react_on_rails 17.0.1 → 17.1.0.rc.0

data/lib/react_on_rails/server_rendering_pool/ruby_embedded_java_script.rb

@@ -3,6 +3,7 @@
 require "open-uri"
 require "execjs"
 require "react_on_rails/length_prefixed_parser"
+require "react_on_rails/lenient_json"
 
 module ReactOnRails
   module ServerRenderingPool
@@ -148,15 +149,31 @@ module ReactOnRails
 
         def read_bundle_js_code
           server_js_file = ReactOnRails::Utils.server_bundle_js_file_path
-          if ReactOnRails::Utils.server_bundle_path_is_http?
+          server_bundle_path_is_http = ReactOnRails::Utils.server_bundle_path_is_http?
+          if server_bundle_path_is_http
             file_url_to_string(server_js_file)
           else
             File.read(server_js_file)
           end
         rescue StandardError => e
-          msg = "You specified server rendering JS file: #{server_js_file}, but it cannot be " \
-                "read. You may set the server_bundle_js_file in your configuration to be \"\" to " \
-                "avoid this warning.\nError is: #{e}\n\n#{Utils.default_troubleshooting_section}"
+          # Sanitized: server_js_file may be an HTTP(S) URL with embedded basic-auth credentials
+          # (a supported config convenience, e.g. https://:password@host:3800). This is the
+          # public entry point that file_url_to_string is called from, so without this the
+          # sanitization inside file_url_to_string's own raise/rescue is moot for any real
+          # caller — the credential would still leak here regardless. Errors already wrapped by
+          # file_url_to_string have passed through the same message sanitizer; scanning that
+          # wrapper again would treat its diagnostic text as fresh untrusted input. Other errors
+          # are scrubbed here because URI::InvalidURIError embeds the raw URL in its message.
+          sanitized_url = sanitized_renderer_url(server_js_file)
+          sanitized_error = if server_bundle_path_is_http && e.is_a?(ReactOnRails::ServerBundleLoadError)
+                              e.message
+                            else
+                              sanitized_renderer_error_message(e.message, server_js_file, sanitized_url)
+                            end
+          msg = "You specified server rendering JS file: #{sanitized_url}, but it cannot " \
+                "be read. You may set the server_bundle_js_file in your configuration to be \"\" to " \
+                "avoid this warning.\nError is: #{sanitized_error}\n\n" \
+                "#{Utils.default_troubleshooting_section}"
           raise ReactOnRails::ServerBundleLoadError, msg
         end
 
@@ -386,10 +403,80 @@ module ReactOnRails
         # Strips any embedded credentials from a configured renderer URL before it is
         # interpolated into an error message, so a password in the URL (a supported config
         # convenience, e.g. https://:password@host:3800) cannot leak into logs or error
-        # trackers. Mirrors ReactOnRailsPro::Configuration#strip_renderer_url_userinfo.
+        # trackers. One configured value is not free-form prose: multiple schemes or line breaks
+        # after its first scheme make it structurally ambiguous, so that URL suffix fails closed
+        # through its final @. Any non-URL prefix is preserved for useful error context.
         def sanitized_renderer_url(url)
           return url if url.nil? || url.empty?
 
