Release Notes

New features, improvements, and fixes across the Agentic B2C Developer Toolkit.

September 15, 2026

MCP 3.0.1

MCP

• Restore --allow-non-ga-tools as a deprecated no-op so existing MCP configurations continue to start after upgrading. The server logs a warning that the flag can be removed; tool availability is unchanged. #684

View on GitHub

CLI 2.0.0IDE Extension 1.2.0MCP 3.0.0Agent Skills 1.9.0TypeScript SDK 2.0.0

CLI, Agent Skills, TypeScript SDK

• De-conflict short flags on the mrt command surface so each -x means one thing: (Thanks @kieran-sf!)

  • --cloud-origin moved from -o to -u, freeing -o for --organization (mrt project create / list) and --output (mrt bundle download) — which previously shadowed the base flag. Breaking: update any scripts passing -o for the cloud origin; the long form --cloud-origin is unchanged.
  • mrt project notification create / update: --target (the notification's target-environment list) now also accepts --environment / -e as aliases, since a notification target is an environment. These two commands no longer expose the standalone single-value --environment flag — it was unused there and its --target alias collided with the command's own --target. #676

• Add storefront as an alias for project across the mrt command surface, matching the terminology of the SCAPI MRT API. b2c mrt storefront <cmd> now works identically to b2c mrt project <cmd> (including the member and notification subtopics), and --storefront / -s are accepted anywhere --project / -p is. The new MRT_STOREFRONT / SFCC_MRT_STOREFRONT environment variables act as fallbacks for MRT_PROJECT / SFCC_MRT_PROJECT. The project / --project (-p) forms and the existing MRT_PROJECT variables continue to work unchanged. (Thanks @kieran-sf!)

  -s now uniformly means --project / --storefront on every mrt command. To make that consistent, two commands changed their own short flags (breaking):

  • mrt project create no longer has a --slug flag. Set the new project's slug with --project / --storefront (-p / -s) instead — e.g. b2c mrt project create "My Storefront" -o my-org -s my-storefront. When omitted, MRT auto-generates the slug from the name (unchanged). Update any scripts using --slug.
  • mrt bundle save moved --save-dir from -s to -d, freeing -s for the storefront alias. Update any scripts using -s for the save directory (the long form --save-dir is unchanged).

  mrt project get, update, and delete accept the project slug either as a positional argument or via --project / --storefront (-p / -s; also honoring MRT_PROJECT and dw.json). Symmetrically, mrt env create and mrt env delete now accept the environment slug either as a positional argument or via --environment / -e (also honoring MRT_ENVIRONMENT and dw.json). An explicit positional still wins when both are given.

  Error messages surface the alias too: the "MRT project is required" errors now mention --project / --storefront (-p / -s), and passing a flag twice through an alias (e.g. -p x -s y) now reports which long and short forms refer to the same flag instead of the bare "can only be specified once".

  On the mrt project notification commands, --environment (-e) is now the primary flag for specifying environments (previously --target), matching the rest of the mrt surface. --target / -t are retained as aliases so existing scripts keep working, and command output and --help now say "environment" / "Environments" rather than "target". notification list follows suit with an --environment filter and an Environments column. #676

• Add a --mrt-backend flag (auto | legacy | scapi, default auto; also MRT_BACKEND env var or mrtBackend in dw.json) to b2c mrt commands. It lets mrt bundle history and mrt bundle deploy <bundleId> run over the SCAPI Storefront Deployments API (OAuth, scopes sfcc.storefront.deployments[.rw]) instead of the legacy MRT Cloud API (per-user API key). auto prefers SCAPI when --short-code/--tenant-id and client-credentials or JWT Bearer auth are configured, otherwise uses legacy, and falls back to legacy on safe pre-execution errors (surfacing the SCAPI error instead when no legacy credentials are configured, so the real failure isn't masked); scapi never silently falls back. All other MRT commands — and mrt bundle deploy's local-build push path — remain on the legacy backend. (Thanks @kieran-sf!)

  Under --json, these commands return the serving backend's native response verbatim (legacy {count, next, previous, deployments} vs SCAPI {limit, offset, total, data}) — the human-readable table is normalized across backends, but --json is not, so pin legacy or scapi when a script needs a stable shape. Legacy-only flags (--api-key, --cloud-origin, --credentials-file) now print a warning under --mrt-backend scapi (where the legacy backend that honors them never runs). --project also gains a --storefront / -s alias for the SCAPI storefront ID. #662

• Add b2c mrt bundle upload-v2 for building and uploading v2-format Managed Runtime bundles. The v2 archive is a gzip tar whose files live under a configurable root directory (default bld/) with the SSR configuration written inside the archive at {root-dir}/{config-path} (default bld/.mrt/config.json), uploaded as multipart/form-data. This command is upload-only — deploy the returned bundle ID with b2c mrt bundle deploy <bundleId> -e <env>. Every server-side parameter (root dir, config path, match mode, SSR patterns/parameters, dependencies, and CC overrides) is exposed as a flag. The SDK adds matching createBundleV2, pushBundleV2, and uploadBundleV2 operations. (Thanks @kieran-sf!)

  Bundle commands now read SSR configuration (ssrOnly/ssrShared/ssrParameters) from config.server.ts in the project directory, loaded straight from source, so it no longer needs to be compiled into the build output. Use --project-directory to point at a project other than the current directory (a compiled config.server.js/config.server.mjs and the legacy build/config.server.js are still accepted). For upload-v2, an on-disk v2 config file ({build-dir}/{config-path}) still takes precedence when present; command flags override the resolved values per key. The SDK's createBundle/createBundleV2 gain a projectDirectory option for this.

  Bundles now include the project's declared dependencies as bundle metadata (v1 bundle_metadata.dependencies; v2 bundleMetadata.dependencies inside the archive config), derived from the project package.json (dependencies + devDependencies) — matching pwa-kit/storefront-next. Explicitly provided dependencies (v2 --dependencies) or dependencies already present in the v2 config file take precedence; collection is best-effort and never blocks a bundle if package.json is missing or unreadable. #646

• Detect deprecated OCAPI instances and guide users to SCAPI. (Thanks @clavery!)

  When an instance has OCAPI disabled, code, job, bm, sites, and cap commands now fail with an actionable message — naming the exact SCAPI scope the operation needs (e.g. sfcc.scripts / sfcc.scripts.rw) — instead of an opaque "Failed to ..." error. Documentation and agent skills for code, job, and bm are now SCAPI-first, presenting OCAPI as the deprecated fallback. #413

• Allow SLAS client get, update, delete, and open commands to use the configured SLAS client ID when their positional client ID is omitted, while keeping the positional value as an explicit override. #642

CLI, IDE Extension, Agent Skills, TypeScript SDK

• Migrate job, code, bm users, bm roles, sites, and catalog discovery to SCAPI-first operation with a temporary OCAPI compatibility fallback. auto tries SCAPI when its coordinates and stateless authentication are available, pins the selected backend for multi-request operations, and falls back only on safe capability/auth/request rejections. Site cartridge-path writes, portable BM user search, disabled-user updates, system-job triggers, SDK/CLI/MCP code-version discovery, and VS Code jobs/code/catalog surfaces now participate. Inventory-list enumeration, BM whoami, access-key administration, and raw OCAPI user-search JSON remain temporary OCAPI compatibility operations because the current live SCAPI schemas have no equivalent. Explicit SCAPI mode rejects these operations before contacting OCAPI and identifies B2C Commerce release 26.8 as the current capability baseline. (Thanks @clavery!)

  setup instance create accepts optional SCAPI coordinates for SCAPI-first active-code-version detection. They are not required in auto; missing coordinates select OCAPI, and failed interactive detection reports the reason before allowing manual entry.

