For intranet and compliance—SSO, audit logs, private registry, and batch operations.
Official & reference links
There is no single global “enterprise CLI” website: teams usually ship internally or via a private artifact registry. Below we list all subcommands and common flags so you can operate from this site alone; external links are toolchain references only.
Overview
The enterprise module (opencli enterprise) installs, configures, and audits OpenCLI submodules inside controlled networks. It fits teams that need unified identity, traceability, and offline bundles.
Prerequisites
| Tool | Minimum | Purpose |
|---|
| Node.js | 20 LTS+ | Run the CLI and some plugins |
| npm or pnpm | npm 10+ / pnpm 9+ | Global install and lockfile resolution |
| Git | 2.40+ | Pull config templates from an internal mirror (optional) |
| Corporate CA bundle | — | Intranet HTTPS / private npm |
Note: If you only use prebuilt binaries, you can skip Node.js and use the packaged opencli executable.
Installation
Option A: npm global (recommended for dev machines)
npm install -g @opencli/cli@latest
npm install -g: installs globally so opencli is on your PATH.@opencli/cli@latest: latest stable; pin a version in production (e.g. @opencli/cli@1.4.2).
Verify:
opencli --version
Option B: Offline tarball
tar -xzf opencli-enterprise-linux-x64.tar.gz
sudo mv opencli /usr/local/bin/
opencli --version
tar -xzf: extract the bundle.sudo mv ... /usr/local/bin/: place the binary on PATH (your policy may use /opt/opencli/bin instead).
First-time setup
Sign in with corporate SSO
opencli enterprise login --tenant your-corp --sso oidc
| Flag | Meaning |
|---|
login | Starts browser or device-code flow for refresh tokens |
--tenant | Tenant id in your IdP |
--sso | Protocol: oidc or saml |
Private registry (optional)
opencli enterprise config set npm.registry https://npm.corp.example.com
Points plugin installs and similar operations at your internal mirror.
Command reference (full)
Assuming the main binary is opencli and the enterprise module is opencli enterprise. <...> placeholders, [...] optional.
Top-level help
opencli --help
opencli enterprise --help
Identity & health
| Command | Description |
|---|
| `opencli enterprise login [—tenant ] [—sso oidc | saml] [—no-browser]` |
opencli enterprise logout | Clear local tokens/session |
opencli enterprise whoami | Print tenant, user, token expiry |
opencli enterprise doctor | Check Node, certs, registry, SSO, disk permissions |
opencli enterprise doctor --verbose / -v | Verbose diagnostics |
opencli enterprise status | One-line ops summary (similar to doctor) |
opencli enterprise doctor
opencli enterprise doctor -v
opencli enterprise whoami
config
| Command | Description |
|---|
opencli enterprise config get <key> | Read one key (e.g. npm.registry) |
opencli enterprise config set <key> <value> | Set a string value |
opencli enterprise config unset <key> | Remove a key |
opencli enterprise config list | List all (secrets masked by default) |
opencli enterprise config list --show-secrets | Include secrets (avoid shared terminals) |
opencli enterprise config set npm.registry https://npm.corp.example.com
opencli enterprise config get npm.registry
opencli enterprise config list
audit
| Command | Description |
|---|
| `opencli enterprise audit export [—since 7d | 30d |
opencli enterprise audit tail [--follow] [--lines N] | Recent audit stream (requires log backend) |
opencli enterprise audit export --since 30d --out ./audit.jsonl
opencli enterprise audit tail --lines 100
bundle
| Command | Description |
|---|
opencli enterprise bundle pack [--output <path>] [--include-plugins] | Build offline bundle; includes enabled plugins by default |
opencli enterprise bundle verify <path> | Verify signature and manifest |
opencli enterprise bundle pack --output ./opencli-offline-bundle.tgz
opencli enterprise bundle verify ./opencli-offline-bundle.tgz
plugins
| Command | Description |
|---|
opencli enterprise plugins list | Installed plugins and versions |
opencli enterprise plugins list --outdated | Mark upgradable entries |
opencli enterprise plugins install <spec> | spec: npm name, version, or tarball path |
opencli enterprise plugins uninstall <name> | Uninstall |
opencli enterprise plugins update | Update all |
opencli enterprise plugins update <name> | Update one plugin |
opencli enterprise plugins list
opencli enterprise plugins install @opencli/plugin-example@1.2.0
opencli enterprise plugins uninstall @opencli/plugin-example
Cache & misc
| Command | Description |
|---|
opencli enterprise cache clear | Clear local HTTP/registry cache |
opencli enterprise version | Enterprise module version (if separate from opencli --version) |
opencli --version
opencli enterprise version
opencli enterprise cache clear
Troubleshooting
UNABLE_TO_VERIFY_LEAF_SIGNATURE: import the corporate root CA, or set NODE_EXTRA_CA_CERTS=/path/to/corp-ca.pem.E401 on login: check NTP time skew and that --tenant matches IdP configuration.