feat(scanner): add unchecked-return value detection plugin

packages/scanner-core/package.json

@@ -20,6 +20,7 @@
   },
   "dependencies": {
     "@veridion/logger": "workspace:*",
+    "@veridion/plugin-unchecked-return": "workspace:*",
     "@veridion/scanner-types": "workspace:*",
     "@veridion/shared": "workspace:*"
   },

packages/scanner-core/src/plugin-registry.test.ts

@@ -2,7 +2,7 @@
 import { FindingSeverity } from '@veridion/shared';
 import { beforeEach, describe, expect, it } from 'vitest';
 
-import { PluginRegistry } from './plugin-registry';
+import { BUILTIN_PLUGIN_SPECIFIERS, PluginRegistry } from './plugin-registry';
 
 function createMockPlugin(
   id: string,
@@ -84,4 +84,15 @@
     const allMeta = registry.getAllMetadata();
     expect(allMeta).toHaveLength(2);
   });
+
+  it('exposes the built-in plugin specifier catalogue', () => {
+    expect(BUILTIN_PLUGIN_SPECIFIERS['unchecked-return']).toBe('@veridion/plugin-unchecked-return');
+  });
+
+  it('registerBuiltins resolves without throwing and leaves size unchanged when the package is missing', async () => {
+    const before = registry.size;
+    const added = await registry.registerBuiltins();
+    expect(added).toEqual([]);
+    expect(registry.size).toBe(before);
+  });
 });

packages/scanner-core/src/plugin-registry.ts

@@ -1,6 +1,79 @@
 import { logger } from '@veridion/logger';
 import type { AnalysisContext, IRulePlugin, PluginMetadata } from '@veridion/scanner-types';
 
+/**
+ * Built-in plugins shipped with the scanner, keyed by plugin id.
+ *
+ * Each entry stores a module specifier instead of being a static `import`,
+ * so that `scanner-core` keeps zero compile-time knowledge of plugin
+ * implementations (see ARCHITECTURE.md: "Scanner-core has zero knowledge of
+ * individual plugins"). At runtime the module is loaded dynamically and every
+ * export that satisfies {@link IRulePlugin} is instantiated.
+ */
+export const BUILTIN_PLUGIN_SPECIFIERS: Readonly<Record<string, string>> = {
+  'unchecked-return': '@veridion/plugin-unchecked-return',
+};
+
+function isRulePlugin(value: unknown): value is IRulePlugin {
+  if (typeof value !== 'object' || value === null) return false;
+  const candidate = value as Partial<IRulePlugin>;
+  return (
+    typeof candidate.metadata?.id === 'string' &&
+    typeof candidate.initialize === 'function' &&
+    typeof candidate.analyze === 'function' &&
+    typeof candidate.getFixRecommendation === 'function' &&
+    typeof candidate.supportsContext === 'function'
+  );
+}
+
+/**
+ * Turn a single module export into a plugin instance. Plugins are shipped as
+ * a class (constructor), but an already-instantiated object is also accepted.
+ */
+function tryInstantiate(exportedValue: unknown): IRulePlugin | null {
+  if (isRulePlugin(exportedValue)) return exportedValue;
+
+  if (typeof exportedValue === 'function') {
+    try {
+      const instance: unknown = new (exportedValue as new () => unknown)();
+      if (isRulePlugin(instance)) return instance;
+    } catch {
+      // Not a constructable plugin class; ignore this export.
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Dynamically import every built-in plugin and instantiate it.
+ *
+ * A failure to resolve a module (for example because the plugin package has
+ * not been declared as a dependency of the consuming package) is logged and
+ * skipped, so this call never throws.
+ */
+export async function loadBuiltinPlugins(): Promise<IRulePlugin[]> {
+  const plugins: IRulePlugin[] = [];
+
+  for (const [pluginId, specifier] of Object.entries(BUILTIN_PLUGIN_SPECIFIERS)) {
+    try {
+      const namespace = (await import(/* webpackIgnore: true */ specifier)) as unknown;
+      const exports = Object.values(namespace as Record<string, unknown>);
+      for (const exportedValue of exports) {
+        const instance = tryInstantiate(exportedValue);
+        if (instance !== null) plugins.push(instance);
+      }
+    } catch (error) {
+      logger.warn(
+        { pluginId, specifier, err: error instanceof Error ? error.message : String(error) },
+        'Built-in plugin could not be loaded; install the matching workspace package to enable it',
+      );
+    }
+  }
+
+  return plugins;
+}
+
 export class PluginRegistry {
   private plugins = new Map<string, IRulePlugin>();
 
@@ -21,6 +94,25 @@ export class PluginRegistry {
     }
   }
 
+  /**
+   * Register every plugin returned by {@link loadBuiltinPlugins}.
+   *
+   * Newly-loaded plugins that were not previously registered are added;
+   * plugins already in the registry are left untouched (use {@link register}
+   * to overwrite).
+   */
+  async registerBuiltins(): Promise<IRulePlugin[]> {
+    const loaded = await loadBuiltinPlugins();
+    const added: IRulePlugin[] = [];
+    for (const plugin of loaded) {
+      if (!this.plugins.has(plugin.metadata.id)) {
+        this.register(plugin);
+        added.push(plugin);
+      }
+    }
+    return added;
+  }
+
   unregister(pluginId: string): boolean {
     return this.plugins.delete(pluginId);
   }

plugins/unchecked-return/.eslintrc.js

@@ -0,0 +1,4 @@
+const { createConfig } = require('@veridion/eslint-config/base');
+
+/** @type {import('eslint').Linter.Config} */
+module.exports = createConfig(__dirname);

plugins/unchecked-return/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "@veridion/plugin-unchecked-return",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Unchecked return value detection plugin for Veridion scanner (SWC-104)",
+  "main": "./src/index.ts",
+  "types": "./src/index.ts",
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src/ --max-warnings 0",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "clean": "rm -rf dist"
+  },
+  "dependencies": {
+    "@veridion/scanner-types": "workspace:*",
+    "@veridion/shared": "workspace:*",
+    "@veridion/logger": "workspace:*"
+  },
+  "devDependencies": {
+    "@veridion/eslint-config": "workspace:*",
+    "@veridion/tsconfig": "workspace:*",
+    "eslint": "^8.57.0",
+    "typescript": "^5.4.5",
+    "vitest": "^1.6.0"
+  }
+}