  This is a major release because JSON/results can change shape during the migration. job run, job wait, and job search return canonical camelCase fields with either backend, including OCAPI fallback; consumers must update fields such as execution_status to executionStatus. Other commands can retain backend-specific shapes, for which explicitly selecting OCAPI preserves the legacy shape. SDK high-level code helpers accept an explicit scripts backend; dual-backend factories and JobsCompatibilityBackend expose reusable fallback without making implicit backend selection an SDK-wide policy.

  SCAPI currently requires client-credentials or JWT Bearer authentication. Browser-based user auth continues through OCAPI/WebDAV and is selected by auto; explicit SCAPI with user auth errors clearly until the platform adds support.

  GitHub Action v2 adopts CLI 2.x and its camelCase job results. Existing @v1 workflows remain on the maintained CLI 1.x line, preserving the OCAPI behavior and legacy result shapes of operations migrated in CLI 2 until consumers update their Action references to @v2. CLI 1.x commands designed specifically for SCAPI continue to use SCAPI.

  The VS Code extension uses configured tenant IDs consistently in API Browser, keeps partial export discovery warnings in the output log instead of showing notifications, and supports JWT-authenticated OCAPI fallback equivalently to client credentials. #413

CLI, MCP, Agent Skills, TypeScript SDK

• Add b2c-ops runbooks for job health, checkout and failed-order investigation, and incident triage, available as a skills plugin, through CLI installation, and included in the MCP. Add an Operations guide with example requests, recovery checks, and handoffs to administrators, developers, providers, or Salesforce Support. #672

CLI

• Add b2c bm users create to create a Business Manager user (create-or-replace), rounding out the bm users lifecycle alongside list/get/search/update/delete. Runs over SCAPI with OCAPI fallback like the other bm users commands. Flags: --email (required), --first-name, --last-name, --external-id, --password, --role (repeatable), --disabled, and preferred locales. Note that most instances use SSO with Account Manager and reject creating local BM users with LocalUserCreationException — creation succeeds only when the instance is configured to allow local users. #413

IDE Extension, MCP, Agent Skills, TypeScript SDK

• Add embedded Commerce skills through MCP resources and searchable skills_read, with focused configuration, authentication, and workflow guidance and consistent CLI/MCP recommendations. Enable all toolsets by default, streamline debugging and logging, identify tool effects for client approval controls, and support MCP 2026-07-28 alongside earlier clients. Include concise installation, capabilities, configuration, and security documentation. (Thanks @clavery!)

  Update explicit tool selections to use debug_control, debug_inspect, logs_watch, and mrt_logs_watch; remove pwakit_get_guidelines and scapi_custom_api_generate_scaffold. Remove --allow-non-ga-tools from launch commands. Use --toolsets or --tools to customize the catalog and b2c scaffold generate custom-api for local scaffolding. #670

MCP, Agent Skills, TypeScript SDK

• Analyze B2C Commerce sales, merchandising, and technical trends directly through MCP with CIP report discovery and SQL queries. Includes analytics skills, shared configuration and Safety Mode support, and bounded, cancellable queries without a separate CLI installation. (Thanks @clavery!)

  Report discovery includes source tables and sales metric definitions. Sales, payment, and promotion reports return unavailable averages for zero-count groups instead of failing on division by zero. #680

• Add SCAPI code mode with offline discovery of 594 Admin and Shopper operations and standard or custom Admin API execution using automatic authentication and SDK Safety Mode. Compose requests and return focused results through scapi_search and scapi_execute, with bounded execution and actionable access errors. (Thanks @clavery!)

  Discover tenant custom API contracts live and execute their declared Admin operations. Live schema reads include custom-property definitions by default; known custom fields work directly in standard Admin requests. Bundled schemas remain tenant-independent.

  Reuse built-in workflows for product creation with optional category assignment, campaign/promotion inspection, and failed-job triage, or save reviewed workflows for later use. Export Account Manager and SLAS tokens when an external client needs them; normal SCAPI requests authenticate automatically. Code mode restricts local filesystem/process APIs to keep programs focused on API workflows; use terminal and file tools for local development. #670

• Add reusable workflows for job history, execution steps, code versions, and site cartridge paths. Update MCP task guidance and operational runbooks to use these workflows and exact job-log reads with less reliance on the CLI. #680

MCP, TypeScript SDK

• Add MCP tools to browse instance files, read exact logs, and upload or download files without a separate CLI. Cartridge deployment now supports selected files and explicit code versions, with clearer reporting when uploads succeed but reload or cleanup fails. #680

MCP

• Clarify how assistants discover tools and read bundled MCP skills, distinguishing resource reads from native assistant skill commands. #683

Agent Skills, TypeScript SDK

• Fix SCAPI system-job requests so site archive imports and exports, including Page Designer content exports, use the required configuration format. Preserve OCAPI compatibility retries and clarify content authentication guidance. #672

• Apply shared HTTP middleware to SLAS shopper token flows so custom headers such as SFCC_EXTRA_HEADERS reach every request. Preserve redirect and cancellation settings when adding extra request parameters, and document the token response shape. #675

• Refocus Storefront Next guidance on managing existing storefronts with environment-variable updates, logs, deployments, and assistant support. Link to Salesforce's Business Manager setup guides and align the included skills and documentation search with that workflow. #677

IDE Extension, TypeScript SDK

• Made VS Code instance selection workspace-specific by default, with explicit actions to set or follow the shared default without unexpectedly changing other tools and workspaces. Opening an instance's configuration now reveals its exact named entry. #643

IDE Extension

• Add in-editor API Browser setup help for Admin and Shopper connections. Remove misleading Swagger authorization controls and show token failures with guidance instead of leaving authentication pending. #681

Agent Skills

• 46ab439 - Lead SCAPI checkout guidance with the documented order payment-instrument authorization, placement, and failure lifecycle while retaining single-phase order hook orchestration as an option.

• Document SFCC_MRT_BACKEND as a supported way to select the b2c mrt backend (alongside MRT_BACKEND) in the b2c-mrt skill. #662

TypeScript SDK

• Allow embedded: true component types on arch_type: controller. Previously the component type schema required arch_type to be headless whenever embedded was true; embedded content blocks (ECBs) are now supported on both headless and controller storefronts. The embedded ⟺ component_id requirement is unchanged. #666

• MRT commands are now aware of Managed Runtime maintenance (read-only) mode. Read commands (list, get) print a non-blocking warning but still run, while write commands (deploys, bundle uploads, environment changes) are blocked with a clear, actionable error instead of a raw API response — both pointing to the Managed Runtime Admin status page for current status and ETA. #661

• Refresh the shared configuration guide with complete SLAS and instance settings, clearer connection examples, and corrected authentication and credential precedence guidance on the site and in documentation search. #681

• Add a Project Setup guide with optional assistant instructions and team conventions for MCP and standalone skills users, linked from the product pages and available through documentation search. #683

• Fix two b2c mrt backend-selection issues. SFCC_MRT_BACKEND is now honored by mrt commands (previously only the unprefixed MRT_BACKEND was read, unlike the other SFCC_-prefixed MRT env vars). And --mrt-backend legacy no longer emits a spurious SCAPI [StatefulAuth] warning — the SCAPI backend is no longer probed when it cannot be used. #662

• 1b6bdf8 - Preserve snapshot versions after packing the SDK so nightly CLI and MCP releases install the matching nightly SDK instead of an older stable version.

