lpm query

Find dependency instances that match a selector, or count behavioral tags across your dependency tree.

lpm query [OPTIONS] [SELECTOR]

Quickstart

lpm query '#lodash'
lpm query ':scripts:not(:built)'
lpm query ':critical' --assert-none

Quote selectors so that your shell does not interpret #, >, *, or parentheses.

LPM CLI supports npm, private registries, and the LPM.dev Registry. Query can inspect supported foreign lockfiles and installed packages.

Examples

# Find an exact version, including build metadata
lpm query '#example@1.0.0+build.1'

# Find direct dependencies with network capabilities
lpm query ':root > :network'

# Match both tags
lpm query ':eval:scripts'

# Match either tag
lpm query ':eval,:child-process'

# Inspect full analysis details
lpm query ':network' --json --query-verbose

# Save a diagram for an LPM CLI-managed project
lpm query ':eval' --format mermaid > eval-graph.mmd

For a reusable check, define an uncached task:

{
  "tasks": {
    "deps:gate": {
      "command": "lpm query ':critical' --assert-none",
      "cache": false
    }
  }
}

lpm run deps:gate

There is no dedicated query configuration in lpm.json. command holds the selector and options. cache: false runs the check each time.

For a different one-run policy, invoke the command directly with another selector. An explicit lpm.json task command takes precedence in lpm run.

Selectors

> follows dependency edges. It does not select every descendant.

Behavioral tags

These tags describe static analysis results. A capability such as filesystem or network access does not, by itself, establish malicious behavior.

The :fs tag does not establish access outside the package directory. The :obfuscated tag requires high-confidence signals.

Manifest and state tags

Dependency protocol tags describe declarations inside a package. They do not describe where that package itself came from.

:no-license also includes declarations such as UNLICENSED, none, proprietary, and SEE LICENSE IN ... for non-private packages.

For exact license inventory and policy checks, use lpm licenses.

A build marker does not prove current approval, a successful security review, or a vulnerability fix. Use lpm trust to inspect approval changes.

Severity selectors

Severity selectors combine these tags with OR:

:high includes any reported vulnerability and any matching lifecycle-script declaration. It is not a vulnerability-severity threshold.

Project and workspace scope

With a lockfile, query selects the applicable project from the current directory, including nested directories. With an LPM CLI workspace lockfile, queries use the selected member's dependency tree.

For other package managers, query uses the whole inventory from the discovered lockfile. It does not select a separate workspace-member tree.

Without a lockfile, run query from the directory that contains node_modules.

:root and :workspace-root are virtual anchors for >. They are not dependency result rows.

cd packages/web/src
lpm query ':root > :scripts'
lpm query ':workspace-root > :scripts'

With an LPM CLI workspace lockfile, the second command uses the owning root's exact dependency instances. It can inspect root dependencies outside the member's normal tree.

Outside an LPM CLI workspace, both anchors use the selected project. For another package manager, this project is the discovered lockfile directory. If an LPM CLI workspace lockfile lacks a root projection, the workspace-root anchor has no children.

Direct dependencies include optional and development dependencies. Query has no production-only, recursive, or workspace-filter flag.

CI checks and incomplete scans

# Fail when any critical tag matches
lpm query ':critical' --assert-none

# Save matching rows and retain the failing status
lpm query ':eval:scripts' --assert-none --json > dependency-findings.json

Without --assert-none, a completed query exits with code 0, even when packages match. With this flag, matches cause code 1.

Incomplete required analysis, unreadable script state, invalid selectors, and registry failures also produce a nonzero status. An empty match list cannot establish a clean result after those failures.

Behavioral queries require readable package sources, valid package manifests, and complete analysis. Pure identity queries in compact JSON do not require script, build, or advisory state.

If sources are missing, restore the installed tree with lpm install, then rerun the query. Unsupported source syntax or exceeded scan limits require separate review.

For broader reports and severity policies, use lpm audit.

Network requests

Behavioral tags, scripts, and build markers use local files. These requests also need remote data:

OSV requests include package names and versions from private registries and local sources when their names do not start with @lpm.dev/.

Negating a selector still requires its data. For example, :not(:vulnerable) needs advisory lookups.

Output

JSON and counts

lpm query '#lodash' --json
lpm query ':network' --json --query-verbose
lpm query --count --json

Selector JSON is one array, including when --assert-none fails. Each row contains name, version, and an optional path.

Exact LPM CLI-managed instances also include instanceId. Same-name versions and separate instances remain separate rows.

Detailed JSON adds analysis, hasScripts, isBuilt, and isVulnerable. A live file: or link: dependency can use its source directory as path.

Count JSON is an object with tag counts and total. An empty inventory still returns this object with zero counts.

--count cannot accompany a selector, --assert-none, --format, or --query-verbose.

Mermaid

lpm query ':eval' --format mermaid > eval-graph.mmd
lpm query ':eval' --format mermaid --assert-none

Mermaid output requires an LPM CLI-managed lockfile. It includes matching instances and their adjacent dependency or peer nodes.

Matched nodes receive a highlight. Exact instance labels include a short instance ID. --assert-none also applies to this output.

--json and --format mermaid cannot be combined. For a full graph, use lpm graph.

Flags

See global flags for shared options.

See also

• lpm audit — vulnerability and behavior reports.
• lpm graph — complete dependency diagrams.
• lpm licenses — license inventory and policy checks.
• lpm rebuild — execute approved dependency scripts.
• Security audit — behavioral analysis and its limits.