`sf project retrieve start` freezes when connected to some sandboxes

[msouther-lisc]

Summary

I was asked by my Salesforce Customer Support rep to log an issue here based on our conversation. I am experiencing an issue with retrieving metadata from certain sandboxes, but not others. For example, this command works fine and the permission set metadata is retrieved:

sf project retrieve start -m PermissionSet:GCM_Super_Users -o LISCERP-UAT

However, when I run the following command...

sf project retrieve start -m PermissionSet:GCM_Super_Users -o LISCERP-MSDEV2

...my terminal appears to get stuck looking something like this:

────────────── Retrieving Metadata ──────────────

√Preparing retrieve request 18ms

• Sending request to org 29.91s
  ■Waiting for the org to respond
  ■Done

Status: -
Elapsed Time: 29.95s

Then about 10 minutes later it returns with an ECONNABORTED error.

Steps To Reproduce

My support rep has been unable to reproduce this issue using a test user authenticated to one of the same sandboxes where I am experiencing the issue. As such, I am not confident I can provide a scenario for another person to reliably reproduce the outcome I'm seeing. There is clearly an element of this problem that is either specific to certain sandbox instances, users, sessions, etc., that makes this difficult to pinpoint.

Expected result

Metadata (e.g. a Permission Set XML) should be retrieved from my sandbox and saved to my local SFDX directory.

Actual result

The process freezes and then much later exits, as described above.

System Information

I am primarily using Git Bash on Windows. I can also reproduce the issue using PowerShell.

{
  "architecture": "win32-x64",
  "cliVersion": "@salesforce/cli/2.90.4",
  "nodeVersion": "node-v22.15.0",
  "osVersion": "Windows_NT 10.0.19044",
  "rootPath": "C:\\Users\\MSouther\\AppData\\Local\\sf\\client\\2.90.4-1709262",
  "shell": "C:\\Users\\MSouther\\AppData\\Local\\Programs\\Git\\usr\\bin\\bash.exe",
  "pluginVersions": [
    "@oclif/plugin-autocomplete 3.2.29 (core)",
    "@oclif/plugin-commands 4.1.25 (core)",
    "@oclif/plugin-help 6.2.28 (core)",
    "@oclif/plugin-not-found 3.2.52 (core)",
    "@oclif/plugin-plugins 5.4.38 (core)",
    "@oclif/plugin-search 1.2.24 (core)",
    "@oclif/plugin-update 4.6.41 (core)",
    "@oclif/plugin-version 2.2.28 (core)",
    "@oclif/plugin-warn-if-update-available 3.1.40 (core)",
    "@oclif/plugin-which 3.2.35 (core)",
    "@salesforce/cli 2.90.4 (core)",
    "apex 3.6.18 (core)",
    "api 1.3.3 (core)",
    "auth 3.6.122 (core)",
    "code-analyzer 5.1.0 (user) published 1 days ago (Tue May 27 2025)",
    "data 4.0.34 (core)",
    "deploy-retrieve 3.22.15 (core)",
    "info 3.4.63 (core)",
    "limits 3.3.55 (core)",
    "marketplace 1.3.8 (core)",
    "org 5.7.10 (core)",
    "packaging 2.13.4 (core)",
    "schema 3.3.63 (core)",
    "settings 2.4.29 (core)",
    "sobject 1.4.58 (core)",
    "telemetry 3.6.41 (core)",
    "templates 56.3.48 (core)",
    "trust 3.7.93 (core)",
    "user 3.6.23 (core)"
  ]
}

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[soridalac]

Hi @msouther-lisc, Can you run sf doctor with your exact command and attach the diagnosis and stdout files? and provide the output so we can see env vars and other diagnostic tests. Thank you!
Also enable jsforce debugging can be helpful with the connection issue -> export JSFORCE_LOG_LEVEL=DEBUG

See more details about doctor command: https://developer.salesforce.com/docs/atlas.en-us.sfdx_setup.meta/sfdx_setup/sfdx_setup_trouble_doctor.htm

[msouther-lisc]

@soridalac Thanks so much for the fast reply. I'd love to give you the sf doctor outputs, but when I ran this...

sf doctor --command "project retrieve start -m PermissionSet:GCM_Super_Users -o LISCERP-MSDEV2"

...I got this in the stdout:

'C:\Program' is not recognized as an internal or external command, operable program or batch file.

