secure-review-extension 1.0.0

package/src/scanners/tool-integrations.js

@@ -0,0 +1,666 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const { execFile } = require("node:child_process");
+const { hashFinding } = require("../utils");
+
+function createScannerRegistry(config, workspaceProfile) {
+  return [
+    {
+      id: "semgrep",
+      enabled: config.get("enableSemgrep", true),
+      applies: () => workspaceProfile.languages.length > 0,
+      run: () => runSemgrep(workspaceProfile)
+    },
+    {
+      id: "eslint",
+      enabled: config.get("enableEslint", true),
+      applies: () => hasLanguage(workspaceProfile, ["javascript", "typescript"]) || hasFramework(workspaceProfile, ["react", "nextjs", "vue", "angular", "svelte"]),
+      run: () => runEslint(workspaceProfile)
+    },
+    {
+      id: "npm-audit",
+      enabled: config.get("enableNpmAudit", true),
+      applies: () => workspaceProfile.manifests["package.json"],
+      run: () => runNpmAudit(workspaceProfile)
+    },
+    {
+      id: "bandit",
+      enabled: config.get("enableBandit", true),
+      applies: () => hasLanguage(workspaceProfile, ["python"]),
+      run: () => runBandit(workspaceProfile)
+    },
+    {
+      id: "pip-audit",
+      enabled: config.get("enablePipAudit", true),
+      applies: () => workspaceProfile.manifests["requirements.txt"] || workspaceProfile.manifests["pyproject.toml"] || workspaceProfile.manifests["Pipfile"],
+      run: () => runPipAudit(workspaceProfile)
+    },
+    {
+      id: "spotbugs",
+      enabled: config.get("enableSpotBugs", true),
+      applies: () => hasLanguage(workspaceProfile, ["java"]),
+      run: () => runSpotBugs(workspaceProfile)
+    },
+    {
+      id: "gosec",
+      enabled: config.get("enableGosec", true),
+      applies: () => hasLanguage(workspaceProfile, ["go"]),
+      run: () => runGosec(workspaceProfile)
+    },
+    {
+      id: "govulncheck",
+      enabled: config.get("enableGovulncheck", true),
+      applies: () => hasLanguage(workspaceProfile, ["go"]),
+      run: () => runGovulncheck(workspaceProfile)
+    },
+    {
+      id: "cargo-audit",
+      enabled: config.get("enableCargoAudit", true),
+      applies: () => hasLanguage(workspaceProfile, ["rust"]),
+      run: () => runCargoAudit(workspaceProfile)
+    },
+    {
+      id: "clippy",
+      enabled: config.get("enableClippy", true),
+      applies: () => hasLanguage(workspaceProfile, ["rust"]),
+      run: () => runClippy(workspaceProfile)
+    },
+    {
+      id: "cppcheck",
+      enabled: config.get("enableCppcheck", true),
+      applies: () => hasLanguage(workspaceProfile, ["c", "cpp"]),
+      run: () => runCppcheck(workspaceProfile)
+    }
+  ];
+}
+
+async function runRegisteredScanners(config, workspaceProfile) {
+  if (!workspaceProfile.workspaceRoot) {
+    return [];
+  }
+
+  const findings = [];
+  const registry = createScannerRegistry(config, workspaceProfile);
+
+  for (const scanner of registry) {
+    if (!scanner.enabled || !scanner.applies()) {
+      continue;
+    }
+
+    findings.push(...await safeRun(scanner.run));
+  }
+
+  return findings;
+}
+
+function safeRun(run) {
+  return run().catch(() => []);
+}
+
+function execFileAsync(command, args, options = {}) {
+  return new Promise((resolve) => {
+    execFile(command, args, { maxBuffer: 25 * 1024 * 1024, ...options }, (error, stdout, stderr) => {
+      resolve({
+        error,
+        stdout,
+        stderr,
+        code: typeof error?.code === "number" ? error.code : 0
+      });
+    });
+  });
+}
+
+function hasLanguage(workspaceProfile, languages) {
+  return languages.some((language) => workspaceProfile.languages.includes(language));
+}
+
+function hasFramework(workspaceProfile, frameworks) {
+  return frameworks.some((framework) => workspaceProfile.frameworks.includes(framework));
+}
+
+async function runSemgrep(workspaceProfile) {
+  const result = await execFileAsync("semgrep", ["scan", "--config", "auto", "--json", workspaceProfile.workspaceRoot], {
+    cwd: workspaceProfile.workspaceRoot
+  });
+
+  if (result.error) {
+    return [];
+  }
+
