coverme-scanner 1.7.0 → 1.7.1

package/dist/prompts/coverme-command.md

@@ -181,8 +181,43 @@ Return ONLY: "done" or "skipped"
 
 ### Agent 20: EXEC - Executive Summary
 ```
-After scanning, generate executive summary with top risks and positives.
-Write to .coverme/agents/EXEC.json
+Generate a comprehensive executive summary:
+
+1. Analyze the project:
+   - Read package.json for stack info
+   - Run `ls -d */ | grep -v node_modules` for key components
+   - Determine architecture type (Monolith/Microservices/Serverless)
+
+2. Calculate risk level:
+   - CRITICAL: Any critical findings
+   - HIGH: No critical but has high findings
+   - MEDIUM: Only medium/low findings
+   - LOW: Few or no findings
+
+3. Write professional summary:
+   - headline: "X Critical + Y High findings - brief assessment"
+   - overview: 2-3 sentences for leadership (architecture + posture + main risks)
+   - topRisks: Top 3-5 specific risks with technical detail
+   - topPriorities: Top 3-5 things to fix with finding IDs
+
+Write to .coverme/agents/EXEC.json:
+{
+  "projectOverview": {
+    "name": "...",
+    "type": "Web Application|API|CLI|Library",
+    "stack": ["Node.js", "TypeScript", ...],
+    "purpose": "What this project does",
+    "architecture": "Monolith|Microservices|Serverless",
+    "keyComponents": ["backend/", "frontend/", ...]
+  },
+  "executiveSummary": {
+    "headline": "...",
+    "riskLevel": "CRITICAL|HIGH|MEDIUM|LOW",
+    "overview": "...",
+    "topRisks": ["...", "...", "..."],
+    "topPriorities": ["...", "...", "..."]
+  }
+}
 Return ONLY: "done"
 ```
 
@@ -220,19 +255,78 @@ ls -la .coverme/agents/
 
 Use the Read tool to read each `.coverme/agents/*.json` file.
 
-Merge all findings into `.coverme/scan.json`:
+**ALSO**: Analyze the project structure to gather:
+- Run `ls -d */ 2>/dev/null | grep -v node_modules | grep -v dist | grep -v .git` to get key components
+- Read `package.json` to get the tech stack
+- Count the actual scan duration
+
+Merge all findings into `.coverme/scan.json` with this **COMPLETE** structure:
 ```json
 {
-  "projectName": "...",
-  "scanDate": "...",
-  "filesScanned": N,
-  "linesOfCode": N,
-  "findings": [...all from agent files...],
-  "positiveObservations": [...from POSITIVE.json...],
-  "summary": {"critical":N,"high":N,"medium":N,"low":N}
+  "projectName": "project-name",
+  "scanDate": "2026-02-18T12:00:00Z",
+  "filesScanned": 1234,
+  "linesOfCode": 56789,
+  "scanDuration": "5m 30s",
+  "agentsUsed": ["SEC", "AUTH", "API", "INFRA", "DATA", "AI", "PERF", "BIZ", "QUAL", "TEST", "REDIS", "RESIL", "PII", "DEAD", "DB", "ARCH", "DESIGN", "CTX", "ENC", "EXEC", "DUP", "POSITIVE"],
+
+  "projectOverview": {
+    "name": "project-name",
+    "type": "Web Application",
+    "stack": ["Node.js", "TypeScript", "React", "PostgreSQL"],
+    "purpose": "Brief 1-2 sentence description of what this project does",
+    "architecture": "Monolith | Microservices | Serverless",
+    "keyComponents": ["backend/", "frontend/", "services/", "chart/"]
+  },
+
+  "executiveSummary": {
+    "headline": "X Critical + Y High findings require attention",
+    "riskLevel": "CRITICAL | HIGH | MEDIUM | LOW",
+    "overview": "A 2-3 sentence executive summary of the security posture. Example: 'This is a Node.js/React application with strong authentication patterns. The main risks are hardcoded secrets in Helm values and missing test coverage. No critical vulnerabilities in application code.'",
+    "topRisks": [
+      "Risk 1 with specific technical detail",
+      "Risk 2 with specific technical detail",
+      "Risk 3 with specific technical detail"
+    ],
+    "topPriorities": [
+      "Priority 1: What to fix first (FINDING-ID)",
+      "Priority 2: What to fix second (FINDING-ID)",
+      "Priority 3: What to fix third (FINDING-ID)"
+    ]
+  },
+
+  "findings": [
+    {
+      "id": "SEC-001",
+      "title": "Descriptive title of the issue",
+      "severity": "critical|high|medium|low",
+      "category": "security|infrastructure|quality|performance",
+      "file": "path/to/file.ts",
+      "line": 123,
+      "description": "Detailed description of the vulnerability",
+      "recommendation": "Specific actionable fix",
+      "confidence": 0.95
+    }
+  ],
+
+  "positiveObservations": [
+    "Good pattern 1 with specific evidence (e.g., 'Rate limiting on /api/chat endpoints')",
+    "Good pattern 2 with specific evidence",
+    "Good pattern 3 with specific evidence"
+  ],
+
+  "summary": {
+    "critical": 0,
+    "high": 0,
+    "medium": 0,
+    "low": 0,
+    "total": 0
+  }
 }
 ```
 
+**IMPORTANT**: All fields are REQUIRED. Do not skip any field.
+
 ---
 
 ## Phase 4: Generate Report

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coverme-scanner",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "AI-powered code scanner with multi-agent verification for Claude Code. One command scans everything.",
   "main": "dist/index.js",
   "files": [