Built-in tools

LPM CLI manages some development tools globally. Other commands use dependencies from your project.

Managed tools download on first use. Later runs reuse complete, verified installations for the current platform.

Quickstart

lpm lint
lpm fmt --check
lpm bundle --entry src/index.ts --out-dir dist
lpm check --engine=tsgo

For project TypeScript and tsdown:

lpm install -D typescript tsdown
lpm check
lpm pack --entry src/index.ts

Commands that need Node reuse a matching installed managed runtime or the inherited PATH. They do not download Node automatically. Use lpm use to install the required runtime first. A missing TypeScript compiler does not automatically select tsgo. Use --engine=tsgo explicitly.

Version selection

Oxlint, Biome, and Rolldown use this order:

1. An exact pin in lpm.json > tools.
2. The newer of the bundled version and the locally approved version.
3. A download if the selected version is not available in the cache.

{
  "tools": {
    "oxlint": "1.89.0",
    "biome": "2.6.2",
    "rolldown": "1.2.14"
  }
}

Workspace members inherit root pins unless they define their own. Normal tool runs do not discover newer upstream versions.

lpm plugin list
lpm plugin outdated
lpm plugin update

lpm plugin list reads local state. outdated checks upstream. update installs and verifies a release before approving it as the shared default.

Updates leave project pins unchanged. Rolldown pins must match the bundled version or a version already approved for the current platform.

Cache locations

LPM_HOME replaces ~/.lpm. Versions and platforms have separate directories. Multiple installations can coexist.

Each installation includes verification metadata. A directory or executable without that metadata does not establish a reusable installation.

The approved-version caches select defaults for later runs. Removal deletes installations but leaves those defaults unchanged.

Checksum verification

Oxlint and Biome verify the downloaded asset against these sources, in order:

1. A SHA-256 checksum bundled with LPM CLI for its default version.
2. A checksum sidecar supplied with the upstream release.
3. The SHA-256 digest for the exact asset in GitHub's release metadata.

The GitHub fallback must match the release tag, asset name, and download URL. A known checksum mismatch stops installation.

These checks establish integrity against the publisher's release. They do not provide an independent signature for that release.

Rolldown and tsgo verify npm SRI integrity before extraction. They also record hashes for their installed files.

If verification is unavailable, installation fails. Correct the connection or select a release with verification data before retrying.

Reuse from cache

Before reuse, LPM CLI checks the tool identity, version, platform, and verification metadata.

For Oxlint and Biome, an unchanged file metadata snapshot avoids another binary hash. Changed metadata triggers a hash comparison. Nonexecutable or invalid files require repair.

Rolldown and tsgo compare the installed layout with its recorded hash. Changes to a dependency or compiler data file invalidate the installation.

Explicit unverified installations

LPM_ALLOW_UNVERIFIED_PLUGINS=1 permits Oxlint and Biome installations when verification data is unavailable. It does not bypass a known checksum mismatch.

The installation records this override. Every later process that reuses the tool must also set the variable. The override does not apply to Rolldown or tsgo.

Update and recovery

lpm plugin update oxlint
lpm plugin update biome
lpm plugin update rolldown

Updates prepare a complete replacement before changing the installed files. A failed replacement preserves the previous installation.

To download Oxlint or Biome again, use:

LPM_FORCE_TOOL_INSTALL=1 lpm lint
LPM_FORCE_TOOL_INSTALL=1 lpm fmt --check

To remove a cached installation, use lpm plugin remove:

lpm plugin remove rolldown
lpm bundle --entry src/index.ts --out-dir dist

The next invocation downloads the selected version again. Removal does not edit lpm.json.

CI and offline runs

lpm lint --json
lpm fmt --check --json
lpm bundle --entry src/index.ts --out-dir dist --json

Cache both ~/.lpm/plugins/ and ~/.lpm/engines/ between CI runs. The first invocation needs network access unless the selected installation is already cached.

For offline use, prepare the exact tool version and platform beforehand. Project dependencies and Node remain separate requirements for commands that need them.

LPM_PLUGIN_QUIET=1 suppresses the Oxlint and Biome download banner. It does not disable downloads or change verification.

Other tools

The managed tool set comes with LPM CLI. There is no command to register another managed plugin.

Install other tools as project dependencies and run a package script:

lpm install -D eslint

Add a package script and the tool's required configuration:

{
  "scripts": { "lint": "eslint ." }
}

lpm run lint

See also

• lpm plugin — list, update, and remove managed tools.
• lpm check — choose TypeScript or tsgo.
• lpm pack — use project-local tsdown.
• lpm use — install Node or Bun.
• Project configuration — tool pins and runtime selection.