hardis:org:refresh:after-refresh

Description

Command Behavior

This command requires human interaction and must be called manually, preferably from the VS Code SFDX Hardis UI. It is not suitable for automation or AI agent usage.

Restores all previously backed-up Connected Apps (including Consumer Secrets), External Client Apps (including credentials), certificates, custom settings, records and other metadata to a Salesforce org after a sandbox refresh.

This command is the second step in the sandbox refresh process. It scans the backup folder created before the refresh, allows interactive or flag-driven selection of items to restore, and automates cleanup and redeployment to the refreshed org while preserving credentials and configuration.

Key functionalities:

Choose a backup to restore: Lets you pick the saved sandbox project that contains the artifacts to restore.
Restore External Client Apps: Detects saved External Client App metadata (ExternalClientApplication, ExtlClntAppOauthSettings, ExtlClntAppGlobalOauthSettings, ExtlClntAppOauthConfigurablePolicies, ExtlClntAppConfigurablePolicies) and deploys them back to the org, including their saved OAuth credentials (Consumer Key and Consumer Secret).
Select which items to restore: Finds Connected App XMLs, certificates, custom settings and other artifacts and lets you pick what to restore (or restore all).
Safety checks and validation: Confirms files exist and prompts before making changes to the target org.
Skip what is already restored: Reads the actions history of the previous runs on the same backup folder, and asks for confirmation before running again a step that already succeeded (certificates, other metadata, SAML SSO configs, custom settings, records, External Client Apps, Connected Apps, reschedule Apex script).
Prepare org for restore: Optionally cleans up existing Connected Apps so saved apps can be re-deployed without conflict.
Redeploy saved artifacts: Restores External Client Apps (with saved credentials), certificates, SAML SSO configs, custom settings and other metadata. Restoring Connected Apps is discouraged (declined by default): since Spring '26 their deploy is rejected unless Salesforce Support has enabled Connected App creation in the org via a Case. Convert them to External Client Apps before the refresh instead.
Handle SAML configs: Cleans and updates SAML XML files and helps you choose certificates to wire into restored configs.
Restore records: Optionally runs data import from selected SFDMU workspaces to restore record data.
Manual actions checklist: Reads the manual-restore-inventory.json file saved before the refresh and lists everything that must be redone by hand: external OAuth authentications (OwnBackup, Microsoft Power Platform and other tools connected via "Log in with Salesforce"), Auth Provider secrets, Named & External Credential secrets and principals, and scheduled jobs to re-enable. A scheduled job runs as the user who scheduled it, so among the per-user Apex reschedule scripts generated by the before-refresh command, only the current user's own script can be executed directly (the command offers it); for the other users, it displays "Login As" + Developer Console Execute Anonymous instructions so each script is run by its own user. Also reminds org-level settings reset by the refresh (email deliverability, .invalid user emails, endpoint URLs, Experience Cloud sites, Shield tenant secret rotation).
Reporting & persistence: Sends restore reports and can update project config to record what was restored.

This command is part of sfdx-hardis Sandbox Refresh and is intended to be run after a sandbox refresh to re-apply saved metadata, credentials and data.

Technical explanations

Backup Folder Handling: Reads the immediate subfolders of scripts/sandbox-refresh/ and validates the chosen project contains the expected manifest/ and force-app layout.
External Client App Handling: Checks for saved ECA metadata in force-app/main/default/externalClientApps/ and related folders, builds a package manifest for all 5 ECA metadata types, and deploys them using sf project deploy start --manifest to recreate the apps with their original credentials in the refreshed org.
Metadata & Deployment APIs: Uses sf project deploy start --manifest for package-based deploys, sf project deploy start --metadata-dir for MDAPI artifacts (certificates), and utility functions for Connected App deployment that preserve consumer secrets.
SAML Handling: Queries active certificates via tooling API, updates SAML XML files, and deploys using sf project deploy start -m SamlSsoConfig.
Records Handling: Uses interactive selection of SFDMU workspaces and runs data import utilities to restore records.
Manual Actions Checklist: Loads manual-restore-inventory.json from the backup project (produced by the before-refresh command) and reports each entry in the actions CSV with status Manual, so the report doubles as a post-refresh handover checklist.
Already Done Detection: Loads sandbox-refresh-after-actions-history.json from the backup folder at startup and looks for rows of the step with status Success. When some exist, it displays them with the date of the last run and prompts (defaulting to no) before executing the step again.
Error Handling & Summary: Aggregates results, logs success/warnings/errors, and returns a structured result indicating which items were restored and any failures.

Parameters

Name	Type	Description
all -a	boolean	If set, all Connected Apps from the local repository will be processed. Takes precedence over --name if both are specified.
flags-dir	option	undefined
json	boolean	Format output as json.
name -n	option	Connected App name(s) to process (bypasses selection prompt). For multiple apps, separate with commas (e.g., "App1,App2")
skipauth	boolean	Skip authentication check when a default username is required
target-org -o	option	undefined
websocket	option	WebSocket host:port for VS Code SFDX Hardis UI integration

Examples

$ sf hardis:org:refresh:after-refresh

$ sf hardis:org:refresh:after-refresh --name "MyConnectedApp" // Process specific app, no selection prompt

$ sf hardis:org:refresh:after-refresh --name "App1,App2,App3" // Process multiple apps, no selection prompt

$ sf hardis:org:refresh:after-refresh --all // Process all apps, no selection prompt

$ sf hardis:org:refresh:after-refresh --target-org myDevOrg