`sf project retrieve start` always fails with error: UnsafeFilepathError

[patrick-skamarak]

Summary

All invocations of sf project retrieve start fail after attempting to retrieve metadata outputting to the temporary directory (/tmp on Mac).

Steps To Reproduce

1. Initialize an empty project
2. Set a default org
3. Run first command: sf project retrieve start -m CustomObject:Account --output-dir /tmp/test
4. Observe error Error (MetadataTransferError): Metadata API request failed: The filepath "../../../../tmp/test/main/default/objects/Account/Account.object-meta.xml" contains unsafe character sequences
5. Observe the retrieve was successful by navigating to and viewing your tmp directory
6. Attempt to run second, third, nth command, etc such as: sf project retrieve start -m CustomObject:Contact , sf project retrieve start, or some other variation.
7. Observe error: Error (UnsafeFilepathError): The filepath "../../../../tmp/test/main/default/objects/Account/Account.object-meta.xml" contains unsafe character sequences

Additional information

Can be resolved by deleting local source tracking folder for the default org (or just the index file)

System Information

{
  "architecture": "darwin-arm64",
  "cliVersion": "@salesforce/cli/2.108.6",
  "nodeVersion": "node-v20.19.0",
  "osVersion": "Darwin 24.6.0",
  "shell": "zsh",
  "pluginVersions": [
    "@dx-cli-toolbox/sfdx-toolbox-package-utils 1.0.2 (user) published 189 days ago (Tue Apr 15 2025)",
    "@oclif/plugin-autocomplete 3.2.35 (core)",
    "@oclif/plugin-commands 4.1.33 (core)",
    "@oclif/plugin-help 6.2.33 (core)",
    "@oclif/plugin-not-found 3.2.68 (core)",
    "@oclif/plugin-plugins 5.4.47 (core)",
    "@oclif/plugin-search 1.2.31 (core)",
    "@oclif/plugin-update 4.7.7 (core)",
    "@oclif/plugin-version 2.2.33 (core)",
    "@oclif/plugin-warn-if-update-available 3.1.48 (core)",
    "@oclif/plugin-which 3.2.40 (core)",
    "@salesforce/cli 2.108.6 (core)",
    "agent 1.24.13 (core)",
    "apex 3.8.1 (core)",
    "api 1.3.3 (core)",
    "auth 3.9.8 (core)",
    "code-analyzer 5.5.0 (user) published 21 days ago (Tue Sep 30 2025)",
    "community 3.3.41 (user) published 38 days ago (Fri Sep 12 2025)",
    "custom-metadata 3.3.68 (user) published 44 days ago (Sat Sep 06 2025)",
    "data 4.0.57 (core)",
    "deploy-retrieve 3.23.3 (core)",
    "env 3.0.34 (user) published 338 days ago (Sun Nov 17 2024) (latest is 3.0.37)",
    "functions 1.23.0 (user) published 594 days ago (Tue Mar 05 2024)",
    "info 3.4.88 (core)",
    "limits 3.3.67 (core)",
    "marketplace 1.3.8 (core)",
    "org 5.9.30 (core)",
    "packaging 2.20.5 (core)",
    "schema 3.3.82 (core)",
    "settings 2.4.48 (core)",
    "signups 2.6.48 (user) published 37 days ago (Sat Sep 13 2025) (latest is 2.6.49)",
    "sobject 1.4.73 (core)",
    "telemetry 3.6.57 (core)",
    "templates 56.3.65 (core)",
    "trust 3.7.113 (core)",
    "user 3.6.38 (core)",
    "@salesforce/sfdx-scanner 4.12.0 (user) published 175 days ago (Tue Apr 29 2025)",
    "texei-sfdx-plugin 2.8.4 (user) published 39 days ago (Fri Sep 12 2025)"
  ]
}

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[WillieRuemmele]

I was able to reproduce this... that's a strange one

[git2gus]

This issue has been linked to a new work item: W-20013096

[jfeingold35]

@patrick-skamarak , out of curiosity, are you still able to reproduce this issue on the latest version of SF CLI? In our latest attempt to reproduce, we've found that we instead receive an Error (OutputDirOutsideProjectError): The output directory must be inside the current project. The path relative you provided /tmp/test is outside the project root.
If you're still able to reproduce your original error, we can dig into why.

[patrick-skamarak]

Hi @jfeingold35, I updated CLI to v2.114.5 from 2.108.6 this morning and am now seeing that error. Good stuff, thanks!

[jfeingold35]

@patrick-skamarak , great! Barring any objections, I'm going to close this as Could Not Reproduce. Acceptable?

[soridalac]

@jfeingold35, I added an error message here in this PR: [salesforcecli/plugin-deploy-retrieve/pull/1480].

[soridalac]

@patrick-skamarak, to use feature of source tracking, you need to retrieve within the a project.

[patrick-skamarak]

@patrick-skamarak, to use feature of source tracking, you need to retrieve within the a project.

Makes sense, thanks!