Installation

LPM CLI ships as a single binary through npm, Homebrew, a standalone installer, and Cargo. Stable is the default release channel. Nightly snapshots are also available through npm and the standalone installer.

Do not use sudo

Run each installer and all LPM CLI user commands without sudo.

LPM CLI stores user state and project files for the current user. A full command under sudo can select root's state or create root-owned files in your project. LPM CLI rejects this privilege transition before it reads user state or changes project files.

Some commands need one operating-system change. Run the normal command as your user. LPM CLI elevates only the restricted helper for that change.

If a global npm install reports a permission error, configure a user-writable npm global prefix. You can also use Homebrew or the standalone installer.

An intentional root session is different from a user command through sudo. Root can manage root's own LPM CLI state when SUDO_USER is not set.

npm

npm install -g @lpm-registry/cli

Works on every currently supported platform, including Windows and x64 Alpine Linux. The npm package is a dependency-free launcher; npm installs the matching platform-native Rust package through optionalDependencies, then runs a small postinstall verifier that checks the native binary and wires the global command to it.

GNU Linux x64 and ARM64 binaries require glibc 2.28 or newer (Debian 10+, Ubuntu 20.04+, and RHEL-compatible 8+). Linux x64 musl distributions use a separate binary.

Install the latest nightly instead:

npm install -g @lpm-registry/cli@nightly

latest always points to stable; nightly points to the newest nightly snapshot.

If your npm config omits optional dependencies (--omit=optional, --no-optional, or a package-manager policy), reinstall with optional dependencies enabled. If install scripts are disabled (--ignore-scripts), the JS launcher stays in place and resolves the native package at runtime, but first-run validation and zero-overhead Unix linking are skipped.

Homebrew (macOS, Linux)

brew tap lpm-dev/lpm
brew install lpm

The formula auto-updates with every stable release.

Standalone installer (macOS, Linux)

curl -fsSL https://cli.lpm.dev/install | sh

Downloads the latest binary into ~/.lpm/bin and adds it to your PATH (.zshrc, .bashrc, or config.fish depending on your shell). On Linux x64, the installer distinguishes glibc from musl and selects the matching binary automatically. Open a new terminal — or source the rc file — and you're done.

The installer always verifies the downloaded binary's SHA-256 digest against the release manifest. When cosign is available, it also authenticates that manifest against the release workflow's Sigstore identity; without cosign, the check proves consistency with the downloaded manifest but does not authenticate who produced it. The installer also refuses releases below its minimum security floor. Two recovery overrides exist for release incidents and broken bootstrap environments: LPM_INSTALL_INSECURE=1 skips all integrity checks, while LPM_INSTALL_MIN_VERSION_OVERRIDE=1 permits an older release but keeps the normal verification behavior.

For Windows, use the npm installer above.

Install the latest nightly:

curl -fsSL https://cli.lpm.dev/install | LPM_INSTALL_CHANNEL=nightly sh

Pin an exact stable or nightly GitHub release tag with LPM_INSTALL_VERSION:

curl -fsSL https://cli.lpm.dev/install | LPM_INSTALL_VERSION=v0.71.0-nightly.20260728.42.d82ceea sh

From source (Cargo)

cargo install --git https://github.com/lpm-dev/rust-client lpm-cli

Builds from the latest main. Requires Rust 1.94 or newer.

On ARM64 Alpine Linux, install the native build prerequisites first:

apk add --no-cache build-base cmake perl pkgconf

ARM64 musl does not currently have an official prebuilt binary, so source installation is the supported fallback on that platform.

Verify

lpm --version
# lpm 0.41.0

lpm doctor

lpm doctor runs a project-and-environment health check (Node detection, registry reachability, store integrity, sandbox availability). Pass --fix to auto-repair what it can.

Updating

lpm self-update

The release channel is sticky: stable installations follow stable, while nightly installations follow nightly.

lpm self-update                    # next release on the installed channel
lpm self-update --channel nightly  # switch stable → nightly
lpm self-update --channel stable   # switch nightly → stable

An explicit nightly-to-stable switch is allowed even when the stable version is semantically lower than the installed nightly. npm users can make the same switches with @nightly and @latest.

Nightly releases are currently available through npm and standalone installs. Homebrew and Cargo installs stay on stable; lpm self-update --channel nightly reports that the channel is unsupported for those install methods.

Uninstalling

# npm
npm uninstall -g @lpm-registry/cli

# Homebrew
brew uninstall lpm && brew untap lpm-dev/lpm

# Standalone
rm -rf ~/.lpm/bin/lpm
# Optional: also remove the global store and caches
rm -rf ~/.lpm

~/.lpm/ holds the global content-addressable store, caches, and config. Removing it is safe — LPM CLI will recreate what it needs on the next install.

What got installed

See Reference → Configuration for what lives where.

Next