• Include SLAS response correlation IDs in debug logs to help diagnose shopper authentication failures without enabling trace logging. #675

• Redesign the documentation with clearer navigation, quick installation for AI tools, and terminal examples throughout the CLI reference. Highlight documentation search for developers, administrators, and merchants, plus live debugging with an assistant. Explain Safety Mode configuration and confirmations across the CLI, MCP, and IDE extension. Add an llms.txt setup guide and discoverable Markdown pages for agents. Update the bundled documentation search index with the revised guides and setup instructions. #672

Dependency updates

CLI, IDE Extension

• Updated dependencies [304f0eb, 6503d81, 6c8bd53, 3751091, 304f0eb, f208d0c, 407075c, 6503d81, 6503d81, 5741d42, 2f92310, 2f92310, c9cf71f, 2924738, 2dbbf72, 2924738, 1b6bdf8, 407075c, 3773648, 3773648, a0214e4, b2b026c, b2b026c, de36e4a, 304f0eb]:

  • @salesforce/b2c-tooling-sdk@2.0.0

MCP

• Updated dependencies [304f0eb, 46ab439, 6503d81, 6c8bd53, 3751091, 304f0eb, f208d0c, 407075c, 6503d81, 6503d81, 5741d42, 2f92310, 2f92310, c9cf71f, 2924738, 2dbbf72, 2f92310, 2924738, 1b6bdf8, 407075c, 3773648, 3773648, a0214e4, b2b026c, b2b026c, de36e4a, 304f0eb]:

  • @salesforce/b2c-agent-plugins@1.9.0
  • @salesforce/b2c-tooling-sdk@2.0.0

TypeScript SDK

• Updated dependencies [407075c]:

  • @salesforce/b2c-api-schemas@0.2.0

View on GitHub · b2c-agent-plugins@1.9.0 · b2c-vs-extension@1.2.0

August 25, 2026

CLI 1.23.2IDE Extension 1.1.4MCP 2.1.2Agent Skills 1.8.5MRT Utilities 0.3.1TypeScript SDK 1.24.2

MCP, Agent Skills, TypeScript SDK

• Keep debugger server-affinity guidance as a rare PIG-only troubleshooting note instead of prompting users and agents to use dwsid during routine debugging. #638

MRT Utilities

• Improve streamed response performance by using a runtime-appropriate Brotli quality and periodically flushing compressed output. The Brotli quality and flush threshold can now be tuned via the MRT_BROTLI_COMPRESSION_QUALITY (0-11) and MRT_BROTLI_FLUSH_THRESHOLD_BYTES (bytes) environment variables, and the periodic flushing behavior can be disabled by setting MRT_BROTLI_CHUNKING_ENABLED=false. #635

TypeScript SDK

• Remember when an Account Manager client rejects PKCE so later CLI and VS Code sessions start directly with the compatible implicit flow, and avoid reporting authentication success before the PKCE token exchange completes. #634

Dependency updates

CLI, IDE Extension, MCP

• Updated dependencies [5d48cfc, 4dee938]:

  • @salesforce/b2c-tooling-sdk@1.24.2

View on GitHub · b2c-agent-plugins@1.8.5 · b2c-vs-extension@1.1.4

August 20, 2026

MCP 2.1.1Agent Skills 1.8.4

MCP, Agent Skills

• Made MCP project resolution provenance consistent and tool guidance more concise, kept local paths out of tool descriptions, and clarified startup documentation workspace detection. Updated MCP protocol libraries and made tool input schemas reject unknown arguments. #631

View on GitHub · b2c-agent-plugins@1.8.4

CLI 1.23.1IDE Extension 1.1.3MCP 2.1.0Agent Skills 1.8.3TypeScript SDK 1.24.1

MCP, Agent Skills, TypeScript SDK

• Added per-call named-instance selection and consistent resolution provenance to project-aware MCP tools, including persisted context for debugger sessions and log watches. Removed the retired Storefront Next MCP toolset in favor of the current Storefront Next agent skills. #629

Dependency updates

CLI, IDE Extension, MCP

• Updated dependencies [1f25b1e]:

  • @salesforce/b2c-tooling-sdk@1.24.1

View on GitHub · b2c-agent-plugins@1.8.3 · b2c-vs-extension@1.1.3

CLI 1.23.0IDE Extension 1.1.2MCP 2.0.0Agent Skills 1.8.2TypeScript SDK 1.24.0

CLI, IDE Extension, MCP, Agent Skills, TypeScript SDK

• Add a shared global dw.json for the CLI, MCP server, and VS Code extension, managed with b2c setup default-config set|get|unset; primary and global instances are available together without merging their fields. MCP tools now accept per-call projectDirectory and configPath; debugger callers must rename cartridge_directory to cartridgeDirectory and remove client_id. #627

Dependency updates

CLI, IDE Extension, MCP

• Updated dependencies [5f7bff4]:

  • @salesforce/b2c-tooling-sdk@1.24.0

View on GitHub · b2c-agent-plugins@1.8.2 · b2c-vs-extension@1.1.2

August 18, 2026

CLI 1.22.1IDE Extension 1.1.1MCP 1.10.1Agent Skills 1.8.1TypeScript SDK 1.23.0

CLI, Agent Skills, TypeScript SDK

• a90f173 - Make unified configuration inspection recognize all CLI configuration environment variables and aliases, and show resolved authentication, project, service, and safety settings only when configured.

Agent Skills, TypeScript SDK

• a90f173 - Allow projects to configure a non-sensitive default siteId under the package.json b2c key for site-aware commands.

Agent Skills

• e563174 - Clarify how to export B2C data directly into ordered import-set migrations for in-place review and trimming.

• ada3072 - Update the documentation search skill to cover the expanded internal tooling corpus, including CLI reference, MCP, and VS Code extension pages.

TypeScript SDK

• ada3072 - Automatically include internal guides, CLI reference pages, MCP docs, and VS Code extension docs in the tooling search corpus, with CI and release checks that prevent stale indexes. The Developer Center corpus is also refreshed through August 18, 2026.

Dependency updates

CLI, IDE Extension, MCP

• Updated dependencies [ada3072, a90f173, a90f173]:

  • @salesforce/b2c-tooling-sdk@1.23.0

View on GitHub · b2c-agent-plugins@1.8.1 · b2c-vs-extension@1.1.1

CLI 1.22.0IDE Extension 1.1.0MCP 1.10.0Agent Skills 1.8.0MRT Utilities 0.3.0TypeScript SDK 1.22.0

CLI, Agent Skills, TypeScript SDK

• Added ordered, idempotent site archive import sets with verified WebDAV receipts, retry-until-receipted behavior, and serialized concurrent runners. #615

• Import discovered cartridge metadata before migration-directory items, supporting single-archive and ordered-child layouts, an opt-out, and project-configurable recursive source exclusions. #624

• job import-set now prints a consolidated post-import notes summary from a README.md (or README) file at the top of each applied item's directory — the idiomatic place to document manual, instance-specific follow-up steps for a migration. Notes are shown for items applied in the run and previewed for pending items during --dry-run. #619

CLI, IDE Extension, TypeScript SDK

• Add support for creating multiple sandbox clones from a single source in one request (1 to many cloning). (Thanks @charithaT07!)

  • b2c sandbox clone create now accepts --target-count <1-5> to create a batch of clones sharing the same source, TTL, profile, and notification emails. --wait polls every clone in the batch until each reaches a terminal state.
  • b2c sandbox clone list supports --batch-id to filter clones belonging to a specific batch.
  • b2c sandbox clone get and the VS Code extension's clone details view now show the batch ID and sibling clone IDs when a clone was created as part of a batch.
  • The VS Code extension's "Clone Sandbox" command prompts for the number of clones to create and reports aggregate progress across the batch. #611

• Add Authorization Code + PKCE support for browser-based OAuth (public clients) and make it the default for the user auth method, replacing the legacy implicit flow in the default chain. The default auth-method order is now client-credentials, jwt, user. The implicit flow is still selectable via --auth-methods implicit (or in dw.json) for backwards compatibility but emits a deprecation warning — OAuth 2.1 deprecates implicit for public clients. (Thanks @clavery!)

  b2c auth login now uses Authorization Code + PKCE by default and persists a refresh token alongside the access token, so subsequent commands silently refresh without re-opening the browser. The new --auth-methods flag on b2c auth login lets you opt back into the legacy implicit flow (--auth-methods implicit). The POC b2c auth pkce command has been removed; use b2c auth login instead.

  dw.json gains a "user-auth": true shorthand for "auth-methods": ["user"]. It is mutually exclusive with "auth-methods" — setting both is rejected during config mapping.

