[sandstream]

What was wrong

kit check warned about crates that its own scanners already cover. In a repo whose root Cargo.toml is a Cargo workspace:

[workspace]
resolver = "2"
members = ["crates/lyssna-core", "src-tauri"]

with one root Cargo.lock, the scan scope row reported:

scan scope: warn  2 nested project(s) NOT covered by this scan: crates/lyssna-core, src-tauri ... run kit check in each

That is a false warning. osv-scanner and cargo audit read the root Cargo.lock, and a workspace's single lockfile pins every member. declaresWorkspaces only looked at package.json workspaces, so any root that was not an npm workspace made every nested crate look uncovered.

What changed

• src/check-nested-projects.ts: scanScopeFacts now also records cargoMembers, the nested paths listed in the root [workspace] members (simple globs such as crates/* supported, exclude honored). It records them only when a root Cargo.lock exists, because the scanners read the lockfile. checkScanScope passes when every nested project is a member, and otherwise warns with only the uncovered paths.
• A root pnpm-workspace.yaml now counts as declaring workspaces, the same as package.json workspaces. It was the same small gap in the same function.
• cargoMembers is optional on ScanScope, so existing callers and fixtures are unchanged.
• CHANGELOG entry under Unreleased / Fixed.

How it was tested

New cases in src/check-nested-projects.test.ts:

• Cargo workspace with members (one by glob) and a root Cargo.lock: pass.
• Same workspace without Cargo.lock: still warns, both members named.
• Cargo workspace with lockfile plus a non-member tools/web/package.json: warns, and names only tools/web.
• pnpm workspace root: pass.

Results:

• npm run build: ok.
• npm test: 6518 tests, 6508 pass, 0 fail, 10 skipped.
• npm run lint: 0 errors, no warnings in the changed files.
• prettier --check on the changed files: clean.
• node dist/cli.js adr check: 4 enforced ADRs, no new violations.
• Ran the built CLI, kit check --category security, against the real repo above. The row now reads scan scope: pass 2 nested crate(s) covered via the Cargo workspace: crates/lyssna-core, src-tauri.

🤖 Generated with Claude Code

[github-actions]

Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published.

[github-actions]

Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published.