@vltpkg/cli-sdk 1.3.8 → 1.5.0

package/dist/commands/publish.js

@@ -10,17 +10,21 @@ import prettyBytes from 'pretty-bytes';
 import { actual } from '@vltpkg/graph';
 import { Query } from '@vltpkg/query';
 import { createHostContextsMap } from "../query-host-contexts.js";
+import { sortScopeLocations } from "../sort-scope-locations.js";
 import { minimatch } from 'minimatch';
 import { resolveRegistry } from "../require-registry.js";
 import { stderr } from "../output.js";
-export const needsRegistry = true;
+import { getPublishConfig } from "../publish-config.js";
 export const usage = () => commandUsage({
     command: 'publish',
     usage: '',
     description: `Create a tarball from a package and publish it to the configured registry.
     
     This command will pack the package in the current directory or specified folder,
-    and then upload it to the configured registry.`,
+    and then upload it to the configured registry.
+
+    The registry is the package's \`publishConfig.registry\` if set (no other
+    registry config needed), else \`--registry\`, else a configured alias.`,
     options: {
         tag: {
             description: 'Publish the package with the given tag',
@@ -114,13 +118,15 @@ export const command = async (conf) => {
         const { nodes } = await query.search(queryString, {
             signal: new AbortController().signal,
         });
+        const found = [];
         for (const node of nodes) {
             const { location } = node.toJSON();
             assert(location, error(`node ${node.id} has no location`, {
                 found: node,
             }));
-            locations.push(resolve(projectRoot, location));
+            found.push(resolve(projectRoot, location));
         }
+        locations.push(...sortScopeLocations(found, options.monorepo));
     }
     else if (paths?.length || groups?.length || recursive) {
         for (const workspace of options.monorepo ?? []) {
@@ -140,22 +146,34 @@ export const command = async (conf) => {
         single = options.packageJson.find(process.cwd()) ?? projectRoot;
     }
     if (single) {
-        return commandSingle(single, conf);
+        const [target] = await resolveTargets([single], conf);
+        assert(target);
+        return commandSingle(target, conf);
     }
     assert(locations.length > 0, error('No workspaces or query results found'));
     const results = [];
-    for (const location of locations) {
-        results.push(await commandSingle(location, conf));
+    for (const target of await resolveTargets(locations, conf)) {
+        results.push(await commandSingle(target, conf));
     }
     return results;
 };
-const getPublishConfig = (manifest) => {
-    const pc = manifest
-        .publishConfig;
-    if (pc && typeof pc === 'object') {
-        return pc;
+/**
+ * Registry of every target, before anything runs or publishes.
+ * The configured one is only resolved (or prompted for) once.
+ */
+const resolveTargets = async (locations, conf) => {
+    let fallback;
+    const targets = [];
+    for (const location of locations) {
+        const manifestPath = conf.options.packageJson.find(location);
+        assert(manifestPath, 'No package.json found');
+        const manifestDir = dirname(manifestPath);
+        const manifest = conf.options.packageJson.read(manifestDir);
+        const registry = getPublishConfig(manifest)?.registry ??
+            (await (fallback ??= resolveRegistry(conf)));
+        targets.push({ manifestDir, registry });
     }
-    return undefined;
+    return targets;
 };
 /** Of several readmes at the package root, npm prefers the markdown one. */
 const README_MARKDOWN_EXTENSION = /\.(?:md|markdown|mdown|mdwn|mkd|mkdn)$/i;
@@ -179,17 +197,13 @@ const readPublishReadme = (packDir, files) => {
         readmeFilename,
     };
 };
-const commandSingle = async (location, conf) => {
-    const manifestPath = conf.options.packageJson.find(location);
-    assert(manifestPath, 'No package.json found');
-    const manifestDir = dirname(manifestPath);
+const commandSingle = async ({ manifestDir, registry }, conf) => {
     const manifest = conf.options.packageJson.read(manifestDir);
     assert(!manifest.private, error('Package has been marked as private'));
     const { 'dry-run': dry = false, otp } = conf.options;
     const publishConfig = getPublishConfig(manifest);
     const tag = publishConfig?.tag ?? conf.options.tag;
     const access = publishConfig?.access ?? conf.options.access;
-    const registry = publishConfig?.registry ?? (await resolveRegistry(conf));
     const registryUrl = new URL(registryBase(registry));
     const runOptions = {
         cwd: manifestDir,

package/dist/commands/query.js

@@ -1,4 +1,4 @@
-import { actual, asNode, humanReadableOutput, jsonOutput, mermaidOutput, GraphModifier, } from '@vltpkg/graph';
+import { actual, asNode, hasSkills, humanReadableOutput, jsonOutput, mermaidOutput, GraphModifier, } from '@vltpkg/graph';
 import { Query } from '@vltpkg/query';
 import { stdout } from "../output.js";
 import { error } from '@vltpkg/error-cause';
@@ -166,6 +166,7 @@ export const command = async (conf) => {
             hostContexts,
             diffFiles,
             getAuthHeader,
+            hasSkills,
         });
         const { nodes: resultNodes } = await scopeQuery.search(scopeQueryString, {
             signal: new AbortController().signal,
@@ -231,6 +232,7 @@ export const command = async (conf) => {
         hostContexts,
         diffFiles,
         getAuthHeader,
+        hasSkills,
     });
     const query = queryString ||
         (graph ? defaultProjectQueryString : defaultLocalScopeQueryString);

package/dist/commands/skills.d.ts

@@ -0,0 +1,56 @@
+import type { DepID } from '@vltpkg/dep-id';
+import type { LinkSkillsResult, ListSkillsResult, UnscannedSkills } from '@vltpkg/graph';
+import type { WhichConfig } from '@vltpkg/vlt-json';
+import type { CommandFn, CommandUsage } from '../index.ts';
+import type { ViewOptions } from '../view.ts';
+export type SkillsResult = ({
+    action: 'list';
+} & ListSkillsResult) | ({
+    action: 'link';
+    /** the `allow-skills` applied */
+    query: string;
+    /** the config file it was saved to, if changed */
+    saved?: WhichConfig;
+} & LinkSkillsResult) | {
+    action: 'unchanged';
+};
+export declare const needsRegistry = true;
+export declare const usage: CommandUsage;
+export declare const views: {
+    readonly human: (r: SkillsResult, o?: ViewOptions) => string;
+    readonly json: (r: SkillsResult) => ({
+        action: "link";
+        /** the `allow-skills` applied */
+        query: string;
+        /** the config file it was saved to, if changed */
+        saved?: WhichConfig;
+    } & UnscannedSkills & {
+        linked: import("@vltpkg/graph").SkillRow[];
+        unchanged: import("@vltpkg/graph").SkillRow[];
+        removed: string[];
+        conflicts: string[];
+        dirs: string[];
+        skipped?: string[];
+        gitignore?: string[];
+        unmatched?: import("@vltpkg/graph").UnmatchedPattern[];
+    }) | {
+        action: "unchanged";
+    } | {
+        skills: {
+            frontmatterName?: string;
+            path: string;
+            linked: string[];
+            name: string;
+            description: string | undefined;
+            'dependency-name': string;
+            'package-id': DepID;
+        }[];
+        action: "list";
+        unscanned?: string[];
+        unscannedReason?: "timeout" | "unscanned";
+        dirs: string[];
+        skipped?: string[];
+    };
+    readonly mermaid: (r: SkillsResult) => string;
+};
+export declare const command: CommandFn<SkillsResult>;

package/dist/commands/skills.js

@@ -0,0 +1,268 @@
+import { styleText } from 'node:util';
+import { error } from '@vltpkg/error-cause';
+import { assertQuery, linkSkills, listSkills, mermaidOutput, } from '@vltpkg/graph';
+import { configLabel, savedLine, storedAllowSkills, unmatchedLines, unscannedLines, } from "../allow-skills.js";
+import { configWriteTarget } from "../config/index.js";
+import { commandUsage } from "../config/usage.js";
+import { confirm, editQuery, interactive } from "../skills-prompt.js";
+export const needsRegistry = true;
+export const usage = () => commandUsage({
+    command: 'skills',
+    usage: ['', 'list [<query>]', 'link [<query>]'],
+    description: `Manage the agent skills shipped by installed packages.
+
+      A skill is a folder with a \`SKILL.md\` file
+      (https://agentskills.io/specification). Packages ship them as a
+      root \`SKILL.md\`, or at \`<name>/SKILL.md\` in \`skills/\`,
+      \`dist/skills/\` or \`.agents/skills/\`: the first skill of a name
+      wins.
+
+      Skills are linked into the project's agent skill dirs:
+      \`.agents/skills\`, plus \`<folder>/skills\` for each agent folder
+      at the project root (e.g. \`.claude/\`), or the \`skills-dir\`
+      config. When packages ship skills with the same name, one is
+      linked and the others are reported. Only links made by vlt
+      (pointing into \`node_modules/.vlt\`) are ever replaced or
+      removed; anything else in the way is skipped.
+
+      Use --target or a query after the subcommand to select packages
+      using DSS query syntax. End a selector with
+      \`:skill(<name>, …)\` to pick single skills, e.g.
+      \`#skills:skill(find-skills)\`. Use
+      \`vlt install --allow-skills=<query>\` to link skills on install.`,
+    subcommands: {
+        list: {
+            usage: '[<query>]',
+            description: `List the skills of installed packages. The default.
+                      Selects all packages (\`*\`) by default. Applies
+                      \`:skill()\`: preview a query before \`link\` saves
+                      it.`,
+        },
+        link: {
+            usage: '[<query>]',
+            description: `Set, save and apply \`allow-skills\`: link what the
+                      query selects and remove vlt links to other skills.
+                      With no query: the stored one, or
+                      \`:not(:malware)\`. Asks before replacing or editing
+                      a stored query (-y skips). Saves to the project
+                      vlt.json, or the user one with --config=user.`,
+        },
+    },
+    options: {
+        target: {
+            value: '<query>',
+            description: 'Query selector to filter packages using DSS syntax.',
+        },
+        yes: {
+            description: 'Skip the prompts: replace or keep the stored allow-skills without asking.',
+        },
+        config: {
+            value: 'user|project',
+            description: 'vlt.json to save allow-skills to (default: project).',
+        },
+        view: {
+            value: '[human | json | mermaid]',
+            description: 'Output format. mermaid: list only.',
+        },
+    },
+});
+const plural = (n, s) => `${n} ${s}${n === 1 ? '' : 's'}`;
+const lines = (header, items) => [header, ...items.map(i => `  ${i}`)].join('\n');
+// warnings shared by list and link
+const notes = (r) => [
+    ...(r.skipped ? [`⚠️ Skipped ${r.skipped.join(', ')}`] : []),
+    ...(r.gitignore ?
+        [`⚠️ Could not update ${r.gitignore.join(', ')}`]
+        : []),
+    ...unscannedLines(r),
+];
+// `vlt ls` style
+const pkgLabel = (s) => {
+    const pkg = s.version ? `${s.name}@${s.version}` : s.name;
+    return s.alias ? `${s.alias} (${pkg})` : pkg;
+};
+const linkedSuffix = (s, dirs) => dirs.length && dirs.every(d => s.linked.includes(d)) ? ' (linked)'
+    : s.linked.length ? ` (linked in ${s.linked.join(', ')})`
+        : '';
+const row = (s, dirs) => `${s.skill} (${pkgLabel(s)})${linkedSuffix(s, dirs)}`;
+const listNotes = (r) => [
+    ...(!r.dirs.length && !r.skipped ?
+        ['No agent skill dirs: skills-dir is empty']
+        : []),
+    ...notes(r),
+];
+// colors as `vlt ls` / `vlt query`: linked skills = selected nodes
+const humanList = (r, { colors } = {}) => {
+    const style = (format) => (s) => colors ? styleText(format, s, { validateStream: false }) : s;
+    const yellow = style('yellow');
+    const rows = r.skills.map(s => {
+        const x = row(s, r.dirs);
+        return s.linked.length ? yellow(x) : x;
+    });
+    const last = rows.length - 1;
+    return [
+        ...(rows.length ?
+            [
+                style('reset')([
+                    r.project,
+                    ...rows.map((x, i) => `${i === last ? '└──' : '├──'} ${x}`),
+                ].join('\n')),
+            ]
+            : ['No agent skills found in installed packages.']),
+        ...listNotes(r),
+    ].join('\n');
+};
+// the dependency graph down to each package, its skills as leaves
+const mermaidList = (r) => {
+    const children = new Map();
+    for (const s of r.skills) {
+        const list = children.get(s.id) ?? [];
+        list.push({
+            edge: pkgLabel(s),
+            label: `${s.skill}${linkedSuffix(s, r.dirs)}`,
+        });
+        children.set(s.id, list);
+    }
+    const { graph } = r;
+    return [
+        mermaidOutput({
+            edges: [],
+            importers: new Set([graph.mainImporter]),
+            nodes: [...graph.nodes.values()].filter(n => n === graph.mainImporter || children.has(n.id)),
+            children,
+        }),
+        ...listNotes(r).map(n => `%% ${n}`),
+    ].join('\n');
+};
+// `name`: the skill, `dependency-name`: the dep it's installed as,
+// `package-id`: its package
+const jsonSkill = ({ skill, name, alias, version, id, description, ...rest }) => ({
+    name: skill,
+    description,
+    'dependency-name': alias ?? name,
+    'package-id': id,
+    ...rest,
+});
+// distinct skills, in any number of dirs
+const count = (rows) => new Set(rows.map(r => `${r.id}\0${r.skill}`)).size;
+const humanLink = (r) => {
+    const out = [];
+    if (r.linked.length) {
+        out.push(lines(`🔗 Linked ${plural(count(r.linked), 'agent skill')}:`, r.linked.map(s => s.mount)));
+    }
+    else if (r.unchanged.length) {
+        out.push(`${plural(count(r.unchanged), 'agent skill')} already linked.`);
+    }
+    if (r.removed.length) {
+        out.push(lines(`🧹 Removed ${plural(r.removed.length, 'skill link')}:`, r.removed));
+    }
+    if (r.conflicts.length) {
+        out.push(lines(`⚠️ Skipped ${plural(r.conflicts.length, 'skill')}, path in use or taken by another package:`, r.conflicts));
+    }
+    out.push(...notes(r));
+    return out.join('\n') || 'No agent skills found to link.';
+};
+const human = (r, o) => r.action === 'list' ? humanList(r, o)
+    : r.action === 'unchanged' ? 'No changes made.'
+        : [
+            humanLink(r),
+            ...unmatchedLines(r.unmatched),
+            ...(r.saved ? [savedLine(r.query, r.saved)] : []),
+        ].join('\n');
+export const views = {
+    human,
+    json: (r) => {
+        if (r.action !== 'list')
+            return r;
+        // key order kept
+        const { project, graph, ...rest } = r;
+        return { ...rest, skills: rest.skills.map(jsonSkill) };
+    },
+    mermaid: (r) => r.action === 'list' ? mermaidList(r) : human(r),
+};
+const defaultQuery = ':not(:malware)';
+const where = (which) => which === 'user' ?
+    'in the user vlt.json'
+    : 'for this project (vlt.json)';
+// the query to link; undefined: no changes
+const pickQuery = async (conf, given) => {
+    const check = (q) => assertQuery(q, 'allow-skills', ['skill']);
+    const stored = storedAllowSkills(conf);
+    const yes = !!conf.get('yes');
+    const tty = interactive();
+    if (given) {
+        await check(given);
+        if (!stored || stored.query === given || yes)
+            return given;
+        if (!tty) {
+            throw error(`allow-skills is already set (${configLabel(stored.which)}): "${stored.query}"; pass -y to replace it`, { code: 'EUSAGE', found: given, wanted: stored.query });
+        }
+        if (!(await confirm(`allow-skills is already set ${where(stored.which)}: "${stored.query}". Replace it? [y/N] `))) {
+            return undefined;
+        }
+        return editQuery({ current: stored.query, prefill: given, check });
+    }
+    if (stored) {
+        if (yes || !tty)
+            return stored.query;
+        const edit = await confirm(`allow-skills is set ${where(stored.which)}: "${stored.query}". Edit it? [y/N] `);
+        // ctrl+C/D: cancel
+        if (edit === undefined)
+            return undefined;
+        return edit ?
+            editQuery({
+                current: stored.query,
+                prefill: stored.query,
+                check,
+            })
+            : stored.query;
+    }
+    if (yes || !tty)
+        return defaultQuery;
+    return editQuery({ prefill: defaultQuery, check });
+};
+export const command = async (conf) => {
+    const [sub = 'list', query] = conf.positionals;
+    const target = conf.get('target') || query;
+    const opts = {
+        ...conf.options,
+        projectRoot: conf.projectRoot,
+        skillsDirs: conf.get('skills-dir'),
+    };
+    switch (sub) {
+        case 'list':
+        case 'ls':
+            return {
+                action: 'list',
+                ...(await listSkills({ ...opts, target })),
+            };
+        case 'link': {
+            const query = await pickQuery(conf, target);
+            if (query === undefined)
+                return { action: 'unchanged' };
+            const res = await linkSkills({
+                ...opts,
+                target: query,
+                apply: true,
+            });
+            // after linking: a link error saves nothing
+            let saved;
+            if (storedAllowSkills(conf)?.query !== query) {
+                saved = configWriteTarget(conf, 'project');
+                await conf.addConfigToFile(saved, { 'allow-skills': query });
+            }
+            return {
+                action: 'link',
+                query,
+                ...(saved && { saved }),
+                ...res,
+            };
+        }
+        default:
+            throw error('Unknown skills subcommand', {
+                code: 'EUSAGE',
+                found: sub,
+                validOptions: ['list', 'ls', 'link'],
+            });
+    }
+};

package/dist/commands/uninstall.d.ts

@@ -1,10 +1,14 @@
-import type { Graph } from '@vltpkg/graph';
+import type { Graph, LinkSkillsResult } from '@vltpkg/graph';
 import type { CommandFn, CommandUsage } from '../index.ts';
 export type UninstallResult = {
     /**
      * The resulting graph structure at the end of an uninstall.
      */
     graph: Graph;
+    /**
+     * Agent skill links added or removed.
+     */
+    skills?: LinkSkillsResult;
 };
 export declare const needsRegistry = true;
 export declare const needsNpmRegistry = true;

package/dist/commands/uninstall.js

@@ -39,10 +39,12 @@ export const command = async (conf) => {
         String(conf.get('allow-scripts'))
         : ':not(*)';
     /* c8 ignore stop */
-    const { graph } = await uninstall({
+    const { graph, skills } = await uninstall({
         ...conf.options,
         allowScripts,
+        allowSkills: conf.get('allow-skills'),
+        skillsDirs: conf.get('skills-dir'),
         lockfileOnly: conf.options['lockfile-only'],
     }, remove);
-    return { graph };
+    return { graph, ...(skills ? { skills } : null) };
 };

package/dist/commands/unpublish.d.ts

@@ -1,5 +1,4 @@
 import type { CommandFn, CommandUsage } from '../index.ts';
-export declare const needsRegistry = true;
 export declare const usage: CommandUsage;
 export type CommandResult = {
     /** The package name */

package/dist/commands/unpublish.js

@@ -1,9 +1,10 @@
 import { error } from '@vltpkg/error-cause';
-import { RegistryClient, assertOk, requestError, } from '@vltpkg/registry-client';
+import { RegistryClient, assertOk, registryBase, requestError, } from '@vltpkg/registry-client';
 import { Spec } from '@vltpkg/spec';
+import { dirname } from 'node:path';
 import { commandUsage } from "../config/usage.js";
+import { getPublishConfig } from "../publish-config.js";
 import { resolveRegistry } from "../require-registry.js";
-export const needsRegistry = true;
 export const usage = () => commandUsage({
     command: 'unpublish',
     usage: ['<package>@<version>', '<package> --force'],
@@ -11,6 +12,8 @@ export const usage = () => commandUsage({
 
     To unpublish a single version, specify the package name and version.
     To unpublish an entire package, specify the package name and use --force.
+    A spec naming the package in the current directory uses its
+    \`publishConfig.registry\`, if set.
 
     ⚠️  Unpublishing is a destructive action that cannot be undone.
     Consider using \`vlt deprecate\` instead if you want to discourage
@@ -45,14 +48,22 @@ export const views = {
     },
     json: (r) => r,
 };
+/** `publishConfig.registry` of the local package, if it is `name` */
+const localPublishRegistry = (conf, name) => {
+    const path = conf.options.packageJson.find(process.cwd());
+    if (!path)
+        return undefined;
+    const manifest = conf.options.packageJson.read(dirname(path));
+    return manifest.name === name ?
+        getPublishConfig(manifest)?.registry
+        : undefined;
+};
 export const command = async (conf) => {
     const specArg = conf.positionals[0];
     if (!specArg) {
         throw error('unpublish requires a package spec argument (e.g. pkg@version)', { code: 'EUSAGE' });
     }
     const { otp, force } = conf.options;
-    const registry = await resolveRegistry(conf);
-    const registryUrl = new URL(registry);
     const spec = Spec.parseArgs(specArg, conf.options);
     const name = spec.name;
     /* c8 ignore start - Spec.parseArgs always produces a name for valid input */
@@ -71,6 +82,8 @@ export const command = async (conf) => {
                 'To unpublish all versions, use: vlt unpublish <package> --force');
         }
     }
+    const registryUrl = new URL(registryBase(localPublishRegistry(conf, name) ??
+        (await resolveRegistry(conf))));
     const rc = new RegistryClient(conf.options);
     const encodedName = name.startsWith('@') ? name.replace('/', '%2F') : name;
     if (version) {

package/dist/commands/update.d.ts

@@ -5,6 +5,18 @@ export declare const needsNpmRegistry = true;
 export declare const usage: CommandUsage;
 export declare const views: {
     readonly json: (i: InstallResult) => {
+        allowSkills?: import("../allow-skills.ts").AllowSkillsSave | undefined;
+        skills?: {
+            unscanned?: string[];
+            unscannedReason?: "timeout" | "unscanned";
+            removed: string[];
+            conflicts: string[];
+            dirs: string[];
+            skipped?: string[];
+            gitignore?: string[];
+            unmatched?: import("@vltpkg/graph").UnmatchedPattern[];
+            linked: string[];
+        } | undefined;
         persistedConfig?: import("../persist-spec-config.ts").SpecConfigPersistPlan | undefined;
         graph: import("@vltpkg/graph").LockfileData;
         buildQueue?: import("@vltpkg/dep-id").DepID[] | undefined;

package/dist/commands/update.js

@@ -1,6 +1,7 @@
 import { update } from '@vltpkg/graph';
 import { error } from '@vltpkg/error-cause';
 import { commandUsage } from "../config/usage.js";
+import { saveAllowSkills } from "../allow-skills.js";
 import { planSpecConfigPersist } from "../persist-spec-config.js";
 import { asUnknownSpecPrefix } from "../require-registry.js";
 import { lazyView } from "../view.js";
@@ -28,8 +29,17 @@ export const usage = () => commandUsage({
             value: '<query>',
             description: 'Filter which packages are allowed to run lifecycle scripts using DSS query syntax.',
         },
+        'allow-skills': {
+            value: '<query>',
+            description: "Link agent skills of packages matching this DSS query into the project's agent skill dirs. Saved to vlt.json.",
+        },
     },
 });
+// link mounts; `unchanged` left out
+const skillsJson = ({ linked, unchanged: _, ...rest }) => ({
+    linked: linked.map(s => s.mount),
+    ...rest,
+});
 export const views = {
     json: i => ({
         ...(i.buildQueue?.length ?
@@ -42,6 +52,8 @@ export const views = {
         ...(i.persistedConfig ?
             { persistedConfig: i.persistedConfig }
             : null),
+        ...(i.skills ? { skills: skillsJson(i.skills) } : null),
+        ...(i.allowSkills ? { allowSkills: i.allowSkills } : null),
     }),
     human: lazyView(async () => (await import('./install/reporter.ts')).InstallReporter),
 };
@@ -58,17 +70,22 @@ export const command = async (conf) => {
         String(conf.get('allow-scripts'))
         : ':not(*)';
     /* c8 ignore stop */
-    const { buildQueue, graph } = await update({
+    const { buildQueue, graph, skills } = await update({
         ...conf.options,
         allowScripts,
+        allowSkills: conf.get('allow-skills'),
+        skillsDirs: conf.get('skills-dir'),
     }).catch((er) => {
         throw asUnknownSpecPrefix(er);
     });
     if (persist)
         await conf.addConfigToFile(persist.which, persist.values);
+    const allowSkillsSave = await saveAllowSkills(conf);
     return {
         buildQueue,
         graph,
         ...(persist ? { persistedConfig: persist } : null),
+        ...(skills ? { skills } : null),
+        ...(allowSkillsSave ? { allowSkills: allowSkillsSave } : null),
     };
 };

package/dist/commands/version.js

@@ -8,6 +8,7 @@ import assert from 'node:assert';
 import { actual } from '@vltpkg/graph';
 import { Query } from '@vltpkg/query';
 import { createHostContextsMap } from "../query-host-contexts.js";
+import { sortScopeLocations } from "../sort-scope-locations.js";
 import { minimatch } from 'minimatch';
 /**
  * `--no-git-tag-version` skips the whole git dance, matching npm.
@@ -223,13 +224,15 @@ export const command = async (conf) => {
         const { nodes } = await query.search(queryString, {
             signal: new AbortController().signal,
         });
+        const found = [];
         for (const node of nodes) {
             const location = node.location;
             assert(location, error(`node ${node.id} has no location`, {
                 found: node,
             }));
-            locations.push(resolve(node.projectRoot, location));
+            found.push(resolve(node.projectRoot, location));
         }
+        locations.push(...sortScopeLocations(found, options.monorepo));
     }
     else if (paths?.length || groups?.length || recursive) {
         for (const workspace of options.monorepo ?? []) {