Update to SonarQube

SKILL.md text changes

− removed · + added

--- before
+++ after
@@ -1,164 +1,164 @@
----
-name: sonar-duplication
-description: Find files with code duplications in a SonarQube project and inspect duplication blocks for a file (project key optional when MCP integration already defines the default project)
-argument-hint: "[project-key?] [--pr id] [--page-size n] [--page n] [--file key]"
-allowed-tools: Read, Grep, Bash(docker ps:*), Bash(podman ps:*), Bash(nerdctl ps:*), Bash(sonar:*)
----
-
-# SonarQube — Duplication
-
-List files that contain duplicated code in a SonarQube project, then drill into **duplication blocks** for a specific file when needed.
-
-## Usage
-
-```
-sonar-duplication                              # all duplicated files in the current project (auto-paginated)
-sonar-duplication my-project                   # duplicated files in a specific project
-sonar-duplication my-project --pr 42           # same, on a pull request
-sonar-duplication my-project --page-size 100 --page 2   # single page of results (manual pagination)
-sonar-duplication my-project --file src/auth/login.py   # duplication detail for one file
-```
-
-## Prerequisites
-
-This skill requires the SonarQube MCP Server to be configured and the tools `mcp__sonarqube__search_duplicated_files` and `mcp__sonarqube__get_duplications` to be available in your session.
-
-**Before proceeding**, verify the tools are accessible. If they are not, try the `sonar api` CLI fallback in Step 3 before giving up — don't invent other CLI commands (e.g. `sonar mcp call` or `sonar duplication` do not exist).
-
-**If the CLI fallback also fails (for example `sonar` not installed/authenticated, or no project key can be resolved), narrow down the cause** — check whether the `sonarqube` MCP server is enabled in this agent's configuration.
-
-- **Not enabled / not registered** → recommend running the sonar-integrate skill.
-- **Enabled but its tools are still unavailable** → configuration is correct but the server failed to start. The most common cause is that the container runtime is not running — the MCP server launches inside Docker/Podman/Nerdctl via `sonar run mcp`, so a correctly configured server still produces no tools if the daemon is stopped. Run `docker ps` yourself (falling back to `podman ps` / `nerdctl ps`) to confirm which cause applies: if it errors, the runtime is down; after the user starts it, confirm the same command succeeds before asking them to restart the agent session.
-
-Either way, show the user:
-
-> Unable to reach the SonarQube MCP Server, or project key not found.
->
-> **Possible causes:**
-> - MCP server not registered — invoke the sonar-integrate skill to configure the SonarQube MCP Server, then restart the agent session
-> - Container runtime not running — the SonarQube MCP Server runs inside a container (Docker, Podman, or Nerdctl); start your container runtime, then restart the agent session
-> - Credentials not configured — invoke the sonar-integrate skill
-> - Project key is wrong or no default project in MCP config — pass an explicit key, or verify `sonar-project.properties` / re-run the sonar-integrate skill for this project
-
-Then ask the user (yes/no) whether to run the sonar-integrate skill now. Briefly explain what it does: it checks the SonarQube setup on their machine — installing or updating `sonarqube-cli` and verifying authentication — and re-configures the integration for this agent, including the SonarQube MCP server and secrets-scanning hooks. If they confirm, invoke the sonar-integrate skill yourself and follow it end-to-end in this session, then ask the user to ensure a container runtime (Docker, Podman, or Nerdctl) is running and to restart the agent session so the new MCP tools become available; if they decline, stop.
-
-## Instructions
-
-### Step 1: Resolve the project key (only when needed)
-
-MCP tools sometimes **do not require** `projectKey` after the sonar-integrate skill has stored the default project for this workspace. Resolve a key only when you must pass it (tool schema requires it, or the user targets another project):
-
-- If the user provided a project key, use it.
-- Otherwise look for `sonar.projectKey` in `sonar-project.properties` at the repo root.
-- If still not found, **omit `projectKey`** in MCP calls and rely on the integration default.
-
-### Step 2: Parse optional flags from the user-provided arguments
-
-| Flag              | Meaning                                                                                                      |
-| ----------------- | ------------------------------------------------------------------------------------------------------------ |
-| `--pr <id>`       | Pull request context (maps to `pullRequest`)                                                                 |
-| `--page-size <n>` | Results per page for **manual** pagination only; integer 1–500 (maps to `pageSize`)                          |
-| `--page <n>`      | Page number for **manual** pagination; starts at **1** (maps to `pageIndex`)                                 |
-| `--file <key>`    | Skip the duplicated-files list; fetch duplication blocks for this file (maps to `key` in `get_duplications`) |
-
-**Pagination rule:** By default, call `search_duplicated_files` **without** `pageSize` or `pageIndex` so the MCP server auto-fetches every page of duplicated files (up to **10,000** files). Use `pageSize` and `pageIndex` only when the user asks for a specific page or wants to limit page size. If the user supplies `--page-size` but not `--page`, use `pageIndex` **1**.
