lpm config

lpm config [action] [key] [value]

Manages ~/.lpm/config.toml — the per-user CLI defaults file. Run bare lpm config in a terminal to open the guided editor for the main security and install-posture settings. For ordinary keys it is a convenience layer over editing the file by hand. For security-sensitive keys, it is also the approved path for persisting a weaker machine posture.

Examples

lpm config                                      # guided editor with current values
lpm config list                                 # show every set key
lpm config get save-prefix                      # → "^"
lpm config set save-prefix '~'                  # write
lpm config set script-policy triage             # write
lpm config get release-age-policy               # read stored cooldown scope
lpm config set release-age-policy strict        # transitive cooldown scope
lpm config release-age --set 1d                # human-friendly release cooldown
lpm config release-age-policy --set strict      # wizard form of the same policy
lpm config set minimum-release-age-secs 3600    # 1h cooldown
lpm config signatures --set true                # verify npm registry signatures during install
lpm config trust-policy --set no-downgrade      # block publisher/provenance trust downgrades
lpm config sigstore --set scope=all             # verify every resolved package's provenance
lpm config sigstore --set availability=strict   # require provenance to be available
lpm config typosquat --set default              # remove override; default keeps checks enabled
lpm config firewall --set enforce               # block packages flagged by firewall.lpm.dev
lpm config integrity --set tree                 # stricter expanded-store reuse checks
lpm config source-analysis --set false          # defer source scanning to lpm audit (guarded)
lpm config lpm-dev                              # grouped LPM.dev settings editor
lpm config lpm-skills --set false               # stop auto-installing @lpm.dev package skills
lpm config lpm-insights --set false             # keep local findings; skip Registry enrichment
lpm config set workspace-concurrency 4          # workspace run/test/bench fan-out
lpm config set audit-after-install true         # enable audit-after-install globally
lpm config delete save-prefix                   # remove
lpm config unset save-prefix                    # alias for delete

Actions

Generic set writes ordinary values as TOML strings. Known typed keys can preserve their native type; boolean security and LPM.dev preference keys are written as booleans. The reader accepts both string and native forms for typed keys — see String coercion for the rationale.

Known keys and defaults

The reader accepts unknown keys silently (forward compatibility), but only the following keys actually do anything today:

The full reference for these keys, their types, defaults, and precedence chain is on ~/.lpm/config.toml.

Guided editor

Bare lpm config opens a single interactive menu. Each row shows the current value and routes into the focused wizard for that setting:

◆  What do you want to configure?
│  ○ Lifecycle scripts      current: deny
│  ○ Triage advisor         current: none
│  ○ Sandbox mode           current: default
│  ○ Sigstore provenance    current: deny
│  ○ Registry signatures    current: disabled
│  ○ Trust downgrade policy current: off
│  ○ Typosquat guard        current: default (enabled)
│  ○ Firewall for npm       current: off
│  ○ Store integrity        current: source
│  ○ Minimum release age    current: default (1d)
│  ○ Release-age scope      current: direct
│  ○ Install-time source analysis current: enabled
│  ○ LPM.dev settings       skills=enabled (default), insights=enabled

After a setting is changed, the editor returns to the menu with refreshed values. If you set lifecycle scripts to triage, LPM CLI also offers to configure the optional triage advisor next.

Setup wizards

The focused setup surfaces handle picking and validation for you:

lpm config scripts                          # pick deny / triage / allow
lpm config scripts --set triage             # non-interactive

lpm config triage                           # pick none / claude-cli / codex / ollama
lpm config triage --set claude-cli          # non-interactive

lpm config sandbox                          # pick default / strict / none
lpm config sandbox --set strict             # non-interactive

lpm config sigstore                                  # pick verify / scope / availability
lpm config sigstore --set deny                       # verify=deny (backward compatible)
lpm config sigstore --set verify=deny                # explicit verification posture
lpm config sigstore --set scope=all                  # verify every resolved package
lpm config sigstore --set availability=strict        # require an attestation

lpm config signatures                       # pick enabled / disabled
lpm config signatures --set true            # non-interactive

lpm config trust-policy                     # pick off / no-downgrade
lpm config trust-policy --set no-downgrade  # non-interactive

lpm config typosquat                        # pick default / on / off
lpm config typosquat --set default          # non-interactive

