Changelog

SFDT follows Keep a Changelog  and Semantic Versioning . Each workspace maintains its own changelog in the repository; this page summarizes recent highlights.

@sfdt/cli — 0.22.0

• .sfdt/config.json is no longer trusted. That file is meant to be committed, so it arrives with whatever repository you cloned. The settings in it that execute code or choose where secrets are sent — plugins[], pluginOptions.autoDiscover, mcp.salesforce.command, a non-loopback ai.baseURL, and a channel’s headersEnv beside a literal remote URL — are now refused at load time unless you export SFDT_ALLOW_UNSAFE_CONFIG=1. If you use plugins or a remote AI endpoint, this affects you — see Configuration and Plugins. Loopback ai.baseURL (Ollama, LM Studio, llama.cpp, vLLM), ai.apiKeyEnv, webhookUrlEnv channels, and defaultOrg are unaffected.
• AI provider sandboxes are no longer disabled by an empty tool list. allowedTools: [] means “no tools at all”, but the gate tested for a non-empty list — so the most restrictive request a caller could make silently dropped the read-only sandbox.
• @sfdt/flow-core 0.11.0 adds extractFieldWrites / filterFieldWrites — “what writes this field?” from a Flow metadata payload, with confirmed/inferred status matching the dependency gaps report. Consumer ranges move to ^0.11.0 in lockstep.

@sfdt/extension — 0.12.0

• A Workspace Overview home. The empty “pick a tool to get started” pane is now a dashboard: org-health tiles, quick actions, and a recent-activity table. The header also shows the org’s API version alongside the release (Summer '26 · v67.0), which decides what every tool calls and was previously only visible on hover. See Workspace.
• A line-numbered, syntax-highlighting editor for SOQL and Apex, so “Malformed query at line 3” from the org points at a line you can see. Used by the SOQL Query Runner and Execute Anonymous.
• One Org Health tool instead of two. “Org Health” and “Org Health (Live)” were two near-identical entries with nothing on screen explaining the difference. Org Health now always runs five checks with no setup and adds twelve more when the CLI bridge answers. See Features.
• Feature kill switches now apply to the Workspace and side panel. Turning a tool off in Settings removed it from the ⚡ menu on Salesforce pages but left it visible and usable in the Workspace. See Kill switch.
• An extension update no longer floods open Salesforce tabs with errors. Chrome updates an extension underneath tabs that are already open, orphaning the content script; every storage touch was throwing uncaught. Storage now fails quietly — the tab still needs a reload, but a routine Web Store update no longer fills the console.

@sfdt/extension — 0.11.0

• Salesforce’s real error is no longer replaced by “Session expired or invalid.” A query the org rejected (say, a quoted value against a numeric field) reported a dead session on a perfectly healthy one, discarding the org’s actual MALFORMED_QUERY answer. Errors now lead with the org’s own message plus its error code, the fields it named, and a short “what to do” line. See Troubleshooting.
• SOAP was broken on every path. The service URL was built with a v-prefixed API version, which Salesforce refuses — so Metadata Retrieve and Deploy, the SOAP API Explorer, and Data Import’s batches all failed. Fixed and pinned per service by tests.
• Writes no longer time out after 5 seconds and blame your session. Reads now get 30s and writes 120s; a blown budget on a write says the result is unknown and the change may already have saved, rather than reporting a failure for something that landed.
• Field Impact Analysis — “what writes this field?”, answered from Flows (parsed, not guessed), workflow field updates, and Apex, each row badged confirmed or inferred.
• SOSL mode in the SOQL Runner, with results grouped per returned object and per-object copy and export. History and bookmarks record and restore the query language.
• The extension is called “SFDT for Salesforce” everywhere now — the manifest name and toolbar tooltip still said “SFDT SF Helper”. Display text only; nothing needs migrating.

@sfdt/cli — 0.21.0

• Apex observability and a bounded SOQL/SOSL toolkit. New sfdt apex commands manage trace flags and debug logs, execute Anonymous Apex, and expose the same capabilities to MCP and VS Code. The new sfdt soql family searches schema, validates queries, inspects query plans, and runs bounded SOQL/SOSL queries; the dashboard adds a matching SOQL Console.
• Manifest builder bridge. The bridge protocol is now 1.3 and adds read-only manifest.discover and manifest.render kinds, so the Chrome extension and dashboard use the CLI’s single manifest writer. Existing 1.2 clients receive a compatibility warning and keep working.
• Salesforce Code Analyzer v5 is now required. The legacy v4 fallback and its opt-in flag, config key, and environment variable are removed. A machine without v5 reports a skipped scan with install guidance rather than a fabricated clean result.

