Installation

LPM CLI ships as a single binary through npm, Homebrew, a standalone installer, and Cargo. Stable is the default release channel. Nightly snapshots are also available through npm and the standalone installer.

Do not use sudo

Run each installer and all LPM CLI user commands without sudo.

LPM CLI stores user state and project files for the current user. A full command under sudo can select root's state or create root-owned files in your project. LPM CLI rejects this privilege transition before it reads user state or changes project files.

Some commands need one operating-system change. Run the normal command as your user. LPM CLI elevates only the restricted helper for that change.

If a global npm install reports a permission error, configure a user-writable npm global prefix. You can also use Homebrew or the standalone installer.

An intentional root session is different from a user command through sudo. Root can manage root's own LPM CLI state when SUDO_USER is not set.

npm

npm install -g @lpm-registry/cli

Works on every currently supported platform, including Windows and x64 Alpine Linux. The npm package is a dependency-free launcher; npm installs the matching platform-native Rust package through optionalDependencies, then runs a small postinstall verifier that checks the native binary and wires the global command to it.

GNU Linux x64 and ARM64 binaries require glibc 2.28 or newer (Debian 10+, Ubuntu 20.04+, and RHEL-compatible 8+). Linux x64 musl distributions use a separate binary.

Install the latest nightly instead:

npm install -g @lpm-registry/cli@nightly

latest always points to stable; nightly points to the newest nightly snapshot.

If your npm config omits optional dependencies (--omit=optional, --no-optional, or a package-manager policy), reinstall with optional dependencies enabled. If install scripts are disabled (--ignore-scripts), the JS launcher stays in place and resolves the native package at runtime, but first-run validation and zero-overhead Unix linking are skipped.

Homebrew (macOS, Linux)

brew tap lpm-dev/lpm
brew install lpm

The formula auto-updates with every stable release.

Standalone installer (macOS, Linux)

curl -fsSL https://cli.lpm.dev/install | sh

Downloads the latest binary into ~/.lpm/bin and adds it to your PATH (.zshrc, .bashrc, or config.fish depending on your shell). On Linux x64, the installer distinguishes glibc from musl and selects the matching binary automatically.

The installer creates a missing Fish configuration directory and quotes the installation path. Repeated runs do not append duplicate PATH entries. Open a new terminal to use the command.

The installer always verifies the downloaded binary's SHA-256 digest against the release manifest. When cosign is available, it also authenticates that manifest against the release workflow's Sigstore identity; without cosign, the check proves consistency with the downloaded manifest but does not authenticate who produced it. The installer also refuses releases below its minimum security floor. Two recovery overrides exist for release incidents and broken bootstrap environments: LPM_INSTALL_INSECURE=1 skips all integrity checks, while LPM_INSTALL_MIN_VERSION_OVERRIDE=1 permits an older release but keeps the normal verification behavior.

For Windows, use the npm installer above.

Install the latest nightly:

curl -fsSL https://cli.lpm.dev/install | LPM_INSTALL_CHANNEL=nightly sh

Pin an exact stable or nightly GitHub release tag with LPM_INSTALL_VERSION:

curl -fsSL https://cli.lpm.dev/install | LPM_INSTALL_VERSION=v0.71.0-nightly.20260728.42.d82ceea sh

From source (Cargo)

cargo install --git https://github.com/lpm-dev/rust-client lpm-cli

Builds from the latest main. Requires Rust 1.94 or newer.

On Windows, lifecycle scripts run in an AppContainer that the lpm-sandbox-helper.exe companion sets up. Without it, LPM CLI runs them only with the sandbox off: --no-sandbox, or [sandbox] mode = "none" in lpm.toml or ~/.lpm/config.toml. Install it beside lpm-rs.exe from the same source:

cargo install --git https://github.com/lpm-dev/rust-client lpm-sandbox --bin lpm-sandbox-helper

When the helper is missing, lpm doctor --all reports sandbox_helper_missing with the command for the running version.

On ARM64 Alpine Linux, install the native build prerequisites first:

apk add --no-cache build-base cmake perl pkgconf

ARM64 musl does not currently have an official prebuilt binary, so source installation is the supported fallback on that platform.

Verify

lpm --version
# lpm 0.41.0

lpm doctor

lpm doctor runs a project-and-environment health check (Node detection, registry reachability, store integrity, sandbox availability). Pass --fix to auto-repair what it can.

Updating

lpm self-update

The release channel is sticky: stable installations follow stable, while nightly installations follow nightly.

lpm self-update                    # next release on the installed channel
lpm self-update --channel nightly  # switch stable → nightly
lpm self-update --channel stable   # switch nightly → stable

An explicit nightly-to-stable switch is allowed even when the stable version is semantically lower than the installed nightly. npm users can make the same switches with @nightly and @latest.

Nightly releases are currently available through npm and standalone installs. Homebrew and Cargo installs stay on stable; lpm self-update --channel nightly reports that the channel is unsupported for those install methods.

Uninstalling

# npm
npm uninstall -g @lpm-registry/cli

# Homebrew
brew uninstall lpm && brew untap lpm-dev/lpm

# Standalone
rm -rf ~/.lpm/bin/lpm
# Optional: also remove the LPM home (read the caution below first)
rm -rf ~/.lpm

~/.lpm/ is the LPM home. Besides the package store, caches, and configuration, it can hold your login state, local env secrets on Linux and Windows, the local root certificate authority, security approvals, and globally installed packages. Deleting it removes all of them. LPM CLI recreates the store and caches on the next install, but not your secrets or approvals.

CAUTION: Push or export local env secrets before you delete the LPM home. Deleting the directory does not remove LPM CLI's entries in the OS credential store, such as the macOS Keychain. Run lpm logout --all first to clear stored logins.

With LPM_HOME set, the LPM home is that directory instead of ~/.lpm.

What got installed

See Files LPM CLI creates for the rest of the LPM home, and for the files LPM CLI writes in a project.

Next