Installation

LPM CLI ships as a single binary, distributed through several channels. Pick whichever fits your workflow — they install the same release.

npm

npm install -g @lpm-registry/cli

Works on every currently supported platform, including Windows. Official x64 Alpine Linux packages are upcoming and are not included in v0.67.0. The npm package is a dependency-free launcher; npm installs the matching platform-native Rust package through optionalDependencies, then runs a small postinstall verifier that checks the native binary and wires the global command to it.

If your npm config omits optional dependencies (--omit=optional, --no-optional, or a package-manager policy), reinstall with optional dependencies enabled. If install scripts are disabled (--ignore-scripts), the JS launcher stays in place and resolves the native package at runtime, but first-run validation and zero-overhead Unix linking are skipped.

Homebrew (macOS, Linux)

brew tap lpm-dev/lpm
brew install lpm

The formula auto-updates with every release.

Standalone installer (macOS, Linux)

curl -fsSL https://cli.lpm.dev/install | sh

Downloads the latest binary into ~/.lpm/bin and adds it to your PATH (.zshrc, .bashrc, or config.fish depending on your shell). The upcoming x64 Alpine Linux release will make the installer distinguish glibc from musl and select the matching binary automatically. Open a new terminal — or source the rc file — and you're done.

The installer always verifies the downloaded binary's SHA-256 digest against the release manifest. When cosign is available, it also authenticates that manifest against the release workflow's Sigstore identity; without cosign, the check proves consistency with the downloaded manifest but does not authenticate who produced it. The installer also refuses releases below its minimum security floor. Two recovery overrides exist for release incidents and broken bootstrap environments: LPM_INSTALL_INSECURE=1 skips all integrity checks, while LPM_INSTALL_MIN_VERSION_OVERRIDE=1 permits an older release but keeps the normal verification behavior.

For Windows, use the npm installer above.

From source (Cargo)

cargo install --git https://github.com/lpm-dev/rust-client lpm-cli

Builds from the latest main. Requires Rust 1.94 or newer.

On ARM64 Alpine Linux, install the native build prerequisites first:

apk add --no-cache build-base cmake perl pkgconf

ARM64 musl does not currently have an official prebuilt binary, so source installation is the supported fallback on that platform.

Verify

lpm --version
# lpm 0.41.0

lpm doctor

lpm doctor runs a project-and-environment health check (Node detection, registry reachability, store integrity, sandbox availability). Pass --fix to auto-repair what it can.

Updating

lpm self-update

Pulls the latest release for whichever channel you installed from, pinning the exact resolved version on npm and Cargo. (Homebrew users can also run brew upgrade lpm; npm users can use npm install -g @lpm-registry/cli@latest for the channel-latest dist-tag.)

Uninstalling

# npm
npm uninstall -g @lpm-registry/cli

# Homebrew
brew uninstall lpm && brew untap lpm-dev/lpm

# Standalone
rm -rf ~/.lpm/bin/lpm
# Optional: also remove the global store and caches
rm -rf ~/.lpm

~/.lpm/ holds the global content-addressable store, caches, and config. Removing it is safe — LPM CLI will recreate what it needs on the next install.

What got installed

See Reference → Configuration for what lives where.

Next