+          scheme = url.match(%r{https?://}i)
+          return url unless scheme
+
+          prefix = url[...scheme.begin(0)]
+          configured_url = url[scheme.begin(0)..]
+          sanitized_url = if configured_url.match?(/[\r\n]/) || configured_url.scan(%r{https?://}i).length > 1
+                            strip_malformed_url_userinfo(configured_url)
+                          else
+                            sanitized_valid_http_url(configured_url) || strip_malformed_url_userinfo(configured_url)
+                          end
+
+          "#{prefix}#{sanitized_url}"
+        end
+
+        def sanitized_renderer_error_message(message, raw_url, sanitized_url = sanitized_renderer_url(raw_url))
+          message = message.to_s
+          return strip_userinfo(message) if raw_url.nil? || raw_url.empty?
+
+          # URI::InvalidURIError embeds String#inspect, while other errors may embed the raw value.
+          message = message.gsub(raw_url.inspect) { sanitized_url.inspect }
+                           .gsub(raw_url) { sanitized_url }
+          strip_userinfo(message)
+        end
+
+        # Protects successfully parsed bare HTTP(S) tokens by assembling the result from spans,
+        # without collision-prone placeholder text. A candidate remains unprotected when any @
+        # follows it before the next scheme: punctuation, prose, and line breaks are not structural
+        # proof that the @ is unrelated to malformed userinfo. When an unresolved region precedes
+        # a credential-bearing candidate, that region is discarded and the candidate is sanitized
+        # independently rather than allowing one fallback match to consume through another scheme.
+        # Ambiguous text may be over-redacted for safety.
+        def strip_userinfo(text)
+          text = text.to_s
+          sanitized = text.dup.clear
+          unprotected_start = 0
+
+          text.to_enum(:scan, %r{https?://(?:(?!https?://)[^\s"'])+}i).each do
+            match = Regexp.last_match
+            protected_url = sanitized_valid_http_url(match[0])
+            next unless protected_url
+            next if userinfo_delimiter_before_next_scheme?(text, match)
+
+            unprotected = text[unprotected_start...match.begin(0)]
+            sanitized << sanitized_unprotected_prefix(unprotected, match[0], protected_url)
+            sanitized << protected_url
+            unprotected_start = match.end(0)
+          end
+
+          sanitized << strip_unprotected_userinfo(text[unprotected_start..])
+        end
+
+        def userinfo_delimiter_before_next_scheme?(text, match)
+          continuation = text[match.end(0)..]
+          boundary = continuation.match(%r{https?://}i)
+          continuation = continuation[...boundary.begin(0)] if boundary
+          continuation.include?("@")
+        end
+
+        def sanitized_unprotected_prefix(text, raw_url, sanitized_url)
+          unresolved_scheme = text.match(%r{https?://}i)
+          return strip_unprotected_userinfo(text) if raw_url == sanitized_url || unresolved_scheme.nil?
+
+          text[...unresolved_scheme.begin(0)]
+        end
+
+        # URI handles valid URLs structurally, so an @ in the path is never mistaken for userinfo.
+        # Returning nil for invalid input keeps that token unprotected for the fail-closed pass.
+        def sanitized_valid_http_url(url)
           uri = URI.parse(url)
           return url if uri.userinfo.nil?
 
@@ -397,30 +484,96 @@ module ReactOnRails
           uri.password = nil
           uri.user = nil
           uri.to_s
-        rescue URI::InvalidURIError
-          # Best-effort strip of the common user:pass@ form so a URL that URI rejects as
-          # malformed still doesn't leak a password into the message or logs.
-          url.to_s.gsub(%r{//[^/@]*@}, "//")
+        rescue URI::Error
+          nil
+        end
+
+        def strip_unprotected_userinfo(text)
+          text.gsub(%r{https?://(?:(?!https?://).)*@}im) { |span| strip_malformed_url_userinfo(span) }
+        end
+
+        # For malformed URLs or unprotected scheme-delimited spans, remove through the last @. The
+        # retained suffix is best-effort context; ambiguous malformed diagnostics may lose text.
+        def strip_malformed_url_userinfo(url)
+          scheme = url.match(%r{\Ahttps?://}i)
+          userinfo_delimiter = url.rindex("@")
+          return url unless scheme && userinfo_delimiter
+
+          "#{url[...scheme.end(0)]}#{url[(userinfo_delimiter + 1)..]}"
         end
 
