login

Authenticate to a Salesforce org. The user can pass:

• --alias <name> to label the auth (e.g., myDevHub, customerSandbox)
• --instance-url <url> for non-production endpoints (e.g., https://test.salesforce.com for sandboxes, https://login.salesforce.com for production — production is the default if omitted)
• --set-default to set this org as the project's target-org after auth

Workflow:

1. Parse the arguments ($ARGUMENTS) the user provided. Extract alias, instance-url, and set-default flag.

2. Run the login command:

   sf org login web {--alias $ALIAS} {--instance-url $URL}
   

   This opens a browser for OAuth. Tell the user clearly: "A browser window will open. Complete the login flow and return here."

3. Handle browser-isn't-available case: If the user is on a remote shell or the browser won't open, fall back to:

   sf org login device-code {--alias $ALIAS} {--instance-url $URL}
   

   which prints a code the user enters at salesforce.com/setup/connect.

4. After successful auth: if the user passed --set-default, run:

   sf config set target-org $ALIAS
   

   Otherwise, suggest they run /salesforce-development:set-default <alias> if they want to use this org for the current project.

5. Verify: print a one-liner with the new org's alias, edition, and instance URL:

   sf org display --target-org $ALIAS --json
   

   so the user sees the connected state.

Rules:

• Always use --json on sf commands so you can parse outcomes
• Do NOT log access tokens or any auth secrets
• If the user doesn't supply an alias, the auth saves under their username — recommend they pass --alias for easier reference later
• For sandbox auth, --instance-url https://test.salesforce.com is required