of metrics.largestFunctions) {
-            lines.push(`  ${terminal_1.color.cyan(fn.name)} ${terminal_1.color.dim(`(${fn.file})`)} - ${fn.size} lines`);
+            lines.push(`  ${(0, terminal_1.padStart)(String(fn.size), 5)} ${terminal_1.color.dim('lines')}  ${terminal_1.color.cyan(fn.name)} ${terminal_1.color.dim(fn.file)}`);
         }
     }
     if (metrics.largestFiles.length > 0) {
-        lines.push('');
-        lines.push(terminal_1.color.bold('Largest files'));
+        lines.push('', (0, terminal_1.sectionHeading)('Largest files', width));
         for (const file of metrics.largestFiles) {
-            lines.push(`  ${terminal_1.color.cyan(file.file)} - ${file.loc} lines`);
+            lines.push(`  ${(0, terminal_1.padStart)(String(file.loc), 5)} ${terminal_1.color.dim('lines')}  ${terminal_1.color.cyan(file.file)}`);
         }
     }
     return lines.join('\n');
 }
 function formatBaselineCompare(previousScore, currentScore) {
     const delta = Number((currentScore - previousScore).toFixed(1));
+    const deltaText = `${delta >= 0 ? '+' : ''}${delta.toFixed(1)}`;
+    const verdict = delta < 0 ? terminal_1.color.red(`${terminal_1.glyph.warn} regression ${deltaText}`) : delta > 0 ? terminal_1.color.green(`${terminal_1.glyph.check} improved ${deltaText}`) : terminal_1.color.dim(`no change ${deltaText}`);
     const lines = [];
     lines.push(terminal_1.color.bold('Baseline compare'));
-    lines.push(`  Previous score: ${previousScore.toFixed(1)}`);
-    lines.push(`  Current score:  ${currentScore.toFixed(1)}`);
-    const deltaText = `${delta >= 0 ? '+' : ''}${delta.toFixed(1)}`;
-    lines.push(`  Regression:     ${delta < 0 ? terminal_1.color.red(deltaText) : terminal_1.color.green(deltaText)}`);
+    lines.push(`  ${terminal_1.color.dim('Previous')}  ${(0, terminal_1.renderScoreBar)(previousScore, 24)} ${previousScore.toFixed(1)}`);
+    lines.push(`  ${terminal_1.color.dim('Current ')}  ${(0, terminal_1.renderScoreBar)(currentScore, 24)} ${currentScore.toFixed(1)}`);
+    lines.push(`  ${verdict}`);
     return lines.join('\n');
 }

package/dist/rules/deadCode.js

@@ -128,12 +128,12 @@ function detectUnusedExports(context) {
             continue;
         if (moduleGraph.entryPoints.has(file))
             continue;
-        if ((0, discovery_1.isTestFile)(file))
+        const relativePath = node_path_1.default.relative(context.projectRoot, file).replace(/\\/g, '/');
+        if ((0, discovery_1.isTestFile)(relativePath))
             continue;
         if (fullyUsedFiles.has(file))
             continue;
         const used = usedExportsByFile.get(file) ?? new Set();
-        const relativePath = node_path_1.default.relative(context.projectRoot, file).replace(/\\/g, '/');
         const dynamicHint = hasDynamicRequireHint(context, relativePath);
         for (const exportInfo of exports) {
             if (used.has(exportInfo.name)) {
@@ -164,14 +164,14 @@ function detectUnusedFiles(context) {
     const findings = [];
     const { moduleGraph } = context;
     for (const file of context.files) {
-        if ((0, discovery_1.isTestFile)(file))
+        const relativePath = node_path_1.default.relative(context.projectRoot, file).replace(/\\/g, '/');
+        if ((0, discovery_1.isTestFile)(relativePath))
             continue;
         if (moduleGraph.entryPoints.has(file))
             continue;
         const incoming = moduleGraph.reverseEdges.get(file);
         if (incoming && incoming.size > 0)
             continue;
-        const relativePath = node_path_1.default.relative(context.projectRoot, file).replace(/\\/g, '/');
         const dynamicHint = hasDynamicRequireHint(context, relativePath);
         findings.push((0, finding_1.buildFinding)({
             ruleId: 'DEAD010',

package/dist/rules/dependencies.js

@@ -44,68 +44,141 @@ function getDeclaredDependencyNames(packageJson) {
     }
     return names;
 }
+/**
+ * Every package.json in the project (root plus any workspace members), so dependency checks run
+ * against the package that actually declares them instead of only the root. Parse failures are
+ * skipped rather than treated as "declares nothing", which would flood a workspace with false
+ * unlisted-dependency findings.
