chore(wheelhouse): cascade template@4f14ec07c

Auto-applied by socket-wheelhouse sync-scaffolding into socket-cli.
4 file(s) touched:
  - .config/fleet/pnpm-workspace.fleet.yaml
  - scripts/fleet/_shared/github-raw-url.mts
  - scripts/fleet/gen/coverage-badge.mts
  - scripts/fleet/lib/coverage-badge.mts

Author: jdalton

.config/fleet/pnpm-workspace.fleet.yaml

@@ -106,6 +106,37 @@ export function repoGitHubSlug(repoRoot: string): string | undefined {
   return parseGitHubSlug(readRepositoryField(repoRoot))
 }
 
+/**
+ * Whether this package's README ever reaches a registry page. Only a published
+ * package needs the absolute URL: a `private: true` package is never uploaded,
+ * so its README is read on GitHub alone, where a relative path resolves for
+ * anyone who can see the repo. The absolute form is actively WORSE there — a
+ * private repo's `raw.githubusercontent.com` URL is not served anonymously, so
+ * GitHub's image proxy gets a 404 and renders the badge broken for everyone.
+ * Read from the manifest rather than the repo's GitHub visibility so the answer
+ * needs no network call and is the same locally and in CI.
+ */
+export function isPublishedPackage(repoRoot: string): boolean {
+  const pkgPath = path.join(repoRoot, 'package.json')
+  if (!existsSync(pkgPath)) {
+    // An absent or unreadable manifest is not evidence of a private package.
+    // Answering "published" keeps the caller on the absolute-url path, where an
+    // unresolvable slug is a hard stop; answering "private" would hand back a
+    // relative path and quietly reship the broken registry image.
+    return true
+  }
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(readFileSync(pkgPath, 'utf8'))
+  } catch {
+    return true
+  }
+  if (typeof parsed !== 'object' || parsed === null) {
+    return true
+  }
+  return (parsed as Record<string, unknown>)['private'] !== true
+}
+
 /**
  * The four-ingredient error a generator prints when [`repoGitHubSlug`] comes
  * back undefined. Falling back to a relative path here would reintroduce the

scripts/fleet/_shared/github-raw-url.mts

@@ -36,6 +36,7 @@ import {
 } from '../lib/coverage-badge.mts'
 import { REPO_ROOT } from '../paths.mts'
 import {
+  isPublishedPackage,
   missingGitHubSlugMessage,
   repoGitHubSlug,
 } from '../_shared/github-raw-url.mts'
@@ -79,16 +80,22 @@ export function makeCoverageBadge(config: MakeCoverageBadgeConfig): number {
     )
     return 1
   }
-  // The README ref is an absolute raw-GitHub url, so the badge renders on the
-  // npm package page too — which means the repo slug is a hard requirement, not
-  // a nice-to-have. No relative fallback: it would silently reship the broken
-  // npm image this url exists to fix.
-  const slug = repoGitHubSlug(cfg.repoRoot)
-  if (slug === undefined) {
-    logger.error(
-      `gen/coverage-badge: ${missingGitHubSlugMessage(cfg.repoRoot)}`,
-    )
-    return 1
+  // A published package's README ref is an absolute raw-GitHub url so the badge
+  // renders on the npm package page too, which makes the repo slug a hard
+  // requirement there, not a nice-to-have. No relative fallback: it would
+  // silently reship the broken npm image this url exists to fix. A private
+  // package has no registry page, so it keeps the relative path — the absolute
+  // form would break it, since a private repo's raw url is not served
+  // anonymously.
+  let slug: string | undefined
+  if (isPublishedPackage(cfg.repoRoot)) {
+    slug = repoGitHubSlug(cfg.repoRoot)
+    if (slug === undefined) {
+      logger.error(
+        `gen/coverage-badge: ${missingGitHubSlugMessage(cfg.repoRoot)}`,
+      )
+      return 1
+    }
   }
   const svgPath = badgeAssetPath(cfg.repoRoot)
   const nextSvg = coverageBadgeSvg(pct)

scripts/fleet/gen/coverage-badge.mts

@@ -74,9 +74,16 @@ export function coverageBadgeUrl(slug: string): string {
 
 // The current README reference to the coverage badge — a dimensioned <img> at
 // the badge's absolute raw-GitHub URL for `slug` (e.g. `SocketDev/socket-lib`).
-// Every other spelling is legacy, recognized only to migrate it.
-export function coverageBadgeRef(slug: string, svg: string): string {
-  return badgeImgTag(coverageBadgeUrl(slug), 'Coverage', svg)
+// Every other spelling is legacy, recognized only to migrate it. An `undefined`
+// slug means the package is never published, so it keeps the repo-relative path
+// (see `isPublishedPackage`): there is no registry page to break, and a private
+// repo's raw URL would not resolve.
+export function coverageBadgeRef(
+  slug: string | undefined,
+  svg: string,
+): string {
+  const src = slug === undefined ? BADGE_ASSET_PATH : coverageBadgeUrl(slug)
+  return badgeImgTag(src, 'Coverage', svg)
 }
 
 // The legacy markdown reference, kept for migration matching.
@@ -188,11 +195,12 @@ export function hasUnrecognizedCoverageBadge(readme: string): boolean {
  * legacy pre-badges/ path, the `![]` markdown form, the relative-src `<img>`,
  * AND an absolute `<img>` whose width went stale after a coverage change.
  * Already-current READMEs come back unchanged. `slug` is the repo's
- * `owner/repo`; `svg` supplies the exact width the <img> pins.
+ * `owner/repo`, or `undefined` for a never-published package that keeps the
+ * relative path; `svg` supplies the exact width the <img> pins.
  */
 export function migrateReadmeBadge(
   readme: string,
-  slug: string,
+  slug: string | undefined,
   svg: string,
 ): string {
   const ref = coverageBadgeRef(slug, svg)