{"id":"0ebae148-1d32-4329-afaf-aadbedaffbf2","slug":"sfdt","kind":"mcp","name":"sfdt","summary":"Salesforce DevTools — CLI, VS Code extension, sf plugin, MCP server, and web dashboard for Salesforce DX deploy, test, org health, and release management. AI-optional, CI-ready.","owner":"scoobydrew83","repoUrl":"https://github.com/scoobydrew83/sfdt","license":"Apache-2.0","licenseTier":"permissive","trust":"community","stars":1,"match":null,"fewStars":true,"format":"mcp","createdAt":"2026-03-30T03:03:45.000Z","addedAt":"2026-10-21T04:23:58.048Z","logoUrl":"https://avatars.githubusercontent.com/u/39525978?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools","cloud-infra","data-analytics"],"tags":["ai-tools","apex","ci-cd","cli","code-quality","deployment","developer-tools","devops"],"runtime":"node","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-21T04:24:14.538Z","sample":false,"url":"https://conduits.dev/tools/sfdt","language":"TypeScript","transports":["stdio"],"install":{"npm":"@sfdt/cli"},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"<div align=\"center\">\n\n<img src=\".github/assets/logo.png\" alt=\"SFDT logo\" width=\"96\" height=\"96\" />\n\n# SFDT — Salesforce DevTools\n\n**Org health and tech debt for Salesforce — see the org you actually have, then change it safely.**\n\n`@sfdt/cli` is the command-line core of the SFDT suite. It diagnoses org health and technical\ndebt (audit, monitoring, drift, dependencies, permissions, coverage), groups that evidence\nunder the AI-Readiness Index, and ships changes with preflight, testing and rollback. Pairs with\nthe SFDT Chrome extension and the [VS Code extension](https://marketplace.visualstudio.com/items?itemName=sfdt.sfdt-devtools).\n\n📖 **[Read the docs at sfdt.dev →](https://sfdt.dev/)**  ·  [npm](https://www.npmjs.com/package/@sfdt/cli)  ·  [Usage guide](docs/USAGE.md)\n\n[![npm version](https://img.shields.io/npm/v/@sfdt/cli.svg)](https://www.npmjs.com/package/@sfdt/cli)\n[![npm downloads](https://img.shields.io/npm/dm/@sfdt/cli.svg)](https://www.npmjs.com/package/@sfdt/cli)\n[![VS Code](https://img.shields.io/badge/VS%20Code-Marketplace-blue?logo=visualstudiocode)](https://marketplace.visualstudio.com/items?itemName=sfdt.sfdt-devtools)\n![Open VSX Version](https://img.shields.io/open-vsx/v/sfdt/sfdt-devtools)\n[![CI](https://github.com/scoobydrew83/sfdt/actions/workflows/ci.yml/badge.svg)](https://github.com/scoobydrew83/sfdt/actions/workflows/ci.yml)\n[![CodeQL](https://github.com/scoobydrew83/sfdt/actions/workflows/codeql.yml/badge.svg)](https://github.com/scoobydrew83/sfdt/actions/workflows/codeql.yml)\n[![license](https://img.shields.io/npm/l/@sfdt/cli.svg)](https://github.com/scoobydrew83/sfdt/blob/main/LICENSE)\n[![node](https://img.shields.io/node/v/@sfdt/cli.svg)](https://nodejs.org)\n\n</div>\n\n## Features\n\n- **Org health & tech-debt diagnosis** — `sfdt audit` (17 checks: access sprawl, MFA, unused and unreferenced Apex, inactive automation, deprecated API versions, connected apps, missing field descriptions, setup audit-trail anomalies), `sfdt monitor` (limits, errors, Security Health Check, deploy history, legacy API use), plus `dependencies`, `permissions`, `packages`, `field` and `coverage`\n- **AI-Readiness Index evidence pack** — `sfdt audit --index` groups every check under the eight Index dimensions (automation sprawl, dependency risk, documentation, permissions, dead metadata, data quality, change safety, AI-groundability) and writes a Markdown pack for an assessment. The same grouping appears in the Chrome extension's Org Health panel. It is evidence for a person scoring the org, not a score.