@sfdt/extension — 0.10.0

• Metadata Retrieve & Deploy is now bridge-aware. When connected to CLI 0.21.0 or later, it browses metadata and renders additive or destructive manifests through the CLI; the existing Salesforce SOAP path remains the offline fallback. Selections persist per org.
• Chrome Web Store release. The extension is now available as SFDT for Salesforce .

@sfdt/cli — 0.20.0

A security fix, and secrets kept out of config on two more surfaces:

• Security — plugins now accepts package names only. Plugins load before argument parsing, and the resolver accepted file paths as well as package names — so a project’s .sfdt/config.json listing "plugins": ["./tools/helper.js"] executed that file’s top-level code on any sfdt command, sfdt --version included, without logging it. Since sfdt is built to run inside other people’s Salesforce projects, cloning a repo and running one command was enough. Entries that look like paths are now refused with a warning. Scoped names (@org/sfdt-plugin-thing) and package subpaths are unaffected — the guard rejects paths, not slashes. If you load a plugin by relative path today, install it as a package instead.
• Security — redaction now catches secrets written as free text. PEM private-key blocks, force:// sfdx auth URLs, Authorization: Bearer headers, and secret-ish key=value assignments are redacted before anything reaches an AI provider, a webhook, or the audit log. Variable names like apiKeyEnv: "MY_VAR" are deliberately left intact.
• headersEnv on notification channels, and ai.headersEnv for the http AI provider. Reference a bearer token or gateway secret by env-var name instead of writing it into .sfdt/config.json. A named-but-unset variable fails that one channel with an error naming it, rather than silently sending an unauthenticated request. Enables n8n Header Auth, Cloudflare Access service tokens, and any gateway expecting a shared-secret header.
• New harness-escalation notification event — for automation that needs to hand a decision back to a person instead of encoding a fix.
• agent-fix runs are recorded in run history, so auto-fix attempts trend alongside deploys and tests.

@sfdt/extension — 0.9.1

• Removed the “Login as user…” Setup tab. The Setup tab strip now injects three base tabs rather than four, and the deep link no longer appears in the ⚡ command palette. It was only ever a link to Setup’s standard user list — the page where Salesforce itself renders the per-user Login action — so nothing is lost. No permission changes.

sfdt.sfdt-devtools (VS Code) — 0.5.2

• “Send Notification (event)” in SFDT: Run Command… now lists harness-escalation among the accepted lifecycle events, matching the CLI. Description text only.

@sfdt/cli — 0.19.0

Org-side API-version coverage now matches the local scan:

• sfdt versions and sfdt audit api-versions now cover LWC and Aura on the org side. The local source scan always inventoried Apex/Trigger/Flow/LWC/Aura, but the org half stopped at Apex and Flows — so an org-side bundle stuck on an old API version was invisible and the two columns weren’t comparing the same set. Both now query LightningComponentBundle and AuraDefinitionBundle via the Tooling API, keyed to match the local scan.
• Independent degradation in audit api-versions — Flow/LWC/Aura are optional types; any that a given org can’t query leaves the check at warn/ok with the type named in the summary rather than failing the run. Apex remains the required core. Output order is deterministic.

@sfdt/cli — 0.18.2

Maintenance and dependency-security release — no CLI behaviour change:

• Security — cleared all outstanding high-severity dependency advisories: npm-audit fixes for fast-uri, brace-expansion, and body-parser; an adm-zip ^0.6.0 override (GHSA-xcpc-8h2w-3j85 / CVE-2026-39244); a shell-quote ^1.9.0 override floor; and an express-rate-limit bump.
• From 0.18.1 — shell scripts resolve bash via /usr/bin/env (works where bash isn’t at /bin/bash), and sfdt skills export emits a stable, deterministic order.