         def file_url_to_string(url)
           response = Net::HTTP.get_response(URI.parse(url))
-          content_type_header = response["content-type"]
-          match = content_type_header.match(/\A.*; charset=(?<encoding>.*)\z/)
-          encoding_type = match[:encoding]
-          response.body.force_encoding(encoding_type)
+          unless response.is_a?(Net::HTTPSuccess)
+            raise "GET #{sanitized_renderer_url(url)} returned a non-success HTTP status: " \
+                  "#{response.code} #{response.message}"
+          end
+
+          # Label the bytes with the declared charset, then transcode to UTF-8: ExecJS's
+          # underlying JS runtime parses source as UTF-8, so a body merely *tagged* with its
+          # declared encoding (e.g. ISO-8859-1) rather than actually converted would have its
+          # non-ASCII bytes silently corrupted once the runtime re-interprets them as UTF-8.
+          #
+          # String#encode is a no-op — it does NOT validate — when the source encoding already
+          # equals the destination (UTF-8). charset_from_content_type returns UTF-8 for three of
+          # the four cases this method exists to handle (no Content-Type header, no charset
+          # parameter, and an explicit charset=utf-8), so `.encode(Encoding::UTF_8)` alone would
+          # silently let invalid bytes through unchanged on those three paths — only a genuine
+          # cross-encoding transcode (e.g. a declared ISO-8859-1 body) actually validates via
+          # `encode`. valid_encoding? is therefore checked explicitly afterward so every path
+          # fails fast, not just the cross-encoding one.
+          #
+          # An undecodable byte sequence (a charset that doesn't actually match the bytes) is
+          # deliberately raised here rather than silently replaced with U+FFFD: this is source
+          # code, and replacing corrupt bytes would produce a bundle that parses but behaves
+          # wrongly, which is harder to diagnose than a clear load failure naming the URL.
+          decoded = response.body.dup
+                            .force_encoding(charset_from_content_type(response["content-type"]))
+                            .encode(Encoding::UTF_8)
+          unless decoded.valid_encoding?
+            raise "response body is not valid UTF-8 after decoding from the declared charset " \
+                  "(GET #{sanitized_renderer_url(url)})"
+          end
+
+          decoded
         rescue StandardError => e
-          msg = "file_url_to_string #{url} failed\nError is: #{e}\n\n#{Utils.default_troubleshooting_section}"
+          # Sanitized here too: a non-2xx response (e.g. 401/403 from a bad-credentials config) is
+          # exactly the failure mode that would otherwise put a URL's embedded password into this
+          # message, which Rails.logger and error trackers can persist. e.message is scrubbed as
+          # well as url itself: a URL malformed enough that URI.parse raises embeds the raw,
+          # unsanitized URL verbatim in URI::InvalidURIError's own message.
+          sanitized_url = sanitized_renderer_url(url)
+          sanitized_error = sanitized_renderer_error_message(e.message, url, sanitized_url)
+          msg = "file_url_to_string #{sanitized_url} failed\nError is: " \
+                "#{sanitized_error}\n\n#{Utils.default_troubleshooting_section}"
           raise ReactOnRails::ServerBundleLoadError, msg
         end
 
+        # Extracts the charset from a Content-Type header value (e.g. "application/javascript;
+        # charset=utf-8"), tolerating a quoted charset value (`charset="UTF-8"`, valid per RFC
+        # 7231's quoted-string parameter syntax) and additional parameters after it (e.g.
+        # `charset=utf-8; boundary=...`). Falls back to UTF-8 — the standard default for
+        # JavaScript/JSON source — when the header is missing, has no charset parameter, or
+        # names an encoding Ruby does not recognize, rather than raising on an absent or
+        # malformed charset. See issue #4584.
+        def charset_from_content_type(content_type_header)
+          match = content_type_header.to_s.match(/;\s*charset=(?<encoding>[^;]+)/i)
+          return Encoding::UTF_8 unless match
+
+          charset = match[:encoding].strip.delete_prefix('"').delete_suffix('"')
+          Encoding.find(charset)
+        rescue ArgumentError
+          Encoding::UTF_8
+        end
+
         def parse_render_result(result_string, render_options)
           # Auto-detect format: length-prefixed (contains tab) or legacy JSON.
           # ExecJS with older bundles may return JSON; node renderer returns length-prefixed.
           result = if result_string.to_s.include?("\t")
                      ReactOnRails::LengthPrefixedParser.parse_one_chunk_result(result_string)
                    else
-                     JSON.parse(result_string.to_s)
+                     # LenientJson repairs lone-surrogate escapes the JS renderer can emit (#4710).
+                     ReactOnRails::LenientJson.parse(result_string.to_s)
                    end
           replay_console_to_rails_logger(result, render_options)
           result

data/lib/react_on_rails/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ReactOnRails
-  VERSION = "17.0.1"
+  VERSION = "17.1.0.rc.0"
 end

data/lib/tasks/agent_guardrails.rake

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require "react_on_rails/agent_guardrails"
+
+namespace :react_on_rails do
+  desc "Install/update the RSC agent-guardrail skill + advisory hook into this app's .claude/ " \
+       "(steers AI coding agents away from React Server Components API footguns; idempotent)"
+  task :install_rsc_agent_guardrails do
+    root = ReactOnRails::AgentGuardrails.default_destination_root(ENV.fetch("DESTINATION", nil))
+    actions = ReactOnRails::AgentGuardrails.install(root)
+
+    puts "React on Rails: RSC agent guardrails -> #{File.join(root, '.claude')}"
+    actions.each { |action| puts "  #{action}" }
+    puts ""
+    puts "The rsc-app-safety skill and its advisory hook are now active for Claude Code in this app."
+    puts "Re-run this task after upgrading React on Rails to pick up guardrail updates; managed files are replaced."
+  rescue ReactOnRails::AgentGuardrails::Error, SystemCallError => e
+    warn "React on Rails: #{e.message}"
+    exit 1
+  end
+end

data/rakelib/run_rspec.rake

@@ -57,6 +57,20 @@ namespace :run_rspec do
                  env_vars: rbs_runtime_env_vars)
   end
 
