feat: pipelineCheck.severityThreshold filters editor diagnostics

A new enum setting (low | medium | high | critical, default "low")
that mirrors the CLI's --severity-threshold. Drives a client-side
handleDiagnostics middleware that drops diagnostics below the
configured threshold before they reach VS Code's Problems panel.

Reads Diagnostic.data["severity"] which the v1.0.6 server emits, so
CRITICAL and HIGH are distinguished even though the LSP severity
enum collapses both to Error. Diagnostics without the data.severity
metadata (older server, or a non-pipeline-check publish) pass
through unconditionally so the filter never hides legitimate signal
when the metadata is absent. The config is re-read on each publish,
so a settings change takes effect on the next scan with no restart.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dmartinochoa

CHANGELOG.md

@@ -9,6 +9,21 @@ versions follow [SemVer](https://semver.org/).
 PRs landing on `main` between releases append entries here. The release
 commit collapses this section into `## [X.Y.Z] — <date>`.
 
+### Added
+
+- **`pipelineCheck.severityThreshold` setting.** A new enum knob
+  (`low` / `medium` / `high` / `critical`, default `low`) that mirrors
+  the CLI's `--severity-threshold`. Drives a client-side
+  `handleDiagnostics` middleware that filters out diagnostics whose
+  upstream pipeline-check severity falls below the threshold before
+  they reach the gutter or Problems panel, so the editor surface can
+  be tuned independently of the CLI's report. The filter reads
+  `Diagnostic.data["severity"]` (set by the v1.0.6 server) so it can
+  distinguish `CRITICAL` from `HIGH` (both map to LSP `Error`).
+  Diagnostics without the `data.severity` metadata pass through
+  unconditionally, so an older server (or a non-pipeline-check
+  publish) is never hidden.
+
 ### Changed
 
 - **Marketplace polish pass.** The `package.json` `description` is

README.md

@@ -58,6 +58,7 @@ pip install "pipeline-check[lsp]"
 |---|---|---|
 | `pipelineCheck.serverCommand` | `python` | Command used to launch the language server. Override if `pipeline_check` is installed under a different interpreter. |
 | `pipelineCheck.serverArgs` | `["-m", "pipeline_check.lsp"]` | Arguments passed to the server command. |
+| `pipelineCheck.severityThreshold` | `low` | Lowest severity that produces a diagnostic. One of `low`, `medium`, `high`, `critical`. Mirrors the CLI's `--severity-threshold`. |
 | `pipelineCheck.trace.server` | `off` | Traces LSP traffic. Set to `verbose` when debugging. |
 
 ## Development

package.json

@@ -78,6 +78,17 @@
           ],
           "markdownDescription": "Arguments passed to the server command. Default invokes the module via `python -m pipeline_check.lsp`."
         },
+        "pipelineCheck.severityThreshold": {
+          "type": "string",
+          "enum": [
+            "low",
+            "medium",
+            "high",
+            "critical"
+          ],
+          "default": "low",
+          "markdownDescription": "Lowest severity that produces a diagnostic. Findings below this level are dropped on the client side so the gutter / Problems panel only carries the cuts you care about. Mirrors the CLI's `--severity-threshold`. Default `low` matches CLI behavior; set to `high` or `critical` for a quieter editor."
+        },
         "pipelineCheck.trace.server": {
           "type": "string",
           "enum": [

src/extension.ts

@@ -23,6 +23,28 @@ const LANGUAGE_ID = "pipelineCheck";
 const LANGUAGE_NAME = "Pipeline-Check";
 const OUTPUT_CHANNEL = "Pipeline-Check";
 
+// Upstream severity ranks. Higher = more severe. The server stuffs the
+// pipeline-check severity name into Diagnostic.data["severity"] (e.g.
+// "CRITICAL"). The LSP DiagnosticSeverity enum collapses CRITICAL + HIGH
+// into a single Error value, so we can't filter precisely on
+// vscode.Diagnostic.severity alone.
+const SEVERITY_RANK: Record<string, number> = {
+  INFO: 0,
+  LOW: 1,
+  MEDIUM: 2,
+  HIGH: 3,
+  CRITICAL: 4,
+};
+
+// Threshold knob values. Map each to the rank a diagnostic must
+// reach to survive the filter.
+const THRESHOLD_RANK: Record<string, number> = {
+  low: SEVERITY_RANK.LOW,
+  medium: SEVERITY_RANK.MEDIUM,
+  high: SEVERITY_RANK.HIGH,
+  critical: SEVERITY_RANK.CRITICAL,
+};
+
 let client: LanguageClient | undefined;
 
 function buildClient(): LanguageClient {
@@ -51,6 +73,34 @@ function buildClient(): LanguageClient {
       configurationSection: "pipelineCheck",
     },
     outputChannelName: OUTPUT_CHANNEL,
+    middleware: {
+      // Drop diagnostics below the user-configured severity threshold
+      // before they reach VS Code's Problems panel. The config is
+      // re-read on each publish so a settings change takes effect on
+      // the next scan without needing a server restart. Diagnostics
+      // whose `data.severity` is missing (older server, or a
+      // not-from-pipeline-check publish that somehow flowed through)
+      // pass through unconditionally so the filter never hides
+      // legitimate signal when the metadata is absent.
+      handleDiagnostics: (uri, diagnostics, next) => {
+        const threshold = vscode.workspace
+          .getConfiguration("pipelineCheck")
+          .get<string>("severityThreshold", "low");
+        const minRank = THRESHOLD_RANK[threshold] ?? SEVERITY_RANK.LOW;
+        const filtered = diagnostics.filter((diag) => {
+          const data = (diag as vscode.Diagnostic & {
+            data?: { severity?: string };
+          }).data;
+          const name = data?.severity;
+          if (!name) {
+            return true;
+          }
+          const rank = SEVERITY_RANK[name];
+          return rank === undefined || rank >= minRank;
+        });
+        next(uri, filtered);
+      },
+    },
   };
 
   return new LanguageClient(