Fish fisher¶

ID: fisher
Home page: https://github.com/jorgebucaran/fisher
Version requirement: >= 4
Platforms: 🐧 Linux · 🍎 macOS
Operations: installed · install · upgrade · upgrade_all · remove
purl types: pkg:fisher
CLI name: fish
Forced environment: NO_COLOR=1
Issues and PRs: 📦 manager: fish-based
Source: meta_package_manager/managers/fisher.py

Fisher is a plugin manager for the Fish shell.

Fisher clones each plugin from GitHub or any other forge into $fisher_path, and records the set in the user’s fish_plugins file. Plugins are identified by the lower-cased owner/repo slug Fisher both reports and accepts, which is the id mpm keys them on. A plugin may carry an @ref suffix pinning it to a Git tag or branch, and that suffix is what mpm surfaces as the installed version.

Caution

fisher is a Fish function, not a standalone binary: it ships as a functions/fisher.fish file that Fish autoloads, so it cannot serve as the manager’s CLI. Every invocation is therefore wrapped in fish -c. Fish is the binary mpm executes, and Fisher’s own presence is established by the version probe: a host with Fish but no Fisher autoloads nothing, reports no version, and leaves the manager unavailable.

Note

No outdated: Fisher exposes no dry run and no upstream comparison. It tracks a branch rather than a release, so “behind” is not a question it answers. upgrade --all still works, and mpm auto-skips the operation.

Note

No search: Fisher resolves plugins straight from forge URLs and indexes no registry to search.

Documentation: fisher.

What `mpm` adds to `fisher`¶

mpm reaches across every manager at once, not fisher alone: mpm installed and mpm outdated cover fisher alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `fisher` commands, in `mpm`¶

You already know fisher: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `fisher`	With `mpm`
List what’s installed	`fish -c 'fisher list'`	`mpm --fisher installed`
Install a package	`fish -c 'fisher install ilancosman/tide@v5'`	`mpm install pkg:fisher/ilancosman/tide@v5`
Upgrade one package	`fish -c 'fisher update jorgebucaran/nvm.fish'`	`mpm --fisher upgrade jorgebucaran/nvm.fish`
Upgrade everything	`fish -c 'fisher update'`	`mpm --fisher upgrade --all`
Remove a package	`fish -c 'fisher remove jorgebucaran/nvm.fish'`	`mpm remove pkg:fisher/jorgebucaran/nvm.fish`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported
`installed`	✓
`outdated`
`orphans`
`search`
`install`	✓
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓
`sync`
`cleanup`
`doctor`

Selecting and configuring `fisher`¶

Deselect fisher for a single run with --no-fisher, or persist the choice in your configuration:

[mpm]
fisher = false

The arguments and environment variables listed in the box atop this page are forced on every fisher call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.fisher]
timeout = 900

mpm config-template fisher prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around fisher, one mpm command each:

Snapshot and clone a machine: mpm --fisher dump fisher.toml, then mpm restore fisher.toml on the next one.
Export a compliance SBOM: mpm --fisher sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown¶

State of Fish fisher’s release-age gating, from the cooldown support table:

Status: ❌ None (clones a Git branch or tag, no release feed)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Upstream Git clones
Retraction: None: a plugin is cloned straight from its upstream repository, so withdrawing a bad revision is its author force-pushing, retagging or deleting it themselves. No index sits in between
Publish date: ❌ a commit or tag date is set by the author and freely rewritable

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe¶

The version is probed by running:

$ fish --version
fisher, version 4.4.8

and extracted with:

r"fisher, version (?P<version>\S+)"

Reference traces¶

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Fish fisher well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ fish -c 'fisher list'
jorgebucaran/fisher
ilancosman/tide@v5
jorgebucaran/nvm.fish

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --fisher installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

7.7.0.dev0 (unreleased)
- Add the Fisher Fish plugin manager with installed, install, upgrade and remove support. Fish is the CLI mpm executes, since Fisher ships as an autoloaded shell function rather than an executable.