+  desc "Run gem unit specs without generator specs"
+  task :gem_unit do
+    run_tests_in("",
+                 rspec_args: "#{File.join('spec', 'react_on_rails')} --exclude-pattern '**/generators/**'",
+                 env_vars: rbs_runtime_env_vars)
+  end
+
+  desc "Run gem generator specs"
+  task :gem_generators do
+    run_tests_in("",
+                 rspec_args: File.join("spec", "react_on_rails", "generators"),
+                 env_vars: rbs_runtime_env_vars)
+  end
+
   desc "Runs dummy rspec with turbolinks"
   task dummy: ["dummy_apps:dummy_app"] do
     run_tests_in(spec_dummy_dir,

data/sig/react_on_rails/prerender_error.rbs

@@ -1,6 +1,7 @@
 module ReactOnRails
   class PrerenderError < ::ReactOnRails::Error
-    MAX_ERROR_SNIPPET_TO_LOG: Integer
+    REDACTED_VALUE: String
+    SENSITIVE_CONTEXT_KEYS: Array[String]
 
     attr_reader component_name: String?
     attr_reader err: StandardError?

data/skills/doctor-fix-loop/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: doctor-fix-loop
+description: >
+  Use when diagnosing a React on Rails app with the stable doctor JSON contract and
+  iterating through actionable remediation until no error-level checks remain.
+---
+
+# Run the doctor fix loop
+
+Read the [version-matched package guide](../../docs/agent/doctor-fix-loop.md), then run:
+
+```bash
+bin/rails react_on_rails:doctor FORMAT=json
+```
+
+1. Parse standard output as one JSON document; treat incidental standard-error output as diagnostics.
+2. Process non-passing checks in array order using their stable `id`, `severity`, `message`,
+   `remediation.prompt`, `remediation.files`, and `remediation.expected_end_state` fields.
+3. Inspect the named files and verify the diagnosis before editing. Do not invent a broad automatic
+   fix from a check ID, and do not treat a nullable `fix_command` as required.
+4. Make the smallest correction, review its diff, and rerun the doctor.
+5. Continue until the report has no error-level checks. Warnings are advisory but should be reported.
+6. Run the focused build or test that exercises each repaired subsystem.
+
+The hosted JSON contract is a secondary reference:
+https://reactonrails.com/docs/api-reference/doctor.

data/skills/install-and-upgrade/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: install-and-upgrade
+description: >
+  Use when installing React on Rails into an existing Rails app or upgrading its
+  gem, npm package, generated configuration, and lockfiles without version skew.
+---
+
+# Install or upgrade React on Rails
+
+Read the [version-matched package guide](../../docs/agent/install-and-upgrade.md)
+before editing dependencies or generated files.
+
+1. Inspect the Rails, Ruby, Node, Shakapacker, gem, npm package, and lockfile state.
+2. Keep the `react_on_rails` gem and `react-on-rails` npm package on the same release.
+   For Pro apps, update the Pro gem and JavaScript packages as one coordinated set.
+3. Use the app's declared JavaScript package manager and update both Ruby and JavaScript lockfiles.
+4. Run the install generator for a new integration. During an upgrade, review its proposed changes
+   against app-owned configuration instead of overwriting custom files blindly.
+5. Run `bin/rails react_on_rails:doctor FORMAT=json`, resolve every error, and rerun it.
+6. Compile assets and run the app's focused tests before calling the change complete.
+
+Use hosted docs only for additional detail after reading the installed guide:
+https://reactonrails.com/docs/getting-started/existing-rails-app and
+https://reactonrails.com/docs/upgrading/upgrading-react-on-rails.

