cli versions stable and newer fail to recognize customPermission metadata for retrieve or deployment

[mike-burke-10xgenomics]

Expected result

Use of deploy and retrieve of the CustomPermission metadata type fails to find any results on stable, stable-rc and nightly currently.

Actual result

Deploy fails to find local metadata, even when explicitly addressed:

PS E:\Projects\sfdx\game> sf project deploy start -m "CustomPermission:Create_New_Game_Rules_and_Criteria"

─────────────── Deploying Metadata ───────────────

Deploying v61.0 metadata to test-ag0bteyay0ze@example.com using the v63.0 SOAP API.

✔ Preparing 291ms
◯ Waiting for the org to respond - Skipped
◯ Deploying Metadata - Skipped
◯ Running Tests - Skipped
◯ Updating Source Tracking - Skipped
✔ Done 0ms

Status: Succeeded
Deploy ID: 0AfE100000cYWqnKAG
Target Org: test-ag0bteyay0ze@example.com
Elapsed Time: 297ms

Retrieve fails similarly

PS E:\Projects\sfdx\game> sf project retrieve start -m "CustomPermission:Create_New_Game_Rules_and_Criteria"

────────────── Retrieving Metadata ──────────────

Retrieving v61.0 metadata from test-ag0bteyay0ze@example.com using the v63.0 SOAP API

✔ Preparing retrieve request 9ms
✔ Sending request to org 753ms
✔ Waiting for the org to respond 197ms
✔ Done 0ms

Status: Succeeded
Elapsed Time: 960ms

» Warning: Nothing retrieved

Additional information

This also fails with wildcards and when deploying or retrieving using source tracking.

System Information

CLI:
@salesforce/cli/2.77.6 win32-x64 node-v22.13.1

Plugin Version:
@oclif/plugin-autocomplete 3.2.21 (core)
@oclif/plugin-commands 4.1.20 (core)
@oclif/plugin-help 6.2.25 (core)
@oclif/plugin-not-found 3.2.40 (core)
@oclif/plugin-plugins 5.4.31 (core)
@oclif/plugin-search 1.2.21 (core)
@oclif/plugin-update 4.6.31 (core)
@oclif/plugin-version 2.2.23 (core)
@oclif/plugin-warn-if-update-available 3.1.33 (core)
@oclif/plugin-which 3.2.29 (core)
@salesforce/cli 2.77.6 (core)
@salesforce/commerce 252.0.1 (user)
apex 3.6.8 (core)
api 1.3.3 (core)
auth 3.6.94 (core)
code-analyzer 5.0.0-beta.1 (user)
data 4.0.11 (core)
deploy-retrieve 3.18.3 (core)
info 3.4.39 (core)
lightning-dev 1.10.0 (user)
limits 3.3.46 (core)
marketplace 1.3.7 (core)
org 5.2.32 (core)
packaging 2.9.16 (core)
schema 3.3.50 (core)
settings 2.4.16 (core)
sobject 1.4.50 (core)
telemetry 3.6.32 (core)
templates 56.3.38 (core)
trust 3.7.64 (core)
user 3.6.9 (core)
sfdmu 4.38.0 (user)
sfdx-git-delta 6.3.0 (user)
texei-sfdx-plugin 2.8.2 (user)

SF ENV. VARS.
SF_AUTOUPDATE_DISABLE,true
SF_BINPATH,C:\Users\Mike\AppData\Local\sf\client\bin\sf
SF_DISABLE_AUTOUPDATE,true
SF_UPDATE_INSTRUCTIONS,Use "npm update --global @salesforce/cli" to update npm-based installations.