+  const payload = parseJson(result.stdout);
+  return (payload.results || []).map((item) => normalizeStaticFinding({
+    workspaceRoot: workspaceProfile.workspaceRoot,
+    tool: "semgrep",
+    title: item.extra?.message || item.check_id || "Semgrep finding",
+    severity: mapSeverity(item.extra?.severity),
+    confidence: "high",
+    category: "Security",
+    subcategory: "Semgrep",
+    reviewDomain: "security",
+    relativePath: item.path || "",
+    line: item.start?.line || 1,
+    column: item.start?.col || 1,
+    code: item.check_id || "semgrep",
+    message: item.extra?.message || "Semgrep finding",
+    evidence: item.extra?.lines || "",
+    remediation: "Review the flagged code path and apply the guidance behind the triggered Semgrep rule.",
+    suggestion: "Validate exploitability, then remediate the underlying pattern and add regression coverage if needed.",
+    whyItMatters: "Semgrep detected a code pattern associated with known security or correctness risks.",
+    standards: ensureArray(item.extra?.metadata?.cwe || item.extra?.metadata?.owasp || ["Semgrep"])
+  }));
+}
+
+async function runEslint(workspaceProfile) {
+  const result = await execFileAsync("eslint", ["-f", "json", "."], {
+    cwd: workspaceProfile.workspaceRoot
+  });
+
+  if (result.error && !result.stdout) {
+    return [];
+  }
+
+  const payload = parseJson(result.stdout);
+  if (!Array.isArray(payload)) {
+    return [];
+  }
+
+  return payload.flatMap((file) => (file.messages || []).map((message) => {
+    const ruleId = message.ruleId || "eslint";
+    const lowerRule = ruleId.toLowerCase();
+    const reviewDomain = /(security|xss|no-eval|detect|react|jsx-a11y)/.test(lowerRule)
+      ? "security"
+      : /(complexity|maintainability|style)/.test(lowerRule)
+        ? "maintainability"
+        : "code-quality";
+
+    return normalizeStaticFinding({
+      workspaceRoot: workspaceProfile.workspaceRoot,
+      tool: "eslint",
+      title: message.message || "ESLint finding",
+      severity: mapEslintSeverity(message.severity, lowerRule),
+      confidence: "medium",
+      category: reviewDomain === "security" ? "Security" : reviewDomain === "maintainability" ? "Maintainability" : "Code Quality",
+      subcategory: hasFramework(workspaceProfile, ["react", "nextjs"]) ? "ESLint / Frontend" : "ESLint",
+      reviewDomain,
+      relativePath: relativize(workspaceProfile.workspaceRoot, file.filePath),
+      line: message.line || 1,
+      column: message.column || 1,
+      code: ruleId,
+      message: message.message || "ESLint finding",
+      evidence: message.source || "",
+      remediation: "Update the flagged code so it complies with the rule and project standards.",
+      suggestion: "Use the ESLint rule details to align the implementation with safer and more maintainable patterns.",
+      whyItMatters: "Lint findings often point to correctness, maintainability, accessibility, or security issues before they become defects.",
+      standards: ["ESLint"]
+    });
+  }));
+}
+
+async function runNpmAudit(workspaceProfile) {
+  if (!fs.existsSync(path.join(workspaceProfile.workspaceRoot, "package.json"))) {
+    return [];
+  }
+
+  const result = await execFileAsync("npm", ["audit", "--json"], { cwd: workspaceProfile.workspaceRoot });
+  const payload = parseJson(result.stdout || result.stderr);
+  const vulnerabilities = payload.vulnerabilities || {};
+
+  return Object.entries(vulnerabilities).map(([name, vulnerability]) => normalizeStaticFinding({
+    workspaceRoot: workspaceProfile.workspaceRoot,
+    tool: "npm-audit",
+    title: `Vulnerable dependency: ${name}`,
+    severity: mapSeverity(vulnerability.severity),
+    confidence: "high",
+    category: "Dependency Risk",
+    subcategory: "npm audit",
+    reviewDomain: "dependency-risk",
+    relativePath: "package.json",
+    line: 1,
+    column: 1,
+    code: "npm-audit",
+    message: vulnerability.title || `npm audit reported a vulnerability in ${name}.`,
+    evidence: `${name} via ${Array.isArray(vulnerability.via) ? vulnerability.via.join(", ") : vulnerability.via || "transitive path unknown"}`,