+ */
+function discoverWorkspacePackages(context) {
+    const packages = [];
+    const seenRoots = new Set();
+    const addPackage = (absolutePath, json, text) => {
+        const root = node_path_1.default.dirname(absolutePath);
+        if (seenRoots.has(root))
+            return;
+        seenRoots.add(root);
+        const scripts = json?.scripts ?? {};
+        packages.push({
+            root,
+            relativePath: node_path_1.default.relative(context.projectRoot, absolutePath).replace(/\\/g, '/') || 'package.json',
+            text,
+            declared: getDeclaredDependencyNames(json),
+            scriptText: Object.values(scripts).join(' ')
+        });
+    };
+    const rootPackageJsonPath = node_path_1.default.join(context.projectRoot, 'package.json');
+    addPackage(rootPackageJsonPath, context.packageJson, (0, discovery_1.readFileSafe)(rootPackageJsonPath));
+    for (const file of context.allFiles) {
+        if (node_path_1.default.basename(file) !== 'package.json' || node_path_1.default.resolve(file) === node_path_1.default.resolve(rootPackageJsonPath))
+            continue;
+        const text = (0, discovery_1.readFileSafe)(file);
+        try {
+            addPackage(file, JSON.parse(text), text);
+        }
+        catch {
+            // Malformed package.json: skip it rather than treating it as declaring nothing.
+        }
+    }
+    return packages.sort((a, b) => b.root.length - a.root.length);
+}
+/** The package whose directory most closely contains `absoluteFile` (longest matching root). */
+function nearestPackage(absoluteFile, packagesByRootLengthDesc) {
+    const fileDir = node_path_1.default.dirname(absoluteFile);
+    for (const pkg of packagesByRootLengthDesc) {
+        const relative = node_path_1.default.relative(pkg.root, fileDir);
+        if (relative === '' || (!relative.startsWith('..') && !node_path_1.default.isAbsolute(relative))) {
+            return pkg;
+        }
+    }
+    return packagesByRootLengthDesc[packagesByRootLengthDesc.length - 1];
+}
 function runDependencyRules(context) {
     const findings = [];
-    const { moduleGraph, packageJson, projectRoot } = context;
-    const packageJsonText = (0, discovery_1.readFileSafe)(node_path_1.default.join(projectRoot, 'package.json'));
-    const usedPackageNames = new Set();
-    for (const [, imports] of moduleGraph.importsByFile) {
+    const { moduleGraph, projectRoot } = context;
+    const packages = discoverWorkspacePackages(context);
+    const isWorkspace = packages.length > 1;
+    const root = packages.reduce((longestRootPkg, pkg) => (pkg.root.length < longestRootPkg.root.length ? pkg : longestRootPkg));
+    // Usage grouped by the nearest package.json, plus a project-wide union: a dependency hoisted to
+    // the workspace root can legitimately be used by any member package without being redeclared there.
+    const usedByPackageRoot = new Map();
+    const usedAnywhere = new Set();
+    for (const [file, imports] of moduleGraph.importsByFile) {
+        const pkg = nearestPackage(file, packages);
         for (const importInfo of imports) {
-            if (!importInfo.isRelative && !importInfo.resolved) {
-                usedPackageNames.add(packageNameFromSpecifier(importInfo.specifier));
-            }
+            if (importInfo.isRelative || importInfo.resolved)
+                continue;
+            const name = packageNameFromSpecifier(importInfo.specifier);
+            usedAnywhere.add(name);
+            if (!usedByPackageRoot.has(pkg.root))
+                usedByPackageRoot.set(pkg.root, new Set());
+            usedByPackageRoot.get(pkg.root).add(name);
         }
     }
-    const scripts = packageJson?.scripts ?? {};
-    const scriptText = Object.values(scripts).join(' ');
-    const declaredDependencies = getDeclaredDependencyNames(packageJson);
     if ((0, config_1.isRuleEnabled)(context.config, 'DEP001')) {
-        for (const dependencyName of declaredDependencies) {
-            if (usedPackageNames.has(dependencyName))
-                continue;
-            // @types/* packages provide ambient global declarations (process, Buffer, JSX, ...)
-            // that are never referenced through an import specifier, so they are exempt by design.