\n- Interactive deployment workflows with preflight validation, tagging, and PR creation\n- Automated release manifest generation from git diffs\n- Parallel Apex test execution with configurable coverage enforcement\n- Code and test quality analysis with AI-powered fix plans\n- Pre-release validation checklist (`sfdt preflight`)\n- Deployment rollback with pre-rollback org state backup\n- Post-deploy smoke testing\n- Org metadata drift detection\n- **Multi-package project support** — scope manifests and deploys to individual `packageDirectories` with `--package` and `--name`; deploy source folders directly with `--source-dir`\n- **Smart package.xml generator** from git diffs with AI dependency cleanup (`sfdt manifest`)\n- **AI deployment error log interpreter** with heuristic fallback for offline use (`sfdt explain`)\n- **AI-generated PR descriptions and Slack messages** from deployment changes (`sfdt pr-description`)\n- **AI-powered code review, test failure analysis, changelog generation, and release notes** — optional, works with Claude, Gemini, or OpenAI\n- **Org metadata comparison** — diff two orgs or local source vs org with optional package.xml export (`sfdt compare`)\n- **Local web dashboard** for test results, preflight, drift monitoring, and org comparison (`sfdt ui`)\n- **Smart delta deployments** — minimal git-delta package with overwrite protection, automatic test-level selection, optional AI / coding-agent auto-fix (`sfdt deploy --smart`)\n- **Scheduled org monitoring & backup** — `sfdt monitor --backup`, notification digests, and CI monitor templates\n- **CI/CD pipeline templates** for GitHub, GitLab, Azure, and Bitbucket (`sfdt ci init` — monitor, PR validation, approval-gated release, scratch-org CI), plus a published **GitHub Action** (`uses: scoobydrew83/sfdt@v0`); PR decoration (`sfdt pr comment`) and cross-org retrofit (`sfdt retrofit`)\n- **Multi-channel notifications** — Slack, MS Teams, Google Chat, email, webhook, and Grafana Loki, with optional AI executive-summary digests (`sfdt notify`)\n- **Plugin architecture** — extend sfdt with `sfdt-plugin-*` npm packages or local `.sfdt/plugins/` scripts, plus a **Salesforce CLI plugin** exposing every command as `sf sfdt <command>` (`sf plugins install @sfdt/plugin`)\n- Works with **any** Salesforce DX project — no project-specific values hardcoded\n\nFor in-depth command walkthroughs and workflow examples, see [docs/USAGE.md](docs/USAGE.md).\n\n## Repository layout\n\n`@sfdt/cli` is one of six workspaces in this monorepo:\n\n| Workspace | What it is | Status |\n|---|---|---|\n| **`@sfdt/cli`** (`/src`, `/bin`, `/scripts`) | The npm CLI documented below. | Published to npm |\n| **`@sfdt/extension`** (`/extension`) | Chrome extension for Salesforce Flow Builder + Setup productivity. Talks to the CLI via the local bridge for deploy / rollback / quality / AI features. See [extension/README.md](extension/README.md) and [extension/PRIVACY.md](extension/PRIVACY.md). | Published to the Chrome Web Store |\n| **`sfdt-devtools`** (`/vscode`) | VS Code extension — a CLI-backed command center (Org Health sidebar, command palette, CodeLens, diagnostics, embedded dashboard); it drives the `sfdt` binary and reimplements no logic. See [vscode/README.md](vscode/README.md). | [Published to the VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=sfdt.sfdt-devtools) |\n| **`@sfdt/host`** (`/host`) | Native messaging host used as the extension's fallback transport when `sfdt ui` isn't running. Installed with `sfdt extension install-host`. | Bundled with CLI |\n| **`@sfdt/flow-core`** (`/packages/flow-core`) | Shared TypeScript library — Flow normalization, rules engine, scoring, and the versioned bridge contract. Consumed by both CLI and extension. | Published to npm (publishes alongside the CLI) |\n| **`@sfdt/plugin`** (`/packages/plugin`) | Salesforce CLI plugin — a thin oclif wrapper exposing every command as `sf sfdt <command>`. Forwards argv to the bundled `sfdt` binary; reimplements no logic. | Published to npm (publishes alongside the CLI) |\n\nThe CLI's `sfdt ui` command starts a local web dashboard (`/gui`) that exposes the same bridge endpoints the extension uses.