@salesforce/plugin-org 5.10.13 → 5.11.0

package/README.md

@@ -99,6 +99,9 @@ the [SandboxNuts](https://github.com/salesforcecli/plugin-org/actions/workflows/
 
 <!-- commands -->
 
+- [`sf org auth show-access-token`](#sf-org-auth-show-access-token)
+- [`sf org auth show-sfdx-auth-url`](#sf-org-auth-show-sfdx-auth-url)
+- [`sf org auth show-user-password`](#sf-org-auth-show-user-password)
 - [`sf org create agent-user`](#sf-org-create-agent-user)
 - [`sf org create sandbox`](#sf-org-create-sandbox)
 - [`sf org create scratch`](#sf-org-create-scratch)
@@ -117,6 +120,140 @@ the [SandboxNuts](https://github.com/salesforcecli/plugin-org/actions/workflows/
 - [`sf org resume sandbox`](#sf-org-resume-sandbox)
 - [`sf org resume scratch`](#sf-org-resume-scratch)
 
+## `sf org auth show-access-token`
+
+Show the current access token for an org.
+
+```
+USAGE
+  $ sf org auth show-access-token -o <value> [--json] [--flags-dir <value>] [-p]
+
+FLAGS
+  -o, --target-org=<value>  (required) Username or alias of the target org. Not required if the `target-org`
+                            configuration variable is already set.
+  -p, --no-prompt           Skip the security warning and reveal the access token without confirmation.
+
+GLOBAL FLAGS
+  --flags-dir=<value>  Import flag values from a directory.
+  --json               Format output as json.
+
+DESCRIPTION
+  Show the current access token for an org.
+
+  Because access tokens are sensitive credentials that grant full access to an org, this command prompts for
+  confirmation before revealing the token. Skip confirmation by specifying either the --no-prompt or --json flag.
+
+EXAMPLES
+  Show the access token for the default org:
+
+    $ sf org auth show-access-token
+
+  Show the access token for an org with alias "my-org":
+
+    $ sf org auth show-access-token --target-org my-org
+
+  Show the access token without the confirmation prompt:
+
+    $ sf org auth show-access-token --target-org my-org --no-prompt
+
+  Get the access token as JSON for use in scripts:
+
+    $ sf org auth show-access-token --target-org my-org --json
+```
+
+_See code: [src/commands/org/auth/show-access-token.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/auth/show-access-token.ts)_
+
+## `sf org auth show-sfdx-auth-url`
+
+Show the SFDX Auth URL for an org.
+
+```
+USAGE
+  $ sf org auth show-sfdx-auth-url -o <value> [--json] [--flags-dir <value>] [-p]
+
+FLAGS
+  -o, --target-org=<value>  (required) Username or alias of the target org. Not required if the `target-org`
+                            configuration variable is already set.
+  -p, --no-prompt           Skip the security warning and reveal the SFDX Auth URL without confirmation.
+
+GLOBAL FLAGS
+  --flags-dir=<value>  Import flag values from a directory.
+  --json               Format output as json.
+
+DESCRIPTION
+  Show the SFDX Auth URL for an org.
+
+  Shows the SFDX Auth URL for an org. This URL is only available for orgs authenticated via a web-based OAuth flow. This
+  command prompts for confirmation before revealing it. Skip confirmation by specifying either the --no-prompt or --json
+  flag.
+
+EXAMPLES
+  Show the SFDX Auth URL for the default org:
+
+    $ sf org auth show-sfdx-auth-url
+
+  Show the SFDX Auth URL for an org with alias "my-org":
+
+    $ sf org auth show-sfdx-auth-url --target-org my-org
+
+  Show the SFDX Auth URL without the confirmation prompt:
+
+    $ sf org auth show-sfdx-auth-url --target-org my-org --no-prompt
+
+  Get the SFDX Auth URL as JSON for use in scripts:
+
+    $ sf org auth show-sfdx-auth-url --target-org my-org --json
+```
+
+_See code: [src/commands/org/auth/show-sfdx-auth-url.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/auth/show-sfdx-auth-url.ts)_
+
+## `sf org auth show-user-password`
+
+Show the stored password for an org's user.
+
+```
+USAGE
+  $ sf org auth show-user-password -o <value> [--json] [--flags-dir <value>] [-p]
+
+FLAGS
+  -o, --target-org=<value>  (required) Username or alias of the target org. Not required if the `target-org`
+                            configuration variable is already set.
+  -p, --no-prompt           Skip the security warning and reveal the password without confirmation.
+
+GLOBAL FLAGS
+  --flags-dir=<value>  Import flag values from a directory.
+  --json               Format output as json.
+
+DESCRIPTION
+  Show the stored password for an org's user.
+
+  This command shows only passwords that were generated locally in your DX project with either the "org generate
+  password" or "org create user" CLI command. If you generated a password for a user in Setup in your org, you can't
+  show it with this command.
+
+  Because passwords are sensitive credentials, this command prompts for confirmation before revealing it. Skip
+  confirmation by specifying either the --no-prompt or --json flag.
+
+EXAMPLES
+  Show the password for the default org's user:
+
+    $ sf org auth show-user-password
+
+  Show the password for an org with alias "my-org":
+
+    $ sf org auth show-user-password --target-org my-org
+
+  Show the password without the confirmation prompt:
+
+    $ sf org auth show-user-password --target-org my-org --no-prompt
+
+  Get the password as JSON for use in scripts:
+
+    $ sf org auth show-user-password --target-org my-org --json
+```
+
+_See code: [src/commands/org/auth/show-user-password.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/auth/show-user-password.ts)_
+
 ## `sf org create agent-user`
 