-            if (dependencyName.startsWith('@types/'))
-                continue;
-            const wordBoundary = new RegExp(`(^|[^A-Za-z0-9_@/.-])${dependencyName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}([^A-Za-z0-9_@/.-]|$)`);
-            if (wordBoundary.test(scriptText))
-                continue;
-            findings.push((0, finding_1.buildFinding)({
-                ruleId: 'DEP001',
-                category: 'dependencies',
-                severity: 'MEDIUM',
-                confidence: 'CERTAIN',
-                file: 'package.json',
-                line: findDependencyLine(packageJsonText, dependencyName),
-                column: 1,
-                message: `Unused dependency: ${dependencyName}`,
-                description: `"${dependencyName}" is declared but not referenced by source files, require/import calls, or package.json scripts.`,
-                evidence: dependencyName,
-                suggestion: 'Remove the unused dependency or confirm it is required by a toolchain entry point.',
-                fixAvailable: true
-            }));
+        for (const pkg of packages) {
+            // The root's dependencies may be consumed by any workspace member; a nested package's
+            // own dependencies are expected to be used within that package.
+            const used = pkg === root ? usedAnywhere : (usedByPackageRoot.get(pkg.root) ?? new Set());
+            const scriptText = isWorkspace && pkg !== root ? `${pkg.scriptText} ${root.scriptText}` : pkg.scriptText;
+            for (const dependencyName of pkg.declared) {
+                if (used.has(dependencyName))
+                    continue;
+                // @types/* packages provide ambient global declarations (process, Buffer, JSX, ...)
+                // that are never referenced through an import specifier, so they are exempt by design.
+                if (dependencyName.startsWith('@types/'))
+                    continue;
+                const wordBoundary = new RegExp(`(^|[^A-Za-z0-9_@/.-])${dependencyName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}([^A-Za-z0-9_@/.-]|$)`);
+                if (wordBoundary.test(scriptText))
+                    continue;
+                findings.push((0, finding_1.buildFinding)({
+                    ruleId: 'DEP001',
+                    category: 'dependencies',
+                    severity: 'MEDIUM',
+                    confidence: 'CERTAIN',
+                    file: pkg.relativePath,
+                    line: findDependencyLine(pkg.text, dependencyName),
+                    column: 1,
+                    message: `Unused dependency: ${dependencyName}`,
+                    description: `"${dependencyName}" is declared in ${pkg.relativePath} but not referenced by source files, require/import calls, or package.json scripts.`,
+                    evidence: dependencyName,
+                    suggestion: 'Remove the unused dependency or confirm it is required by a toolchain entry point.',
+                    fixAvailable: true
+                }));
+            }
         }
     }
     if ((0, config_1.isRuleEnabled)(context.config, 'DEP002')) {
-        for (const usedName of usedPackageNames) {
-            if (BUILTIN_MODULES.has(usedName))
-                continue;
-            if (declaredDependencies.has(usedName))
-                continue;
-            findings.push((0, finding_1.buildFinding)({
-                ruleId: 'DEP002',
-                category: 'dependencies',
-                severity: 'HIGH',
-                confidence: 'HIGH',
-                file: 'package.json',
-                line: 1,
-                column: 1,
-                message: `Unlisted dependency: ${usedName}`,
-                description: `"${usedName}" is imported from source but is not declared in package.json.`,
-                evidence: usedName,
-                suggestion: 'Add the package to package.json dependencies, or remove the import if it was unintentional.',
-                fixAvailable: false
-            }));
+        const reported = new Set();
+        for (const [file, imports] of moduleGraph.importsByFile) {
+            const pkg = nearestPackage(file, packages);
+            // Tolerate hoisting: a nested package may use a dependency declared only at the workspace root.
+            const declared = pkg === root ? pkg.declared : new Set([...pkg.declared, ...root.declared]);
+            for (const importInfo of imports) {
+                if (importInfo.isRelative || importInfo.resolved)
+                    continue;
+                const usedName = packageNameFromSpecifier(importInfo.specifier);
+                if (BUILTIN_MODULES.has(usedName) || declared.has(usedName))
+                    continue;
+                const key = `${pkg.root}::${usedName}`;
+                if (reported.has(key))
+                    continue;
+                reported.add(key);
+                findings.push((0, finding_1.buildFinding)({
+                    ruleId: 'DEP002',
+                    category: 'dependencies',
+                    severity: 'HIGH',
+                    confidence: 'HIGH',
+                    file: pkg.relativePath,
+                    line: 1,
+                    column: 1,
+                    message: `Unlisted dependency: ${usedName}`,
+                    description: `"${usedName}" is imported from source under ${node_path_1.default.relative(projectRoot, pkg.root).replace(/\\/g, '/') || '.'} but is not declared in ${pkg.relativePath}${isWorkspace ? ' or the workspace root' : ''}.`,
+                    evidence: usedName,
+                    suggestion: 'Add the package to the appropriate package.json dependencies, or remove the import if it was unintentional.',
+                    fixAvailable: false
+                }));
+            }
         }
     }
     if ((0, config_1.isRuleEnabled)(context.config, 'DEP003')) {