-
-### Step 3: Run the appropriate flow
-
-#### Flow A — Duplicated file list (default, no `--file`)
-
-Call `mcp__sonarqube__search_duplicated_files`.
-
-**Default (auto-fetch all pages):**
-
-Include **`projectKey` only if** you resolved one in Step 1 **and** the tool requires it; otherwise omit it.
-
-```json
-{
-  "projectKey": "<only-if-required>",
-  "pullRequest": "<id>"
-}
-```
-
-Omit `pullRequest` when `--pr` was not given. Omit `pageSize` and `pageIndex` entirely so all duplicated files are retrieved automatically. Omit `projectKey` from the payload when the integration default applies.
-
-**Manual pagination (single page):**
-
-```json
-{
-  "projectKey": "<only-if-required>",
-  "pullRequest": "<id>",
-  "pageSize": <n>,
-  "pageIndex": <n>
-}
-```
-
-The tool returns **only files that have duplications**. Present results in a table. Include columns the response provides (for example path, duplicated line counts, or density); sort by the strongest duplication signal if multiple metrics exist (for example highest duplicated-lines density or count first).
-
-```markdown
-## Duplication — `my-project`
-
-Files with duplications:
-
-| File                 | Duplicated lines (example) |
-| -------------------- | -------------------------- |
-| src/auth/login.py    | 42                         |
-| src/utils/helpers.py | 18                         |
-```
-
-If the list is empty: *"No duplicated files were returned for this project/branch/PR."*
-
-Then offer to drill in:
-
-*"Ask me to open duplications for any file, or invoke the sonar-duplication skill with `--file <file-key>` (add a project key only if needed)."*
-
-**If `mcp__sonarqube__search_duplicated_files` is unavailable, fall back to `sonar api`.** This needs an explicit project key (no MCP default) — if none was resolved in Step 1, ask the user or invoke sonar-list-projects, then stop.
-
-```bash
-sonar api get "/api/measures/component_tree?component=<project-key>&metricKeys=duplicated_lines,duplicated_blocks,duplicated_lines_density&qualifiers=FIL&strategy=leaves[&pullRequest=<id>]"
-```
-
-Use `metricKeys`; add `-v` if a call 400s unexpectedly. Manual pagination maps to `&p=<page>&ps=<page-size>`; there's no auto-fetch-all mode, so page yourself up to the 10,000-file cap if needed. Filter out components with all-zero duplication metrics, then present the same table as above.
-
-#### Flow B — Duplication detail (`--file <key>` given, or user asks to inspect a file)
-
-Call `mcp__sonarqube__get_duplications`:
-
-```json
-{
-  "key": "<file-key>",
-  "pullRequest": "<id>"
-}
-```
-
-The file key format is `<projectKey>:<path>`, e.g. `my-project:src/auth/login.py`. If the user provides just a path, prepend the resolved project key when you have one; otherwise follow the MCP tool schema for the default project. Omit `pullRequest` when `--pr` was not given.
-
-> **Permission:** This call requires **Browse** permission on the file’s project. If the tool returns a permission or authorization error, tell the user they need the **Browse** role on the project and that they may need a role with code-view access.
-
-Present duplication **blocks** from the response: for each block, show ranges, sibling copies, or other fields returned by the API so the user can see where code is duplicated.
-
-```markdown
-## Duplication detail — `src/auth/login.py`
-
-### Block 1
-- Lines 10–24 (example) duplicated in `src/other/helper.py` lines 30–44
-...
-```
-
-If the file has no duplications in the response, say: *"No duplications were reported for this file."*
-
-**If `mcp__sonarqube__get_duplications` is unavailable, fall back to `sonar api`:**
-
-```bash
-sonar api get "/api/duplications/show?key=<file-key>[&pullRequest=<id>]"
-```
-
-Omit `pullRequest` when `--pr` was not given. The same **Browse** permission requirement applies. Present the returned blocks in the same format as above.
-
-If this also fails, show the standard message above — don't guess further commands.
