fix(security): fix CVSS parsing and Claude prompt

OSV returns severity.score as a CVSS vector string, not a number, so
unmarshalling into float64 errored and every vuln was dropped. Read it
as a string, compute the CVSS v3 base score from the vector, and fall
back to the database_specific severity label otherwise.

Invoke the analysis via "claude -p" instead of a nonexistent "ask"
subcommand (which made the CLI treat "ask" as the prompt), and request
strict JSON so recommendations are parsed reliably rather than by
substring matching.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GVbEgdgcC1w6qwSq3zC4kg

internal/security/claude.go

@@ -15,28 +15,84 @@ func analyzeWithCLI(a *Audit, findings []Finding) error {
 		// Build prompt for Claude
 		prompt := buildClaudePrompt(finding)
 
-		// Call claude command
-		cmd := exec.Command("claude", "ask", prompt)
+		// Call claude in non-interactive print mode (-p). There is no "ask"
+		// subcommand; passing one makes the CLI treat "ask" as the prompt.
+		cmd := exec.Command("claude", "-p", prompt)
 		output, err := cmd.Output()
 		if err != nil {
 			fmt.Printf("  ⚠️  Error analyzing %s %s: %v\n", finding.PackageName, finding.CVE, err)
 			continue
 		}
 
-		// Parse Claude's response
-		mitigation := Mitigation{
-			Finding:        finding,
-			Rationale:      string(output),
-			Recommendation: inferRecommendation(string(output)),
-			NextSteps:      inferNextSteps(string(output)),
-		}
-
-		a.Mitigations = append(a.Mitigations, mitigation)
+		a.Mitigations = append(a.Mitigations, parseMitigation(finding, string(output)))
 	}
 
 	return nil
 }
 
+// claudeResponse is the strict JSON schema we ask Claude to emit.
+type claudeResponse struct {
+	Recommendation string `json:"recommendation"`
+	Rationale      string `json:"rationale"`
+	NextSteps      string `json:"next_steps"`
+}
+
+// parseMitigation builds a Mitigation from Claude's raw stdout. It prefers the
+// structured JSON we request, falling back to heuristic extraction if the
+// model returned free-form text.
+func parseMitigation(finding Finding, output string) Mitigation {
+	if cr, ok := parseClaudeJSON(output); ok {
+		rec := strings.ToLower(strings.TrimSpace(cr.Recommendation))
+		switch rec {
+		case "update", "replace", "protect", "monitor":
+		default:
+			rec = "unknown"
+		}
+		return Mitigation{
+			Finding:        finding,
+			Recommendation: rec,
+			Rationale:      cr.Rationale,
+			NextSteps:      cr.NextSteps,
+		}
+	}
+
+	// Fallback: heuristic parsing of free-form text.
+	return Mitigation{
+		Finding:        finding,
+		Rationale:      output,
+		Recommendation: inferRecommendation(output),
+		NextSteps:      inferNextSteps(output),
+	}
+}
+
+// parseClaudeJSON extracts a claudeResponse from output that may be wrapped in
+// Markdown code fences or surrounded by prose.
+func parseClaudeJSON(output string) (claudeResponse, bool) {
+	s := strings.TrimSpace(output)
+
+	// Strip a leading ```json / ``` fence and its closing fence if present.
+	if strings.HasPrefix(s, "```") {
+		if i := strings.IndexByte(s, '\n'); i != -1 {
+			s = s[i+1:]
+		}
+		s = strings.TrimSuffix(strings.TrimSpace(s), "```")
+		s = strings.TrimSpace(s)
+	}
+
+	// Narrow to the outermost JSON object.
+	start := strings.IndexByte(s, '{')
+	end := strings.LastIndexByte(s, '}')
+	if start == -1 || end == -1 || end < start {
+		return claudeResponse{}, false
+	}
+
+	var cr claudeResponse
+	if err := json.Unmarshal([]byte(s[start:end+1]), &cr); err != nil {
+		return claudeResponse{}, false
+	}
+	return cr, true
+}
+
 // analyzeWithSDK sends findings to Claude via Anthropic SDK
 // This requires ANTHROPIC_API_KEY environment variable
 func analyzeWithSDK(a *Audit, findings []Finding) error {
@@ -49,7 +105,7 @@ func analyzeWithSDK(a *Audit, findings []Finding) error {
 
 // buildClaudePrompt constructs a prompt for Claude analysis
 func buildClaudePrompt(f Finding) string {
-	return fmt.Sprintf(`You are a security expert. Analyze this vulnerability and provide a clear mitigation strategy.
+	return fmt.Sprintf(`You are a security expert analyzing a single software vulnerability.
 
 Package: %s (version %s)
 CVE: %s
@@ -57,18 +113,15 @@ CVSS Score: %.1f
 Severity: %s
 Summary: %s
 
-For this vulnerability, provide a concise mitigation strategy. Consider these options:
-1. UPDATE - update to a patched version
-2. REPLACE - replace with an alternative package
-3. PROTECT - add extra protections without updating
-4. MONITOR - monitor and plan update
+Choose ONE recommended action:
+- update: update to a patched version
+- replace: replace with an alternative package
+- protect: add extra protections without updating
+- monitor: monitor and plan an update
 
-Respond with:
-- Recommended action (UPDATE/REPLACE/PROTECT/MONITOR)
-- Why you recommend this action
-- Specific steps to take
-
-Be concise and practical.`, f.PackageName, f.PackageVersion, f.CVE, f.CVSS, f.Severity, f.Summary)
+Respond with ONLY a JSON object (no prose, no Markdown fences) in exactly this shape:
+{"recommendation": "<update|replace|protect|monitor>", "rationale": "<one or two sentences on why>", "next_steps": "<concrete, practical steps>"}`,
+		f.PackageName, f.PackageVersion, f.CVE, f.CVSS, f.Severity, f.Summary)
 }
 
 // inferRecommendation extracts the recommendation from Claude's response