 Create the default Salesforce user that is used to run an agent.
@@ -193,7 +330,7 @@ FLAG DESCRIPTIONS
     "agent.user.<GUID>@your-org-domain.com".
 ```
 
-_See code: [src/commands/org/create/agent-user.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/create/agent-user.ts)_
+_See code: [src/commands/org/create/agent-user.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/create/agent-user.ts)_
 
 ## `sf org create sandbox`
 
@@ -327,7 +464,7 @@ FLAG DESCRIPTIONS
     You can specify either --source-sandbox-name or --source-id when cloning an existing sandbox, but not both.
 ```
 
-_See code: [src/commands/org/create/sandbox.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/create/sandbox.ts)_
+_See code: [src/commands/org/create/sandbox.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/create/sandbox.ts)_
 
 ## `sf org create scratch`
 
@@ -509,7 +646,7 @@ FLAG DESCRIPTIONS
     Omit this flag to have Salesforce generate a unique username for your org.
 ```
 
-_See code: [src/commands/org/create/scratch.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/create/scratch.ts)_
+_See code: [src/commands/org/create/scratch.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/create/scratch.ts)_
 
 ## `sf org delete sandbox`
 
@@ -555,7 +692,7 @@ EXAMPLES
     $ sf org delete sandbox --target-org my-sandbox --no-prompt
 ```
 
-_See code: [src/commands/org/delete/sandbox.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/delete/sandbox.ts)_
+_See code: [src/commands/org/delete/sandbox.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/delete/sandbox.ts)_
 
 ## `sf org delete scratch`
 
@@ -599,7 +736,7 @@ EXAMPLES
     $ sf org delete scratch --target-org my-scratch-org --no-prompt
 ```
 
-_See code: [src/commands/org/delete/scratch.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/delete/scratch.ts)_
+_See code: [src/commands/org/delete/scratch.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/delete/scratch.ts)_
 
 ## `sf org disable tracking`
 
@@ -638,7 +775,7 @@ EXAMPLES
     $ sf org disable tracking
 ```
 
-_See code: [src/commands/org/disable/tracking.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/disable/tracking.ts)_
+_See code: [src/commands/org/disable/tracking.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/disable/tracking.ts)_
 
 ## `sf org display`
 
@@ -683,7 +820,7 @@ EXAMPLES
     $ sf org display --target-org TestOrg1 --verbose
 ```
 
-_See code: [src/commands/org/display.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/display.ts)_
+_See code: [src/commands/org/display.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/display.ts)_
 
 ## `sf org enable tracking`
 
@@ -725,7 +862,7 @@ EXAMPLES
     $ sf org enable tracking
 ```
 
-_See code: [src/commands/org/enable/tracking.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/enable/tracking.ts)_
+_See code: [src/commands/org/enable/tracking.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/enable/tracking.ts)_
 
 ## `sf org list`
 
@@ -764,7 +901,7 @@ EXAMPLES
     $ sf org list --clean
 ```
 
-_See code: [src/commands/org/list.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/list.ts)_
+_See code: [src/commands/org/list.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/list.ts)_
 
 ## `sf org list metadata`
 
@@ -831,7 +968,7 @@ FLAG DESCRIPTIONS
     Examples of metadata types that use folders are Dashboard, Document, EmailTemplate, and Report.
 ```
 