+    remediation: vulnerability.fixAvailable ? "Apply the recommended package update or remediation path." : "Review the dependency manually and upgrade or replace it with a patched alternative.",
+    suggestion: "Pin to a safe version and re-run dependency review after remediation.",
+    whyItMatters: "Known vulnerable dependencies can expose exploitable flaws even when application code looks safe.",
+    standards: ["Dependency Audit"]
+  }));
+}
+
+async function runBandit(workspaceProfile) {
+  const result = await execFileAsync("bandit", ["-r", ".", "-f", "json"], {
+    cwd: workspaceProfile.workspaceRoot
+  });
+
+  if (result.error && !result.stdout) {
+    return [];
+  }
+
+  const payload = parseJson(result.stdout);
+  return (payload.results || []).map((item) => normalizeStaticFinding({
+    workspaceRoot: workspaceProfile.workspaceRoot,
+    tool: "bandit",
+    title: item.test_name || item.issue_text || "Bandit finding",
+    severity: mapSeverity(item.issue_severity),
+    confidence: mapSeverity(item.issue_confidence),
+    category: "Security",
+    subcategory: "Bandit",
+    reviewDomain: "security",
+    relativePath: relativize(workspaceProfile.workspaceRoot, item.filename),
+    line: item.line_number || 1,
+    column: 1,
+    code: item.test_id || "bandit",
+    message: item.issue_text || item.test_name || "Bandit finding",
+    evidence: item.code || "",
+    remediation: "Review the Python code path and replace the unsafe pattern with a safer equivalent.",
+    suggestion: "Use the Bandit test guidance to harden the implementation and add regression tests where appropriate.",
+    whyItMatters: "Bandit identified a Python pattern commonly associated with exploitable security issues.",
+    standards: ensureArray(item.more_info ? [item.more_info] : ["Bandit"])
+  }));
+}
+
+async function runPipAudit(workspaceProfile) {
+  const result = await execFileAsync("pip-audit", ["-f", "json"], {
+    cwd: workspaceProfile.workspaceRoot
+  });
+
+  if (result.error && !result.stdout) {
+    return [];
+  }
+
+  const payload = parseJson(result.stdout);
+  return (payload.dependencies || []).flatMap((dependency) => (dependency.vulns || []).map((vulnerability) => normalizeStaticFinding({
+    workspaceRoot: workspaceProfile.workspaceRoot,
+    tool: "pip-audit",
+    title: `Vulnerable Python dependency: ${dependency.name}`,
+    severity: "high",
+    confidence: "high",
+    category: "Dependency Risk",
+    subcategory: "pip-audit",
+    reviewDomain: "dependency-risk",
+    relativePath: "requirements.txt",
+    line: 1,
+    column: 1,
+    code: "pip-audit",
+    message: vulnerability.description || vulnerability.id || "pip-audit finding",
+    evidence: `${dependency.name} ${dependency.version || ""}`.trim(),
+    remediation: "Upgrade the affected package to a patched version and retest the environment.",
+    suggestion: "Pin Python dependencies and add routine vulnerability review to dependency management workflows.",
+    whyItMatters: "Known vulnerable Python packages can introduce exploitable behavior through direct or transitive use.",
+    standards: [vulnerability.id || "pip-audit"]
+  })));
+}
+
+async function runSpotBugs(workspaceProfile) {
+  const targetPath = findExistingPath(workspaceProfile.workspaceRoot, [
+    "target/classes",
+    "build/classes/java/main",
+    "build/classes",
+    "out/production"
+  ]);
+
+  if (!targetPath) {
+    return [];
+  }
+
+  const result = await execFileAsync("spotbugs", ["-textui", "-xml:withMessages", targetPath], {
+    cwd: workspaceProfile.workspaceRoot
+  });
+
+  if (result.error && !result.stdout) {
+    return [];
+  }
+
+  const xml = result.stdout || "";
+  const bugBlocks = [...xml.matchAll(/<BugInstance[\s\S]*?<\/BugInstance>/g)];
+
+  return bugBlocks.map((match) => {
+    const block = match[0];
+    const sourcePath = capture(block, /sourcepath="([^"]+)"/);
+    const message = capture(block, /<ShortMessage>([\s\S]*?)<\/ShortMessage>/) || "SpotBugs finding";
+    const longMessage = capture(block, /<LongMessage>([\s\S]*?)<\/LongMessage>/) || message;
+    const type = capture(block, /type="([^"]+)"/) || "spotbugs";
