Environment variables

Environment variables configure LPM CLI for one process. Use them for CI credentials, temporary overrides, and diagnostics. Use lpm config for persistent user defaults.

LPM_AUDIT_AFTER_INSTALL=true lpm install
LPM_NO_AUTO_INSTALL=1 lpm run build
LPM_REMOTE_CACHE_READ_ONLY=true lpm run build
lpm config list --json

These examples use POSIX shell syntax. In PowerShell, set $env:NAME = "value" before the command. Each variable has its own parser and precedence. Empty values do not have one universal meaning. Run and exec commands remove inherited credentials and runtime injection variables from child processes. Dependency lifecycle scripts use a restricted environment.

Auth and routing

LPM CLI supports npm-compatible registries, private registries, and LPM.dev Registry. Only @lpm.dev/* packages always route through LPM.dev Registry. See Registry configuration.

Release lookups send GitHub tokens only to the canonical GitHub API origin. A token alias does not apply to every GitHub feature. NODE_AUTH_TOKEN is not a direct substitute for NPM_TOKEN. See Authentication for registry scopes and credential storage.

npm configuration paths

Path overrides support home expansion. For global npm configuration, the prefix order is the npm environment override, eligible user configuration, PREFIX, then the detected Node prefix. See npm compatibility for .npmrc support.

OIDC credentials

Blank OIDC token and GitHub runtime values act as absent. Nonblank tokens retain their original bytes. A selected provider failure stops the operation instead of trying another identity.

GitHub Actions supplies ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN with permissions: id-token: write. Both values must be nonblank. LPM CLI requests the audience for the selected workflow and preserves other endpoint query parameters. LPM_OIDC_TOKEN does not supply Sigstore provenance or npm Trusted Publishing.

Other environment commands ignore LPM_VAULT_ID. See CI setup, package publishing, and environment project identity.

npm publish and provenance

lpm publish and lpm stage publish read these npm-compatible aliases:

CLI provenance flags and package.json > publishConfig take precedence over environment values. Empty provenance-file values fail. Relative paths cannot contain .. or escape the selected project. A provenance file cannot combine with a Boolean provenance setting. Provenance files attach to npm-compatible targets. lpm publish rejects them when an LPM.dev Registry target is active.

Filesystem layout

A home other than ~/.lpm keeps its own entries in the OS credential store, so it has its own login, local env secrets, and security approvals. lpm doctor warns with lpm_home_default_state_unused when ~/.lpm still holds login or env files that the selected home doesn't use.

LPM_HOME does not move OS-managed security policy, or the state of lpm self-update, which stays in .lpm in your OS account's home directory. Project env values cannot set LPM_HOME for scripts: LPM CLI drops it from .env files and stored env values, as it does HOME and PATH. Don't point LPM_HOME at a project's .lpm directory. Commands that write project state refuse a project whose .lpm is the LPM home.

For temporary CI isolation:

LPM_HOME="$PWD/.lpm-ci" lpm install --frozen-lockfile

A fresh home has no saved login. Supply LPM_TOKEN for private @lpm.dev/* packages. LPM CLI keeps a home inside a repository out of Git with a .gitignore of its own, and lpm publish never packs it. See Files LPM CLI creates for the layout.

Install pipeline

Signature, audit, Firewall, and integrity values accept whitespace and case variations. An explicit linker value disables automatic peer-conflict isolation. Workspace installation concurrency is separate from the saved concurrency for workspace scripts, tests, and benchmarks. See lpm install and user configuration.

CI detection

For frozen-lockfile defaults, installs read CI, GITHUB_ACTIONS, GITLAB_CI, BUILDKITE, and CIRCLECI. Empty, 0, and case-insensitive false values mean false after whitespace removal. Other values mean true. A detected CI environment enables frozen mode when an LPM CLI lockfile exists. Other features have separate CI checks. Setting CI=false does not universally enable interactive prompts.

Runtimes and built-in tools

See Node version pinning, built-in tools, and lpm self-update.

Security and recovery overrides

See security approval and plugin verification. Debug and acceptance-test storage switches are not supported release configuration.

Standalone installer

The shell installer reads these values. The installed CLI does not use them.

The normal installer checks SHA-256 against the downloaded manifest. When cosign and a release bundle are available, it also checks the manifest signature and stops on failure. See Installation.

Remote task cache

lpm.json > remoteCache supplies persistent project configuration.

Cache Booleans accept 1, true, yes, on, 0, false, no, and off, with whitespace and case variations. Endpoints require HTTPS or HTTP loopback. HTTPS redirects cannot downgrade to HTTP. Third-party cache origins require both an explicit token and a signing key. See Remote task cache.

Triage advisor cache

The advisor cache reuses verdicts for matching package content, scripts, prompts, provider, and provider configuration. Ollama model and endpoint changes request a new verdict.

Tunnel

An invalid selected relay URL warns and uses the default. It does not retry the saved URL. Relay pins use $LPM_HOME/relay-pins/<host>. See lpm tunnel, lpm hosts, and lpm proxy.

Script context

LPM CLI supplies these values to package scripts, explicit tasks, root install hooks, and dependency lifecycle scripts:

Generated values replace inherited values. Workspace and dependency scripts retain the original INIT_CWD. See npm script execution.

Terminal output

The order is CLI color mode, FORCE_COLOR, NO_COLOR, then terminal detection.

Resolver (advanced)

These diagnostic controls also work in release builds. Their behavior can change between releases.

Diagnostic / experimental

LPM_TIMING_DETAIL=trace lpm install --json

Store-version values accept whitespace and case variations. Timing Boolean words are case-insensitive. LPM_TIMING_DETAIL=0 still enables detail.

Precedence reminder

Environment variables do not override every project or user value. For example, saved linker beats LPM_LINKER, and saved read-only caching remains active with LPM_REMOTE_CACHE_READ_ONLY=false. Use the rules in each section and lpm config list --json for supported effective values.

See also

• Global flags
• User configuration
• Project configuration
• CI setup