-_See code: [src/commands/org/list/metadata.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/list/metadata.ts)_
+_See code: [src/commands/org/list/metadata.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/list/metadata.ts)_
 
 ## `sf org list metadata-types`
 
@@ -886,7 +1023,7 @@ FLAG DESCRIPTIONS
     Override the api version used for api requests made by this command
 ```
 
-_See code: [src/commands/org/list/metadata-types.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/list/metadata-types.ts)_
+_See code: [src/commands/org/list/metadata-types.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/list/metadata-types.ts)_
 
 ## `sf org open`
 
@@ -962,7 +1099,7 @@ EXAMPLES
     $ sf org open --source-file force-app/main/default/bots/Coral_Cloud_Agent/Coral_Cloud_Agent.bot-meta.xml
 ```
 
-_See code: [src/commands/org/open.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/open.ts)_
+_See code: [src/commands/org/open.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/open.ts)_
 
 ## `sf org open agent`
 
@@ -1037,7 +1174,7 @@ FLAG DESCRIPTIONS
     flag.
 ```
 
-_See code: [src/commands/org/open/agent.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/open/agent.ts)_
+_See code: [src/commands/org/open/agent.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/open/agent.ts)_
 
 ## `sf org open authoring-bundle`
 
@@ -1083,7 +1220,7 @@ EXAMPLES
     $ sf org open authoring-bundle --target-org MyTestOrg1 --browser firefox
 ```
 
-_See code: [src/commands/org/open/authoring-bundle.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/open/authoring-bundle.ts)_
+_See code: [src/commands/org/open/authoring-bundle.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/open/authoring-bundle.ts)_
 
 ## `sf org refresh sandbox`
 
@@ -1186,7 +1323,7 @@ FLAG DESCRIPTIONS
     You can specify either --source-sandbox-name or --source-id when refreshing an existing sandbox, but not both.
 ```
 
-_See code: [src/commands/org/refresh/sandbox.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/refresh/sandbox.ts)_
+_See code: [src/commands/org/refresh/sandbox.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/refresh/sandbox.ts)_
 
 ## `sf org resume sandbox`
 
@@ -1249,7 +1386,7 @@ FLAG DESCRIPTIONS
     returns the job ID. To resume checking the sandbox creation, rerun this command.
 ```
 
-_See code: [src/commands/org/resume/sandbox.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/resume/sandbox.ts)_
+_See code: [src/commands/org/resume/sandbox.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/resume/sandbox.ts)_
 