  To smooth the migration, the user flow includes a transitional safety net: if the configured Account Manager client is not a PKCE-capable public client, it automatically falls back to the implicit flow for that client and logs a deprecation warning recommending you create a new public (PKCE) client and use it. (An AM client's type cannot be changed after creation, so a legacy implicit-only client must be replaced, not converted.) Set SFCC_DISABLE_PKCE_FALLBACK=1 to disable the fallback and surface PKCE failures directly. This fallback is temporary and will be removed once public clients have migrated.

  Persisted browser-auth sessions (which now hold long-lived PKCE refresh tokens) are written 0o600 in a 0o700 directory, so they are no longer world-readable.

  The VS Code extension persists PKCE refresh tokens via OS-keychain-backed SecretStorage (with a sync-snapshot/async-write-through cache), keeping behavior compatible with the unified AuthSessionBackend used by the CLI. #574

CLI, TypeScript SDK

• Show the target hostname and real local source for each import-set item, and reject empty site archive directories before upload with a clear error. #624

• cap:install now warns and prompts for confirmation before installing a Commerce App from a non-Salesforce provider. Use --force to skip the prompt (e.g. in CI or scripted installs); the prompt is also skipped automatically in --json mode. #604

CLI

• b2c setup inspect now redacts the JWT private key passphrase (jwtPassphrase) by default, matching the other secret fields. Use --unmask to show it. #613

CLI, IDE Extension, Agent Skills, TypeScript SDK

• Add support for Page Designer "content blocks" (reusable fragment.*-typed content). (Thanks @clavery!)

  Content blocks are now a first-class node type: the SDK classifies them as FRAGMENT (instead of mislabeling them as components), parses their display name, and exposes Library.getContentBlocks() to list a library's blocks (including unlinked ones). The CLI renders them distinctly in content export/content list (as CONTENT BLOCK), counts them in export summaries, and supports content list --type fragment. In the VS Code extension, each library gains a Content Blocks group that is the single source of truth for a block; because blocks are shared singletons, every page/component that links a block shows a reference that reveals the canonical block in the group rather than an editable copy. (Converting a component into a content block is done in Business Manager / Page Designer — it is not offered here because reproducing it via site-archive import can silently drop a Layout block's child links.) #500

CLI, IDE Extension

• Update the embedded B2C Commerce Script API TypeScript definitions from version 26.7 to 26.9 so IDE IntelliSense reflects the latest platform APIs. #618

MCP, TypeScript SDK

• Add a config_inspect MCP tool that reports the resolved configuration (instance, auth, SCAPI/MRT settings) with the source of each value and the effective project directory — secrets are redacted by default. Filesystem tools now resolve the project directory with explicit precedence (per-call argument, then --project-directory/SFCC_PROJECT_DIRECTORY, then the process working directory) and echo the resolved directory back in their output, so agents can override it per call and see which directory was used across MCP clients that spawn the server from inconsistent working directories. #613

IDE Extension, TypeScript SDK

• Fix sandbox creation in the VS Code extension not granting default OCAPI/WebDAV permissions. New sandboxes created from the extension now grant the configured client ID the same default permissions as the CLI's sandbox create, so code deployment and job execution work without manual permission setup. The shared defaults are now provided by the SDK via buildSandboxSettings. #614

MRT Utilities

• Make DataStore.getEntry shard-aware. When the MRT_NUM_SHARDS environment variable is set to a value greater than 1, reads are spread across shard partitions by selecting a random shard, relieving read pressure on a single hot partition. When MRT_NUM_SHARDS is unset or 1, behavior is unchanged. The getEntry signature and return shape are unchanged, so this is backward compatible. #623

• Harden the data store's DynamoDB client against throttling: it now uses adaptive retries, a bounded number of attempts, and per-attempt connection/request timeouts so a slow or throttled call can no longer consume the whole request budget. Throttling failures are now distinguishable in error logs. #622

IDE Extension

• Start, stop, and restart the active sandbox from the Command Palette (Realm Explorer context menus still target the selected sandbox) #617

• Honor the SFCC_CONFIG environment variable when resolving instance configuration. Previously the extension only looked for a dw.json in the workspace folder and ignored a global dw.json referenced by SFCC_CONFIG, so projects that relied on that env var (e.g. alongside a project .env) resolved to "No B2C Commerce instance configured". The extension now threads SFCC_CONFIG through as the explicit config path, matching the CLI's --config flag. #621

Agent Skills

• Package the plugins to the open Agent Plugins standard (agent-plugins.org v1.0.0). Each plugin now has a root plugin.json manifest with its Codex display metadata under extensions."com.openai", and the MCP server plugin ships a standard mcp.json. This lets Codex, Cursor, GitHub Copilot, VS Code, and Kiro consume the plugins directly; Claude Code continues to install from its marketplace as before. The legacy .codex-plugin/plugin.json manifests are retained during the transition so existing Codex users on older CLI versions are unaffected. #613

• Fix six cross-pack skill links in b2c-scapi-admin and b2c-scapi-shopper that were one directory level short and resolved to paths that do not exist. #609

TypeScript SDK

• Keep site archive and import-set SDK operations silent so CLI consumers exclusively control progress and job-log output. #624

• Refresh the bundled documentation corpora to the 26.8 release so b2c docs (Thanks [@clavery](https://github.com/clavery)!) search/docs read and the MCP docs_* tools surface the latest content:

  • Script API reference and XSD schemas updated to DWAPP 26.8 (adds the dw.commerceapps package, connection-health hooks, and ShippingHooks).
  • Developer Center guides refreshed (adds newly published guides such as SCAPI CDN caching, guest order access codes, and several Storefront Next topics).

  Each corpus index now records where it came from so maintainers can spot the delta before a refresh: git-sourced prose corpora store the upstream commit (source block) and DWAPP-sourced corpora store the platform release (platformDocVersion, e.g. "DWAPP 26.8"). #605

Dependency updates

CLI, IDE Extension, MCP

• Updated dependencies [02ccc2a, 1f553b3, 02ccc2a, 35f2960, d5551f3, 02ccc2a, 591f886, c0ec3f6, 62db97f, 8d096d0, 9382697, 2de9046]:

  • @salesforce/b2c-tooling-sdk@1.22.0

View on GitHub · b2c-agent-plugins@1.8.0 · b2c-vs-extension@1.1.0

July 31, 2026

CLI 1.21.4IDE Extension 1.0.6MCP 1.9.3Agent Skills 1.7.0TypeScript SDK 1.21.3

CLI, Agent Skills, TypeScript SDK

• Fix skill installation output so mixed-source downloads do not show an unresolved version placeholder, repair the b2c-hooks skill frontmatter, and identify the affected skill path in future parsing warnings. #603

Agent Skills

• Add Codex plugin packaging for the B2C DX MCP server so Codex CLI and Codex in the ChatGPT desktop app can install and load the MCP server directly through the B2C Developer Tooling plugin marketplace. Claude Code marketplace installation remains supported by the same plugin. #603

• Correct B2C agent skill examples to use supported Script APIs, hook extension points, OCAPI contracts, and schema-valid metadata. Generated implementations no longer rely on nonexistent APIs or invalid request and response shapes. #601

Dependency updates

CLI, IDE Extension, MCP

• Updated dependencies [94c7ba9]:

