vulkro-sf cloud

Work your Vulkro Cloud for Salesforce workspace from the terminal. Every action runs as you, with your role and org access in the workspace.

This is workspace access only: it does not use or change your vulkro-sf licence, and nothing here changes a Salesforce org.

Connect

vulkro-sf cloud connect https://<name>.vulkro.com

vulkro-sf shows a short code and opens the workspace in your browser. Check the code matches, approve, and the terminal finishes on its own. The workspace token is stored in ~/.vulkro/sf-cloud.json (readable by you only), lasts 90 days, and stops working at once if you disconnect it in the workspace (My account > vulkro-sf connections) or leave the workspace.

vulkro-sf cloud status
vulkro-sf cloud disconnect

Commands

Command	What it does
orgs	The orgs you can see, with their open, to-triage and pending counts.
todo [--view ...] [--severity ...] [--org ...]	What to fix: the issue list, most severe first. Views: to_triage, open, pending, suppressed, resolved, mine, all.
show <fp> [--evidence]	One issue, with the engine's evidence trail when you ask for it.
triage <fp> --state <state> [--reason ...] [--expires ...]	new, in_progress and fixed apply at once. false_positive and accepted_risk need a reason and wait for an approver.
assign <fp> <me|member id|none>	Assign an issue.
review [list|approve <id>|reject <id> --note ...]	The approval queue. You cannot approve your own proposal unless your workspace allows it.
rules [list|show <rule>|propose <rule> --mode ... --reason ...]	Rules and their policies. Propose advisory, off or enforced, a severity, and an org or file scope.
scan <org> [--wait]	Start a cloud scan of an org and follow it.
fix-plan <fp> [--path <project>]	Find the issue's file and line in your local SFDX project, with the evidence and the fix advice. For an org setting, the metadata change to make in your project.
verify <fp> [--path <project>] [--mark-fixed]	Re-scan your project and report whether the rule still fires in that file; --mark-fixed marks the issue fixed when it is gone. The next cloud scan confirms it.
triage-ai [--dry-run]	Ask your configured AI model (see vulkro-sf ai) for a verdict on each issue to triage. Verdicts are proposals marked AI and wait for a person to approve them.

Every command takes --json (or --format json) for scripts.

The fix loop

1. vulkro-sf cloud todo --view mine
2. vulkro-sf cloud fix-plan <fp> and change the code
3. vulkro-sf cloud verify <fp> --mark-fixed
4. The next cloud scan confirms the fix; if the issue is still there, it is reopened.

AI assistants (MCP)

vulkro-sf mcp serve exposes the same actions as tools: sf_cloud_connect_status, sf_cloud_orgs, sf_cloud_todo, sf_cloud_finding, sf_cloud_triage, sf_cloud_review, sf_cloud_assign, sf_cloud_rule_policy, sf_cloud_scan, sf_cloud_fix_plan and sf_cloud_verify. An assistant marks its own verdicts as AI, and they wait for a person's approval.

Environment

Variable	Use
VULKRO_SF_CLOUD_URL	The workspace address, instead of the saved connection (CI).
VULKRO_SF_CLOUD_TOKEN	A workspace token (vkws_...), instead of the saved one (CI).

The cloud commands use the network, so they are refused when VULKRO_OFFLINE is set.

Exit codes

Code	Meaning
0	The request succeeded (an empty list is still 0).
2	Error: not connected, refused by the workspace, network, bad arguments, or a scan --wait whose scan failed.