 ## `sf org resume scratch`
 
@@ -1302,6 +1439,6 @@ FLAG DESCRIPTIONS
     returns the job ID. To resume checking the scratch creation, rerun this command.
 ```
 
-_See code: [src/commands/org/resume/scratch.ts](https://github.com/salesforcecli/plugin-org/blob/5.10.13/src/commands/org/resume/scratch.ts)_
+_See code: [src/commands/org/resume/scratch.ts](https://github.com/salesforcecli/plugin-org/blob/5.11.0/src/commands/org/resume/scratch.ts)_
 
 <!-- commandsstop -->

package/lib/commands/org/auth/show-access-token.d.ts

@@ -0,0 +1,14 @@
+import { SfCommand } from '@salesforce/sf-plugins-core';
+export type OrgAuthShowAccessTokenResult = {
+    accessToken: string;
+};
+export default class OrgAuthShowAccessToken extends SfCommand<OrgAuthShowAccessTokenResult> {
+    static readonly summary: string;
+    static readonly description: string;
+    static readonly examples: string[];
+    static readonly flags: {
+        'target-org': import("@oclif/core/interfaces").OptionFlag<import("@salesforce/core").Org, import("@oclif/core/interfaces").CustomOptions>;
+        'no-prompt': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<OrgAuthShowAccessTokenResult>;
+}

package/lib/commands/org/auth/show-access-token.js

@@ -0,0 +1,69 @@
+/*
+ * Copyright 2026, Salesforce, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { SfCommand, Flags } from '@salesforce/sf-plugins-core';
+import { AuthInfo, Messages, SfError } from '@salesforce/core';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('@salesforce/plugin-org', 'org.auth.show-access-token');
+export default class OrgAuthShowAccessToken extends SfCommand {
+    static summary = messages.getMessage('summary');
+    static description = messages.getMessage('description');
+    static examples = messages.getMessages('examples');
+    static flags = {
+        'target-org': Flags.requiredOrg(),
+        'no-prompt': Flags.boolean({
+            summary: messages.getMessage('flags.no-prompt.summary'),
+            char: 'p',
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(OrgAuthShowAccessToken);
+        const org = flags['target-org'];
+        const username = org.getUsername();
+        try {
+            // The auth file can have a stale access token. Refresh it before getting the fields
+            await org.refreshAuth();
+        }
+        catch (error) {
+            // Even if this fails, we want to display the information we can read from the auth file
+            this.warn('Unable to refresh auth for org. Access token may be stale.');
+        }
+        // Don't ask for confirmation if --json or --no-prompt is passed
+        if (!this.jsonEnabled() && !flags['no-prompt']) {
+            const confirmed = await this.confirm({
+                message: messages.getMessage('prompt.show-access-token', [username]),
+                ms: 30_000,
+            });
+            if (!confirmed) {
+                throw new SfError('Show access token confirmation denied or timed out.');
+            }
+        }
+        else {
+            // Note: We don't show this warning if the user has already been prompted
+            this.warn(messages.getMessage('warning.show-access-token'));
+        }
+        const authInfo = await AuthInfo.create({ username });
+        const { accessToken } = authInfo.getFields(true);
+        if (!accessToken) {
+            throw messages.createError('error.noAccessToken', [username]);
+        }
+        this.table({
+            overflow: 'wrap',
+            data: [{ key: 'Access Token', value: accessToken }],
+        });
+        return { accessToken };
+    }
+}
+//# sourceMappingURL=show-access-token.js.map

package/lib/commands/org/auth/show-access-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"show-access-token.js","sourceRoot":"","sources":["../../../../src/commands/org/auth/show-access-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE/D,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,wBAAwB,EAAE,4BAA4B,CAAC,CAAC;AAM/F,MAAM,CAAC,OAAO,OAAO,sBAAuB,SAAQ,SAAuC;IAClF,MAAM,CAAU,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,CAAU,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,CAAU,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAE5D,MAAM,CAAU,KAAK,GAAG;QAC7B,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE;QACjC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC;YACzB,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,yBAAyB,CAAC;YACvD,IAAI,EAAE,GAAG;SACV,CAAC;KACH,CAAC;IAEK,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAE3D,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,oFAAoF;YACpF,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wFAAwF;YACxF,IAAI,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC1E,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;gBACnC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,0BAA0B,EAAE,CAAC,QAAQ,CAAC,CAAC;gBACpE,EAAE,EAAE,MAAM;aACX,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,OAAO,CAAC,qDAAqD,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAEjD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC,WAAW,CAAC,qBAAqB,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,KAAK,CAAC;YACT,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;SACpD,CAAC,CAAC;QAEH,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC"}

package/lib/commands/org/auth/show-sfdx-auth-url.d.ts

@@ -0,0 +1,14 @@
+import { SfCommand } from '@salesforce/sf-plugins-core';
+export type OrgAuthShowSfdxAuthUrlResult = {
+    sfdxAuthUrl: string;
+};
+export default class OrgAuthShowSfdxAuthUrl extends SfCommand<OrgAuthShowSfdxAuthUrlResult> {
+    static readonly summary: string;
+    static readonly description: string;
+    static readonly examples: string[];