data/skills/rsc-adoption/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: rsc-adoption
+description: >
+  Use when adopting React Server Components in a React on Rails Pro app, including
+  prerequisites, generator setup, component boundaries, data flow, and safety checks.
+---
+
+# Adopt React Server Components (Pro)
+
+React Server Components are a React on Rails Pro workflow. Read the
+[version-matched package guide](../../docs/agent/rsc-adoption.md) before changing setup.
+
+1. Confirm the app uses the Pro gem and matching Pro npm packages, the Node renderer,
+   and compatible React, React DOM, and RSC package releases.
+2. Preserve the app's language on the supported setup path: use
+   `bundle exec rails generate react_on_rails:rsc --typescript` for TypeScript apps and
+   `bundle exec rails generate react_on_rails:rsc` for JavaScript apps. Review every generated change.
+3. Treat the `'use client'` directive as the RSC boundary. Do not confuse it with
+   `.client.` and `.server.` filename suffixes, which control bundle placement.
+4. Keep Rails-owned data, authentication, authorization, and caching on the Rails side;
+   pass data through props or async props rather than assuming server components can
+   access Rails process state.
+5. Run `bundle exec rake react_on_rails:install_rsc_agent_guardrails` and review payload
+   route authorization, renderer isolation, secret handling, and serialized output.
+6. Run the JSON doctor, build all required bundles, and exercise the RSC route in a browser.
+
+Hosted RSC docs are a secondary reference:
+https://reactonrails.com/docs/pro/react-server-components.