  • @salesforce/b2c-tooling-sdk@1.21.3

View on GitHub · b2c-agent-plugins@1.7.0 · b2c-vs-extension@1.0.6

July 29, 2026

IDE Extension 1.0.5

IDE Extension

• Stop the VS Code extension from blocking other extensions in empty or non-B2C windows. Because the extension registers a TypeScript server plugin, VS Code activates it whenever any JavaScript/TypeScript file is opened — including windows with no folder. In that case the extension no longer falls back to the process working directory, and all cartridge/workspace discovery now runs only from a concrete workspace folder and never from a home or filesystem-root directory, so it can't trigger a recursive filesystem scan that stalls the extension host. #598

View on GitHub

July 27, 2026

CLI 1.21.3

CLI

• Fix slas client update corrupting existing callback URIs. When merging with the current client, the command split the API's pipe-delimited callbackUri value on commas instead of pipes, so the entire list was sent back as a single string and the update was rejected with "CallbackURI must be a valid URL". Callback URIs are now parsed with the same shared helper used for redirect URIs everywhere in the SLAS commands, so the two paths can no longer disagree. #596

View on GitHub

CLI 1.21.2IDE Extension 1.0.4MCP 1.9.2Agent Skills 1.6.2TypeScript SDK 1.21.2

CLI, IDE Extension, TypeScript SDK

• Treat activation of an already-active code version as success, preserve useful OCAPI fault details, and avoid redundant activation choices in VS Code. #592

IDE Extension

• Detect nested dw.json project roots in VS Code workspaces and allow nested folders to be pinned from Explorer, so parent-folder and multi-root layouts connect to the intended project. #592

Agent Skills

• Document the sf-toolkit="off" attribute on <isinclude> in the b2c-isml skill, explaining how to disable Storefront Toolkit markers and when to use it. #588

• Document the order hook lifecycle in the b2c-hooks skill: the beforePOST → afterPOST → modifyPOSTResponse sequence, Status.ERROR rollback semantics per phase, the two-hook pattern for persisting a failed order while returning an HTTP error, and request.custom for inter-hook data passing. #577

Dependency updates

CLI, IDE Extension, MCP

• Updated dependencies [f6b4ced]:

  • @salesforce/b2c-tooling-sdk@1.21.2

View on GitHub · b2c-agent-plugins@1.6.2 · b2c-vs-extension@1.0.4

July 23, 2026

CLI 1.21.1IDE Extension 1.0.3MCP 1.9.1Agent Skills 1.6.0TypeScript SDK 1.21.1

CLI, MCP, Agent Skills, TypeScript SDK

• Expose directly related documentation IDs from Salesforce Help child-topic links and Developer Center guide TOCs, including articles previously omitted from composite Help maps or hyphenated topic filenames. CLI and MCP documentation search results can now be paged by ranked position, so agents can traverse the full published content without surfacing future-profiled Help content. #581

Agent Skills

• Add the figma-to-sfnext-pagedesigner plugin: an agent skill that converts a Figma frame into live Storefront Next Page Designer blocks — splitting the frame into one block per section, reconciling brand tokens, generating React + Tailwind components with Page Designer decorator metadata and SCAPI product loaders, and validating design fidelity. Requires the Figma MCP server. Install with claude plugin install figma-to-sfnext-pagedesigner@b2c-developer-tooling. #589

• The b2c-logs skill now documents custom-category log file discovery. It explains that a custom logger category writes to its own custom-<prefix>-*.log file (distinct from customerror), that the prefix is the first argument to Logger.getLogger(prefix, category), and how to find and read these files with logs list --filter custom and logs get --filter custom-<prefix>, plus the webdav ls --root logs fallback. This makes the retrieval skill self-contained for triaging integration and job logs, which almost always use a custom category. #583

Dependency updates

CLI, IDE Extension, MCP

• Updated dependencies [1fe5ff2]:

  • @salesforce/b2c-tooling-sdk@1.21.1

View on GitHub · b2c-agent-plugins@1.6.0 · b2c-vs-extension@1.0.3

July 16, 2026

IDE Extension 1.0.2

IDE Extension

• Prepare the VS Code extension for its 1.0 Marketplace launch with a public-facing README, feature tour, setup guidance, Marketplace installation instructions, and support links. Contributor build, test, and packaging instructions now live in DEVELOPMENT.md. #579

• Point the extension's marketplace repository URL at forcedotcom/b2c-dx. The extension is published from a separate Salesforce-owned repository under open-source governance (public OSS lives under a forcedotcom/salesforce org); development, issues, and pull requests continue in this monorepo. See packages/b2c-vs-extension/PUBLISHING.md for the publish flow. #549

View on GitHub · b2c-vs-extension@1.0.2

CLI 1.21.0IDE Extension 1.0.1MCP 1.9.0Agent Skills 1.5.3TypeScript SDK 1.21.0

CLI, MCP, Agent Skills, TypeScript SDK

• Log commands and tools can now access logs in Logs/ subdirectories (such as internal/). Pass a path-like --filter/prefixes value containing a / — e.g. --filter internal/server to target server-*.log files under internal/, or --filter internal/ for everything in that subdirectory. Plain prefix filters (and the default listing) are unchanged and still only scan the top-level Logs/ directory, so there is no performance impact unless you opt in with a path filter. Works across logs list, logs get, logs tail, and the corresponding MCP tools. #568

IDE Extension

• Add a Marketplace/Open VSX listing icon. The extension previously published with the default placeholder tile; it now ships a 256x256 branded icon (Salesforce cloud + B2C Commerce cart) via the top-level icon manifest field. #578

TypeScript SDK

• Fix b2c docs read failing to load Salesforce Help (Business Manager) articles. Help content is served online but its index entries carried a bundled-file path, so reads tried a nonexistent local file and failed instead of fetching from the source URL. Reads now fetch help articles online as intended. #576

Dependency updates

CLI, IDE Extension, MCP

• Updated dependencies [f169fa1, 633f3cb]:

  • @salesforce/b2c-tooling-sdk@1.21.0

View on GitHub · b2c-agent-plugins@1.5.3 · b2c-vs-extension@1.0.1

July 15, 2026

CLI 1.20.1IDE Extension 1.0.0MCP 1.8.1Agent Skills 1.5.2TypeScript SDK 1.20.1

IDE Extension

• Release the B2C Commerce VS Code extension 1.0. #570

Agent Skills

• 4b3ecd1 - Clarify that commands without a configured client ID reuse the saved stateful session.

• Add storefront-next skills for SCAPI client management and custom API implementation workflows #566

TypeScript SDK

• Fix dead 404 links in the Developer Center guides documentation corpus. The guides index now includes only pages that are published on developer.salesforce.com (referenced from a guide table-of-contents), removing 105 orphaned entries whose URLs returned 404 in b2c docs search/docs read. #572

Dependency updates

CLI, IDE Extension, MCP

• Updated dependencies [3b1152f]:

  • @salesforce/b2c-tooling-sdk@1.20.1

View on GitHub · b2c-agent-plugins@1.5.2 · b2c-vs-extension@1.0.0

July 13, 2026

CLI 1.20.0IDE Extension 0.11.0MCP 1.8.0Agent Skills 1.5.1TypeScript SDK 1.20.0

CLI, TypeScript SDK

• Script API reference content is now read online (from developer.salesforce.com) instead of shipping in the package, reducing the installed SDK/CLI size by ~6 MB. Documentation search is unchanged and still works offline from the bundled index; only docs read for a dw.* class now fetches its content. (Thanks @clavery!)