+    static readonly flags: {
+        'target-org': import("@oclif/core/interfaces").OptionFlag<import("@salesforce/core").Org, import("@oclif/core/interfaces").CustomOptions>;
+        'no-prompt': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<OrgAuthShowSfdxAuthUrlResult>;
+}

package/lib/commands/org/auth/show-sfdx-auth-url.js

@@ -0,0 +1,60 @@
+/*
+ * Copyright 2026, Salesforce, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { SfCommand, Flags } from '@salesforce/sf-plugins-core';
+import { AuthInfo, Messages, SfError } from '@salesforce/core';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('@salesforce/plugin-org', 'org.auth.show-sfdx-auth-url');
+export default class OrgAuthShowSfdxAuthUrl extends SfCommand {
+    static summary = messages.getMessage('summary');
+    static description = messages.getMessage('description');
+    static examples = messages.getMessages('examples');
+    static flags = {
+        'target-org': Flags.requiredOrg(),
+        'no-prompt': Flags.boolean({
+            summary: messages.getMessage('flags.no-prompt.summary'),
+            char: 'p',
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(OrgAuthShowSfdxAuthUrl);
+        const org = flags['target-org'];
+        const username = org.getUsername();
+        if (!this.jsonEnabled() && !flags['no-prompt']) {
+            const confirmed = await this.confirm({
+                message: messages.getMessage('prompt.show-sfdx-auth-url', [username]),
+                ms: 30_000,
+            });
+            if (!confirmed) {
+                throw new SfError('Show SFDX auth URL confirmation denied or timed out.');
+            }
+        }
+        else {
+            this.warn(messages.getMessage('warning.show-sfdx-auth-url'));
+        }
+        const authInfo = await AuthInfo.create({ username });
+        const { refreshToken } = authInfo.getFields(true);
+        if (!refreshToken) {
+            throw messages.createError('error.noRefreshToken', [username]);
+        }
+        const sfdxAuthUrl = authInfo.getSfdxAuthUrl();
+        this.table({
+            overflow: 'wrap',
+            data: [{ key: 'SFDX Auth URL', value: sfdxAuthUrl }],
+        });
+        return { sfdxAuthUrl };
+    }
+}
+//# sourceMappingURL=show-sfdx-auth-url.js.map

package/lib/commands/org/auth/show-sfdx-auth-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"show-sfdx-auth-url.js","sourceRoot":"","sources":["../../../../src/commands/org/auth/show-sfdx-auth-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE/D,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,wBAAwB,EAAE,6BAA6B,CAAC,CAAC;AAMhG,MAAM,CAAC,OAAO,OAAO,sBAAuB,SAAQ,SAAuC;IAClF,MAAM,CAAU,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,CAAU,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,CAAU,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAE5D,MAAM,CAAU,KAAK,GAAG;QAC7B,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE;QACjC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC;YACzB,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,yBAAyB,CAAC;YACvD,IAAI,EAAE,GAAG;SACV,CAAC;KACH,CAAC;IAEK,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAE3D,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAEnC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;gBACnC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,2BAA2B,EAAE,CAAC,QAAQ,CAAC,CAAC;gBACrE,EAAE,EAAE,MAAM;aACX,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,OAAO,CAAC,sDAAsD,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAElD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,QAAQ,CAAC,WAAW,CAAC,sBAAsB,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;QAE9C,IAAI,CAAC,KAAK,CAAC;YACT,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;SACrD,CAAC,CAAC;QAEH,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC"}

package/lib/commands/org/auth/show-user-password.d.ts

@@ -0,0 +1,14 @@
+import { SfCommand } from '@salesforce/sf-plugins-core';
+export type OrgAuthShowUserPasswordResult = {
+    password: string;
+};
+export default class OrgAuthShowUserPassword extends SfCommand<OrgAuthShowUserPasswordResult> {
+    static readonly summary: string;
+    static readonly description: string;
+    static readonly examples: string[];
+    static readonly flags: {
+        'target-org': import("@oclif/core/interfaces").OptionFlag<import("@salesforce/core").Org, import("@oclif/core/interfaces").CustomOptions>;
+        'no-prompt': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<OrgAuthShowUserPasswordResult>;
+}

package/lib/commands/org/auth/show-user-password.js

@@ -0,0 +1,59 @@
+/*
+ * Copyright 2026, Salesforce, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { SfCommand, Flags } from '@salesforce/sf-plugins-core';
+import { AuthInfo, Messages, SfError } from '@salesforce/core';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('@salesforce/plugin-org', 'org.auth.show-user-password');
+export default class OrgAuthShowUserPassword extends SfCommand {
+    static summary = messages.getMessage('summary');
+    static description = messages.getMessage('description');
+    static examples = messages.getMessages('examples');
+    static flags = {
+        'target-org': Flags.requiredOrg(),
+        'no-prompt': Flags.boolean({
+            summary: messages.getMessage('flags.no-prompt.summary'),
+            char: 'p',
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(OrgAuthShowUserPassword);
+        const org = flags['target-org'];
+        const username = org.getUsername();
+        if (!this.jsonEnabled() && !flags['no-prompt']) {
+            const confirmed = await this.confirm({
+                message: messages.getMessage('prompt.show-user-password', [username]),