+    const priority = capture(block, /priority="([^"]+)"/);
+    const line = Number(capture(block, /start="(\d+)"/) || 1);
+
+    return normalizeStaticFinding({
+      workspaceRoot: workspaceProfile.workspaceRoot,
+      tool: "spotbugs",
+      title: message,
+      severity: mapSpotbugsPriority(priority),
+      confidence: "medium",
+      category: "Security",
+      subcategory: "SpotBugs",
+      reviewDomain: "security",
+      relativePath: sourcePath || "Java bytecode analysis",
+      line,
+      column: 1,
+      code: type,
+      message: longMessage,
+      evidence: longMessage,
+      remediation: "Inspect the affected Java class and address the unsafe pattern identified by SpotBugs.",
+      suggestion: "Use this bytecode-level finding to verify whether the issue is real in the compiled code path.",
+      whyItMatters: "SpotBugs detected a pattern in compiled Java classes that may not be obvious from simple text inspection.",
+      standards: ["SpotBugs"]
+    });
+  });
+}
+
+async function runGosec(workspaceProfile) {
+  const result = await execFileAsync("gosec", ["-fmt=json", "./..."], {
+    cwd: workspaceProfile.workspaceRoot
+  });
+
+  if (result.error && !result.stdout) {
+    return [];
+  }
+
+  const payload = parseJson(result.stdout);
+  return (payload.Issues || []).map((item) => normalizeStaticFinding({
+    workspaceRoot: workspaceProfile.workspaceRoot,
+    tool: "gosec",
+    title: item.rule_id || item.details || "gosec finding",
+    severity: mapSeverity(item.severity),
+    confidence: mapSeverity(item.confidence),
+    category: "Security",
+    subcategory: "gosec",
+    reviewDomain: "security",
+    relativePath: relativize(workspaceProfile.workspaceRoot, item.file),
+    line: item.line || 1,
+    column: item.column || 1,
+    code: item.rule_id || "gosec",
+    message: item.details || item.rule_id || "gosec finding",
+    evidence: item.code || "",
+    remediation: "Refactor the Go code path to remove the unsafe pattern identified by gosec.",
+    suggestion: "Validate the issue in context, then harden the implementation and add tests where feasible.",
+    whyItMatters: "gosec identified a Go security pattern that commonly leads to exploitable vulnerabilities.",
+    standards: ["gosec"]
+  }));
+}
+
+async function runGovulncheck(workspaceProfile) {
+  const result = await execFileAsync("govulncheck", ["-json", "./..."], {
+    cwd: workspaceProfile.workspaceRoot
+  });
+
+  if (result.error && !result.stdout && !result.stderr) {
+    return [];
+  }
+
+  const lines = `${result.stdout}\n${result.stderr}`.split(/\r?\n/).filter(Boolean);
+  const findings = [];
+
+  for (const line of lines) {
+    const entry = parseJson(line);
+    const vulnerability = entry?.finding || entry?.vulnerability;
+    if (!vulnerability) {
+      continue;
+    }
+
+    const osv = vulnerability.osv || vulnerability;
+    const id = osv.id || vulnerability.osv || "govulncheck";
+    const summary = osv.summary || vulnerability.trace?.[0]?.module || "Go vulnerability finding";
+    findings.push(normalizeStaticFinding({
+      workspaceRoot: workspaceProfile.workspaceRoot,
+      tool: "govulncheck",
+      title: `Go vulnerability: ${id}`,
+      severity: "high",
+      confidence: "high",
+      category: "Dependency Risk",
+      subcategory: "govulncheck",
+      reviewDomain: "dependency-risk",
+      relativePath: "go.mod",
+      line: 1,
+      column: 1,
+      code: "govulncheck",
+      message: summary,
+      evidence: id,
+      remediation: "Upgrade the affected module to a non-vulnerable version and validate transitive exposure.",
+      suggestion: "Use the vulnerability identifier to review impacted call paths and prioritize patching.",
+      whyItMatters: "Known vulnerable Go modules can be exploitable depending on how the affected packages are used.",
+      standards: [id]
+    }));
+  }
+
+  return findings;
+}
+
+async function runCargoAudit(workspaceProfile) {
+  const result = await execFileAsync("cargo", ["audit", "--json"], {
+    cwd: workspaceProfile.workspaceRoot
+  });
+
+  if (result.error && !result.stdout) {
