Zsh zplug¶

ID: zplug
Home page: https://github.com/zplug/zplug
Version requirement: >= 2
Platforms: 🐧 Linux · 🍎 macOS
Operations: installed · upgrade · upgrade_all
purl types: pkg:zplug
CLI name: zsh
Forced environment: NO_COLOR=1 · SHELL_SESSIONS_DISABLE=1
Issues and PRs: 📦 manager: zsh-based
Source: meta_package_manager/managers/zplug.py

zplug is a plugin manager for Zsh.

Plugins are declared in the user’s .zshrc with zplug "user/repo" calls, then materialized under $ZPLUG_HOME/repos. Packages are identified by the user/repo slug zplug reports, which is the id mpm keys them on.

Caution

zplug is a shell function, not a standalone binary: it is defined by sourcing $ZPLUG_HOME/init.zsh, so it cannot serve as the manager’s CLI. Every invocation is therefore wrapped in zsh -c. Zsh is the binary mpm executes, and zplug’s own presence is established by the version probe: a host with Zsh but no zplug fails to source and reports no version, which leaves the manager unavailable.

Caution

No install and no remove: zplug materializes exactly the plugin set the user’s own .zshrc declares. zplug install clones what that file already names and zplug clean drops repositories it no longer names, so neither takes a plugin of mpm’s choosing. Installing one would mean mpm editing the user’s .zshrc, which is configuration mpm does not own. Both operations are therefore not implemented rather than faked, and mpm auto-skips them.

Note

No outdated: zplug status does check each plugin against its remote, but it reports through a progress display rather than a parseable list, and its output is not pinned by any upstream sample this implementation could be held to. upgrade --all still works and mpm auto-skips the operation.

Documentation: zplug.

What `mpm` adds to `zplug`¶

mpm reaches across every manager at once, not zplug alone: mpm installed and mpm outdated cover zplug alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `zplug` commands, in `mpm`¶

You already know zplug: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `zplug`	With `mpm`
List what’s installed	`zsh -c 'source ~/.zplug/init.zsh && zplug list'`	`mpm --zplug installed`
Upgrade one package	`zplug update b4b4r07/zsh-gomi`	`mpm --zplug upgrade b4b4r07/zsh-gomi`
Upgrade everything	`zplug update`	`mpm --zplug upgrade --all`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported
`installed`	✓
`outdated`
`orphans`
`search`
`install`
`upgrade`	✓
`upgrade_all`	✓
`remove`
`sync`
`cleanup`
`doctor`

Selecting and configuring `zplug`¶

Deselect zplug for a single run with --no-zplug, or persist the choice in your configuration:

[mpm]
zplug = false

The arguments and environment variables listed in the box atop this page are forced on every zplug call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.zplug]
timeout = 900

mpm config-template zplug prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around zplug, one mpm command each:

Snapshot and clone a machine: mpm --zplug dump zplug.toml, then mpm restore zplug.toml on the next one.
Export a compliance SBOM: mpm --zplug sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown¶

State of Zsh zplug’s release-age gating, from the cooldown support table:

Status: ❌ None (clones a Git branch or tag, no release feed)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Upstream Git clones
Retraction: None: a plugin is cloned straight from its upstream repository, so withdrawing a bad revision is its author force-pushing, retagging or deleting it themselves. No index sits in between
Publish date: ❌ a commit or tag date is set by the author and freely rewritable

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe¶

The version is probed by running:

$ zsh --version
2.4.2

and extracted with:

r"(?P<version>\d+(?:\.\d+)+)"

Reference traces¶

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Zsh zplug well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ zsh -c 'source ~/.zplug/init.zsh && zplug list'
zplug/zplug => nil
b4b4r07/zsh-gomi => as:command, use:bin/gomi
peco/peco => as:command, from:gh-r, frozen:1

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --zplug installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

7.7.0.dev0 (unreleased)
- Add the zplug Zsh plugin manager with installed and upgrade support. It declares no install or remove: zplug materializes only the plugin set the user’s own .zshrc names.