\n\n## Quick Start\n\n```bash\nnpm install -g @sfdt/cli\ncd your-salesforce-project\nsfdt init\nsfdt deploy\n```\n\n### Other install methods\n\n```bash\n# Bootstrap script (checks prerequisites, then installs via npm)\ncurl -fsSL https://raw.githubusercontent.com/scoobydrew83/sfdt/main/install.sh | bash\n\n# Homebrew (macOS/Linux) — tap once, then install by name\nbrew tap scoobydrew83/sfdt\nbrew install sfdt\n# (Third-party tap: it won't show in brew's website search, which only lists homebrew-core.)\n\n# Docker (official multi-arch image)\ndocker run --rm -v \"$PWD:/project\" ghcr.io/scoobydrew83/sfdt:latest --help\n\n# Salesforce CLI plugin — run every command as `sf sfdt <command>`\nsf plugins install @sfdt/plugin\nsf sfdt deploy --dry-run\n```\n\n> The `@sfdt/plugin` package is a thin wrapper over `@sfdt/cli` (it shells out to\n> the same binary), so every command, flag, and `--json` output is identical to\n> running `sfdt` directly. `--json` commands emit a Salesforce-native\n> `{ status, result, warnings }` envelope. As an unsigned third-party plugin, `sf`\n> shows a one-time security prompt on install.\n\n**npm alternatives:** `pnpm add -g @sfdt/cli` · `yarn global add @sfdt/cli` · one-off `npx @sfdt/cli --help`.\n\n**From source (contributors):**\n\n```bash\ngit clone https://github.com/scoobydrew83/sfdt.git && cd sfdt\nnpm install\nnpm link            # makes `sfdt` available globally from your checkout\nnpm run build:gui   # build the local web dashboard\n```\n\nFull install reference — every method plus CI usage — at **[sfdt.dev/cli/installation](https://sfdt.dev/cli/installation)**.\n\n## Commands\n\nThe full command reference — every command, flag, and default, generated from the CLI's own\ncommand registry so it can never drift — lives at\n**[sfdt.dev/cli/commands](https://sfdt.dev/cli/commands)**. Locally, `sfdt --help` (and\n`sfdt <command> --help`) is always current. The machine-readable inventory is\n[`generated/commands.json`](generated/commands.json).\n\nBy area:\n\n- **Deploy & release** — smart git-delta deploys with overwrite protection and automatic\n  test-level selection, preflight validation, rollback with pre-rollback backup, smoke tests,\n  release manifests + AI release notes, CI pipeline generation for four providers, and\n  PR decoration.\n- **Metadata & source** — incremental pull with a SQLite delta cache, drift detection,\n  org-to-org compare, full inventory scans, `package.xml` from git diffs, dependency tracing\n  (including source-parsed gaps the Tooling API misses), and cross-org retrofit.\n- **Testing & quality** — the enhanced Apex runner, unified Apex + Flow logic tests, local LWC\n  (Jest) tests, Agentforce agent tests as CI gates, Code Analyzer v5 scans (SARIF output for\n  code scanning), coverage gates, and changelog management.\n- **Environments & data** — scratch-org creation, deletion, listing, and pooling (`sfdt scratch`),\n  plus org data set import/export over `sf data tree` (`sfdt data`).\n- **AI** — code review, deployment-error analysis, PR descriptions, fix plans, and ad-hoc\n  prompts across Claude / Gemini / Codex CLI providers or any OpenAI-compatible endpoint.