-
-### Step 4: Next steps
-
-- To refactor: *"Ask me to extract a shared helper or consolidate the duplicated regions."*
-- To scan the same file for issues: *"Invoke the sonar-analyze skill with `<file>`."*
-- To check the quality gate (e.g. `new_duplicated_lines_density`): *"Invoke the sonar-quality-gate skill (add a project key only if you are not using the integration default)."*
+---
+name: sonar-duplication
+description: Find files with code duplications in a SonarQube project and inspect duplication blocks for a file (project key optional when MCP integration already defines the default project)
+argument-hint: "[project-key?] [--pr id] [--page-size n] [--page n] [--file key]"
+allowed-tools: Read, Grep, Bash(docker ps:*), Bash(podman ps:*), Bash(nerdctl ps:*), Bash(sonar:*)
+---
+
+# SonarQube — Duplication
+
+List files that contain duplicated code in a SonarQube project, then drill into **duplication blocks** for a specific file when needed.
+
+## Usage
+
+```
+sonar-duplication                              # all duplicated files in the current project (auto-paginated)
+sonar-duplication my-project                   # duplicated files in a specific project
+sonar-duplication my-project --pr 42           # same, on a pull request
+sonar-duplication my-project --page-size 100 --page 2   # single page of results (manual pagination)
+sonar-duplication my-project --file src/auth/login.py   # duplication detail for one file
+```
+
+## Prerequisites
+
+This skill requires the SonarQube MCP Server to be configured and the tools `mcp__sonarqube__search_duplicated_files` and `mcp__sonarqube__get_duplications` to be available in your session.
+
+**Before proceeding**, verify the tools are accessible. If they are not, try the `sonar api` CLI fallback in Step 3 before giving up — don't invent other CLI commands (e.g. `sonar mcp call` or `sonar duplication` do not exist).
+
+**If the CLI fallback also fails (for example `sonar` not installed/authenticated, or no project key can be resolved), narrow down the cause** — check whether the `sonarqube` MCP server is enabled in this agent's configuration.
+
+- **Not enabled / not registered** → recommend running the sonar-integrate skill.
+- **Enabled but its tools are still unavailable** → configuration is correct but the server failed to start. The most common cause is that the container runtime is not running — the MCP server launches inside Docker/Podman/Nerdctl via `sonar run mcp`, so a correctly configured server still produces no tools if the daemon is stopped. Run `docker ps` yourself (falling back to `podman ps` / `nerdctl ps`) to confirm which cause applies: if it errors, the runtime is down; after the user starts it, confirm the same command succeeds before asking them to restart the agent session.
+
+Either way, show the user:
+
+> Unable to reach the SonarQube MCP Server, or project key not found.
+>
+> **Possible causes:**
+> - MCP server not registered — invoke the sonar-integrate skill to configure the SonarQube MCP Server, then restart the agent session
+> - Container runtime not running — the SonarQube MCP Server runs inside a container (Docker, Podman, or Nerdctl); start your container runtime, then restart the agent session
+> - Credentials not configured — invoke the sonar-integrate skill
+> - Project key is wrong or no default project in MCP config — pass an explicit key, or verify `sonar-project.properties` / re-run the sonar-integrate skill for this project
+
+Then ask the user (yes/no) whether to run the sonar-integrate skill now. Briefly explain what it does: it checks the SonarQube setup on their machine — installing or updating `sonarqube-cli` and verifying authentication — and re-configures the integration for this agent, including the SonarQube MCP server and secrets-scanning hooks. If they confirm, invoke the sonar-integrate skill yourself and follow it end-to-end in this session, then ask the user to ensure a container runtime (Docker, Podman, or Nerdctl) is running and to restart the agent session so the new MCP tools become available; if they decline, stop.
+
+## Instructions
+
+### Step 1: Resolve the project key (only when needed)
+
+MCP tools sometimes **do not require** `projectKey` after the sonar-integrate skill has stored the default project for this workspace. Resolve a key only when you must pass it (tool schema requires it, or the user targets another project):
+
+- If the user provided a project key, use it.
+- Otherwise look for `sonar.projectKey` in `sonar-project.properties` at the repo root.
+- If still not found, **omit `projectKey`** in MCP calls and rely on the integration default.
+
+### Step 2: Parse optional flags from the user-provided arguments
+
+| Flag              | Meaning                                                                                                      |
+| ----------------- | ------------------------------------------------------------------------------------------------------------ |
+| `--pr <id>`       | Pull request context (maps to `pullRequest`)                                                                 |
+| `--page-size <n>` | Results per page for **manual** pagination only; integer 1–500 (maps to `pageSize`)                          |
+| `--page <n>`      | Page number for **manual** pagination; starts at **1** (maps to `pageIndex`)                                 |
+| `--file <key>`    | Skip the duplicated-files list; fetch duplication blocks for this file (maps to `key` in `get_duplications`) |
+
+**Pagination rule:** By default, call `search_duplicated_files` **without** `pageSize` or `pageIndex` so the MCP server auto-fetches every page of duplicated files (up to **10,000** files). Use `pageSize` and `pageIndex` only when the user asks for a specific page or wants to limit page size. If the user supplies `--page-size` but not `--page`, use `pageIndex` **1**.