@sfdt/cli — 0.18.0

A platform-integrity release plus a new API-version audit across every surface:

• sfdt versions — audit the Salesforce API versions of local source (Apex, Flow, LWC, Aura) and the org against the org’s max API version; --local-only works offline, --json for scripting.
• sfdt versions --advise — an AI upgrade advisor (value / risks / breaking changes / effort per component), grounded by a curated per-version registry so it never invents version facts; read-only.
• Surface catalog framework — the command reference, feature counts, and dashboard page list are now generated from the code’s own catalogs, with CI that fails on drift.
• GitHub Action args-json — a shell-injection-proof way to pass arguments; the legacy command string is deprecated and hardened.
• Hardening — test --logic zero-test guard + --wait validation, and quality --allow-legacy-analyzer (Code Analyzer v4 is opt-in legacy only; v5 required for authoritative scans).

@sfdt/extension — 0.9.0 — 2026-07-24

The API Version Audit gets specific, and a contrast-guard sweep:

• API Version Audit now names the components that are behind, and covers LWC + Aura. The audit used to say “12 things are on v41” but never which twelve — its queries selected the version alone. It now selects each type’s name field and renders below-floor buckets as keyboard-accessible disclosures that expand to the component list. LightningComponentBundle and AuraDefinitionBundle are queried too, so it covers five types where it covered three. See Features.
• Widened the fill-token contrast guard to every design-token fill with a foreground variant (it previously checked only three, and only inline literals), and fixed three pre-existing dark-mode contrast defects it surfaced.

@sfdt/extension — 0.8.0 — 2026-07-20

The full Phase 0–3 build-out: a security-hardened worker-side session model, dark mode, a global command palette, a Schema Browser, a docked side panel, and a complete debug-log analysis suite. See Features.

• Security posture — the session id never leaves the background worker. Every REST/Tooling/SOAP call (and the Event Monitor’s live streaming) now runs inside the service worker, so page and content-script code hold no sid. Injected UI mounts in a closed shadow root, isolating it from Salesforce’s own CSS/DOM in both directions.

• Dark mode + session-layer hardening — a light/dark/auto Theme setting, plus support for US GovCloud (.mil), Salesforce China (.sfcrmapps.cn), and Microsoft Defender (.mcas.ms)-proxied orgs with per-org session resolution and org-id cross-matching. See Privacy & Permissions.

• Command palette (command-palette) — a global, keyboard-first ⚡ overlay (Ctrl/Cmd+Shift+K) on any Salesforce page: fuzzy-search features, Setup deep-links, objects, a pasted record Id, and your own custom shortcuts (managed on the options page). Opening it makes zero org API calls. See Features → Command palette.

• Schema Browser (schema-browser) — a two-pane object/field explorer (types, picklists, formula source, reference cross-links, child relationships) with Copy API name, Insert into query (into the SOQL Runner), and an Export selected for prompt field picker. A Workspace tool and a record-page ⚡ entry.

• Docked side panel — the tools now also run in a docked Chrome side panel (Firefox: native sidebar_action), opened from the toolbar popup. It follows the active org across tab switches, and an Appearance setting can make it the default tool surface. Adds the Chrome-only sidePanel permission — see Privacy & Permissions.

• Debug Logs — Analyze view + Flame chart — a per-log 📊 Analyze action renders a sortable method-timing table (total / self / count), per-namespace governor-limit snapshots, and SOQL/DML/callout inventories with jump-to-line, plus a canvas Flame chart of the invocation tree (zoom, hover, click-to-select synced with the table). Backed by a pure Apex-log parser.

• Import log from disk & Run & analyze — drag-drop or pick a local .log/.txt and analyze it with no org connection; and Execute Anonymous gains 📊 Run & analyze, which runs the Apex, finds the log it produced, and opens it in the Analyzer.

• Trace Flags & debug-session manager (trace-flags) — list active TraceFlags with a live expiry countdown + one-click renew, start/stop a debug session for yourself or another user, and Basic/Full/Custom DebugLevel presets. A Workspace tool and a ⚑ Trace flags entry in the Debug Logs header.

• SOQL Runner power-ups — a 🔎 Explain action shows Salesforce’s query plan (cost, cardinality, leading operation, notes) without executing; Copy JSON and Copy for Excel (TSV) on the result toolbar; and Export all as CSV that follows queryMore pagination to download every row, with a live progress indicator and Cancel (memory-safe by construction).

• Query template pack — the Saved SOQL panel gains a read-only Templates group of 8 built-in admin/dev queries (Apex test coverage, validation rules, login history, setup audit trail, limits snapshot, deploy requests, active TraceFlags, record types) that load straight into the runner.

• Execute Anonymous — DebugLevel picker — choose which org DebugLevel a captured log uses from a native Log level select (persists per user), no trip to Setup.

