• Usage
• Notes on org access
• Security settings as code
• Commands

Usage

$ npm install -g qdx-plugin
$ sf COMMAND
running command...
$ sf (--version)
qdx-plugin/2.1.0 darwin-arm64 node-v24.14.0
$ sf --help [COMMAND]
USAGE
  $ sf COMMAND
...

Notes on org access

This plugin talks to Salesforce orgs directly through the official Salesforce libraries (@salesforce/core, @salesforce/source-deploy-retrieve, @salesforce/apex-node) — no sf or sfdx CLI is required at runtime. Orgs authenticated with the Salesforce CLI are picked up automatically (same auth files, same aliases).

Changes from earlier releases that shelled out to the retired sfdx CLI:

• sf qdx package now takes the org as --target-org/-o. The old --username flag still works as a deprecated alias and prints a warning; the short -u form is gone.
• sf qdx package --delete deletes components from the org only (a destructive deploy). It no longer removes local source files — clean those up manually or via git.
• sf qdx migrate loads data with Bulk API v2. Result logs show succeeded/failed/unprocessed counts plus failed-record details instead of Bulk v1 job and batch payloads.
• The metadata describe data used to map file paths to metadata types is no longer bundled. It is fetched from the org once and cached at .qdx/metadata-describe.json, keyed by API version. The first manifest build in a project (and any run after the project's API version changes) needs --target-org to seed or refresh the cache; after that, manifest building works offline.

Security settings as code

The sf qdx security commands manage an org's SecuritySettings (password policies, session settings, CSRF/clickjack protections, and more) as YAML files in the manifest/ folder:

• sf qdx security retrieve -o myorg — write the org's full security settings to manifest/security.yml for reference.
• sf qdx security baseline — write manifest/security-baseline.yml with recommended values aligned with Salesforce Security Health Check guidance. Edit it to define your desired posture; delete any lines you don't want managed. Trusted IP ranges (networkAccess) are not included by default because they are org-specific.
• sf qdx security assess -o myorg — compare the org against the baseline (only the settings listed in the baseline are checked) and write a JSON drift report to manifest/security-assessment.json with current value, desired value, and severity per finding. Exits non-zero when drift exists, so it can gate CI pipelines.
• sf qdx security deploy -o myorg — deploy the settings in a YAML file (default: the baseline) to the org. Only the settings present in the file are touched; everything else is left unchanged. Shows the pending changes and asks for confirmation (--no-prompt for CI, --checkonly to validate without applying).

The typical loop: baseline → edit to taste → assess → deploy → assess (clean).

Commands

• sf qdx migrate
• sf qdx package PACKAGENAME [COMMIT1] [COMMIT2]
• sf qdx release RELEASENAME
• sf qdx security assess
• sf qdx security baseline
• sf qdx security deploy
• sf qdx security retrieve
• sf qdx snippet

sf qdx migrate

Migrate data from one org to another based on a migration plan.

USAGE
  $ sf qdx migrate [--json] [--flags-dir <value>] [-d <value>] [-f <value>] [--sample] [-s <value>] [-n <value>]
    [--clear-data-folder] [--clear-ref-folder]

FLAGS
  -d, --destination=<value>  Destination org username or alias.
  -f, --file=<value>         Path of migration plan file. Must be relative to cwd and in unix format.
  -n, --name=<value>         Name of the step to execute.
  -s, --source=<value>       Source org username or alias.
      --clear-data-folder    Clear the data folder before processing.
      --clear-ref-folder     Clear the reference folder before processing.
      --sample               Copy sample migration plan files to current directory.

GLOBAL FLAGS
  --flags-dir=<value>  Import flag values from a directory.
  --json               Format output as json.

DESCRIPTION
  Migrate data from one org to another based on a migration plan.

  Migrate data from one org to another based on a migration plan.

ALIASES
  $ sf qdx migrate

EXAMPLES
  $ sf qdx migrate --source prod --destination dev --file migrationPlan.js

  $ sf qdx migrate --sample

  $ sf qdx migrate --name Demo_Step_1 --source prod --destination dev

See code: src/commands/qdx/migrate.ts

sf qdx package PACKAGENAME [COMMIT1] [COMMIT2]

Build a package manifest and retrieve/deploy it using Salesforce APIs.