  To keep reads fast, fetched documentation content (Script API, Developer Center guides, and Salesforce Help) is cached locally — in memory for the session and on disk (under the CLI cache dir) for 7 days — so repeated reads avoid the network. A new b2c docs cache command shows the cache location and size, and b2c docs cache --clear empties it. When a fetch fails, docs read falls back to the indexed summary and prints both the article URL and the raw markdown URL so you can retrieve the page yourself. #563

• Add support for the SCAPI Preferences API. The SDK exposes createPreferencesClient and the CLI exposes a new b2c preferences topic with global list/get/update, site list/get/update/search, and site preference get/update commands. Read scope is sfcc.preferences; write scope is sfcc.preferences.rw. #565

CLI, MCP, TypeScript SDK

• Add a Salesforce Help documentation corpus to docs search/docs read (and the MCP docs tools), covering Business Manager administration and merchandising content from help.salesforce.com. It is split into two categories — help-admin (import/export, jobs, replication, security, Account Manager, permissions, logs, inventory) and help-merchant (catalogs, products, promotions, search, content, analytics, SEO) — so you can search platform-administration and merchandising topics alongside the existing Script API, Developer Center, and tooling docs. (Thanks @clavery!)

  You can scope the whole docs corpus to chosen categories with the new docsCategories config field, sourced from dw.json (docs-categories), the SFCC_DOCS_CATEGORIES env var, or package.json — in addition to the existing --topics / --docs-topics flags (which still override config). For example, set "docs-categories": ["script-api", "job-step", "help-admin", "tooling"] in dw.json to expose only developer + admin docs. #563

CLI

• Remove the b2c setup ide third-party dw.js bridge subcommand and its documentation. The setup ide topic retains vscode-types (vendor Script API TypeScript definitions) and tsserver-plugin (print the TS Server plugin path for LSP editors). Users of the B2C DX VS Code extension need no setup; other editors can use setup ide vscode-types or setup ide tsserver-plugin. #565

CLI, MCP

• docs read / docs_read now apply the same workspace-aware ranking as docs search when resolving a fuzzy query, so a fuzzy read (e.g. productmgr) returns the same top result that search ranks first for the current project. Exact id lookups (e.g. dw.catalog.ProductMgr) are unaffected — they resolve deterministically. The CLI gains a --workspace flag on docs read (defaults to auto-detect; all opts out); the MCP docs_read uses the server's detected workspace. #563

IDE Extension, TypeScript SDK

• Add an interactive Export view to the VS Code extension for building site impex (site archive) exports. Check the data units you want — sites (with per-site flags), global data, catalogs, inventory lists, libraries, customer lists, and price books — then run Export to download and extract the archive locally. Sites, catalogs, and inventory lists are discovered from the instance automatically; libraries, customer lists, and price books are added by ID. The SDK gains a discoverExportableUnits helper that lists the exportable sites, catalogs, and inventory lists on an instance. #565

• Make the VS Code extension resilient offline and when an instance is unreachable. A malformed dw.json no longer prevents the extension from activating, so local code browsing — cartridge discovery, Script API IntelliSense, cartridge-path require resolution, CAP detection, and scaffolding — keeps working without a connection. Connection-dependent views (WebDAV, Content, Sandbox, Logs) now collapse repeated "instance unreachable" errors into a single notification instead of flooding, and the Sandbox view explains when Account Manager OAuth credentials are the missing piece. The SDK's listInstances() now tolerates a malformed dw.json (returning no instances) rather than throwing. #565

IDE Extension

• Surface Custom Step Types as a third category under each cartridge in the Cartridges explorer, alongside Hooks and Job Steps. (Thanks @clavery!)

  • Custom step types are parsed from any steptypes.json under the cartridge (both script-module-step and chunk-script-module-step categories are supported, and the legacy flat-array shape is tolerated).
  • Clicking a step type opens its module implementation (the .js file referenced by the module field) — resolving across sibling cartridges when the module lives in a different cartridge from where it's registered.
  • Right-click → Show Step Type Definition jumps to the @type-id line inside steptypes.json for the alternate navigation target.
  • Nodes for step types whose module cannot be resolved on disk fall back to opening the JSON definition, so the click always does something useful. #565

• Add B2C-DX Analytics (CIP/CCAC) feature to the VS Code extension. Surfaces three webview panels: (Thanks @clavery!)

  • Query Builder — visual SELECT/FROM/WHERE/ORDER BY/LIMIT composer with raw-SQL toggle and a workspace-scoped Saved Queries library tagged per tenant.
  • Tables Browser — schema explorer for the active CIP warehouse tenant.
  • Curated Reports — parameter forms for every cip report … command with date pickers, validation, sortable result grid, and CSV/JSON export.

  Adds multi-realm management (group, add, edit, switch, remove) so a single workspace can target multiple tenants. CIP commands now route through registerSafeCommand so SafetyGuard policies are enforced and a cipAnalytics feature category is recorded by usage telemetry. The shared webview stylesheet is copied into dist/cip-analytics/ at build time so the packaged extension no longer reaches into src/ for runtime assets. #565

• The extension no longer activates on every VS Code startup. It now activates on demand when you open a B2C Commerce workspace (detected via dw.json, .project, cartridge/*.properties, or commerce-app.json), open a B2C view, or run a B2C command — reducing startup overhead in unrelated projects. (Thanks @clavery!)

  Adds an opt-in b2c-dx.features.sandboxFilesystem setting (default off) that automatically mounts the active instance's WebDAV filesystem as a workspace folder. #559

• Improve ISML diagnostics and hover help: (Thanks @clavery!)

  • Add four diagnostics that catch common structural mistakes: <iselse>/<iselseif> outside an <isif>, <isbreak>/<isnext>/<iscontinue> outside an <isloop>, <isreplace> outside an <isdecorate>, and <isprint> setting both style and formatter.
  • The encoding="off" output-escaping warning (stored-XSS risk) is now on by default and fires for every tag with an encoding attribute (previously it was opt-in and only checked a subset of tags). Silence it per line with <iscomment> b2c-dx-disable-next-line encoding-off </iscomment> or globally via b2c-dx.isml.diagnostics.disabledRules.
  • Correct and expand tag hover text (fixes an inaccurate <isscript> tip, documents <isloop> status properties, <isprint> style/formatter, and <iscontent> placement). #565

• Add ISML document formatting and expand ISML diagnostics. (Thanks @clavery!)

  Formatting. ISML files now support Format Document and Format Selection, powered by the same engine as VS Code's built-in HTML formatter (vscode-html-languageservice). <isscript> bodies and ${...} expressions are preserved verbatim, and void ISML tags are normalized to <isxxx/>. Configurable via b2c-dx.isml.format.* and gated by b2c-dx.features.ismlFormatting.

  Diagnostics. Added required-attribute checks (e.g. <isif> needs condition, <isloop> needs an iterator and an alias, <isinclude> needs template or url) and an opt-in encoding="off" output-escaping warning. Every diagnostic now carries a stable rule code shown in the Problems panel.

  Suppression & configuration. Individual lines can be suppressed inline with an ISML comment directive — <iscomment> b2c-dx-disable-next-line <code> </iscomment> (or b2c-dx-disable-line, or no code to suppress all rules on the line) — offered as a quick fix on any diagnostic. Rules can be disabled project-wide via b2c-dx.isml.diagnostics.disabledRules (the encoding-off warning is disabled by default). #565

• Highlight ISML tags (<isif>, <isloop>, <isprint>, <isscript>, etc.) distinctly from plain HTML tags so ISML directives are easier to spot at a glance. Controlled by the b2c-dx.isml.highlightTags setting (on by default); disable it to render ISML tags in the normal HTML tag color. The color follows the active theme and never modifies your settings. #565

• Add ISML language support in the VS Code extension, including .isml file association, grammar and snippets, auto-close and linked editing for tags, diagnostics and quick fixes, symbols/folding/hover, semantic completions (Resource.msg, URLUtils, res.render, require), and template path links/definitions/references across cartridges. #565

• Consolidate the B2C Operations (Jobs) experience into the primary B2C-DX sidebar based on review feedback: (Thanks @clavery!)