data/skills/streaming-debug/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: streaming-debug
+description: >
+  Use when a React on Rails Pro streaming SSR or async-props response buffers,
+  stalls, fails to reveal Suspense content, or behaves differently behind a proxy.
+---
+
+# Debug streaming SSR (Pro)
+
+Streaming SSR is a React on Rails Pro workflow. Read the
+[version-matched package guide](../../docs/agent/streaming-debug.md) before changing code.
+
+1. Run `bin/rails react_on_rails:doctor FORMAT=json` and fix setup errors first.
+2. Identify the exact helper before applying streaming prerequisites.
+
+## Progressive helpers
+
+For `stream_react_component`, `cached_stream_react_component`, and
+`stream_react_component_with_async_props`:
+
+1. Confirm the controller includes `ReactOnRailsPro::Stream`, the action calls
+   `stream_view_containing_react_components`, and the Node renderer is healthy.
+2. When Suspense content should reveal progressively, confirm the boundary's child actually suspends.
+3. For `stream_react_component_with_async_props` only, confirm
+   `ReactOnRailsPro.configuration.enable_rsc_support` is enabled by setting
+   `config.enable_rsc_support = true` in the Pro initializer.
+   This is not a prerequisite for `stream_react_component` or `cached_stream_react_component`.
+4. For async props, keep slow work inside the streaming block, emit JSON-serializable values,
+   and ensure every requested prop is emitted or rejected.
+
+## Buffered helpers
+
+For `buffered_stream_react_component`, `cached_buffered_stream_react_component`, and
+`cached_static_rsc_component`:
+
+1. Confirm the Node renderer is healthy and inspect the complete buffered result.
+2. These helpers do not require the streaming controller wrapper: they do not require
+   `ReactOnRailsPro::Stream`, `stream_view_containing_react_components`, or a suspending boundary.
+3. For `cached_static_rsc_component`, set `config.enable_rsc_support = true`; disabling RSC support
+   omits the RSC payload generation that gives this helper its static-RSC behavior.
+   This setting is not a prerequisite for `buffered_stream_react_component` or
+   `cached_buffered_stream_react_component`.
+4. Do not expect early shell flush or progressive Suspense reveal from a buffered helper.
+
+## Debug either path
+
+1. Observe the response with an unbuffered client and compare origin behavior with the proxy/CDN path.
+   Check compression and buffering configuration before changing React code.
+2. Correlate Rails logs, Node renderer logs, response chunks, and browser timing marks; fix one
+   demonstrated boundary at a time and rerun the same probe.
+
+Hosted streaming docs are a secondary reference:
+https://reactonrails.com/docs/pro/streaming-ssr.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: react_on_rails
 version: !ruby/object:Gem::Version
-  version: 17.0.1
+  version: 17.1.0.rc.0
 platform: ruby
 authors:
 - Justin Gordon
@@ -122,6 +122,11 @@ files:
 - Rakefile
 - Steepfile
 - app/helpers/react_on_rails_helper.rb
+- docs/agent/README.md
+- docs/agent/doctor-fix-loop.md
+- docs/agent/install-and-upgrade.md
+- docs/agent/rsc-adoption.md
+- docs/agent/streaming-debug.md
 - lib/generators/USAGE
 - lib/generators/react_on_rails/USAGE
 - lib/generators/react_on_rails/base_generator.rb
@@ -153,9 +158,9 @@ files:
 - lib/generators/react_on_rails/templates/base/base/.dev-services.yml.example
 - lib/generators/react_on_rails/templates/base/base/.env.example
 - lib/generators/react_on_rails/templates/base/base/.github/workflows/ci.yml.tt
-- lib/generators/react_on_rails/templates/base/base/Procfile.dev
 - lib/generators/react_on_rails/templates/base/base/Procfile.dev-prod-assets
-- lib/generators/react_on_rails/templates/base/base/Procfile.dev-static-assets
+- lib/generators/react_on_rails/templates/base/base/Procfile.dev-static-assets.tt
+- lib/generators/react_on_rails/templates/base/base/Procfile.dev.tt
 - lib/generators/react_on_rails/templates/base/base/app/controllers/hello_world_controller.rb
 - lib/generators/react_on_rails/templates/base/base/app/controllers/home_controller.rb
 - lib/generators/react_on_rails/templates/base/base/app/javascript/bundles/HelloWorld/components/HelloWorld.jsx
@@ -173,7 +178,6 @@ files:
 - lib/generators/react_on_rails/templates/base/base/babel.config.js.tt
 - lib/generators/react_on_rails/templates/base/base/bin/dev
 - lib/generators/react_on_rails/templates/base/base/bin/shakapacker-precompile-hook
-- lib/generators/react_on_rails/templates/base/base/bin/shakapacker-watch
 - lib/generators/react_on_rails/templates/base/base/bin/switch-bundler
 - lib/generators/react_on_rails/templates/base/base/config/initializers/react_on_rails.rb.tt
 - lib/generators/react_on_rails/templates/base/base/config/shakapacker.yml.tt
@@ -231,6 +235,9 @@ files:
 - lib/generators/react_on_rails/templates/rsc/base/app/views/hello_server/index.html.erb.tt
 - lib/generators/react_on_rails/templates/rsc/base/config/webpack/rscWebpackConfig.js.tt
 - lib/react_on_rails.rb
+- lib/react_on_rails/agent_guardrails.rb
+- lib/react_on_rails/agent_guardrails/templates/rsc_app_safety_check.rb
+- lib/react_on_rails/agent_guardrails/templates/rsc_app_safety_skill.md
 - lib/react_on_rails/config_path_resolver.rb
 - lib/react_on_rails/configuration.rb
 - lib/react_on_rails/controller.rb
@@ -245,6 +252,7 @@ files:
 - lib/react_on_rails/dev/server_mode.rb
 - lib/react_on_rails/dev/service_checker.rb
 - lib/react_on_rails/doctor.rb
+- lib/react_on_rails/doctor_schema.rb
 - lib/react_on_rails/engine.rb
 - lib/react_on_rails/error.rb
 - lib/react_on_rails/font_helper.rb
@@ -253,6 +261,7 @@ files:
 - lib/react_on_rails/json_output.rb
 - lib/react_on_rails/json_parse_error.rb
 - lib/react_on_rails/length_prefixed_parser.rb
+- lib/react_on_rails/lenient_json.rb
 - lib/react_on_rails/locales/base.rb
 - lib/react_on_rails/locales/to_js.rb
 - lib/react_on_rails/locales/to_json.rb
@@ -282,6 +291,7 @@ files:
 - lib/react_on_rails/version_checker.rb
 - lib/react_on_rails/version_synchronizer.rb
 - lib/react_on_rails/version_syntax_converter.rb
+- lib/tasks/agent_guardrails.rake
 - lib/tasks/assets.rake
 - lib/tasks/doctor.rake
 - lib/tasks/generate_packs.rake
@@ -327,6 +337,10 @@ files:
 - sig/react_on_rails/typescript_response_types/generated_file_writer.rbs
 - sig/react_on_rails/utils.rbs
 - sig/react_on_rails/version_checker.rbs
+- skills/doctor-fix-loop/SKILL.md
+- skills/install-and-upgrade/SKILL.md
+- skills/rsc-adoption/SKILL.md
+- skills/streaming-debug/SKILL.md
 homepage: https://reactonrails.com/docs/
 licenses:
 - MIT

data/lib/generators/react_on_rails/templates/base/base/bin/shakapacker-watch

@@ -1,26 +0,0 @@
-#!/usr/bin/env sh
-set -eu
-
-child_pid=""
-
-cleanup() {
-  if [ -n "${child_pid}" ] && kill -0 "$child_pid" 2>/dev/null; then
-    kill -TERM "$child_pid" 2>/dev/null || true
-    wait "$child_pid" 2>/dev/null || true
-  fi
-
-  exit 0
-}
-
-bin/shakapacker "$@" &
-child_pid=$!
-trap cleanup INT TERM
-
-if wait "$child_pid"; then
-  status=0
-else
-  status=$?
-fi
-
-child_pid=""
-exit "$status"