\n- **Org health** — `audit` and `monitor` check suites with multi-channel notifications,\n  metadata backup, run history trending, and generated org documentation with ER diagrams.\n- **Platform** — the local web dashboard (`sfdt ui`), MCP server for agents, Chrome-extension\n  bridge + native messaging host management, feature kill-switch, environment doctor, shell\n  completion, and a plugin scaffold.\n\n## Configuration\n\nRunning `sfdt init` creates a `.sfdt/` directory in your project root:\n\n```\n.sfdt/\n  config.json          # Core settings: org aliases, feature flags, AI provider, coverage threshold\n  environments.json    # Named environments and org aliases\n  test-config.json     # Test classes, coverage threshold, test level\n  pull-config.json     # Metadata types to pull from org\n```\n\n### config.json\n\n```json\n{\n  \"projectName\": \"My Salesforce Project\",\n  \"defaultOrg\": \"my-dev-org\",\n  \"deployment\": {\n    \"coverageThreshold\": 75,\n    \"preflight\": {\n      \"enforceTests\": false,\n      \"enforceBranchNaming\": false,\n      \"enforceChangelog\": false\n    }\n  },\n  \"features\": {\n    \"ai\": true,\n    \"notifications\": false,\n    \"releaseManagement\": true\n  },\n  \"ai\": {\n    \"provider\": \"claude\",\n    \"model\": \"\",\n    \"baseURL\": \"\",\n    \"apiKeyEnv\": \"\",\n    \"headers\": {},\n    \"timeoutMs\": 300000\n  },\n  \"plugins\": []\n}\n```\n\n> `baseURL` / `apiKeyEnv` / `headers` / `timeoutMs` apply only to the `http` provider; CLI providers (`claude`/`gemini`/`openai`) ignore them. See [AI Features](#ai-features).\n\n## AI Features\n\nAI-powered commands (`review`, `explain`, `manifest --ai-cleanup`, `quality --fix-plan`, `pr-description`, `changelog generate`, `release`) work with **Claude, Gemini, OpenAI/Codex CLI providers, or any OpenAI-compatible HTTP endpoint** (Ollama, OpenRouter, MiniMax, …). The provider is configured during `sfdt init` or by editing `.sfdt/config.json`.\n\n### Claude (default)\n\nRequires the [Claude Code CLI](https://www.npmjs.com/package/@anthropic-ai/claude-code):\n\n```bash\nnpm install -g @anthropic-ai/claude-code\n```\n\n```json\n{ \"ai\": { \"provider\": \"claude\" } }\n```\n\nClaude's interactive mode lets AI commands read your repository files directly with tool use.\n\n### Gemini\n\nRequires the Gemini CLI:\n\n```bash\nnpm install -g @google/gemini-cli\n```\n\n```json\n{ \"ai\": { \"provider\": \"gemini\", \"model\": \"\" } }\n```\n\nAuthentication and model selection are handled by the Gemini CLI.\n\n### OpenAI\n\nRequires the Codex CLI:\n\n```bash\nnpm install -g @openai/codex\n```\n\n```json\n{ \"ai\": { \"provider\": \"openai\", \"model\": \"\" } }\n```\n\nAuthentication and model selection are handled by the Codex CLI.\n\n### HTTP (OpenAI-compatible)\n\nA single `http` provider talks to any endpoint exposing `POST /chat/completions` — local (Ollama) or cloud (OpenRouter, MiniMax, or any gateway). No extra CLI is needed; it uses Node's built-in `fetch`.\n\n```jsonc\n// Ollama (local, no API key)\n{ \"ai\": { \"provider\": \"http\", \"baseURL\": \"http://localhost:11434/v1\", \"model\": \"llama3.1\" } }\n\n// OpenRouter / MiniMax (cloud — key comes from an env var, never stored in config)\n{ \"ai\": {\n  \"provider\": \"http\",\n  \"baseURL\": \"https://openrouter.ai/api/v1\",\n  \"model\": \"openrouter/auto\",\n  \"apiKeyEnv\": \"OPENROUTER_API_KEY\"\n} }\n```\n\n`apiKeyEnv` names the environment variable holding your key (`export OPENROUTER_API_KEY=…`); the key itself is never written to `.sfdt/config.json`. Optional `headers` (object) and `timeoutMs` (default `300000`) are also supported.