lpm config firewall                         # pick off / monitor / enforce, then review policy groups
lpm config firewall --set enforce           # non-interactive

lpm config integrity                        # pick source / tree
lpm config integrity --set tree             # non-interactive

lpm config release-age                      # pick default / 3d / off / custom
lpm config release-age --set 3d             # non-interactive

lpm config release-age-policy               # pick direct / strict
lpm config release-age-policy --set strict  # non-interactive

lpm config source-analysis                  # pick enabled / disabled
lpm config source-analysis --set false      # guarded non-interactive setter

lpm config lpm-dev                          # grouped skills + insights editor
lpm config lpm-skills                       # pick enabled / disabled
lpm config lpm-skills --set false           # non-interactive
lpm config lpm-insights                     # pick enabled / disabled
lpm config lpm-insights --set false         # non-interactive

lpm config triage auto-detects which advisor providers are installed on your machine and only offers the available ones (plus none). Picking none in lpm config sandbox, disabling source analysis, or picking off in lpm config sigstore, lpm config typosquat, or lpm config firewall adds an approval step when it weakens the approved floor. The --set forms still persist through the same guarded flow for guarded weakeners: in an interactive TTY they ask for native system approval, and in --json / CI / non-TTY mode they fail with security_approval_required instead of silently weakening the machine floor.

lpm config signatures and lpm config trust-policy are opt-in hardening controls. Their defaults are disabled, so enabling them does not require a security unlock.

The Sigstore axes are independent. verify = "deny" is the default response to a bundle that is present but fails cryptographic or artifact-binding checks. scope = "approved" keeps verification limited to packages with a previously approved provenance identity; scope = "all" opts every resolved package into verification and lockfile evidence. availability = "best-effort" keeps missing or temporarily unavailable attestations non-blocking; availability = "strict" requires evidence. The defaults remain deny, approved, and best-effort. An enabled trust-policy = "no-downgrade" is a separate floor: it checks npm publish-trust history during resolution, and prior artifact-verified lockfile history must remain verified even when one of these Sigstore controls would otherwise warn, skip, or fail open.

LPM.dev settings

lpm config lpm-dev opens one interactive editor for two independent LPM.dev preferences. LPM.dev package skills controls automatic package-published skill reconciliation. Fetch LPM AI Insights Results controls the best-effort install-time batch request that enriches local security summaries with server-side findings for @lpm.dev/* packages. The focused lpm-skills and lpm-insights commands remain available for scripts.

Disabling package skills keeps existing .lpm/skills/ files and skips future automatic fetches; use lpm skills clean when you also want to remove existing package-owned skill content. Explicit lpm skills add commands are unaffected. Disabling LPM insights does not disable local source analysis or remove local findings.

Install-time source analysis

lpm config source-analysis manages install-time-source-analysis, which defaults to enabled. The enabled path analyzes package source as bytes enter the store and repairs missing, malformed, or outdated analysis caches from stored bytes. The disabled path skips new install-time scans; lpm audit still scans installed source when it needs a result.

Disabling is a guarded machine-wide weakening under the source-analysis-disable approval scope. Re-enabling is hardening and does not require approval. force-security-floor = true and managed policy can require the enabled posture.

lpm config typosquat accepts default, on, or off. default removes the explicit config key and follows the product default, currently enabled; on forces the guard on even when the diagnostic env override is set; off disables suspicious-name analysis machine-wide. off is a guarded weakening: the interactive wizard asks for confirmation and native approval before saving it, while --json / CI / non-TTY callers fail with security_approval_required. For false positives, prefer a committed lpm.toml allow-list entry with a reason instead of turning the guard off globally.

Policy extensions are configured by editing ~/.lpm/config.toml directly. They are local verdict-only install checks; use lpm policy list, lpm policy status, lpm policy doctor, and lpm policy test to inspect and test them.

npm firewall

lpm config firewall accepts off, monitor, or enforce. off keeps the default direct npm metadata and tarball path with no LPM Firewall verdict check. monitor sends selected public npm package versions to LPM Firewall in batches, prints block/warn verdicts, and lets the command continue. enforce uses the same batched check and blocks packages whose effective firewall action is block before package bytes are installed, fetched, downloaded, or copied through lpm add. The hosted firewall verdict service is an LPM.dev Registry Pro/Org feature, so active modes send LPM.dev Registry auth; run lpm login locally or set LPM_TOKEN in CI. If entitlement is denied, monitor warns and continues, while enforce fails before package bytes are materialized. The legacy string report is still accepted as an alias for monitor, but the wizard persists monitor.