Windows: true
Shell: powershell
Channel: stable

---

Diagnostics

✅ pass - salesforcedx plugin isn’t installed
✅ pass - you don't have any linked plugins
✅ pass - [@salesforce/plugin-trust] can ping: https://registry.npmjs.org
✅ pass - [@salesforce/plugin-trust] can ping: https://registry.yarnpkg.com
✅ pass - [@salesforce/plugin-trust] can ping: https://registry.npmjs.org/
✅ pass - using latest or latest-rc CLI version
✅ pass - [@salesforce/plugin-deploy-retrieve] sourceApiVersion matches apiVersion
✅ pass - [@salesforce/plugin-deploy-retrieve] default target DevHub max apiVersion matches default target org max apiVersion
❌ warn - [@salesforce/plugin-deploy-retrieve] sourceApiVersion matches default target org max apiVersion
✅ pass - can access: https://test.salesforce.com
✅ pass - can access: https://appexchange.salesforce.com/services/data
✅ pass - can access: https://developer.salesforce.com/media/salesforce-cli/sf/channels/stable/sf-win32-x64-buildmanifest
❌ fail - [@salesforce/plugin-auth] CLI supports v2 crypto
✅ pass - [@salesforce/plugin-auth] CLI using stable v1 crypto

[shetzel]

I'm not able to reproduce this with deploy or retrieve:
E.g., sf project retrieve start -m "CustomPermission:My_Cust_Perm" retrieves the custom permission.

Was there a recent change to the .forceignore file that is causing it to be ignored?
Is there a version of the CLI (or plugin-deploy-retrieve plugin) where this worked as expected?
If you enable debug output (--dev-debug flag) is there any indication of what could be wrong in the output?

[mike-burke-10xgenomics]

This works for me on 2.73.8 of the CLI (currently looking at which version 'breaks' it). Simply changing the cli version using sf update stable for instance is enough to get it to exhibit the behavior again, while reverting with sf update dev gets it back to working.

To clarify, I don't seem to be getting the usual "No source-backed components present in the package" message as if it had found nothing, but it simply seems to run a deployment of zero components which succeeds:

{ "status": 0, "result": { "checkOnly": false, "completedDate": "2025-02-20T01:21:10.000Z", "createdBy": "005E100000Jaqeg", "createdByName": "User User", "createdDate": "2025-02-20T01:21:10.000Z", "details": { "componentSuccesses": [ { "changed": true, "componentType": "", "created": false, "createdDate": "2025-02-20T01:21:10.000Z", "deleted": false, "fileName": "package.xml", "fullName": "package.xml", "success": true } ], "runTestResult": { "numFailures": 0, "numTestsRun": 0, "totalTime": 0, "codeCoverage": [], "codeCoverageWarnings": [], "failures": [], "flowCoverage": [], "flowCoverageWarnings": [], "successes": [] }, "componentFailures": [] }, "done": true, "id": "0AfE100000cbqHtKAI", "ignoreWarnings": false, "lastModifiedDate": "2025-02-20T01:21:10.000Z", "numberComponentErrors": 0, "numberComponentsDeployed": 0, "numberComponentsTotal": 0, "numberTestErrors": 0, "numberTestsCompleted": 0, "numberTestsTotal": 0, "rollbackOnError": true, "runTestsEnabled": false, "startDate": "2025-02-20T01:21:10.000Z", "status": "Succeeded", "success": true, "files": [], "zipSize": 237, "zipFileCount": 1, "deployUrl": "https://innovation-ability-5110-dev-ed.scratch.my.salesforce.com/lightning/setup/DeployStatus/page?address=%2Fchangemgmt%2FmonitorDeploymentsDetails.apexp%3FasyncId%3D0AfE100000cbqHtKAI%26retURL%3D%252Fchangemgmt%252FmonitorDeployment.apexp" }, "warnings": [] }

I'll try with debug output and a clean no-plugin instance to see if I can track the issue down a little bit more concretely.

[mike-burke-10xgenomics]

v2.74.5 seems to identify and deploy the customPermission
v2.74.6 has the same issue with an empty deployment

[mike-burke-10xgenomics]

I don't see anything in the logging that would indicate WHY the file is being left out of the deploy, but here's the salient bits where things start to diverge.

