Numan
Numan is a cross-platform package manager for Nushell. It installs registry plugins, modules, scripts, and completion payloads from signed registries, pins immutable artifacts in a lockfile, and activates plugins and modules with Nu only when you ask — keeping installs inert until you run numan activate.
Built in Rust for Linux, macOS, and Windows.
---
About
Nushell’s ecosystem has grown around community packages, but managing them across machines, Nu versions, and platforms is still painful. nupm covers local installs well; registry-based workflows need verified artifacts, reproducible lockfiles, and safe activation that survives Nu upgrades.
Numan fills that gap:
| Concern | How Numan handles it | |--------|----------------------| | Trust | Ed25519 signatures over registry indexes; built-in production trust root for official; SHA256 verification of plugin binaries | | Reproducibility | Lockfile v2 pins version, payload hash, and install origin | | Platform safety | Artifacts resolved for the compile-time OS/arch/libc triple | | Nu version matching | Resolver respects per-package Nu constraints | | Activation isolation | install never touches Nu; only activate registers plugins or writes autoloads | | Crash recovery | Journals for activation, autoload, lifecycle, and nupm import operations | | nupm coexistence | Read-only discovery, one-way import, and drift detection for existing nupm installs |
Numan is early-stage. Core install, activate, update, remove, gc, registry, doctor, snapshots, nupm interoperability, and shell completions are implemented and covered by unit and hermetic integration tests, plus real-Nu acceptance on Linux, macOS, and Windows in CI. Pre-built release binaries are published via GitHub Releases.
---
Features
- Registry-backed installs — search, inspect versions, and install owner/name or owner/name@version
- Official registry — production trust root built in; numan init configures official automatically; numan registry sync verifies signed indexes
- Package types — plugins and modules support activation; scripts and completion packages are install-only while their activation contracts are deferred
- Verified artifacts — mandatory SHA256 for plugin binaries; signed registry indexes
- Scoped activation — plugins active only when Nu executable hash, Nu version, and plugin registry path match
- Module autoloads — managed vendor autoload files with ownership markers and candidate validation
- Lifecycle management — update, remove, and gc with pending-lifecycle journal recovery
- nupm interoperability — numan nupm status|inspect|import|diff for migration from nupm
- Health checks — numan doctor [--fix] diagnoses root state and applies safe repairs
- Shell completions — bash, fish, zsh, PowerShell, and Nushell via numan completions
---
Registry package support
| Registry package type | Install, verify, and lock | numan activate | Support tier | |-----------------------|----------------------------|------------------|--------------| | Plugin | Yes | Yes, through Nu's plugin registry | Supported | | Module | Yes | Yes, through a Numan-managed vendor autoload file | Supported | | Script | Yes | No | Install-only; activation is deferred | | Completion package | Yes | No | Install-only; activation is deferred |
Install-only packages remain inert: Numan downloads, verifies, locks, lists, removes, and garbage-collects their payloads, but does not execute them or modify Nu configuration for them. This is separate from Numan's own shell completion generator: numan completions <shell is supported for bash, fish, zsh, PowerShell, and Nushell (nu).
---