USAGE
  $ sf qdx package PACKAGENAME [COMMIT1] [COMMIT2] [--json] [--flags-dir <value>] [-s] [--diff] [--diffwithbase
    <value>] [--dir] [--csv] [--yaml] [-p <value>] [--version <value>] [-r] [-d] [--delete] [--checkonly] [--projectpath
    <value>] [-o <value>] [--fill] [--full] [--feature]

ARGUMENTS
  PACKAGENAME  Name of the package
  [COMMIT1]    First git commit hash (for --diff)
  [COMMIT2]    Second git commit hash (for --diff)

FLAGS
  -d, --deploy                Deploys source already retrieved.
  -o, --target-org=<value>    Target org username or alias.
  -p, --path=<value>          Path to app directory or csv file.
  -r, --retrieve              Retrieve source based on YAML configuration.
  -s, --start                 Start a new package. Will create YAML file if not already exist.
      --checkonly             Set to true for deployment validation.
      --csv                   Build metadata components based on a csv file.
      --delete                Delete the specific components listed in the yaml file.
      --diff                  Build metadata components by running a diff.
      --diffwithbase=<value>  Components added in current branch based on diff with base.
      --dir                   Build metadata components based on directory contents.
      --feature               Output package to manifest/feature/ directory for feature-based management.
      --fill                  Set to true to include all metadata for types listed in yaml.
      --full                  Set to true to get a complete list of all metadata available.
      --projectpath=<value>   Base path for the project code.
      --version=<value>       API version to use for SFDX.
      --yaml                  Build metadata components based on a yml file.

GLOBAL FLAGS
  --flags-dir=<value>  Import flag values from a directory.
  --json               Format output as json.

DESCRIPTION
  Build a package manifest and retrieve/deploy it using Salesforce APIs.

  Build a package manifest and retrieve/deploy it using Salesforce APIs.

  # To Start a new package
  sf qdx package [packageName] --start

EXAMPLES
  $ sf qdx package myPackage --start

  $ sf qdx package myPackage --diff commit1 commit2

  $ sf qdx package myPackage --yaml -p path/to/file.yml

  $ sf qdx package myPackage --retrieve -o [email protected]

  $ sf qdx package myPackage --deploy -o [email protected]

See code: src/commands/qdx/package.ts

sf qdx release RELEASENAME

Compose a release package from feature packages.

USAGE
  $ sf qdx release RELEASENAME [--json] [--flags-dir <value>] [--add <value>...] [--remove <value>...]

ARGUMENTS
  RELEASENAME  Name of the release

FLAGS
  --add=<value>...     Feature name to add to the release.
  --remove=<value>...  Feature name to remove from the release.

GLOBAL FLAGS
  --flags-dir=<value>  Import flag values from a directory.
  --json               Format output as json.

DESCRIPTION
  Compose a release package from feature packages.

  Compose a release package by adding or removing feature packages.

  Features are created with `sf qdx package <name> --feature` and stored in manifest/feature/.
  Releases merge feature packages into a single manifest for deployment.

EXAMPLES
  $ sf qdx release sprint-42 --add login-flow

  $ sf qdx release sprint-42 --add login-flow --add dashboard-revamp

  $ sf qdx release sprint-42 --remove login-flow

See code: src/commands/qdx/release.ts

sf qdx security assess

Assess the org's security settings against a baseline.

USAGE
  $ sf qdx security assess [--json] [--flags-dir <value>] [-o <value>] [-b <value>] [-f <value>] [--version <value>]

FLAGS
  -b, --baseline=<value>    [default: manifest/security-baseline.yml] Path of the baseline YAML file to assess against.
  -f, --file=<value>        [default: manifest/security-assessment.json] Path of the JSON report file to write.
  -o, --target-org=<value>  Target org username or alias.
      --version=<value>     API version to use.

GLOBAL FLAGS
  --flags-dir=<value>  Import flag values from a directory.
  --json               Format output as json.

DESCRIPTION
  Assess the org's security settings against a baseline.

  Retrieves the org's SecuritySettings and compares them against the baseline YAML. Only settings listed in the baseline
  are checked. Writes a JSON drift report and exits non-zero when any setting differs, so it can gate CI pipelines.
  Requires a baseline; create one with "sf qdx security baseline".

