# lpm plugin (/docs/dev/plugin)



```bash
lpm plugin <action> [name]
```

Manages the lazy-downloaded tools that back [`lpm lint`](/docs/dev/lint) (Oxlint), [`lpm fmt`](/docs/dev/fmt) (Biome), and [`lpm bundle`](/docs/dev/bundle) (Rolldown). Oxlint and Biome are single-binary plugins cached under `~/.lpm/plugins/{name}/{version}/{platform}/`. Rolldown is user-facing as a plugin, but its verified npm package layout is stored under `~/.lpm/engines/rolldown/{version}/{platform}/`.

## Examples [#examples]

```bash
lpm plugin list                # show installed managed plugins
lpm plugin outdated            # check upstream for newer managed plugin versions
lpm plugin update              # update every installed managed plugin
lpm plugin update oxlint       # update one plugin
lpm plugin update rolldown     # update Rolldown's verified package graph
lpm plugin remove biome        # delete cached binaries for one plugin
```

## Available plugins [#available-plugins]

| Plugin     | Backs                            | Notes                                                  |
| ---------- | -------------------------------- | ------------------------------------------------------ |
| `oxlint`   | [`lpm lint`](/docs/dev/lint)     | Distributed as `.tar.gz` archives by `oxc-project/oxc` |
| `biome`    | [`lpm fmt`](/docs/dev/fmt)       | Distributed as direct binaries by `biomejs/biome`      |
| `rolldown` | [`lpm bundle`](/docs/dev/bundle) | Distributed as a verified npm package graph            |

`tsdown` is project-owned: [`lpm pack`](/docs/dev/pack) uses the repo's local `tsdown` dependency and `lpm plugin update tsdown` does not update it. `lpm check` is also not a plugin — it shells out to project-local `tsc` unless `--engine tsgo` is selected.

## Pinning per-project [#pinning-per-project]

```json title="lpm.json"
{
  "tools": {
    "oxlint": "1.57.0",
    "biome": "2.4.8",
    "rolldown": "1.1.3"
  }
}
```

For Oxlint and Biome, a pinned version downloads on first use and verifies against the upstream `<asset_url>.sha256` sidecar. For Rolldown, the pinned version must already be an approved managed plugin version from `lpm plugin update rolldown`; otherwise `lpm bundle` fails with a clear repair command. Normal `lpm lint`, `lpm fmt`, and `lpm bundle` runs do not check upstream for newer versions.

See [Built-in tools — Checksum verification](/docs/dev/builtin-tools#checksum-verification) for the full verification pipeline.

## Subcommands [#subcommands]

| Subcommand | Aliases           | Effect                                                                                                                                                                   |
| ---------- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `list`     | `ls`              | Print installed managed plugins and the latest locally approved version                                                                                                  |
| `outdated` | —                 | Check upstream and print current vs latest for Oxlint, Biome, and Rolldown; notes that tsdown is project-owned                                                           |
| `update`   | `upgrade`         | Pull the latest release for one plugin (or installed plugins if no name given); human output shows the download and verification phases before the final updated version |
| `remove`   | `rm`, `uninstall` | Delete cached binaries for one plugin                                                                                                                                    |

Plus the [global flags](/docs/commands#global-flags) — `--json` returns a structured listing.

## See also [#see-also]

* [`lpm lint`](/docs/dev/lint), [`lpm fmt`](/docs/dev/fmt) — the user-facing commands plugins back
* [Built-in tools](/docs/dev/builtin-tools) — design overview, security model, cache layout