2.74.5

[20:35:34.494] DEBUG (sf:oclif:ComponentSetBuilder): Searching for matching metadata in directories: E:\Projects\sfdx\gamify\gamify-core\
[20:35:34.494] TRACE (sf:oclif:ComponentSet): Created 'sf:oclif:ComponentSet' child logger instance
[20:35:34.494] TRACE (sf:oclif): Setup child 'sf:oclif:ComponentSet' logger instance
[20:35:34.525] DEBUG (sf:oclif:ComponentSetBuilder): Matching metadata files (1):
[20:35:34.525] DEBUG (sf:oclif:ComponentSetBuilder): E:\Projects\sfdx\gamify\gamify-core\main\default\customPermissions\Create_New_Game_Rules_and_Criteria.customPermission-meta.xml
[20:35:34.525] DEBUG (sf:oclif:ComponentSetBuilder): ComponentSet apiVersion = <not set>
[20:35:34.525] DEBUG (sf:oclif:ComponentSetBuilder): ComponentSet sourceApiVersion = 63.0
[20:35:34.525] TRACE (sf:oclif:MetadataApiDeploy): Created 'sf:oclif:MetadataApiDeploy' child logger instance
...
[20:35:34.892] TRACE (sf:oclif:ComponentSet): Created 'sf:oclif:ComponentSet' child logger instance
[20:35:34.892] TRACE (sf:oclif): Setup child 'sf:oclif:ComponentSet' logger instance
[20:35:34.892] DEBUG (sf:oclif:SourceTracking.PopulateFilePaths):  the generated component set has 1 items
[20:35:34.892] TRACE (sf:oclif:ComponentSet): Created 'sf:oclif:ComponentSet' child logger instance
[20:35:34.892] TRACE (sf:oclif): Setup child 'sf:oclif:ComponentSet' logger instance
[20:35:34.916] DEBUG (sf:oclif:SourceTracking.PopulateFilePaths):  local source-backed component set has 0 items from remote
[20:35:34.917] TRACE (sf:oclif:SourceTracking.PopulateTypesAndNames): Created 'sf:oclif:SourceTracking.PopulateTypesAndNames' child logger instance
[20:35:34.917] TRACE (sf:oclif): Setup child 'sf:oclif:SourceTracking.PopulateTypesAndNames' logger instance
[20:35:34.917] DEBUG (sf:oclif:SourceTracking.PopulateTypesAndNames): populateTypesAndNames for 5 change elements
[20:35:34.918] DEBUG (sf:oclif:SourceTracking.PopulateTypesAndNames):  matching SourceComponents have 1 items from local
[20:35:34.919] TRACE (sf:oclif:ZipWriter): Created 'sf:oclif:ZipWriter' child logger instance
[20:35:34.919] TRACE (sf:oclif): Setup child 'sf:oclif:ZipWriter' logger instance
[20:35:34.919] DEBUG (sf:oclif:ZipWriter): generating zip in memory
[20:35:34.927] DEBUG (sf:oclif:ZipWriter): Generated zip complete
[20:35:34.928] DEBUG (sf:oclif:MetadataApiDeploy): Deploying metadata source in v63.0 shape using SOAP v63.0
[20:35:34.928] DEBUG (sf:oclif:MetadataApiDeploy): Deployment zip file size = 798 Bytes containing 2 files
[20:35:35.148] DEBUG (sf:oclif:MetadataApiDeploy): Started metadata transfer. ID = 0AfE100000cbm7rKAA

2.74.6 (not working)