• Debug Logs — auto-refresh + bulk delete — a 15-second Auto-refresh toggle (off by default, no orphan timers) and a Delete all logs action that clears every org ApexLog behind a count-confirm dialog.

• Inspect Record — raw-JSON toggle + right-click open — a Fields / JSON view toggle renders the raw REST payload (copyable), and a right-click “Inspect this record” context menu opens the inspector for a record Id on the page or link (new contextMenus permission — see Privacy & Permissions).

• Login as user — the Setup tabs feature adds a Login as user… deep link to Setup’s user list (deep link only; Salesforce enforces the Login-As permission server-side).

@sfdt/extension — 0.7.0

• api-version-audit (the 40th feature) — an org-side Setup pill showing the org’s max API version and how many components lag, expanding to per-type API-version histograms.

sfdt.sfdt-devtools (VS Code) — 0.5.1

• sfdt.orgColor is now opt-in. Per-org window theming defaults to false; the extension no longer silently writes workbench.colorCustomizations into a version-controlled .vscode/settings.json on activation. Disabling the setting now removes the colour keys it wrote instead of leaving a stale block behind.

sfdt.sfdt-devtools (VS Code) — 0.5.0

• API Versions Report and Run History command-tree entries (running sfdt versions / sfdt history), plus a surface-parity fix exposing twelve more commands in the tree.

@sfdt/cli — 0.17.0

A CI/CD and diagnostics batch:

• GitHub Action — run any sfdt command as a single step (uses: scoobydrew83/sfdt@v0) with built-in sfdx-url/JWT auth and version pinning (cli-version: auto).
• ci init expansion — new release (approval-gated real deploys) and scratch (create → deploy → test → always-delete) pipeline types; JWT auth (--auth jwt); Docker (--runner docker, GitLab/Bitbucket) and Action (--runner action, GitHub) runners.
• Quality gate in PR pipelines — generated deploy workflows run an advisory sfdt quality scan; GitHub uploads SARIF to code scanning (quality --output-file).
• test --lwc — run LWC (Jest) unit tests via the CLI, locally and in scratch-org CI.
• deploy --smart --notify — smart deploys now push success/failure notifications through your configured channels.
• sfdt doctor core group — new environment diagnostics (sf, Node, git, .sfdt config validity, AI provider, and a warn-only, timeout-bounded org-connectivity probe) alongside the extension-stack checks. Flags --core, --extension, --org, --json; CI-safe (the org check never fails the run).
• Node 22 floor — @sfdt/cli requires Node ≥ 22.15; all generated pipelines and the action default to Node 22.

@sfdt/cli — 0.16.0

A Salesforce-release-readiness and Agentforce batch:

• sfdt agent-test — run an Agentforce agent test (sf agent test run) as an exit-code CI gate, with --notify and --pr-comment. Smart deploy and sfdt manifest now also recognise Agentforce metadata (Bot, GenAiPlanner/Plugin, AiEvaluationDefinition, and more) in git deltas — see Smart Deploy.
• sfdt test --logic — run Apex and Flow tests together via Salesforce’s Spring ‘26 sf logic run test, with AI failure analysis.
• sfdt quality upgrades — Code Analyzer v5 (sf code-analyzer run) with --include-fixes, an API v67 user-mode readiness scan (--api67), and a --test-hints check for missing @IsTest(testFor=…) annotations.
• sfdt deploy automations as flags — --tag, --create-pr, and --notify (previously GUI-only), plus any-.xml manifest auto-detection.
• New org-health checks — audit mfa-readiness and audit soap-logins; monitor limits/org-info gain elastic-async and release-version reporting.
• Google Chat notifications and dashboard run-now / create-delete-generate actions for Audit, Monitor, Scratch, Data, and Docs (plus new Agent Test and Retrofit pages).
• MCP surface now covers the full CLI lifecycle — on top of the read-only sfdt_coverage / sfdt_scan / sfdt_dependencies / sfdt_flow_scan, the server gained the mutating (confirmExecution-gated) sfdt_release, sfdt_scratch_*, and sfdt_data_* tools plus sfdt_test and read-only sfdt_history — 30 tools in total.
• Run history — sfdt history (with --type / --limit / --json) surfaces a durable local index of every audit/monitor/quality/test/deploy/agent-test run, so outcomes can be trended over time; audit/monitor also archive full timestamped snapshots.
• sfdt test --class-names runs a specific subset of Apex test classes (powers the VS Code “Run test class” CodeLens), and sfdt skills export --target pack emits an npx skills add-compatible pack. The Chrome extension’s native-messaging host now also answers the read-only bridge kinds (quality/scan/compare/drift/org-health) when the HTTP bridge isn’t running.
• Dependency coverage expanded + graph rebuilt — the CLI and the dashboard graph share one METADATA_TYPE_REGISTRY in @sfdt/flow-core (no more drift) and cover Visualforce components and Aura alongside Apex, triggers, VF pages, Flows, and LWC, with Custom Object / Custom Field reachable too. The dashboard graph is now seed + expand-on-click: pick a component by name and type, then click nodes to expand their dependencies (both directions, capped per click with a “+more” badge on high-degree nodes) — so it scales to any org instead of bulk-loading the whole thing.
• Dependency gap report — sfdt dependencies <name> --gaps parses local source to surface references the Tooling API misses (dynamic Apex, LWC @salesforce/apex, formula and Flow references). Offline by default; --org diffs against the API to mark each MISSING vs confirmed. Also available as a Gaps panel on the dashboard Dependencies page, and a Show inferred toggle overlays those missing edges onto the graph itself as dashed lines.