+    return [];
+  }
+
+  const payload = parseJson(result.stdout);
+  const advisories = payload.vulnerabilities?.list || [];
+
+  return advisories.map((item) => normalizeStaticFinding({
+    workspaceRoot: workspaceProfile.workspaceRoot,
+    tool: "cargo-audit",
+    title: `Rust advisory: ${item.advisory?.id || item.package?.name || "cargo-audit"}`,
+    severity: "high",
+    confidence: "high",
+    category: "Dependency Risk",
+    subcategory: "cargo audit",
+    reviewDomain: "dependency-risk",
+    relativePath: "Cargo.lock",
+    line: 1,
+    column: 1,
+    code: "cargo-audit",
+    message: item.advisory?.title || item.advisory?.description || "cargo-audit finding",
+    evidence: `${item.package?.name || "package"} ${item.package?.version || ""}`.trim(),
+    remediation: "Update the affected Rust crate to a patched version and re-run dependency review.",
+    suggestion: "Review the advisory details, impacted crate versions, and lockfile drift before release.",
+    whyItMatters: "Known vulnerable Rust crates can undermine otherwise memory-safe application code.",
+    standards: ensureArray(item.advisory?.id ? [item.advisory.id] : ["cargo-audit"])
+  }));
+}
+
+async function runClippy(workspaceProfile) {
+  const result = await execFileAsync("cargo", ["clippy", "--message-format=json", "--all-targets", "--all-features"], {
+    cwd: workspaceProfile.workspaceRoot
+  });
+
+  if (result.error && !result.stdout && !result.stderr) {
+    return [];
+  }
+
+  const lines = `${result.stdout}\n${result.stderr}`.split(/\r?\n/).filter(Boolean);
+  const findings = [];
+
+  for (const line of lines) {
+    const entry = parseJson(line);
+    if (entry.reason !== "compiler-message" || !entry.message) {
+      continue;
+    }
+
+    const level = entry.message.level || "warning";
+    if (level !== "warning" && level !== "error") {
+      continue;
+    }
+
+    const span = entry.message.spans?.find((item) => item.is_primary) || entry.message.spans?.[0];
+    findings.push(normalizeStaticFinding({
+      workspaceRoot: workspaceProfile.workspaceRoot,
+      tool: "clippy",
+      title: entry.message.code?.code || entry.message.message || "clippy finding",
+      severity: level === "error" ? "high" : "medium",
+      confidence: "medium",
+      category: "Code Quality",
+      subcategory: "clippy",
+      reviewDomain: "code-quality",
+      relativePath: span?.file_name || "Rust workspace",
+      line: span?.line_start || 1,
+      column: span?.column_start || 1,
+      code: entry.message.code?.code || "clippy",
+      message: entry.message.message || "clippy finding",
+      evidence: span?.text?.map((item) => item.text).join(" ") || "",
+      remediation: "Refactor the Rust code path according to the clippy guidance and project conventions.",
+      suggestion: "Treat clippy warnings in critical modules as opportunities to reduce correctness and maintainability risk.",
+      whyItMatters: "Rust lints can expose subtle correctness and maintainability issues before they turn into bugs.",
+      standards: ["clippy"]
+    }));
+  }
+
+  return findings;
+}
+
+async function runCppcheck(workspaceProfile) {
+  const result = await execFileAsync("cppcheck", ["--xml", "--xml-version=2", "--enable=warning,style,performance,portability,information,unusedFunction", "."], {
+    cwd: workspaceProfile.workspaceRoot
+  });
+
+  const xml = result.stderr || result.stdout;
+  if (!xml) {
+    return [];
+  }
+
+  const errors = [...xml.matchAll(/<error\b([^>]*)>([\s\S]*?)<\/error>/g)];
+  return errors.map((match) => {
+    const attrs = match[1];
+    const block = match[2];
+    const filePath = capture(block, /<location[^>]*file="([^"]+)"/);
+    const line = Number(capture(block, /<location[^>]*line="([^"]+)"/) || 1);
+    const column = Number(capture(block, /<location[^>]*column="([^"]+)"/) || 1);
+    const id = capture(attrs, /id="([^"]+)"/) || "cppcheck";
+    const severity = capture(attrs, /severity="([^"]+)"/) || "warning";
+    const message = capture(attrs, /msg="([^"]+)"/) || capture(attrs, /verbose="([^"]+)"/) || "cppcheck finding";
+