\n\nBecause an HTTP model can't read files or run `git`/`sf` itself, sfdt pre-gathers the needed context (git history, test results) and injects it into the prompt for agentic commands. Note: with a cloud endpoint, prompt content (diffs, git logs) is transmitted to that service — sensitive values are redacted before sending.\n\n### Disabling AI\n\nSet `features.ai` to `false` to disable all AI prompts. Heuristic fallbacks still run in `sfdt explain`.\n\n```json\n{ \"features\": { \"ai\": false } }\n```\n\n## Web Dashboard (`sfdt ui`)\n\n`sfdt ui` starts a local Express server and opens the SFDT dashboard in your browser:\n\n```bash\nsfdt ui                   # opens http://localhost:7654\nsfdt ui --port 8080       # custom port\nsfdt ui --no-open         # start server without opening browser\n```\n\nThe dashboard has 25 pages, grouped in the sidebar. The authoritative list is\n[`generated/gui-pages.json`](generated/gui-pages.json):\n\n- **Observe** — Dashboard, Drift, Org Audit, Org Monitor, Test Runs, Coverage, Logs\n- **Analyze** — Compare, Scan, Preflight, Manifests, Quality, Agent Test, Pull, Review, Explain,\n  Flow Intelligence, Dependency Graph, Scratch Orgs, Data Sets, Documentation\n- **Release** — Release Hub, Retrofit\n- **Config** — Notifications, Settings\n\nMost pages both read the latest snapshot and can trigger the underlying command directly from the UI.\n\nThe dashboard reads log files from the project's configured `logDir` (defaults to `<project>/logs`). Data appears automatically after running `sfdt test`, `sfdt preflight`, or `sfdt drift` when those commands write JSON result files.\n\n**Build the GUI** (required after cloning from source):\n\n```bash\nnpm run build:gui\n```\n\nThe pre-built `gui/dist/` is included in the published npm package so end users don't need to build it.\n\n## Plugin Architecture\n\nExtend sfdt with custom subcommands by creating a plugin.\n\n### npm package plugin\n\nCreate a package named `sfdt-plugin-<name>` and publish it to npm:\n\n```javascript\n// sfdt-plugin-my-thing/index.js\nexport function register(program) {\n  program\n    .command('my-thing')\n    .description('My custom command')\n    .action(async () => {\n      console.log('Hello from my-thing!');\n    });\n}\n```\n\nInstall it in your Salesforce project:\n\n```bash\nnpm install --save-dev sfdt-plugin-my-thing\n```\n\nsfdt auto-discovers all `sfdt-plugin-*` packages in your project's `node_modules/` on startup — no config required.\n\n### Local plugin\n\nDrop a `.js` file in `.sfdt/plugins/`:\n\n```javascript\n// .sfdt/plugins/custom-deploy.js\nexport function register(program) {\n  program.command('custom-deploy').action(async () => { ... });\n}\n```\n\n### Explicit plugin list\n\nList plugin package names in `config.plugins` to load them in a specific order:\n\n```json\n{ \"plugins\": [\"sfdt-plugin-my-thing\", \"@myorg/sfdt-plugin-audit\"] }\n```\n\n## GitHub Action\n\nThe repository doubles as a composite GitHub Action: run any sfdt command as a\nsingle `uses:` step, with org authentication handled for you. Pinning the\naction tag pins the CLI version (`cli-version: auto` installs the version\nshipped at that ref — no unpinned `@latest`).\n\n```yaml\n- uses: actions/checkout@v4\n  with:\n    fetch-depth: 0\n- name: Smart delta validation\n  uses: scoobydrew83/sfdt@v0\n  with:\n    args-json: '[\"deploy\",\"--smart\",\"--org\",\"ci\",\"--delta-base\",\"origin/${{ github.event.pull_request.base.ref }}\",\"--dry-run\"]'\n    auth-method: sfdx-url\n    sfdx-auth-url: ${{ secrets.SFDX_AUTH_URL }}\n    org-alias: ci\n```\n\n`args-json` (a JSON array of arguments) is executed with no shell, so values can\nnever be interpreted as shell syntax. The legacy `command` string input still\nworks for shell-neutral strings but is deprecated; strings needing quoting or\nexpansion additionally require `allow-shell-command: 'true'` (trusted input only).