  • Single Job History view under the existing b2c-dx container (collapsed by default). The standalone "B2C-DX Operations" sidebar and the React-based Job History table webview have been removed — all controls now live in the tree's title bar.
  • No fetch on activation. The view shows a load hint until you press Refresh (or enable the new Auto-Refresh toggle). A new b2c-dx.jobs.autoRefresh setting (off by default) and a title-bar toggle control opt-in polling.
  • Chronological-first root view. Job History now defaults to a BM-style flat timeline of recent executions, with a title-bar toggle to switch to the previous "group by job" view. New b2c-dx.jobs.defaultGrouping setting controls the default.
  • Default status filter is all, fixing the empty-view-on-first-load defect (previously required clicking the filter before anything appeared).
  • Inline name filter in the title bar (BM-style job-name search).
  • Open in Business Manager deep-links directly to Administration › Operations › Jobs instead of the BM landing page.
  • Job Definitions view removed. Its useful action — Create Job Scaffold — moves to a right-click on a cartridge in the Cartridges explorer.
  • Cartridges explorer broadened to expand each cartridge into Hooks and Job Steps child nodes (parsed from hooks.json and cartridge/scripts/jobsteps/). Click a file to open it. #565

• Add a B2C Operations (Jobs) experience to the VS Code extension: (Thanks @clavery!)

  • Job History — view execution history from the connected instance, including jobs that are currently running (shown live with a spinner and auto-refresh), with a table to search, filter (status, job, user, date, time presets), sort, and export runs to CSV/JSON. Each run has inline actions to open its log, view details, and re-run.
  • Job Definitions — view the jobs (jobs.xml) and custom step types (steptypes.json) defined in your workspace cartridges, with actions to run, deploy, and open the source files.
  • Run / Re-run — trigger a job (optionally with parameters), poll it to completion, and open its log automatically. Re-run reuses the original execution's parameters.
  • Create Job Scaffold — generate a custom job step script, its steptypes.json registration, and a matching jobs.xml that references the registered custom.* step type.
  • Deploy Job Definition — deploy a jobs.xml to register the job in Business Manager.

  System (sfcc-*) jobs are distinguished from custom jobs, and actions that don't apply to them are disabled with an explanation. #565

• Add XSD-based validation, autocomplete, and hover docs for B2C metadata XML files, backed by ~50 bundled schemas (catalogs, promotions, jobs, services, A/B tests, page-meta-tags, sorting rules, source codes, content libraries, event routing, and more). (Thanks @clavery!)

  Namespace-based association. Validation is matched by the document's declared XML namespace, not by filename or folder layout, so a metadata file validates against the correct schema wherever it lives — in a canonical site-archive (sites/<id>/…), an exploded metadata/ workspace, or anywhere else. The extension ships an XML catalog and registers it with the Red Hat XML language server at runtime; no changes are written to your settings.json.

  Optional companion extension. Validation is powered by the Red Hat XML extension (redhat.vscode-xml), a soft dependency — it is not force-installed and no Java runtime is required. When you open a B2C metadata XML file, the extension offers to install it (with a "Don't ask again" option); until then the extension is unaffected. You can trigger setup any time via the B2C DX: Set Up Metadata XML Validation command, and disable the whole feature with the b2c-dx.features.xmlValidation setting. Teams whose policies block third-party extensions can simply decline the prompt. #565

• Fix the VS Code extension failing to activate when ISML support is enabled. The src/isml/scanner.ts module loaded vscode-html-languageservice via runtime require() calls that esbuild left unbundled. Because the VSIX is packaged with vsce --no-dependencies, the deep submodule paths could not be resolved at runtime and activation crashed silently — no "B2C DX" output channel, no instance selector, no commands. Switched to direct ESM imports so esbuild inlines the scanner code into the bundle. #565

• Harden ISML language support: (Thanks @clavery!)

  • Treat <isslot>, <ismodule>, and <iscomponent> as empty (self-closing) elements, so auto-close no longer inserts invalid closing tags and diagnostics no longer report them as "not closed".
  • Ignore markup inside <iscomment> and <isscript> bodies — commented-out ISML and < characters in scripts no longer produce false diagnostics, folding, or symbols.
  • Debounce diagnostics so large templates are not re-linted on every keystroke.
  • Guard the "create template" command against being run directly from the command palette.
  • Resolve template links without the vscode-html-languageservice dependency, removing a fragile deep import into that package's internals. #565

• Gate the developer onboarding walkthrough behind a new b2c-dx.features.onboarding setting (Preview, off by default). The guided walkthrough, role-based deep-dive panel, and their palette commands no longer appear — and the walkthrough no longer auto-opens on first activation — unless the setting is enabled. Set b2c-dx.features.onboarding to true to opt in while the feature is still in development. #565

• Stop bundling development-only files into the published extension. The packaged VSIX no longer includes the test-workspace/ sample cartridges or local .claude/ editor settings, reducing package size and removing files that were never meant to ship. #565

Agent Skills

• Update the b2c-docs skill for the new Salesforce Help corpus (help-admin, help-merchant), the docsCategories config field, and the b2c docs cache command (online content caching + purge). #563

• Update the b2c-config skill's IDE integration section to reference setup ide vscode-types and setup ide tsserver-plugin for Script API IntelliSense. #565

Dependency updates

CLI, IDE Extension, MCP

• Updated dependencies [9fb332d, 9fb332d, 54d69bc, 54d69bc, 54d69bc]:

  • @salesforce/b2c-tooling-sdk@1.20.0

View on GitHub · b2c-agent-plugins@1.5.1 · b2c-vs-extension@0.11.0

July 9, 2026

CLI 1.19.1IDE Extension 0.10.4MCP 1.7.0TypeScript SDK 1.19.1

MCP, TypeScript SDK

• Fix costly recursive filesystem scan on MCP server startup. Workspace auto-discovery previously did an unbounded **/.project walk from the launch directory, which could hang startup when the server was spawned from a home directory (as Cursor and Claude Code often do). Discovery is now skipped entirely when explicit --toolsets/--tools are provided, skipped for home and root directories, and otherwise depth-bounded and short-circuited at the first match. findCartridges gains optional maxDepth and firstMatchOnly options for callers that need a bounded search (existing callers are unaffected). #557

Dependency updates

CLI, IDE Extension, MCP

• Updated dependencies [71dfe3a]:

  • @salesforce/b2c-tooling-sdk@1.19.1

View on GitHub · b2c-vs-extension@0.10.4

July 8, 2026

CLI 1.19.0IDE Extension 0.10.3MCP 1.6.0Agent Skills 1.5.0TypeScript SDK 1.19.0

CLI, MCP, Agent Skills, TypeScript SDK

• Add Metrics API support (CLOSED BETA). The new SCAPI Observability Metrics API (observability/metrics/v1) is now available across the tooling: (Thanks @clavery!)

