@W-23634161: warn before installing non-Salesforce Commerce Apps - #604
Open
jbisaSF wants to merge 1 commit into
Open
@W-23634161: warn before installing non-Salesforce Commerce Apps#604jbisaSF wants to merge 1 commit into
jbisaSF wants to merge 1 commit into
Conversation
clavery
approved these changes
Jul 31, 2026
jbisaSF
force-pushed
the
jbisa.W-23634161.cap-install-non-sfdc-warning
branch
from
July 31, 2026 21:01
8cdd2f6 to
421c2ad
Compare
cap:install now reads the commerce-app.json provider field and, when it is anything other than 'salesforce' (including apps predating the field), prints a warning and prompts for confirmation before proceeding. --force and --json bypass the prompt for scripted use. Co-Authored-By: Claude <noreply@anthropic.com>
jbisaSF
force-pushed
the
jbisa.W-23634161.cap-install-non-sfdc-warning
branch
from
July 31, 2026 21:05
421c2ad to
7bbeff2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cap:installnow reads theproviderfield fromcommerce-app.jsonand, when it isn't'salesforce'(including manifests that omit the field entirely, e.g. older apps), prints a warning and prompts for y/n confirmation before proceeding.--forceto skip the prompt; the prompt is also automatically skipped in--jsonmode.CommerceAppProvidertype andproviderfield toCommerceAppManifestin the SDK, plus areadManifestFromTargethelper (directory or.zip) so the CLI can inspect the manifest even when--skip-validateis passed.Backwards compatibility
This is backwards compatible: no install that succeeded before this change will fail because of it, and no manifest field is required.
provideris optional onCommerceAppManifest. Manifests predating this field (providerisundefined) still parse and install correctly.manifest.provider !== 'salesforce', so a missingprovideris treated the same as an explicit'thirdParty'/'custom'— it triggers the warning rather than silently skipping it. This is intentional: most existing Commerce Apps predate theproviderfield, and we can't assume "missing" means "Salesforce-authored," so they get the same non-Salesforce confirmation as an app that explicitly declares a third-party provider.--force, and is skipped automatically in--jsonmode — so existing scripts/CI pipelines that install CAPs non-interactively continue to work unchanged.Test plan
pnpm --filter @salesforce/b2c-cli run test:agent— all passing, including new provider-warning suite (salesforce/thirdParty/no-provider, cancel,--force,--json)pnpm --filter @salesforce/b2c-tooling-sdk run test:agent— passing (one pre-existing unrelatedoauth-commandfailure present onmain)pnpm run lint:agent— clean@salesforce/b2c-cli,@salesforce/b2c-tooling-sdk, patch)