Everything changed since origin/main (committed and uncommitted)

<h1 align="center">
  <img alt="sf-preflight: preflight checks for Salesforce changes" src="https://raw.githubusercontent.com/visparashar/sf-preflight/main/docs/assets/sf-preflight-banner.png">
</h1>

[![CI](https://github.com/visparashar/sf-preflight/actions/workflows/ci.yml/badge.svg)](https://github.com/visparashar/sf-preflight/actions/workflows/ci.yml)
[![CodeQL](https://github.com/visparashar/sf-preflight/actions/workflows/codeql.yml/badge.svg)](https://github.com/visparashar/sf-preflight/actions/workflows/codeql.yml)
[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/visparashar/sf-preflight/badge)](https://scorecard.dev/viewer/?uri=github.com/visparashar/sf-preflight)
[![npm](https://img.shields.io/npm/v/sf-preflight.svg)](https://www.npmjs.com/package/sf-preflight)
[![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
![Node.js 22.13+](https://img.shields.io/badge/node-%3E%3D22.13-brightgreen.svg)
[![Website](https://img.shields.io/badge/website-visparashar.github.io%2Fsf--preflight-52E0A1)](https://visparashar.github.io/sf-preflight/)
[![M8ven Score](https://m8ven.ai/badge/mcp/visparashar-sf-preflight-13zbfy?v=17a47b225ccd7f1293f0a618ea86a19d)](https://m8ven.ai/mcp/visparashar-sf-preflight-13zbfy?s=readme)

**Preflight checks for Salesforce changes: know what a change will set off — before it ships.**

AI coding agents and Headless 360 make Salesforce changes cheap to produce, but verifying them
is still slow and manual. `sf-preflight` reads your SFDX project and a git diff, follows the
change through the org's order of execution — flows, triggers, validation rules, roll-ups,
permissions — and reports the blast radius, the risks and the tests that matter.

It is open source, runs offline on your source code, and needs no org credentials. (The one request it
makes on its own is a daily check for a newer version; see [Update notices](#update-notices).)

> **Status:** early (0.x). The CLI, MCP server, GitHub Action, test generation, Agentforce
> action verification, the quality gate and evidence packs work today; org context is in beta.
> See the [roadmap](docs/ROADMAP.md). Feedback and contributions are very welcome.

**Website:** <https://visparashar.github.io/sf-preflight/> · **Demo videos:** <https://visparashar.github.io/sf-preflight/demos.html>

<p align="center">
  <img alt="Demo: preflight analyze on the sample org finds two automation cycles, an affected agent action and validation-rule collisions" src="https://raw.githubusercontent.com/visparashar/sf-preflight/main/docs/assets/preflight-demo.gif">
</p>

## What it finds

| Finding | Why it matters |
|---|---|
| **Recursion cycles** | `Account → Contact → Account` loops settle at human pace and break at bulk or agent volume |
| **Validation-rule collisions** | An automation or agent action can be *correct* and still fail on a rule it doesn't satisfy |
| **New rules vs existing automation** | A new validation rule silently constrains every flow, trigger and class that writes the object |
| **After-save self-updates** | Re-runs the whole save procedure for the record |
| **Automation density** | Many overlapping automations or multiple triggers on one object hide ordering bugs |
| **DML/SOQL in loops** | In changed Apex and in Apex inside the blast radius |
| **Access and sharing** | New Modify All / View All, delete access and sensitive system permissions; access taken away (and the components that need it); guest user exposure; organization-wide defaults; sharing rules; permission set groups and muting — diffed against the base |
| **Broken references** | Deleted fields, flows or classes that are still used |
| **Lightning components** | Components that use a changed field or call a changed Apex class, what a changed component saves through Apex, and fields or classes it uses that the project lacks |
| **Labels, custom metadata and Visualforce** | Removed labels still in use, who reads a changed custom metadata record, Visualforce pages tied to a changed Apex class or naming a missing one |
| **Picklists and record types** | Removed or deactivated picklist values still offered by record types or written in code; record types that drop values or are deleted while code names them |
| **Save rules and platform events** | Duplicate, assignment, auto-response and escalation rules in the order of execution; automation that a blocking duplicate rule can stop; rules and approval processes switched on, off or re-scoped; platform event publishers and subscribers when an event changes |
| **Integrations** | Named and external credentials that move host, change authentication or use http; remote sites and CSP trusted sites removed while code still calls the host; connected app scopes, callback URLs and committed secrets; outbound messages that send session IDs |
| **OmniStudio** | OmniScripts, Integration Procedures, Data Mappers and FlexCards: who calls a changed one, what it calls that the project

... (truncated)