Merge remote-tracking branch 'origin/main' into bm-users-and-table-flags

Author: clavery

.changeset/add-debug-cli-command.md

@@ -0,0 +1,5 @@
+---
+'@salesforce/b2c-cli': minor
+---
+
+Add `b2c debug cli` command for interactive terminal-based script debugging. Includes a REPL with commands for breakpoints, stepping, variable inspection, and expression evaluation. Use `--rpc` for JSONL-over-stdio mode suitable for headless scripts and agents.

.changeset/add-debug-diagnostics-toolset.md

@@ -0,0 +1,5 @@
+---
+'@salesforce/b2c-dx-mcp': minor
+---
+
+Add script debugger MCP tools to the CARTRIDGES and STOREFRONTNEXT toolsets. Includes `debug_start_session`, `debug_end_session`, `debug_list_sessions`, `debug_set_breakpoints`, `debug_wait_for_stop`, `debug_get_stack`, `debug_get_variables`, `debug_evaluate`, `debug_continue`, `debug_step_over`, `debug_step_into`, `debug_step_out`, and `debug_capture_at_breakpoint`.

.changeset/add-debug-skill-and-docs.md

@@ -0,0 +1,6 @@
+---
+'@salesforce/b2c-dx-docs': patch
+'@salesforce/b2c-agent-plugins': patch
+---
+
+Add debug command documentation and b2c-debug agent skill covering interactive REPL, RPC mode, and DAP usage.

.changeset/add-mcp-server-context.md

@@ -0,0 +1,5 @@
+---
+'@salesforce/b2c-dx-mcp': minor
+---
+
+Add `ServerContext` for persistent server-scoped state across MCP tool invocations. Enables stateful tools (debug sessions, log watches) while preserving per-call config reloading for existing tools.

.changeset/add-resolve-breakpoint-path.md

@@ -0,0 +1,5 @@
+---
+'@salesforce/b2c-tooling-sdk': minor
+---
+
+Add `resolveBreakpointPath` utility that normalizes user-provided file paths to SDAPI script paths. Accepts server paths, absolute/relative local paths, and cartridge-name-prefixed paths with helpful error messages on failure.

.changeset/audit-cleanup-cli.md

@@ -0,0 +1,11 @@
+---
+'@salesforce/b2c-cli': patch
+---
+
+CLI cleanup and correctness fixes:
+
+- `b2c cip query`, `cip describe`, `cip tables`, and `cip report *` now stream output through oclif's `ux.stdout` instead of writing directly to `process.stdout`. This restores the `--json` flag and makes output capturable by tests and CI.
+- Long-running commands (`code:watch`, `logs:tail`, `mrt:tail-logs`) now deregister their SIGINT/SIGTERM handlers when finished, so re-invocations no longer stack handlers on the same process.
+- Hook and signal-handler errors that were previously swallowed (`job:run` afterOperation hooks, `logs:tail` stop, `setup:ide:prophet` console fallbacks) now log at debug instead of disappearing.
+- AM list commands (`am clients|roles|users list`) share a single `amPageSizeFlag` definition.
+- Removed deprecated `LocalSourceResult` re-export.

.changeset/audit-cleanup-mcp.md

@@ -0,0 +1,6 @@
+---
+'@salesforce/b2c-dx-mcp': patch
+---
+
+- Telemetry send failures are no longer silently swallowed; they now log at debug level so deployment-monitoring drift is visible behind the `--debug` flag.
+- `registerToolsets()` throws a clear error if invoked more than once for the same server instance (instead of producing a cryptic duplicate-tool error from the SDK).

.changeset/audit-cleanup-mrt.md

@@ -0,0 +1,6 @@
+---
+'@salesforce/mrt-utilities': patch
+---
+
+- The Lambda response adapter's `pipeToDestination` now destroys the destination stream when the underlying pipeline rejects, so consumers fail fast instead of hanging.
+- `pipedDestinations` cleanup is unified between the success and error paths.

.changeset/audit-cleanup-sdk.md

@@ -0,0 +1,13 @@
+---
+'@salesforce/b2c-tooling-sdk': patch
+---
+
+Hardened auth and long-running operation paths:
+
+- Token store now writes atomically (temp file + rename) so concurrent CLI invocations cannot corrupt `auth-session.json`.
+- `OAuthStrategy.getAccessToken()` coalesces concurrent refreshes onto a single in-flight request, preventing token-endpoint stampedes.
+- Debug session cleans up its keepalive/poll timers if `connect()` fails after starting them.
+- `downloadCartridges` and `deployCartridges` use try/finally around progress timers so an aborted or failing request can no longer leak intervals.
+- New `@salesforce/b2c-tooling-sdk/ux` export surfaces the canonical `confirm()` prompt; CLI re-exports from here.
+- New `auth/jwt-utils` consolidates JWT `exp`/`scope` decoding previously duplicated across three auth strategies.
+- Better error message when the implicit-OAuth port is already in use (suggests `SFCC_OAUTH_LOCAL_PORT`).

.changeset/audit-cleanup-vsx.md

@@ -0,0 +1,9 @@
+---
+'b2c-vs-extension': patch
+---
+
+VS Code extension reliability fixes:
+
+- Swagger API Browser webview no longer attempts `postMessage` after the panel has been disposed (previously could throw on token refresh or proxy responses arriving after close).
+- Sandbox tree polling no longer stacks "stop-check" timers when the configured polling interval is shorter than the 3-second stabilization window.
+- Code Sync now drains pending uploads/deletes before tearing down its file watchers, so saves immediately preceding a stop are no longer dropped.