When you choose enforce interactively, the wizard shows the five npm firewall policy groups on one review screen: trusted public malicious advisories, LPM Firewall AI-confirmed malware, LPM Firewall AI-agent control-surface policy, critical vulnerabilities, and static-only suspicious signals. Press Enter to accept the recommended profile, or change individual groups before saving. Recommended enforcement blocks trusted public malicious advisories and LPM Firewall AI-confirmed malware, and warns for AI-agent control-surface policy, critical vulnerabilities, and static-only suspicious signals. See the Firewall for npm guide for the full profile.

When a human-output materialization command has eligible public npm packages to check, its progress line carries the 🔥 LPM Firewall active badge. Private/custom registry packages and LPM.dev Registry packages are not sent to the npm firewall verdict API. JSON output for materialization commands includes a firewall object when the firewall is active. Turning the firewall on is hardening and does not require an unlock; after monitor or enforce is approved as the machine floor, moving to a weaker mode is guarded.

Store integrity

lpm config integrity accepts source or tree. source is the default and validates reused v2 store objects by their source identity without rehashing every expanded file, which keeps warm installs fast. tree is stricter and rehashes expanded files before reuse so local tampering or corruption under ~/.lpm/store/v2/objects/ is detected before the object is linked into a project.

This is separate from --strict-integrity. --strict-integrity controls trust-on-first-use for tarball URL dependencies that do not declare an inline SRI hash. integrity = "tree" controls how LPM CLI validates already-expanded v2 store objects before reuse.

lpm config release-age accepts default, off, or human durations like 12h, 1d, 3d, and 0. The wizard persists canonical seconds into minimum-release-age-secs, but the interactive and --set surfaces stay duration-based. Picking default removes the global override and falls back to the built-in 24h default. In the interactive wizard, any non-off cooldown also asks whether the cooldown should use the default direct/root scope or strict direct+transitive scope.

Bare lpm config and all focused editors write to the same ~/.lpm/config.toml that lpm config set would. They require a TTY when invoked without --set; non-interactive callers must use an explicit action such as lpm config list or pass --set <value> to a focused setter. The grouped lpm config lpm-dev editor is TTY-only.

Security-sensitive writes

Lowering machine-wide security posture through lpm config is guarded.

Examples:

lpm config scripts --set allow
lpm config release-age --set 0
lpm config release-age-policy --set direct
lpm config sandbox --set none
lpm config sigstore --set off
lpm config typosquat --set off
lpm config firewall --set off
lpm config source-analysis --set false

In an interactive TTY, LPM CLI asks for confirmation before persisting the weaker value.

In --json, CI, or any non-TTY shell, the same write fails with error_code: "security_approval_required" instead of silently lowering the machine floor.

If a managed policy owns that control (/etc/lpm/security-policy.toml on Unix/macOS, C:\ProgramData\lpm\security-policy.toml on Windows), the write fails with error_code: "security_floor" instead.

Directly editing ~/.lpm/config.toml is not equivalent to approval for these keys. A raw file edit is only a proposal; when the value is weaker than the current approved floor, LPM CLI refuses with security_approval_required or security_floor. In particular, raw [sigstore].verify = "warn" / "off", raw typosquat-guard = "off", raw [firewall].mode = "off" or "monitor", and raw install-time-source-analysis = false below the approved floor are surfaced as active runtime overrides and require the matching unlock before mutating install or trust flows proceed.

File location

~/.lpm/config.toml (or %USERPROFILE%\.lpm\config.toml on Windows). Override the entire ~/.lpm/ root with LPM_HOME.

The file is created on demand the first time you set a key.

Flags

lpm config takes no specific flags besides the global flags and the focused-setter --set <value>. --json returns structured output for explicit actions — get / set / delete / list and non-interactive focused setters emit a {success, …} envelope under --json. The bare guided editor and grouped lpm-dev editor are interactive-only; use lpm config list --json for machine-readable current config.

See also

• ~/.lpm/config.toml — the file itself, with full key reference
• lpm policy — inspect and test local install policy extensions
• lpm security — temporary approvals and floor status
• lpm.toml — project-level alternative
• Save policy