EXAMPLES
  $ sf qdx security assess -o [email protected]

  $ sf qdx security assess -o [email protected] --baseline manifest/prod-baseline.yml

See code: src/commands/qdx/security/assess.ts

sf qdx security baseline

Create a security settings baseline YAML with recommended values.

USAGE
  $ sf qdx security baseline [--json] [--flags-dir <value>] [-f <value>] [--force]

FLAGS
  -f, --file=<value>  [default: manifest/security-baseline.yml] Path of the baseline YAML file to write.
      --force         Overwrite the baseline file if it already exists.

GLOBAL FLAGS
  --flags-dir=<value>  Import flag values from a directory.
  --json               Format output as json.

DESCRIPTION
  Create a security settings baseline YAML with recommended values.

  Writes a baseline of recommended security settings (aligned with Salesforce Security Health Check guidance) that you
  can edit to define your desired posture, then use with "sf qdx security assess" and "sf qdx security deploy". Trusted
  IP ranges (networkAccess) are not included because they are org-specific; add them manually if desired. No org
  connection is required.

EXAMPLES
  $ sf qdx security baseline

  $ sf qdx security baseline --file manifest/prod-baseline.yml --force

See code: src/commands/qdx/security/baseline.ts

sf qdx security deploy

Deploy security settings from a YAML file to the org.

USAGE
  $ sf qdx security deploy [--json] [--flags-dir <value>] [-o <value>] [-f <value>] [--checkonly] [--no-prompt]
    [--version <value>]

FLAGS
  -f, --file=<value>        [default: manifest/security-baseline.yml] Path of the settings YAML file to deploy.
  -o, --target-org=<value>  Target org username or alias.
      --checkonly           Validate the deployment without applying any changes.
      --no-prompt           Skip the confirmation prompt (for CI use).
      --version=<value>     API version to use.

GLOBAL FLAGS
  --flags-dir=<value>  Import flag values from a directory.
  --json               Format output as json.

DESCRIPTION
  Deploy security settings from a YAML file to the org.

  Deploys the settings listed in the YAML file (default: the baseline) to the org via the Metadata API. Only the
  settings present in the file are deployed; all other org settings are left unchanged. Shows the settings that will
  change and asks for confirmation before deploying.

EXAMPLES
  $ sf qdx security deploy -o [email protected]

  $ sf qdx security deploy -o [email protected] --checkonly

  $ sf qdx security deploy -o [email protected] --file manifest/security.yml --no-prompt

See code: src/commands/qdx/security/deploy.ts

sf qdx security retrieve

Retrieve the org's security settings as a YAML file.

USAGE
  $ sf qdx security retrieve [--json] [--flags-dir <value>] [-o <value>] [-f <value>] [--version <value>]

FLAGS
  -f, --file=<value>        [default: manifest/security.yml] Path of the YAML file to write.
  -o, --target-org=<value>  Target org username or alias.
      --version=<value>     API version to use.

GLOBAL FLAGS
  --flags-dir=<value>  Import flag values from a directory.
  --json               Format output as json.

DESCRIPTION
  Retrieve the org's security settings as a YAML file.

  Reads the org's SecuritySettings via the Metadata API and writes the full settings tree as YAML (default:
  manifest/security.yml).

EXAMPLES
  $ sf qdx security retrieve -o [email protected]

  $ sf qdx security retrieve -o [email protected] --file manifest/prod-security.yml

See code: src/commands/qdx/security/retrieve.ts

sf qdx snippet

Convert code file to VSCode snippet.

USAGE
  $ sf qdx snippet -a <value> -p <value> [--json] [--flags-dir <value>]

FLAGS
  -a, --alias=<value>  (required) Alias for the snippet.
  -p, --path=<value>   (required) Path to file that needs to be converted to snippet.

GLOBAL FLAGS
  --flags-dir=<value>  Import flag values from a directory.
  --json               Format output as json.

DESCRIPTION
  Convert code file to VSCode snippet.

  Convert a code file into a VSCode code snippet and save it to the project's .vscode directory.

EXAMPLES
  $ sf qdx snippet -a mySnippet -p src/myFile.cls

See code: src/commands/qdx/snippet.ts