+                ms: 30_000,
+            });
+            if (!confirmed) {
+                throw new SfError('Show user password confirmation denied or timed out.');
+            }
+        }
+        else {
+            this.warn(messages.getMessage('warning.show-user-password'));
+        }
+        const authInfo = await AuthInfo.create({ username });
+        const { password } = authInfo.getFields(true);
+        if (!password) {
+            throw messages.createError('error.noPassword', [username]);
+        }
+        this.table({
+            overflow: 'wrap',
+            data: [{ key: 'Password', value: password }],
+        });
+        return { password };
+    }
+}
+//# sourceMappingURL=show-user-password.js.map

package/lib/commands/org/auth/show-user-password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"show-user-password.js","sourceRoot":"","sources":["../../../../src/commands/org/auth/show-user-password.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE/D,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,wBAAwB,EAAE,6BAA6B,CAAC,CAAC;AAMhG,MAAM,CAAC,OAAO,OAAO,uBAAwB,SAAQ,SAAwC;IACpF,MAAM,CAAU,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,CAAU,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,CAAU,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAE5D,MAAM,CAAU,KAAK,GAAG;QAC7B,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE;QACjC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC;YACzB,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,yBAAyB,CAAC;YACvD,IAAI,EAAE,GAAG;SACV,CAAC;KACH,CAAC;IAEK,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAEnC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;gBACnC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,2BAA2B,EAAE,CAAC,QAAQ,CAAC,CAAC;gBACrE,EAAE,EAAE,MAAM;aACX,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,OAAO,CAAC,sDAAsD,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAE9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,CAAC,WAAW,CAAC,kBAAkB,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,KAAK,CAAC;YACT,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;SAC7C,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC"}

package/messages/org.auth.show-access-token.md

@@ -0,0 +1,41 @@
+# summary
+
+Show the current access token for an org.
+
+# description
+
+Because access tokens are sensitive credentials that grant full access to an org, this command prompts for confirmation before revealing the token. Skip confirmation by specifying either the --no-prompt or --json flag.
+
+# flags.no-prompt.summary
+
+Skip the security warning and reveal the access token without confirmation.
+
+# prompt.show-access-token
+
+You're about to reveal the access token for "%s". This token grants full access to the org with your current permissions. Sharing or logging this token is equivalent to sharing your credentials. Do you want to continue?
+
+# warning.show-access-token
+
+This command exposes a sensitive Access Token that allows for subsequent activity using your current authenticated session. Sharing this information is equivalent to logging someone in under the current credential, resulting in unintended access and escalation of privilege. For additional information about org authorization, review https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_auth.htm.
+
+# error.noAccessToken
+
+No access token found for "%s". The org may need to be re-authenticated.
+
+# examples
+
+- Show the access token for the default org:
+
+  <%= config.bin %> <%= command.id %>
+
+- Show the access token for an org with alias "my-org":
+
+  <%= config.bin %> <%= command.id %> --target-org my-org
+
+- Show the access token without the confirmation prompt:
+
+  <%= config.bin %> <%= command.id %> --target-org my-org --no-prompt
+
+- Get the access token as JSON for use in scripts:
+
+  <%= config.bin %> <%= command.id %> --target-org my-org --json

package/messages/org.auth.show-sfdx-auth-url.md

@@ -0,0 +1,41 @@
+# summary
+
+Show the SFDX Auth URL for an org.
+
+# description
+
+Shows the SFDX Auth URL for an org. This URL is only available for orgs authenticated via a web-based OAuth flow. This command prompts for confirmation before revealing it. Skip confirmation by specifying either the --no-prompt or --json flag.
+
+# flags.no-prompt.summary
+
+Skip the security warning and reveal the SFDX Auth URL without confirmation.
+
+# prompt.show-sfdx-auth-url
+
+You're about to reveal the SFDX Auth URL for "%s". This URL contains a refresh token that can be used to authenticate to the org without user interaction. Do you want to continue?
+
+# warning.show-sfdx-auth-url
+
+This command exposes an SFDX Auth URL. Unlike an access token, this credential contains a refresh token that allows extended access to an org. Avoid sharing or logging this URL. For additional information about org authorization, review https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_auth_url.htm.
+
+# error.noRefreshToken
+
+An SFDX Auth URL is not available for "%s". This URL is only available for orgs authenticated via a web-based login flow. Re-authenticate to the org using "sf org login web" to make it available.
+
+# examples
+
+- Show the SFDX Auth URL for the default org:
+
+  <%= config.bin %> <%= command.id %>
+
+- Show the SFDX Auth URL for an org with alias "my-org":
+
+  <%= config.bin %> <%= command.id %> --target-org my-org
+
+- Show the SFDX Auth URL without the confirmation prompt:
+
+  <%= config.bin %> <%= command.id %> --target-org my-org --no-prompt
+
+- Get the SFDX Auth URL as JSON for use in scripts:
+
+  <%= config.bin %> <%= command.id %> --target-org my-org --json