+
+### Step 3: Run the appropriate flow
+
+#### Flow A — Duplicated file list (default, no `--file`)
+
+Call `mcp__sonarqube__search_duplicated_files`.
+
+**Default (auto-fetch all pages):**
+
+Include **`projectKey` only if** you resolved one in Step 1 **and** the tool requires it; otherwise omit it.
+
+```json
+{
+  "projectKey": "<only-if-required>",
+  "pullRequest": "<id>"
+}
+```
+
+Omit `pullRequest` when `--pr` was not given. Omit `pageSize` and `pageIndex` entirely so all duplicated files are retrieved automatically. Omit `projectKey` from the payload when the integration default applies.
+
+**Manual pagination (single page):**
+
+```json
+{
+  "projectKey": "<only-if-required>",
+  "pullRequest": "<id>",
+  "pageSize": <n>,
+  "pageIndex": <n>
+}
+```
+
+The tool returns **only files that have duplications**. Present results in a table. Include columns the response provides (for example path, duplicated line counts, or density); sort by the strongest duplication signal if multiple metrics exist (for example highest duplicated-lines density or count first).
+
+```markdown
+## Duplication — `my-project`
+
+Files with duplications:
+
+| File                 | Duplicated lines (example) |
+| -------------------- | -------------------------- |
+| src/auth/login.py    | 42                         |
+| src/utils/helpers.py | 18                         |
+```
+
+If the list is empty: *"No duplicated files were returned for this project/branch/PR."*
+
+Then offer to drill in:
+
+*"Ask me to open duplications for any file, or invoke the sonar-duplication skill with `--file <file-key>` (add a project key only if needed)."*
+
+**If `mcp__sonarqube__search_duplicated_files` is unavailable, fall back to `sonar api`.** This needs an explicit project key (no MCP default) — if none was resolved in Step 1, ask the user or invoke sonar-list-projects, then stop.
+
+```bash
+sonar api get "/api/measures/component_tree?component=<project-key>&metricKeys=duplicated_lines,duplicated_blocks,duplicated_lines_density&qualifiers=FIL&strategy=leaves[&pullRequest=<id>]"
+```
+
+Use `metricKeys`; add `-v` if a call 400s unexpectedly. Manual pagination maps to `&p=<page>&ps=<page-size>`; there's no auto-fetch-all mode, so page yourself up to the 10,000-file cap if needed. Filter out components with all-zero duplication metrics, then present the same table as above.
+
+#### Flow B — Duplication detail (`--file <key>` given, or user asks to inspect a file)
+
+Call `mcp__sonarqube__get_duplications`:
+
+```json
+{
+  "key": "<file-key>",
+  "pullRequest": "<id>"
+}
+```
+
+The file key format is `<projectKey>:<path>`, e.g. `my-project:src/auth/login.py`. If the user provides just a path, prepend the resolved project key when you have one; otherwise follow the MCP tool schema for the default project. Omit `pullRequest` when `--pr` was not given.
+
+> **Permission:** This call requires **Browse** permission on the file’s project. If the tool returns a permission or authorization error, tell the user they need the **Browse** role on the project and that they may need a role with code-view access.
+
+Present duplication **blocks** from the response: for each block, show ranges, sibling copies, or other fields returned by the API so the user can see where code is duplicated.
+
+```markdown
+## Duplication detail — `src/auth/login.py`
+
+### Block 1
+- Lines 10–24 (example) duplicated in `src/other/helper.py` lines 30–44
+...
+```
+
+If the file has no duplications in the response, say: *"No duplications were reported for this file."*
+
+**If `mcp__sonarqube__get_duplications` is unavailable, fall back to `sonar api`:**
+
+```bash
+sonar api get "/api/duplications/show?key=<file-key>[&pullRequest=<id>]"
+```
+
+Omit `pullRequest` when `--pr` was not given. The same **Browse** permission requirement applies. Present the returned blocks in the same format as above.
+
+If this also fails, show the standard message above — don't guess further commands.
+
+### Step 4: Next steps
+
+- To refactor: *"Ask me to extract a shared helper or consolidate the duplicated regions."*
+- To scan the same file for issues: *"Invoke the sonar-analyze skill with `<file>`."*
+- To check the quality gate (e.g. `new_duplicated_lines_density`): *"Invoke the sonar-quality-gate skill (add a project key only if you are not using the integration default)."*