+    return normalizeStaticFinding({
+      workspaceRoot: workspaceProfile.workspaceRoot,
+      tool: "cppcheck",
+      title: message,
+      severity: mapCppcheckSeverity(severity),
+      confidence: "medium",
+      category: "Code Quality",
+      subcategory: "cppcheck",
+      reviewDomain: /(performance)/i.test(severity) ? "performance" : "code-quality",
+      relativePath: relativize(workspaceProfile.workspaceRoot, filePath || ""),
+      line,
+      column,
+      code: id,
+      message,
+      evidence: message,
+      remediation: "Refactor the affected C/C++ code path to address the static analysis warning.",
+      suggestion: "Validate whether the finding affects runtime safety, performance, or portability before release.",
+      whyItMatters: "C and C++ static analysis can surface memory-safety, portability, and correctness risks that are hard to catch manually.",
+      standards: ["cppcheck"]
+    });
+  });
+}
+
+function normalizeStaticFinding(input) {
+  const relativePath = input.relativePath || "";
+  const absolutePath = input.filePath
+    || (relativePath ? path.join(input.workspaceRoot, relativePath) : input.workspaceRoot);
+  const normalizedPath = relativePath.split(path.sep).join("/");
+
+  return {
+    id: hashFinding([input.tool, normalizedPath, String(input.line || 1), input.code || input.title]),
+    source: "static",
+    title: input.title,
+    severity: input.severity,
+    confidence: input.confidence || "medium",
+    category: input.category || "Security",
+    subcategory: input.subcategory || input.tool,
+    reviewDomain: input.reviewDomain || "security",
+    filePath: absolutePath,
+    relativePath: normalizedPath,
+    line: input.line || 1,
+    column: input.column || 1,
+    code: input.code || input.tool,
+    message: input.message || input.title,
+    evidence: input.evidence || "",
+    remediation: input.remediation || "Review and remediate the flagged issue.",
+    suggestion: input.suggestion || input.remediation || "Review and remediate the flagged issue.",
+    whyItMatters: input.whyItMatters || "This issue may increase security, correctness, reliability, or maintainability risk.",
+    standards: ensureArray(input.standards || [input.tool])
+  };
+}
+
+function parseJson(raw) {
+  try {
+    return JSON.parse(raw || "");
+  } catch {
+    return {};
+  }
+}
+
+function ensureArray(value) {
+  return Array.isArray(value) ? value : [value];
+}
+
+function relativize(workspaceRoot, candidate) {
+  if (!candidate) {
+    return "";
+  }
+  return path.isAbsolute(candidate) ? path.relative(workspaceRoot, candidate) : candidate;
+}
+
+function findExistingPath(workspaceRoot, candidates) {
+  for (const candidate of candidates) {
+    const fullPath = path.join(workspaceRoot, candidate);
+    if (fs.existsSync(fullPath)) {
+      return fullPath;
+    }
+  }
+  return null;
+}
+
+function capture(text, pattern) {
+  return text.match(pattern)?.[1] || "";
+}
+
+function mapSeverity(severity) {
+  const normalized = String(severity || "").toLowerCase();
+  if (normalized.includes("critical")) {
+    return "critical";
+  }
+  if (normalized.includes("high") || normalized === "error") {
+    return "high";
+  }
+  if (normalized.includes("moderate") || normalized.includes("medium")) {
+    return "medium";
+  }
+  return "low";
+}
+
+function mapEslintSeverity(value, ruleId) {
+  if ((ruleId || "").includes("security") || (ruleId || "").includes("xss")) {
+    return "high";
+  }
+  if (Number(value) >= 2) {
+    return "medium";
+  }
+  return "low";
+}
+
+function mapSpotbugsPriority(priority) {
+  const numeric = Number(priority || 0);
+  if (numeric === 1) {
+    return "high";
+  }
+  if (numeric === 2) {
+    return "medium";
+  }
+  return "low";
+}
+
+function mapCppcheckSeverity(value) {
+  const normalized = String(value || "").toLowerCase();
+  if (normalized.includes("error")) {
+    return "high";
+  }
+  if (normalized.includes("warning") || normalized.includes("performance")) {
+    return "medium";
+  }
+  return "low";
+}
+
+module.exports = {
+  runRegisteredScanners,
+  createScannerRegistry
+};