{
  "schemaVersion": 1,
  "methodology": "https://ionbin.com/interfaces/methodology/#evaluations",
  "evaluation": {
    "id": "salesforce-cli",
    "testedOn": "2026-10-18",
    "coverage": "local-runtime",
    "summary": "The official npm package reported its version and listed connected orgs as JSON with empty lists, confirming credential-free local behavior. No org was contacted.",
    "identity": {
      "version": "@salesforce/cli 2.154.4 (npm latest at test time)",
      "target": "@salesforce/cli from the npm registry, run as sf",
      "integrity": "npm dist.integrity sha512-5y8YyCZvXRDCsjo2HZPzTzhf8Ck8O5F0Lllrem2pfkEa1C6n6el8c1NnePWHBd2rXFw/PWLEPqwMgr3ccA5Gbg== (registry-published package integrity; not an independent provenance audit)"
    },
    "environment": [
      "Debian Linux x86_64 (kernel 6.12); Node.js 24.18.0; npm 11.16.0; installed with --ignore-scripts into an isolated directory.",
      "Fresh HOME; environment limited to PATH plus SF_DISABLE_TELEMETRY, SF_AUTOUPDATE_DISABLE and SF_SKIP_NEW_VERSION_CHECK; no Salesforce login or credentials.",
      "Observed 2026-10-19T06:29:11.146438+00:00 through 2026-10-19T06:29:12.161824+00:00 UTC."
    ],
    "checks": [
      {
        "id": "salesforce-cli-version",
        "name": "Installed version",
        "method": "sf --version",
        "expected": "Print the package version.",
        "observed": "Exit 0. @salesforce/cli/2.154.4 linux-x64 node-v24.18.0. Stderr carried a Node warning that a spawned sf process was not found on the isolated PATH; the command still completed.",
        "outcome": "pass"
      },
      {
        "id": "salesforce-cli-org-list-empty",
        "name": "Empty org list",
        "method": "sf org list --json",
        "expected": "Return status 0 with empty org lists when no org is logged in.",
        "observed": "Exit 0. JSON status 0; result lists other, sandboxes, nonScratchOrgs, devHubs and scratchOrgs all empty; warnings empty.",
        "outcome": "pass"
      }
    ],
    "findings": [
      {
        "title": "Machine-readable output without a login",
        "basis": "observed",
        "severity": "informational",
        "detail": "sf org list --json returned structured empty results with no org logged in.",
        "practicalAdvice": "Use --json and check status in scripts, and pass an explicit --target-org for every org command."
      },
      {
        "title": "Several login flows, one local store",
        "basis": "observed",
        "severity": "informational",
        "detail": "sf org login lists web, JWT, access-token and SFDX auth-URL flows; each stores the authorization in local CLI configuration.",
        "practicalAdvice": "On shared machines or CI, prefer JWT with a dedicated integration user, and log out when done."
      }
    ],
    "caveats": [
      "The npm latest version tested (2.154.4) lagged the latest repository release (2.156.5).",
      "Installed with --ignore-scripts; platform installers were not tested."
    ],
    "notTested": [
      "Org login (web, JWT or access token), org operations, deployments, data commands and plugin installation.",
      "Telemetry and autoupdate behavior with defaults on, and the Windows and macOS installers; only the npm package ran on Linux."
    ],
    "sources": [
      {
        "label": "Official setup and verification steps",
        "url": "https://developer.salesforce.com/docs/atlas.en-us.sfdx_setup.meta/sfdx_setup/sfdx_setup_intro.htm"
      }
    ],
    "reportUrl": "/interface-evaluations/salesforce-cli.json"
  }
}