fix: scope RSC client reference discovery

CHANGELOG.md

@@ -78,6 +78,7 @@ After a release, run `/update-changelog` in Claude Code to analyze commits, writ
 - **`bin/dev` now cleans copied runtime files before startup**: When you duplicate an app directory to run another local dev stack, `bin/dev` now removes copied stale Overmind sockets and stale `tmp/pids/server.pid` files that point to a Puma process running from another app directory. This prevents false startup failures in copied workspaces while still preserving active local sockets and pid files for the current app. [PR 3142](https://github.com/shakacode/react_on_rails/pull/3142) by [justin808](https://github.com/justin808).
 - **`bin/dev kill` is more thorough and Pro-aware under base-port mode**: `ServerManager.kill_processes` no longer short-circuits after the first successful step — pattern-based kills, port-based kills, and socket/pid cleanup all run unconditionally so a stale renderer port-binding or socket file cannot survive a `bin/dev kill`. In base-port mode, the derived renderer port (`base+2`) is now always included in port-based killing when `react_on_rails_pro` is loaded, even if `RENDERER_PORT` / `REACT_RENDERER_URL` are unset in the current shell (an informational message is printed so the wider scan is not silent). `ProcessManager` also now preserves the legacy `RENDERER_URL` env var alongside `REACT_RENDERER_URL` across Bundler's env reset so mid-migration users keep a consistent renderer URL in spawned subprocesses. [PR 3274](https://github.com/shakacode/react_on_rails/pull/3274) by [justin808](https://github.com/justin808).
 - **CI change detection handles shallow clones with long-lived branches**: `script/ci-changes-detector` and `script/check-docs-sidebar` now resolve an actual merge base before diffing, deepening shallow `origin/main` and current-branch history as needed. `ci-changes-detector` now fails visibly when it cannot compute a safe diff instead of treating git failures as no changes. Fixes [Issue 3108](https://github.com/shakacode/react_on_rails/issues/3108). [PR 3224](https://github.com/shakacode/react_on_rails/pull/3224) by [justin808](https://github.com/justin808).
+- **[Pro]** **RSC setup now scopes client-reference discovery to app source**: Generated RSC webpack configs now pass `clientReferences` based on Shakapacker's `source_path`, avoiding CI failures where the plugin could scan vendored gem templates under `vendor/bundle`. Fixes [Issue 3201](https://github.com/shakacode/react_on_rails/issues/3201). [PR 3219](https://github.com/shakacode/react_on_rails/pull/3219) by [justin808](https://github.com/justin808).
 - **[Pro]** **Node renderer now exposes `performance` when `supportModules: true`**: React 19's development build of `React.lazy` calls `performance.now()`, which previously threw `ReferenceError: performance is not defined` inside the node renderer's VM context unless users manually added `performance` via `additionalContext`. `performance` is now included in the default globals alongside `Buffer`, `process`, etc. Fixes [Issue 3154](https://github.com/shakacode/react_on_rails/issues/3154). [PR 3158](https://github.com/shakacode/react_on_rails/pull/3158) by [justin808](https://github.com/justin808).
 - **Scaffolded CI workflow pins a pnpm version when `packageManager` is absent**: The generated `.github/workflows/ci.yml` now emits `with: version:` for `pnpm/action-setup@v4` when pnpm is detected from `pnpm-lock.yaml` alone, preventing the setup step from failing before dependency install. When `packageManager` is declared in `package.json`, the version key is omitted so the action reads the pin from there. Note: `GeneratorMessages.detect_package_manager(package_json: nil)` now treats `nil` as "caller cached that the file is absent" and skips disk fallback, instead of re-reading `package.json`; the previous fallthrough behavior is now the default (omit the keyword) and is documented on `read_package_json`. Fixes [Issue 3172](https://github.com/shakacode/react_on_rails/issues/3172). [PR 3174](https://github.com/shakacode/react_on_rails/pull/3174) by [justin808](https://github.com/justin808).
 - **Client startup now recovers if initialization begins during `interactive` after `DOMContentLoaded` already fired**: React on Rails now still initializes the page when the client bundle starts in the browser timing window after `DOMContentLoaded` but before the document reaches `complete`. Fixes [Issue 3150](https://github.com/shakacode/react_on_rails/issues/3150). [PR 3151](https://github.com/shakacode/react_on_rails/pull/3151) by [ihabadham](https://github.com/ihabadham).

docs/oss/migrating/rsc-preparing-app.md

@@ -265,7 +265,11 @@ module.exports = {
 };
 ```
 
-> **`clientReferences`**: If omitted, the plugin defaults to scanning the entire project root recursively (`{ directory: ".", recursive: true, include: /\.(js|ts|jsx|tsx)$/ }`), which works but is slow on large codebases. Setting `directory` to your app's source directory (e.g., `'./client/app'`) limits the scan to only the files that could contain `'use client'` directives.
+> **`clientReferences`**: Always point this at your application source directory. If omitted, the plugin defaults to scanning the entire project root recursively (`{ directory: ".", recursive: true, include: /\.(js|ts|jsx|tsx)$/ }`). That can accidentally discover vendored gem templates under paths such as `vendor/bundle` in CI and make webpack compile files that are not part of your app. Setting `directory` to your app's source directory (e.g., `'./client/app'`) limits the scan to only the files that could contain `'use client'` directives.
+
+> **Generator note (CommonJS only):** The `rails generate react_on_rails:rsc` migration only rewrites webpack configs that use CommonJS (`require`-style) imports. If your config has been converted to ESM (`import`/`export`) syntax, the generator emits an "expected webpack import anchor was not found" warning and you must add `clientReferences` manually as shown above.
+
+> **Upgrade note for apps already on RSC:** `verify_rsc_webpack_transforms` (and the `rails generate react_on_rails:rsc` doctor check) now requires that `RSCWebpackPlugin` be invoked with `clientReferences: rscClientReferences` pointing at `resolve(config.source_path)`. Existing apps that have the plugin without a scoped `clientReferences` option were previously passing verification and will now report `"generated scoped clientReferences in {client,server}WebpackConfig.js"` as a missing transform. To remediate, either (a) re-run `rails generate react_on_rails:rsc` and accept the in-place migration, or (b) manually add the helper and option as shown above — declare `const rscClientReferences = { directory: resolve(config.source_path), recursive: true, include: /\.(js|mjs|cjs|ts|mts|cts|jsx|tsx)$/ };` at module scope and pass `clientReferences: rscClientReferences` into every `RSCWebpackPlugin` invocation.
 
 ### 4c. Add RSCWebpackPlugin to the client webpack config