v3.0.0

Full Changelog: v2.12.0...v3.0.0

v2.8.7

v2.8.7

This is the first GitHub Release for this repo, so it covers everything shipped in git since npm's last published version (v2.8.0) — 7 patch releases and 42+ real bugs found and fixed by testing against a live org, not just code review.

Added

• sf_create_external_client_app — Salesforce's newer replacement for Connected Apps. Unlike sf_create_connected_app, its Client Credentials Flow "Run As" user (clientCredentialsFlowUser) is settable via the Metadata API, verified live — on a classic Connected App that same setting is Setup-UI-only. Tool count: 222.

Fixed

• sf_create_connected_app could never successfully grant any OAuth scope — every scope value used the wrong casing versus Salesforce's actual metadata enum (api vs Api). Fixed with each literal verified against a live org; also added the chatbot_api scope needed for Agent API callers.
• Agentforce agent creation was broken end to end (v2.8.4): GenAiPlanner no longer exists as a type (superseded by GenAiPlannerBundle), the agent→planner link was never written by any tool, and sf_create_agent broke outright whenever instructions was passed.
• 8 more Agentforce/Einstein bugs (v2.8.5): sf_retrieve_metadata started an async job but could never actually return the result; sf_create_einstein_bot and sf_create_einstein_prediction were both non-functional (5 separate XML defects between them).
• 10 Flow bugs (v2.8.3): sf_create_flow and sf_create_flow_from_xml turned out to be two independent XML generators — the one sf_create_flow actually uses had never been tested; record-triggered and scheduled flows never deployed at all.
• 5 bugs across dashboards, escalation rules, field dependencies, global value sets, business processes (v2.8.2), including missing XML-escaping that broke any deploy containing &.
• 5 bugs in code-scanning and package tools (v2.8.1): sf_run_code_scanner/sf_scan_apex_antipatterns 404'd on every call; several CLI-wrapping tools swallowed the real Salesforce error message and surfaced only a generic failure; sf_install_package hung on any package requesting site-access approval.
• Removed 5 fake-passing Agentforce/Einstein tests from test-suite.mjs that could never fail (try/catch always returning success) and exercised orphaned code no MCP tool actually calls — real coverage now lives in dedicated qa-agentforce.mjs/qa-agentforce-adjacent.mjs suites.
• Fixed sf_create_connected_app's own regression test, which called the function with a wrong parameter name and omitted both required fields — very likely how the scope-casing bug above went unnoticed for as long as it did.

Investigated, not a code defect

Agentforce custom action creation (GenAiFunction) is blocked by org licensing/edition in the test org used for this project, confirmed by attempting to assign the relevant Permission Set License directly (Salesforce rejected it: user license doesn't support it). Agent activation and Consumer Secret retrieval have no API path on either Connected Apps or External Client Apps — both are Setup UI only, by Salesforce's own design.

Full details for every fix: CHANGELOG.md