  • SDK: a typed createMetricsClient plus getOverallMetrics, getSalesMetrics, getEcdnMetrics, getThirdPartyMetrics, getScapiMetrics, getScapiHooksMetrics, getMrtMetrics, getControllerMetrics, getOcapiMetrics, and getMetricsByCategory operations that fetch operational time-series metrics for an organization. Admin OAuth scope sfcc.metrics is handled automatically. Time bounds accept a Date or epoch milliseconds and are sent to the API as epoch seconds; response timestamps are normalized to epoch milliseconds. Optional enrichMetricsTags/parseSeriesTags helpers add a structured tags object (realm, environment, applied filters, and per-series dimensions like apiFamily/host/cacheStatus) to each series, so consumers can group and filter by dimension instead of parsing the packed series id.
  • CLI: a new metrics topic with per-category commands (b2c metrics overall, b2c metrics scapi, b2c metrics ocapi, etc.) and b2c metrics list — with table and --json output. The time window is set with --from/--to (relative like 1h/7d or ISO 8601) and an optional --window duration (e.g. --from 7d --window 1h for a one-hour window seven days ago). Any open bound defaults to a 24-hour window (the API caps a window at 24 hours), so requests always send an explicit range. Category-specific filter flags (--api-family, --api-name, --ocapi-category, --ocapi-api, --third-party-service-id) live only on the command they apply to. Each series is enriched with a structured tags object by default; use --no-tags for the raw API shape.
  • MCP: a metrics_get tool in the SCAPI toolset (gated as non-GA; requires --allow-non-ga-tools). Series are returned with the structured tags object.

  This is a closed beta feature: it must be enabled for your organization, and its behavior, output, and OAuth scopes may change without notice. #552

MCP, Agent Skills

• Pin the b2c-dx-mcp Claude Code plugin to the exact published MCP server version instead of @latest, and version its marketplace entry. npx reuses a cached package for a floating tag, so users could keep running a stale server (e.g. missing the latest docs tools) after an upgrade — an exact version forces a fetch, and versioning the marketplace entry makes clients re-pull the new pin. The pin and marketplace version track the MCP release automatically. #556

Dependency updates

CLI, IDE Extension, MCP

• Updated dependencies [fdf3c5f]:

  • @salesforce/b2c-tooling-sdk@1.19.0

View on GitHub · b2c-agent-plugins@1.5.0 · b2c-vs-extension@0.10.3

CLI 1.18.0IDE Extension 0.10.2MCP 1.5.0Agent Skills 1.4.5TypeScript SDK 1.18.0

CLI, MCP, Agent Skills, TypeScript SDK

• Add B2C Commerce Developer Center guides and tooling docs to b2c docs (CLI), the docs_* MCP tools, and the SDK docs module. Documentation search now spans Script API reference, standard job steps, Developer Center guides (Commerce API, PWA Kit, SFRA, Storefront Next, B2C Commerce), and this tooling's own guides, with content-aware ranking and workspace-aware results tuned to the detected project type. #546

CLI, TypeScript SDK

• Clarified SFCC_SHORTCODE vs SFCC_SHORT_CODE env var usage #550

• Improve "configuration required" errors and error telemetry: (Thanks @clavery!)

  • When a command needs instance/auth configuration but no source is found at all (no flags, environment variables, or dw.json), the error now points to the configuration guide (https://salesforcecommercecloud.github.io/b2c-developer-tooling/guide/configuration.html) so first-time users know where to start. When a config source is present, the existing message (which lists the specific flag/env var to set) is unchanged.
  • Command-error telemetry now tags each error with a category (validation, guardrail, or runtime) so expected user/config errors and safety-guard blocks can be separated from genuine runtime failures when measuring reliability.
  • All telemetry events now include an isCI flag indicating whether they originated from a CI/automation environment, so automation traffic can be distinguished from interactive developer usage. #525

• Fix OAuth client authentication failing for client secrets containing + (or other reserved characters). Per RFC 6749 §2.3.1, the client ID and secret are now form-url-encoded before being Base64-encoded into the HTTP Basic Authorization header, matching how they are already encoded when sent in the request body. Previously a raw + in a secret was decoded to a space by Account Manager, causing invalid_client errors on Basic auth even though the same credential worked via the request body. Affects the client-credentials/password grants (b2c auth client, token renewal) and SLAS private-client flows. #551

CLI, MCP, TypeScript SDK

• Documentation entries now expose both a human-facing url (the rendered .html page, for citing/opening in a browser) and a machine-readable sourceUrl (the raw .md). Content is always sourced from .md, and Script API reference entries gain durable developer.salesforce.com permalinks (previously only guides had URLs). Surface them in the CLI with --columns url,sourceUrl (or -x) and in the MCP docs_search verbose output. #546

MCP, Agent Skills

• Stop MCP debug tools from routinely suggesting the session cookie (dwsid). The cookie is only needed in the rare multi-app-server production instance group case where a breakpoint is never hit — it is now surfaced as a troubleshooting hint on breakpoint timeout instead of in the debug_start_session/debug_list_sessions descriptions. Also clarifies that the debugger needs standard Basic auth (account password or a WebDAV File Access and UX Studio access key) with no separate Business Manager enablement step. #545

IDE Extension, MCP

• Telemetry for MCP tool failures and VS Code extension activation failures now records the underlying error message (and cause, when present), instead of an empty value. Previously these failure events carried no error detail, which made it impossible to diagnose why a tool call or activation failed. No new data beyond the error text is collected, matching what the CLI already reports for command errors. #525

Agent Skills, TypeScript SDK

• Reworked the MCP Server documentation to be leaner and human-focused: trimmed internal implementation prose from the tool reference pages, reorganized the nav around toolsets and logical tool groups (combined the two log pages and the two SCAPI custom-API pages, with client-side redirects from the old URLs), corrected the project-type auto-detection table, and removed agent-directed prompting guidance. Renamed the homepage/header "Agent Skills" entry to "Agent Plugins" and grouped the MCP plugin with the core plugins in the install instructions. The b2c-docs skill now notes that the MCP docs_* tools offer the same coverage as the CLI. (Thanks @clavery!)

  The tooling documentation corpus (the CLI/MCP/SDK guides available via docs search/read) no longer bundles a copy of each page's markdown in the SDK — like the Developer Center guides, its content is now fetched online from the docs site at read time (with an offline fallback to the indexed summary). This shrinks the package and stops doc edits from duplicating content into the SDK. #553

IDE Extension

• Improve the B2C Logs view when tailing. Log entries are now color-coded by level (error, warn, info, debug) with a built-in level filter, each entry is tagged with its source log prefix (e.g. [error], [customerror]), and multi-line stack traces are indented so each entry reads as a single block. Uses the same "B2C Logs" output channel — no new panel or command. #517

TypeScript SDK

• Add optional preview property to the page-type JSON Schema to mirror ECOM W-23233931. #542

• Bound the online documentation fetch (Developer Center guides read via docs_read) with a 10s timeout. Previously a stalled or unreachable connection would hang the read indefinitely; it now falls back to the indexed offline summary once the timeout elapses. #554

• Fix Storefront Next workspace detection misclassifying PWA Kit projects. A PWA Kit app that depends on @salesforce/storefront-next-runtime (now common) was incorrectly detected as Storefront Next as well. Detection now keys on the @salesforce/storefront-next-dev toolchain dependency, and a positive PWA Kit signal rules out Storefront Next. #546

• Refresh bundled Script API docs, XSD schemas, Page Designer content schemas, and standard job-step data to platform version DWAPP 26.7. The content validate command now matches the current platform rules for Page Designer component types — component_id accepts the full platform character set and is only valid on embedded components (embedded: true). #543

• Fix b2c slas token registered-customer login failing against a private SLAS client with HTTP 400 code_verifier is required. The registered login flow is always PKCE-protected, so the token exchange now always sends the code_verifier with the authorization_code_pkce grant — and, for private clients, additionally authenticates with the client secret via HTTP Basic. Registered login now works on both public and private clients; guest and client_credentials flows are unchanged. #538

Dependency updates

CLI, IDE Extension, MCP

• Updated dependencies [04b02f3, 3d0c4aa, 85e6ca1, 7055134, 85e6ca1, 9418f08, 85e6ca1, 31ec679, b62b00b, 31324e1, cab53af]:

  • @salesforce/b2c-tooling-sdk@1.18.0

View on GitHub · b2c-agent-plugins@1.4.5 · b2c-vs-extension@0.10.2

Older Releases

Releases before July 2026 on GitHub