fix: normalize confidence case across config filtering and semantic output

src/config.js

@@ -172,8 +172,9 @@ export function meetsSeverityThreshold(severity, config) {
 }
 
 export function meetsConfidenceThreshold(confidence, config) {
-  const threshold = config.confidence_threshold || 'LOW';
-  const confidenceLevel = CONFIDENCE_ORDER[confidence] ?? 0;
+  const threshold = String(config.confidence_threshold || 'LOW').toUpperCase();
+  const normalizedConfidence = String(confidence || 'LOW').toUpperCase();
+  const confidenceLevel = CONFIDENCE_ORDER[normalizedConfidence] ?? 0;
   const thresholdLevel = CONFIDENCE_ORDER[threshold] ?? 0;
   return confidenceLevel >= thresholdLevel;
 }

src/semantic-integration.js

@@ -46,7 +46,7 @@ export async function runSemanticAnalysis(filePath, options = {}) {
       column: 0,
       length: 0,
       severity: mapSeverity(f.severity),
-      confidence: f.confidence || 'medium',
+      confidence: (f.confidence ? String(f.confidence) : 'MEDIUM').toUpperCase(),
       metadata: {
         category: f.category,
         engine: 'semantic',

tests/config.test.js

@@ -138,6 +138,17 @@ describe('meetsConfidenceThreshold', () => {
   it('should pass MEDIUM when threshold is MEDIUM', () => {
     expect(meetsConfidenceThreshold('MEDIUM', { confidence_threshold: 'MEDIUM' })).toBe(true);
   });
+
+  it('should treat lowercase confidence as valid values', () => {
+    expect(meetsConfidenceThreshold('medium', { confidence_threshold: 'MEDIUM' })).toBe(true);
+    expect(meetsConfidenceThreshold('high', { confidence_threshold: 'MEDIUM' })).toBe(true);
+    expect(meetsConfidenceThreshold('low', { confidence_threshold: 'MEDIUM' })).toBe(false);
+  });
+
+  it('should treat lowercase threshold as valid', () => {
+    expect(meetsConfidenceThreshold('MEDIUM', { confidence_threshold: 'medium' })).toBe(true);
+    expect(meetsConfidenceThreshold('LOW', { confidence_threshold: 'medium' })).toBe(false);
+  });
 });
 
 describe('applyConfig', () => {
@@ -174,6 +185,17 @@ describe('applyConfig', () => {
     expect(result[0].ruleId).toBe('sql-injection');
   });
 
+  it('should preserve semantic findings with lowercase confidence when threshold is MEDIUM', () => {
+    const config = { suppress: [], severity_threshold: 'info', confidence_threshold: 'MEDIUM' };
+    const findings = [
+      { ruleId: 'semantic-rule', severity: 'warning', confidence: 'medium' },
+      { ruleId: 'low-confidence', severity: 'warning', confidence: 'low' },
+    ];
+    const result = applyConfig(findings, 'test.js', config);
+    expect(result).toHaveLength(1);
+    expect(result[0].ruleId).toBe('semantic-rule');
+  });
+
   it('should handle null config', () => {
     const findings = [{ ruleId: 'test', severity: 'warning', confidence: 'MEDIUM' }];
     expect(applyConfig(findings, 'test.js', null)).toEqual(findings);