@sfdt/cli — 0.15.2

• Fewer false-positive trigger conflicts — @sfdt/flow-core 0.9.4 now reads a record-triggered flow’s event from recordTriggerType, so Create-only and Update-only flows no longer collapse into a single “Unknown” conflict bucket in sfdt audit / Flow Intelligence. The fix reaches every flow-core consumer: CLI, dashboard, Chrome extension, and VS Code extension.
• VS Code dashboard embed fixed — the dashboard server now sends Content-Security-Policy: frame-ancestors 'self' vscode-webview: instead of X-Frame-Options: SAMEORIGIN, so the VS Code extension’s webview can embed the dashboard again (it previously rendered blank). Arbitrary web origins are still refused.

@sfdt/cli — 0.15.1

• Deploy picker & Release Hub cleanup — under subpath manifest layout, the deploy menu and dashboard Release Hub no longer list in-flight (manifest/release/deploy/) or already-deployed (deployed/) artifacts, which previously clogged the picker. A project path containing a space no longer breaks the interactive selection either.
• Editable preflight settings — deployment.preflight.* flags can now be changed from the dashboard (Settings → Config) with an inline safety caution, instead of being file-only. See Configuration.

@sfdt/cli — 0.15.0

Org-monitoring, CI/CD, and AI-agent additions on top of the org-health suite:

• Expanded org health — sfdt audit / sfdt monitor grew to ~25 native checks (inactive validation/workflow rules, field-level access lint, connected apps, unused permission sets, legacy API usage, deployment history, paused flows, and more). License/Beta-gated checks degrade to a warn instead of failing CI. See Org Health & Operations.
• Multi-channel notifications — Slack, Microsoft Teams, email, generic webhook, and Grafana Loki, with per-channel event filters and severity routing, plus optional AI executive-summary digests.
• CI/CD templates — sfdt ci init generates ready-to-run GitHub/GitLab/Azure/Bitbucket pipelines.
• Smart Deploy — sfdt deploy --smart delta-deploys with smart test selection and overwrite protection; optional AI deploy-error analysis and a bounded coding-agent auto-fix loop (default-off).
• Retrofit & PR comments — sfdt retrofit (retrieve → commit → smart-deploy) and sfdt pr comment PR decoration.
• AI — a new text-only http provider, a non-interactive --agent convention across AI commands, and per-metadata-type documentation prompts. See AI Providers.

@sfdt/cli — 0.13.1

Adds a native org health & operations suite — clean-room reimplementations of org diagnose/audit, monitoring/backup, documentation generation, data-set management, and scratch-org pooling — surfaced across four consumers: the CLI, the web dashboard, the built-in MCP server, and a brand-new VS Code extension. No AGPL dependency.