\n\nJWT bearer flow instead of an auth URL:\n\n```yaml\n    auth-method: jwt\n    consumer-key: ${{ secrets.SFDX_CONSUMER_KEY }}\n    jwt-secret-key: ${{ secrets.SFDX_JWT_SECRET_KEY }}\n    username: ${{ secrets.SFDX_USERNAME }}\n```\n\n`sfdt ci init --provider github --runner action` generates complete workflows\nbuilt on the action (monitor, deploy, release). The floating `v0` tag tracks\nthe newest stable release; pin an exact tag (e.g. `@v0.16.2`) or a commit SHA\nif you prefer immutable references. Always pass secrets as `${{ secrets.X }}`\nexpressions, and never feed untrusted input to `command` — it runs as a shell\ncommand line.\n\n## Docker\n\nAn official Docker image is available for CI/CD pipelines. It ships Node 22, Salesforce CLI, git, bash, and jq.\n\n**Build from source:**\n\n```bash\ndocker build -t sfdt .\n```\n\n**Run against a mounted project:**\n\n```bash\ndocker run --rm \\\n  -v \"$(pwd):/project\" \\\n  -e SFDX_AUTH_URL=\"$SFDX_AUTH_URL\" \\\n  sfdt deploy\n```\n\n**GitHub Actions example:**\n\n```yaml\n- name: Deploy\n  run: |\n    docker run --rm \\\n      -v \"${{ github.workspace }}:/project\" \\\n      -e SF_ORG_INSTANCE_URL=\"${{ secrets.SF_ORG_INSTANCE_URL }}\" \\\n      sfdt deploy --skip-preflight\n```\n\nInstall the selected AI provider CLI in the container when using AI features:\n\n```bash\ndocker run --rm -v \"$(pwd):/project\" \\\n  sfdt explain --latest\n```\n\n## Pull Groups\n\nPull groups let you define named sets of metadata types in `.sfdt/pull-config.json`:\n\n```json\n{\n  \"metadataTypes\": [\n    \"ApexClass\",\n    \"ApexTrigger\",\n    \"LightningComponentBundle\",\n    \"CustomObject\",\n    \"CustomField\",\n    \"Layout\",\n    \"FlexiPage\",\n    \"PermissionSet\",\n    \"Flow\"\n  ],\n  \"targetDir\": \"force-app/main/default\"\n}\n```\n\nUse `sfdt pull` to retrieve all configured metadata types from the default org.\n\n### Pull Cache\n\n`sfdt pull` uses a SQLite cache (stored in `.sfdt/cache/`) to track retrieved components and their modification dates. On subsequent runs, only components that have changed in the org are re-fetched, significantly reducing retrieval time for large orgs.\n\nCache behavior is controlled via `pullCache` in `.sfdt/config.json`:\n\n```json\n{\n  \"pullCache\": {\n    \"enabled\": true,\n    \"parallelism\": 5,\n    \"batchSize\": 100\n  }\n}\n```\n\n| Flag | Description |\n|------|-------------|\n| `sfdt pull` | Incremental pull — only retrieves changed components |\n| `sfdt pull --full` | Force full retrieve and rebuild the cache |\n| `sfdt pull --status` | Show cache status (last pull time, component counts) |\n\n## Requirements\n\n- **Node.js** >= 22.15.0 (uses the built-in `node:sqlite` module, unflagged in Node 22.15)\n- **Salesforce CLI** (`sf`) installed and authenticated to target orgs\n- **bash** 4.0+ (macOS users: `brew install bash`)\n- **jq** 1.6+ (required by several shell scripts)\n- **Optional:** [Claude Code CLI](https://www.npmjs.com/package/@anthropic-ai/claude-code) for AI features with the `claude` provider\n- **Optional:** Gemini CLI or Codex CLI for AI features with the `gemini` or `openai` provider\n- **Optional:** an OpenAI-compatible HTTP endpoint (Ollama, OpenRouter, MiniMax, …) for AI features with the `http` provider — no extra CLI required\n- **Optional:** [GitHub CLI](https://cli.github.com/) (`gh`) for PR creation during deployments\n\n## Development\n\n```bash\ngit clone https://github.com/scoobydrew83/sfdt.git\ncd sfdt\nnpm install\nnpm link              # makes `sfdt` available globally from your checkout\n\n# Build the web dashboard\nnpm run build:gui\n\n# Run tests\nnpm test\n\n# Lint\nnpm run lint\n```\n\nAfter `npm link`, the `sfdt` command points to your local checkout.