fix(039): threat-based risk scoring + scanner execution logs

Risk score based on threat level instead of raw CVSS severity.
Scanner stdout/stderr/exit_code stored on ScannerJobStatus.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: claude

internal/security/scanner/engine.go

@@ -196,14 +196,16 @@ func (e *Engine) executeScan(ctx context.Context, job *ScanJob, scanners []*Scan
 			callback.OnScannerStarted(job, scanner.ID)
 			e.updateScannerStatus(job, scanner.ID, ScanJobStatusRunning, time.Now(), time.Time{}, "", 0)
 
-			report, err := e.runSingleScanner(ctx, scanner, req)
+			report, scanLogs, err := e.runSingleScanner(ctx, scanner, req)
 			if err != nil {
 				e.logger.Warn("Scanner failed",
 					zap.String("scanner", scanner.ID),
 					zap.String("server", req.ServerName),
 					zap.Error(err),
 				)
 				e.updateScannerStatus(job, scanner.ID, ScanJobStatusFailed, time.Time{}, time.Now(), err.Error(), 0)
+				// Store logs even on failure
+				e.setScannerLogs(job, scanner.ID, scanLogs)
 				callback.OnScannerFailed(job, scanner.ID, err)
 				return
 			}
@@ -216,6 +218,7 @@ func (e *Engine) executeScan(ctx context.Context, job *ScanJob, scanners []*Scan
 			mu.Unlock()
 
 			e.updateScannerStatus(job, scanner.ID, ScanJobStatusCompleted, time.Time{}, time.Now(), "", len(report.Findings))
+			e.setScannerLogs(job, scanner.ID, scanLogs)
 			callback.OnScannerCompleted(job, scanner.ID, report)
 		}(i, s)
 	}
@@ -252,8 +255,8 @@ func (e *Engine) executeScan(ctx context.Context, job *ScanJob, scanners []*Scan
 	callback.OnScanCompleted(job, reports)
 }
 
-// runSingleScanner executes one scanner and returns its report
-func (e *Engine) runSingleScanner(ctx context.Context, s *ScannerPlugin, req ScanRequest) (*ScanReport, error) {
+// runSingleScanner executes one scanner and returns its report plus execution logs
+func (e *Engine) runSingleScanner(ctx context.Context, s *ScannerPlugin, req ScanRequest) (*ScanReport, scannerLogs, error) {
 	// Parse timeout
 	timeout := 120 * time.Second
 	if s.Timeout != "" {
@@ -266,7 +269,7 @@ func (e *Engine) runSingleScanner(ctx context.Context, s *ScannerPlugin, req Sca
 	jobID := fmt.Sprintf("scan-%s-%d", req.ServerName, time.Now().UnixNano())
 	reportDir, err := PrepareReportDir(e.dataDir, jobID, s.ID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to prepare report directory: %w", err)
+		return nil, scannerLogs{}, fmt.Errorf("failed to prepare report directory: %w", err)
 	}
 
 	// Build env vars: scanner config + request env
@@ -310,8 +313,9 @@ func (e *Engine) runSingleScanner(ctx context.Context, s *ScannerPlugin, req Sca
 	}
 
 	stdout, stderr, exitCode, err := e.docker.RunScanner(ctx, cfg)
+	logs := scannerLogs{Stdout: stdout, Stderr: stderr, ExitCode: exitCode}
 	if err != nil {
-		return nil, fmt.Errorf("scanner %s execution failed: %w", s.ID, err)
+		return nil, logs, fmt.Errorf("scanner %s execution failed: %w", s.ID, err)
 	}
 
 	e.logger.Debug("Scanner finished",
@@ -331,12 +335,13 @@ func (e *Engine) runSingleScanner(ctx context.Context, s *ScannerPlugin, req Sca
 		if len(stdout) > 0 {
 			reportData = []byte(stdout)
 		} else {
-			return nil, fmt.Errorf("scanner %s produced no output (exit code: %d, stderr: %s)", s.ID, exitCode, truncate(stderr, 500))
+			return nil, logs, fmt.Errorf("scanner %s produced no output (exit code: %d, stderr: %s)", s.ID, exitCode, truncate(stderr, 500))
 		}
 	}
 
 	// Parse results
-	return e.parseResults(reportData, s.ID)
+	report, parseErr := e.parseResults(reportData, s.ID)
+	return report, logs, parseErr
 }
 
 // parseResults parses scanner output into a ScanReport
@@ -393,6 +398,27 @@ func (e *Engine) parseResults(data []byte, scannerID string) (*ScanReport, error
 	return report, nil
 }
 
+// scannerLogs captures stdout/stderr from a scanner execution
+type scannerLogs struct {
+	Stdout   string
+	Stderr   string
+	ExitCode int
+}
+
+// setScannerLogs stores stdout/stderr on a scanner's job status
+func (e *Engine) setScannerLogs(job *ScanJob, scannerID string, logs scannerLogs) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	for i := range job.ScannerStatuses {
+		if job.ScannerStatuses[i].ScannerID == scannerID {
+			job.ScannerStatuses[i].Stdout = truncate(logs.Stdout, 50000)
+			job.ScannerStatuses[i].Stderr = truncate(logs.Stderr, 50000)
+			job.ScannerStatuses[i].ExitCode = logs.ExitCode
+			return
+		}
+	}
+}
+
 // updateScannerStatus updates a specific scanner's status within a job
 func (e *Engine) updateScannerStatus(job *ScanJob, scannerID, status string, startedAt, completedAt time.Time, errMsg string, findingsCount int) {
 	e.mu.Lock()

internal/security/scanner/sarif.go

@@ -247,29 +247,54 @@ func categorizeFromRule(ruleID string, props map[string]any, rules map[string]SA
 	return "security"
 }
 
