CLI-77 Auto-install sonar-secrets during sonar integrate claude

Author: kirill-knize-sonarsource

README.md

@@ -119,40 +119,6 @@ sonar auth status
 
 ---
 
-### `sonar install`
-
-Install Sonar tools
-
-#### `sonar install secrets`
-
-Install sonar-secrets binary from https://binaries.sonarsource.com
-
-**Options:**
-
-| Option     | Type    | Required | Description                                     | Default |
-| ---------- | ------- | -------- | ----------------------------------------------- | ------- |
-| `--force`  | boolean | No       | Force reinstall even if already installed       | -       |
-| `--status` | boolean | No       | Check installation status instead of installing | -       |
-
-**Examples:**
-
-Install latest sonar-secrets binary
-```bash
-sonar install secrets
-```
-
-Reinstall sonar-secrets (overwrite existing)
-```bash
-sonar install secrets --force
-```
-
-Check if sonar-secrets is installed and up to date
-```bash
-sonar install secrets --status
-```
-
----
-
 ### `sonar integrate`
 
 Setup SonarQube integration for AI coding agents, git and others.

src/cli/command-tree.ts

@@ -28,7 +28,6 @@ import { authLogin, type AuthLoginOptions } from './commands/auth/login';
 import { authLogout, type AuthLogoutOptions } from './commands/auth/logout';
 import { authPurge } from './commands/auth/purge';
 import { authStatus } from './commands/auth/status';
-import { installSecrets, type InstallSecretsOptions } from './commands/install/secrets';
 import { integrateClaude, type IntegrateClaudeOptions } from './commands/integrate/claude';
 import { integrateGit, type IntegrateGitOptions } from './commands/integrate/git/index';
 import { analyzeSecrets, type AnalyzeSecretsOptions } from './commands/analyze/secrets';
@@ -66,16 +65,6 @@ COMMAND_TREE.name('sonar')
   .addHelpText('beforeAll', getHelpBanner())
   .enablePositionalOptions();
 
-// Install Sonar tools
-const install = COMMAND_TREE.command('install').description('Install Sonar tools');
-
-install
-  .command('secrets')
-  .description('Install sonar-secrets binary from https://binaries.sonarsource.com')
-  .option('--force', 'Force reinstall even if already installed')
-  .option('--status', 'Check installation status instead of installing')
-  .authenticatedAction((_auth, options: InstallSecretsOptions) => installSecrets(options));
-
 // Setup SonarQube integration for AI coding agent
 const integrateCommand = COMMAND_TREE.command('integrate').description(
   'Setup SonarQube integration for AI coding agents, git and others.',

src/cli/commands/install/secrets.ts

@@ -62,7 +62,7 @@ export async function installSecrets(
     await installSecretsStatus();
   } else {
     text('\nInstalling sonar-secrets binary\n');
-    const binaryPath = await performSecretInstall(options, { binDir });
+    const { binaryPath } = await performSecretInstall(options, { binDir });
     logInstallationSuccess(binaryPath);
   }
 }
@@ -73,7 +73,7 @@ export async function installSecrets(
 export async function performSecretInstall(
   options: { force?: boolean },
   { binDir }: { binDir?: string } = {},
-): Promise<string> {
+): Promise<{ binaryPath: string; freshlyInstalled: boolean }> {
   const platform = detectPlatform();
   const resolvedBinDir = ensureBinDirectory(binDir);
   const binaryPath = join(resolvedBinDir, buildLocalBinaryName(platform));
@@ -82,13 +82,12 @@ export async function performSecretInstall(
 
   try {
     await performInstallation(options, platform, binaryPath);
-    text(`  sonar-secrets installed at ${binaryPath}`);
-    return binaryPath;
+    return { binaryPath, freshlyInstalled: true };
   } catch (err) {
     const isAlreadyUpToDate =
       (err as Error).message === 'Installation skipped - already up to date';
     if (isAlreadyUpToDate) {
-      return binaryPath;
+      return { binaryPath, freshlyInstalled: false };
     }
     throw err;
   }
@@ -265,7 +264,6 @@ async function checkExistingInstallation(binaryPath: string): Promise<boolean> {
 
   if (existingVersion === pinnedVersion) {
     text(`sonar-secrets ${existingVersion} is already installed (latest)`);
-    text('  Use --force to reinstall');
     return true;
   }
 

src/cli/commands/integrate/claude/index.ts

@@ -29,6 +29,7 @@ import { blank, info, intro, note, outro, success, text, warn } from '../../../.
 import type { DiscoveredProject } from '../../_common/discovery';
 import { discoverProject } from '../../_common/discovery';
 import { CommandFailedError } from '../../_common/error';
+import { performSecretInstall } from '../../install/secrets';
 import { runHealthChecks } from './health';
 import { installHooks } from './hooks';
 import { repairToken } from './repair';
@@ -70,6 +71,18 @@ export async function integrateClaude(
 
   let token = config.token;
 
+  try {
+    const { binaryPath, freshlyInstalled } = await performSecretInstall({ force: false });
+    if (freshlyInstalled) {
+      success(`sonar-secrets installed at ${binaryPath}`);
+    }
+  } catch (err) {
+    warn(`sonar-secrets installation failed: ${(err as Error).message}`);
+    warn(
+      'Secrets scanning will not be available until installed. Re-run sonar integrate claude to retry.',
+    );
+  }
+
   blank();
   text('Phase 2/3: Health Check & Repair');
   blank();