\n\n### Surface catalogs\n\n`generated/` holds machine-generated catalogs of every public surface — commands, MCP tools, GUI\npages, VS Code commands, Chrome features, CI capabilities, and the parity matrix. **Code is\nauthoritative; the catalogs are derived and checked in.** Never edit `generated/*` by hand.\n\nIf you add or change a public surface (a command, a flag, an MCP tool, a GUI page), regenerate and\ncommit the diff:\n\n```bash\nnpm run generate:catalogs   # rewrite generated/* from the code\nnpm run check:all-contracts # what CI runs — fails on drift\n```\n\nCI fails on catalog drift, so a surface change without a regenerated catalog will not merge.\n\n## Contributing\n\nContributions are welcome! Please follow these steps:\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/your-feature`)\n3. Make your changes with tests\n4. Run the test suite (`npm test`) and linter (`npm run lint`)\n5. Commit with a descriptive message\n6. Push to your fork and open a Pull Request\n\nPlease ensure all tests pass and linting is clean before submitting.\n\n## Security\n\nTo report a vulnerability, use [GitHub's private security advisory feature](https://github.com/scoobydrew83/sfdt/security/advisories/new) rather than opening a public issue. See [SECURITY.md](SECURITY.md) for the full policy.\n\n## Acknowledgements\n\nParts of SFDT's Flow tooling are derived from [SF Flow Utility Toolkit](https://github.com/ThisIsMarkJones/SF-Flow-Utility-Toolkit) by Mark Jones (MIT). The derived areas are the Flow Health rules, the flow metadata normalizer, the health scorer, the API name prefixes, the scheduled flow calculator, the metadata cleaner and the default AI prompts, in `@sfdt/flow-core` and the browser extension. The copyright and permission notice, with the full list of derived files, is in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).\n\nThe web dashboard bundles third-party npm packages. `npm run build:gui` writes their licenses to `gui/dist/THIRD_PARTY_LICENSES.md`, which ships in the npm package.\n\n### Related open-source projects\n\nSFDT copies no code from the projects below. They cover overlapping ground, and several are worth running alongside it:\n\n- [Org Check](https://github.com/SalesforceLabs/OrgCheck) (Salesforce Labs): an in-org technical-debt and org-health analyzer. It is the free benchmark for what `sfdt audit` and the AI-Readiness Index evidence pack cover.\n- [Lightning Flow Scanner](https://github.com/Lightning-Flow-Scanner): Flow best-practice rules. `@sfdt/flow-core` checks overlapping concepts (DML/SOQL in loops, missing fault paths, hardcoded IDs), but its rule set and scorer come from SF Flow Utility Toolkit, credited above.\n- [sfdx-git-delta](https://github.com/scolladon/sfdx-git-delta): git-diff → `package.xml` / `destructiveChanges.xml`, the same job as `sfdt manifest` and `sfdt deploy --smart`. SFDT's mapper is an independent implementation.\n- [Salesforce Inspector Reloaded](https://github.com/tprouvot/Salesforce-Inspector-reloaded): the browser power tool the SFDT Chrome extension is designed to sit beside, not replace.\n- [Salesforce Lightning Design System](https://github.com/salesforce-ux/design-system): the SFDT extension's colour palette takes SLDS values (`extension/lib/tokens.ts`). Values only, no SLDS code or assets.\n\n## License\n\n[Apache-2.0](LICENSE)\n"}