[tomshafir-sonarsource]

Devin already scans file reads through a blocking hook, but also installs instructions asking the agent to scan files itself. Remove the separate instructions feature and clean up its managed block from existing installations while preserving user content and the secrets hooks.

Uses replacedIds to migrate existing instructions installations to the hooks feature and updates the Devin integration tests.

Ticket: CLI-1351

Validation:

• Typecheck passed.
• Devin integration suite: 32 passed.
• Pre-commit formatting and lint checks passed.
• Vortex analysis was unavailable (ECONNREFUSED).

[netlify]

✅ Deploy Preview for sonarqube-cli canceled.

Name	Link
🔨 Latest commit	4175754
🔍 Latest deploy log	https://app.netlify.com/projects/sonarqube-cli/deploys/6adbe9ea82e78ff1a624b0bd

[hashicorp-vault-sonar-prod]

CLI-1351

[gitar-bot]

Code Review ✅ Approved 2 closed / 2 findings

🔴 High risk · Removing Devin’s agent-side secrets-scanning guidance could leave reads outside the blocking hook unscanned, increasing the chance secrets reach model context.

Removes the separate Devin secrets-instructions feature, which duplicated the blocking file-read scan hook, and migrates existing installs by cleaning up their managed instruction block while preserving user content and the secrets hooks. Resolved the stale integrate/CLAUDE.md reference to the removed instructions. The lack of test coverage for migrating existing installs is closed without a fix in this PR.

✅ 2 closed

✅ Quality: integrate/CLAUDE.md still documents Devin's removed secrets-instructions

📄 src/commands/integrate/devin/declaration.ts:142-153 📄 src/commands/integrate/devin/declaration.ts:255-258
src/commands/integrate/CLAUDE.md line 7 still says the Devin declaration "has four features: sonar-secrets-hooks and secrets-instructions". The same line also says secrets-instructions writes SECRETS_ON_READ_BODY ("shared with Codex") into <Devin config dir>/AGENTS.md between devin-secrets-on-read markers. After this PR Devin has three features. That block is now only removed: sonar-secrets-hooks carries replacedIds: ['secrets-instructions'] and a textSnippetRemover legacy cleanup, and SECRETS_ON_READ_BODY is used only by Codex. This file is the maintainer guidance for these integrations, so it now describes behaviour that no longer exists. Update the Devin paragraph to list three features and describe the migration and cleanup.

Closed: Edge Case: No test covers cleanup/migration of existing secrets-instructions installs

📄 tests/integration/specs/integrate/devin.test.ts:415-429 📄 src/commands/integrate/devin/declaration.ts:142-153
The PR's main claim is that existing installations get the devin-secrets-on-read block removed from AGENTS.md (user content kept) and their secrets-instructions state record moved to sonar-secrets-hooks through replacedIds. The updated tests only run fresh installs, where no block is ever written. So the textSnippetRemover legacy cleanup is never run against a file that actually contains the block, and the migrateReplacedFeatures path for a recorded secrets-instructions feature is never run. If, say, a marker string were wrong, the remover would quietly do nothing and every test would still pass. Add a test that seeds AGENTS.md with user content plus the old fenced block and seeds state with a secrets-instructions record. Then run integrate devin and a post-update reconcile, and assert that only the user content is left and the record now points to sonar-secrets-hooks.

Verification Rules 2/2 met PRs 1 inspected

Functional validation No results

Rules 2 passed 2 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Broader impact PRs 1 inspected

Cross-PR 1 PR inspected 0 open impacts

PR 1101: CLI-1350 Replace Copilot prompt secrets instructions with a hook Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud