test(coverage): cover getWorkspaceGlobs + globWorkspace

Adds tests for two previously-untested public functions in fs/glob.mts:

getWorkspaceGlobs:
- PNPM agent reads pnpm-workspace.yaml and returns parsed glob patterns
- Missing pnpm-workspace.yaml → empty array
- Malformed YAML → empty array (catch branch at lines 53-55)

globWorkspace:
- Empty workspaceGlobs → early-return [] (line 299-300)

glob.mts: 89.32% → 98.05% statements (87.20% → 93.02% branch),
function coverage 89.47% → 100%. Remaining gap is the non-PNPM
package.json workspaces fallback (line 58, 262).

Author: jdalton

packages/cli/test/unit/utils/fs/glob.test.mts

@@ -350,4 +350,53 @@ describe('utils/fs/glob', () => {
       expect(result).toEqual(['**/node_modules', '**/dist'])
     })
   })
+
+  describe('getWorkspaceGlobs', () => {
+    it('reads pnpm-workspace.yaml packages list for PNPM agent (lines 49-56)', async () => {
+      const { safeReadFile } = vi.mocked(await import('@socketsecurity/lib/fs'))
+      safeReadFile.mockResolvedValueOnce(
+        'packages:\n  - "packages/*"\n  - "apps/*"\n',
+      )
+      const { getWorkspaceGlobs } = await import(
+        '../../../../src/utils/fs/glob.mts'
+      )
+      const result = await getWorkspaceGlobs('pnpm', '/repo')
+      // Workspace patterns are converted to glob form ("packages/*" → "packages/*/").
+      expect(Array.isArray(result)).toBe(true)
+      expect(result.length).toBeGreaterThan(0)
+    })
+
+    it('returns empty array when pnpm-workspace.yaml is missing', async () => {
+      const { safeReadFile } = vi.mocked(await import('@socketsecurity/lib/fs'))
+      safeReadFile.mockResolvedValueOnce(undefined as any)
+      const { getWorkspaceGlobs } = await import(
+        '../../../../src/utils/fs/glob.mts'
+      )
+      const result = await getWorkspaceGlobs('pnpm', '/repo')
+      expect(result).toEqual([])
+    })
+
+    it('returns empty array when pnpm-workspace.yaml is malformed', async () => {
+      const { safeReadFile } = vi.mocked(await import('@socketsecurity/lib/fs'))
+      safeReadFile.mockResolvedValueOnce('this is not :::valid::: yaml{{{')
+      const { getWorkspaceGlobs } = await import(
+        '../../../../src/utils/fs/glob.mts'
+      )
+      const result = await getWorkspaceGlobs('pnpm', '/repo')
+      expect(result).toEqual([])
+    })
+  })
+
+  describe('globWorkspace', () => {
+    it('returns empty array when no workspace globs (line 299-300)', async () => {
+      const { safeReadFile } = vi.mocked(await import('@socketsecurity/lib/fs'))
+      // pnpm-workspace.yaml missing → empty workspaceGlobs → early-return [].
+      safeReadFile.mockResolvedValueOnce(undefined as any)
+      const { globWorkspace } = await import(
+        '../../../../src/utils/fs/glob.mts'
+      )
+      const result = await globWorkspace('pnpm', '/nonexistent/repo')
+      expect(result).toEqual([])
+    })
+  })
 })