wpm: the package manager built into WinuxCmd

Why wpm

Installing CLI tools on Windows usually means adding another package manager and its runtime. wpm trades the other way: the package manager lives inside the command set itself, and the package boundary is the command boundary — single-exe tools install flat; toolchains with DLLs install self-contained.

Core features

Official index of 281 packages; the sha256/size/urls triple contract; flat and shim layouts; hard-link entries (zero launch overhead); a schema:1 --json contract for GUI/TUI/agents; four mirror sources with fallback; two anti-poisoning locks; and self-update with rollback. Full eight-point list (Chinese):

Install & quick start

wpm has no installer of its own — it lands together with WinuxCmd. First thing after installing WinuxCmd: refresh the index.

The four-command starter (each line's comment says what it does):

wpm index update                 # refresh the official index
wpm install ripgrep fd jq        # install several packages at once (rg / fd / jq land on PATH)
wpm installed                    # what this machine has installed
wpm info ripgrep --json          # the full package record (machine-readable)

First-run orientation

wpm --help lists every subcommand (install/uninstall/update/list/search/info/installed/ export/restore/outdated/categories/index/source/links/clean/version). If the index is unreachable (no reachable index source), switch sources and retry with wpm index update -s official-jsdelivr; behind a proxy set WPM_HTTPS_PROXY and friends (WinHTTP auto-detects system proxies and PAC). On Chinese networks, switch straight to the official mirror:

wpm source use official-cn

To clear caches/staging/rollback directories: wpm clean [cache|staging|backup|all]; to replay a machine's package list: wpm export > profile.txt then wpm restore profile.txt.

Deep dive: the package model and the index

Mirror mechanism

Sources fall back automatically by priority (lower number wins); wpm source use pins a favorite and wpm source add adds your own. The security boundary is written down: the candidate-source set = the built-in registry + user-added sources — sources declared inside the index file are never merged in (a compromised mirror cannot persistently inject download locations); wpm index update records last_success_source and last_index_sha256, and warns when a non-preferred source delivers a different index — a poisoned mirror cannot swap it silently.

Measured numbers

Release feed

wpm has no version of its own — it ships with winuxcmd.exe, and its entries are recorded in WinuxCmd's changelog. The wpm-related content of the newest three versions (changelogs.json, fetched 2026-10-19; the full feed lives on the changelog):

• Unreleased (the WinuxCmd release line) WSL interop paths: /mnt/X/… operands fold in the same shape as /X/… and X:\… (#1172) — every tool crossing the shared argument boundary (ls/du/sed/cp…) benefits at once, including toolchains installed via wpm.
• v1.1.14 (2026-10-17) New wpm links verify (per-path report of links not running the current winuxcmd.exe) and the winuxcmd-shim.exe forwarder (24.5 ms → 12.1 ms; older installs switch over smoothly via wpm links rebuild --force); fixed wpm update winuxcmd leaving command links on the old image; rollback copies now keep the newest two and auto-prune (one machine had accumulated 61.8 MB; reclaimed with wpm clean backup).
• v1.1.13 (2026-10-17) Files held by running processes upgrade via rename-aside: wpm install --force succeeded on a real install with 28 fsmonitor--daemon payload holders, packages intact; upgrades either complete or leave everything untouched (failed file names and holding processes reported together); wpm clean staging/all also clears parked .wpm-old-<pid> directories.

Related links