-// CalculateRiskScore computes a 0-100 risk score from findings
+// CalculateRiskScore computes a 0-100 risk score from findings.
+// Scoring is based on user-facing threat levels, not raw CVSS:
+//   - Dangerous (tool poisoning, prompt injection): 30 pts each, max contribution 90
+//   - Warning (rug pull, high CVEs): 5 pts each, max contribution 40
+//   - Info (low CVEs): 1 pt each, max contribution 10
+//
+// This prevents a pile of CVE warnings from scoring as high as actual tool poisoning.
 func CalculateRiskScore(findings []ScanFinding) int {
 	if len(findings) == 0 {
 		return 0
 	}
 
-	score := 0
+	var dangerousScore, warningScore, infoScore int
 	for _, f := range findings {
-		switch f.Severity {
-		case SeverityCritical:
-			score += 25
-		case SeverityHigh:
-			score += 15
-		case SeverityMedium:
-			score += 5
-		case SeverityLow:
-			score += 2
-		case SeverityInfo:
-			score += 1
+		switch f.ThreatLevel {
+		case ThreatLevelDangerous:
+			dangerousScore += 30
+		case ThreatLevelWarning:
+			warningScore += 5
+		case ThreatLevelInfo:
+			infoScore += 1
+		default:
+			// Unclassified: use severity as fallback
+			switch f.Severity {
+			case SeverityCritical:
+				dangerousScore += 30
+			case SeverityHigh:
+				warningScore += 5
+			case SeverityMedium:
+				warningScore += 3
+			case SeverityLow:
+				infoScore += 1
+			}
 		}
 	}
 
-	// Cap at 100
+	// Cap each category
+	if dangerousScore > 90 {
+		dangerousScore = 90
+	}
+	if warningScore > 40 {
+		warningScore = 40
+	}
+	if infoScore > 10 {
+		infoScore = 10
+	}
+
+	score := dangerousScore + warningScore + infoScore
 	if score > 100 {
 		score = 100
 	}

internal/security/scanner/sarif_test.go

@@ -233,22 +233,35 @@ func TestCalculateRiskScore(t *testing.T) {
 		want     int
 	}{
 		{"no findings", nil, 0},
-		{"one low", []ScanFinding{{Severity: SeverityLow}}, 2},
-		{"one high", []ScanFinding{{Severity: SeverityHigh}}, 15},
-		{"one critical", []ScanFinding{{Severity: SeverityCritical}}, 25},
-		{"mixed", []ScanFinding{
+		{"one info", []ScanFinding{{ThreatLevel: ThreatLevelInfo}}, 1},
+		{"one warning", []ScanFinding{{ThreatLevel: ThreatLevelWarning}}, 5},
+		{"one dangerous", []ScanFinding{{ThreatLevel: ThreatLevelDangerous}}, 30},
+		{"6 warnings + 1 info", []ScanFinding{
+			{ThreatLevel: ThreatLevelWarning},
+			{ThreatLevel: ThreatLevelWarning},
+			{ThreatLevel: ThreatLevelWarning},
+			{ThreatLevel: ThreatLevelWarning},
+			{ThreatLevel: ThreatLevelWarning},
+			{ThreatLevel: ThreatLevelWarning},
+			{ThreatLevel: ThreatLevelInfo},
+		}, 31}, // 6*5=30 + 1 = 31
+		{"dangerous + warnings", []ScanFinding{
+			{ThreatLevel: ThreatLevelDangerous},
+			{ThreatLevel: ThreatLevelWarning},
+			{ThreatLevel: ThreatLevelWarning},
+			{ThreatLevel: ThreatLevelInfo},
+		}, 41}, // 30 + 10 + 1 = 41
+		{"capped dangerous", []ScanFinding{
+			{ThreatLevel: ThreatLevelDangerous},
+			{ThreatLevel: ThreatLevelDangerous},
+			{ThreatLevel: ThreatLevelDangerous},
+			{ThreatLevel: ThreatLevelDangerous},
+		}, 90}, // 4*30=120 capped to 90 (dangerous max)
+		{"unclassified fallback", []ScanFinding{
 			{Severity: SeverityCritical},
 			{Severity: SeverityHigh},
-			{Severity: SeverityMedium},
 			{Severity: SeverityLow},
-		}, 47},
-		{"capped at 100", []ScanFinding{
-			{Severity: SeverityCritical},
-			{Severity: SeverityCritical},
-			{Severity: SeverityCritical},
-			{Severity: SeverityCritical},
-			{Severity: SeverityCritical},
-		}, 100},
+		}, 36}, // 30 + 5 + 1 = 36
 	}
 
 	for _, tt := range tests {

internal/security/scanner/types.go

@@ -85,6 +85,9 @@ type ScannerJobStatus struct {
 	CompletedAt   time.Time `json:"completed_at,omitempty"`
 	Error         string    `json:"error,omitempty"`
 	FindingsCount int       `json:"findings_count"`
+	Stdout        string    `json:"stdout,omitempty"` // Scanner stdout (for log viewing)
+	Stderr        string    `json:"stderr,omitempty"` // Scanner stderr (for log viewing)
+	ExitCode      int       `json:"exit_code"`
 }
 
 // User-facing threat category constants