[21:12:29.688] DEBUG (sf:oclif:ComponentSetBuilder): Searching for matching metadata in directories: E:\Projects\sfdx\gamify\gamify-core\
[21:12:29.688] TRACE (sf:oclif:ComponentSet): Created 'sf:oclif:ComponentSet' child logger instance
[21:12:29.688] TRACE (sf:oclif): Setup child 'sf:oclif:ComponentSet' logger instance
[21:12:29.720] DEBUG (sf:oclif:ComponentSetBuilder): Matching metadata files (1):
[21:12:29.720] DEBUG (sf:oclif:ComponentSetBuilder): E:\Projects\sfdx\gamify\gamify-core\main\default\customPermissions\Create_New_Game_Rules_and_Criteria.customPermission-meta.xml
[21:12:29.721] DEBUG (sf:oclif:ComponentSetBuilder): ComponentSet apiVersion = <not set>
[21:12:29.721] DEBUG (sf:oclif:ComponentSetBuilder): ComponentSet sourceApiVersion = 63.0
[21:12:29.721] TRACE (sf:oclif:MetadataApiDeploy): Created 'sf:oclif:MetadataApiDeploy' child logger instance
...
[21:12:30.136] TRACE (sf:oclif:ComponentSet): Created 'sf:oclif:ComponentSet' child logger instance
[21:12:30.136] TRACE (sf:oclif): Setup child 'sf:oclif:ComponentSet' logger instance
[21:12:30.136] DEBUG (sf:oclif:SourceTracking.PopulateFilePaths):  the generated component set has 1 items
[21:12:30.136] TRACE (sf:oclif:ComponentSet): Created 'sf:oclif:ComponentSet' child logger instance
[21:12:30.136] TRACE (sf:oclif): Setup child 'sf:oclif:ComponentSet' logger instance
[21:12:30.161] DEBUG (sf:oclif:SourceTracking.PopulateFilePaths):  local source-backed component set has 0 items from remote
[21:12:30.162] TRACE (sf:oclif:SourceTracking.PopulateTypesAndNames): Created 'sf:oclif:SourceTracking.PopulateTypesAndNames' child logger instance
[21:12:30.162] TRACE (sf:oclif): Setup child 'sf:oclif:SourceTracking.PopulateTypesAndNames' logger instance
[21:12:30.162] DEBUG (sf:oclif:SourceTracking.PopulateTypesAndNames): populateTypesAndNames for 5 change elements
[21:12:30.163] DEBUG (sf:oclif:SourceTracking.PopulateTypesAndNames):  matching SourceComponents have 1 items from local
[21:12:30.164] TRACE (sf:oclif:ZipWriter): Created 'sf:oclif:ZipWriter' child logger instance
[21:12:30.164] TRACE (sf:oclif): Setup child 'sf:oclif:ZipWriter' logger instance
[21:12:30.164] DEBUG (sf:oclif:ZipWriter): generating zip in memory
[21:12:30.170] DEBUG (sf:oclif:ZipWriter): Generated zip complete
[21:12:30.170] DEBUG (sf:oclif:MetadataApiDeploy): Deploying metadata source in v63.0 shape using SOAP v63.0
[21:12:30.170] DEBUG (sf:oclif:MetadataApiDeploy): Deployment zip file size = 237 Bytes containing 1 files

Also possibly of interest, the ~/.sf/manifestCache/DEPLOYID.xml and ~/.sf/YYYY-MM-DD logs don't seem to agree on what was actually deployed:

  "0AfE100000cbzcvKAA": {
    "dry-run": false,
    "ignore-conflicts": false,
    "ignore-errors": false,
    "ignore-warnings": false,
    "metadata": [
      "CustomPermission:Create_New_Game_Rules_and_Criteria"
    ],
    "target-org": "test-ag0bteyay0ze@example.com",
    "api": "SOAP",
    "manifest": "C:\\Users\\Mike\\.sf\\manifestCache\\0AfE100000cbzcvKAA.xml",
    "wait": 33,
    "isMdapi": false,
    "timestamp": "2025-02-20T04:52:10.411Z",
    "status": "Succeeded"
  }
}

Mike@DESKTOP-JKN5M8N MINGW64 ~/.sf
$ cat manifestCache/0AfE100000cbzcvKAA.xml
<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <version>63.0</version>
</Package>

[shetzel]

Are you using the decomposePermissionSetBeta2 sourceBehaviorOptions in sfdx-project.json? A bug was fixed in that release window that might have caused the behavior you're seeing.

UPDATE: Yeah, if I use that preset and then run the same commands I reproduce it. Thanks for narrowing it down to that release window. That was huge in finding this!

As a temporary workaround you can install a previous CLI release or install a version of the deploy-retrieve plugin before 3.17.7.

[git2gus]

This issue has been linked to a new work item: W-17874345

[mike-burke-10xgenomics]

Are you using the decomposePermissionSetBeta2 sourceBehaviorOptions in sfdx-project.json? A bug was fixed in that release window that might have caused the behavior you're seeing.

I am! I can update the source behavior for now to undo that change while this is pending - we're not using the feature to any extensive effect, so turning it off won't really affect much in the meantime.

Thanks for helping track down the issue so quickly.