lpm plugin

lpm plugin <action> [name]

Manages the lazy-downloaded binaries that back lpm lint (Oxlint), lpm fmt (Biome), and friends. Plugins are downloaded on first use, cached under ~/.lpm/plugins/{name}/{version}/{platform}/, and SHA-256-verified against either a checksum bundled with the LPM binary or an upstream <asset_url>.sha256 sidecar.

Examples

lpm plugin list                # show installed plugins, current vs latest
lpm plugin update              # update every plugin to its latest version
lpm plugin update oxlint       # update one plugin
lpm plugin remove biome        # delete cached binaries for one plugin

Available plugins

lpm check is not a plugin — it shells out to the project-local tsc.

Pinning per-project

{
  "tools": {
    "oxlint": "1.57.0",
    "biome": "2.4.8"
  }
}

When a pinned version isn't in the cache, the next lpm lint / lpm fmt downloads and verifies it against the upstream <asset_url>.sha256 sidecar. If the upstream sidecar is unreachable (yanked or very old release), the install fails with an actionable message; set LPM_ALLOW_UNVERIFIED_PLUGINS=1 to opt out of verification — the override is recorded on the sidecar and re-required on every reuse.

See Built-in tools — Checksum verification for the full verification pipeline.

Subcommands

Plus the global flags — --json returns a structured listing.

See also

• lpm lint, lpm fmt — the user-facing commands plugins back
• Built-in tools — design overview, security model, cache layout