• sfdt audit / sfdt monitor — native org diagnostics and monitoring (audit trail, licenses, MFA coverage, unused Apex, inactive users, deprecated API versions; org limits, errors, health, plus metadata backup), each writing a JSON snapshot every surface can read.
• sfdt docs / sfdt data / sfdt scratch — generate MkDocs docs (objects, Apex, Flows, LWC) with optional AI overviews and per-role Developer/Admin/User/DevOps guides; manage data sets via sf data tree; and create/delete/list scratch orgs with a pre-created pool.
• VS Code extension (@sfdt/vscode) — a new fourth surface: command-palette integration, an Org Health sidebar (audit + monitor snapshots), a status-bar item, and an embedded dashboard webview.
• 0.13.1 hardening — sfdt data delete no longer reports partial or failed deletes as clean (--json returns status: "partial" with skippedCount/errorCount); audit, monitor, and data now surface Salesforce CLI’s real error text instead of the opaque execa message.

@sfdt/extension — 0.6.0

• Flow Scanner — the flow-quality feature now renders the full @sfdt/flow-core report (issue families by score impact, affected elements, recommended fixes, dependencies) on real Salesforce pages, with Explore cross-links into the org-wide Dependency Explorer.
• Org release badge & Field Access quick link — the Workspace and Setup tab strip show the org’s Salesforce release (and flag preview instances); Object Manager pages gain a Field Access tab.
• Org Health (bridge) is now registered on real Salesforce pages and works via the native host.

@sfdt/extension — 0.5.0

• show-api-names — annotate Lightning record detail pages with each field’s API name next to its label, plus the object API name and 18-char record id in the header. Copy helpers generate the record’s Id, an Apex insert statement, or a SOQL SELECT. See Features.
• ai-assistant now shows the AI’s answer — “Run via sfdt” renders the response in the panel (with provider and a copy button) instead of confirming with a toast and discarding it, and uses the 60-second bridge timeout real AI runs need.
• Safer bulk delete — flow-version-manager no longer blanket-overrides confirm(); the bypass is bounded to the selected versions and restored immediately.
• missing-descriptions surfaces fetch failures with an error toast instead of silently rendering nothing.

@sfdt/extension — 0.4.0

A WXT/Chrome MV3 extension with a growing set of opt-in features.

• 0.4.0 — Live-org Workspace — new tools that read the org directly (no sfdt ui server needed): code-coverage (org-wide + per-class Apex coverage), org-health-live (checks run against the org, not a snapshot), dependency-explorer (MetadataComponentDependency lookups), and an apex-test-runner. The Workspace is now tabbed — tools open as persistent tabs that keep their state when you switch away, so a stray click can’t discard a half-written query. flow-quality runs the shared @sfdt/flow-core rulebook in-browser for byte-identical scores to the CLI.
• 0.3.3 — fixed the org-health bridge-token error hints to point at the real pairing flow (paste the token from ~/.sfdt/bridge-token, created when you run sfdt ui) and corrected the stale token-rotation comment.
• 0.3.2 — added the Org Health panel (surfaces the CLI’s audit + monitor snapshots via the local bridge), richer anonymous-Apex log capture, and standardised the internal namespace to sfdt.
• 0.3.0 — Workspace & Apex — added the standalone Workspace tab plus apex-anonymous, debug-log-viewer, org-switcher, and saved-soql; the Salesforce API client now works from the chrome-extension:// origin.

sfdt.sfdt-devtools (VS Code) — 0.4.1

• Commands-tree catalog now surfaces the new CLI actions — test --lwc, deploy --smart --notify, and quality --output-file — keeping the extension in step with CLI 0.17.0.

sfdt.sfdt-devtools (VS Code) — 0.4.0

• Run-test-class & agent-test CodeLenses — a ▶ Run test class lens on Apex test classes and a ▶ Run agent test lens on *.aiEvaluationDefinition-meta.xml specs, plus palette commands.
• Test Runs in the Status view, coverage highlights, Problems-pane diagnostics — recent runs, gutter coverage bands, and quality violations surfaced as native VS Code diagnostics.
• Smart Deploy — Validate & Review / Quick Deploy and a “Get started with SFDT” walkthrough; the two CLI spawn paths were consolidated into one.

sfdt.sfdt-devtools (VS Code) — 0.3.1

• Embedded dashboard no longer renders blank — fixed server-side in @sfdt/cli 0.15.2 (frame-ancestors CSP replaces X-Frame-Options); update the CLI to 0.15.2+ alongside the extension. Also ships a refreshed extension icon.

@sfdt/vscode — 0.1.0

Initial release of the VS Code extension: command palette integration, the Org Health sidebar (audit + monitor snapshots), a status bar item, and an embedded dashboard webview.