Looks like sf doctor doesn't know how to play nice with standard Windows directory names with spaces in them, like "C:\Program Files"? Not sure if this is something I can hack on my end.

[soridalac]

@msouther-lisc hmm Are you able to run your command with --dev-debug?

[msouther-lisc]

@soridalac Yes, I was able to run with --dev-debug. The full output contains a lot of proprietary info about my org's metadata and structure that I'm hesitant to share on a public forum. But here is the rest of the output after I removed those lines. I hope it helps.

debug_output_2025-05-29_2.txt

[supert3d1975]

I seem to be getting the same as well. Hangs here...

[22:36:54.219] DEBUG (sf:remoteSourceTrackingService:readFileContents): older tracking file version, found 0. Upgrading file contents.  Some expected data may be missing
[22:36:56.015] TRACE (sf:ShadowRepo): done: getStatus (noCache = false)
[22:36:56.015] TRACE (sf:ShadowRepo): start: getStatus (noCache = false)
[22:36:56.015] TRACE (sf:ShadowRepo): done: getStatus (noCache = false)
[22:36:56.018] DEBUG (sf:SourceTracking): ensureRemoteTracking: remote tracking already exists
[22:36:56.018] DEBUG (RemoteSourceTrackingService): Query: SELECT MemberIdOrName, MemberType, MemberName, IsNameObsolete, RevisionCounter, IsNewMember, ChangedBy, LastModifiedDate FROM SourceMember WHERE RevisionCounter > 16126
[22:36:56.019] DEBUG (sf:connection): request
    method: "GET"
    url: "https://redacted.for.security.my.salesforce.com/services/data/v63.0/tooling/query?q=SELECT%20MemberIdOrName%2C%20MemberType%2C%20MemberName%2C%20IsNameObsolete%2C%20RevisionCounter%2C%20IsNewMember%2C%20ChangedBy%2C%20LastModifiedDate%20FROM%20SourceMember%20WHERE%20RevisionCounter%20%3E%2016126"
    headers: {
      "content-type": "application/json",
      "user-agent": "sfdx toolbelt:"
    }

Cannot even retrieve with manifest. Just hangs.

sf project retrieve start --manifest tmp/package.xml

OS Name:                       Microsoft Windows 11 Pro
OS Version:                    10.0.26100 N/A Build 26100

GNU bash, version 5.2.12(1)-release (x86_64-pc-msys)
Copyright (C) 2022 Free Software Foundation, Inc.

$ sf version
@salesforce/cli/2.90.4 win32-x64 node-v22.15.0

[soridalac]

@msouther-lisc @supert3d1975 , thank you for providing the output. I suggest you try to disable the source tracking and deleting the existing source tracking data. Then try to retrieve the data again. sf org disable tracking & sf project tracking delete

[supert3d1975]

@msouther-lisc Awesome! That did the trick! Thanks so much!

[msouther-lisc]

@soridalac Worked like a charm! I owe you one. 🎉

I see warnings in the docs about using sf project delete tracking, but as far as I can tell this only matters if you're relying on the source tracking files to know what needs to be retrieved or deployed. For me personally, that's not a concern.

[laissaouibrahim]

For me i was facing the same issue today 01/01/2026. After i have added '-c' to my commands the issue is resolved.
sf project retrieve start -m Settings:ConnectedApp -c

Tips : you can debug cli command using --dev-debug
Similar issue here : j-schreiber/js-sf-cli-security-audit#12