From 4ee772e46a832b04582fe242895d002d96d044c5 Mon Sep 17 00:00:00 2001
From: Justin Gordon <justin@shakacode.com>
Date: Sat, 20 Sep 2025 22:02:34 -1000
Subject: [PATCH 01/30] Fix server bundle path resolution in test environments
 (#1797)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Fix fallback logic when manifest lookup fails to check multiple locations
- Try environment-specific path, standard location (public/packs), then generated assets path
- Return first path where bundle file actually exists
- Maintains backward compatibility with original behavior as final fallback
- Add comprehensive test cases to prevent regression

Fixes issue where server rendering failed in test environments when bundles
were in standard Shakapacker location but manifest lookup pointed to
environment-specific directory.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 lib/react_on_rails/utils.rb       | 22 +++++++++--
 spec/react_on_rails/utils_spec.rb | 62 +++++++++++++++++++++++++++++++
 2 files changed, 80 insertions(+), 4 deletions(-)

diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index 1f148188d..01e7c6681 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -90,10 +90,24 @@ def self.bundle_js_file_path(bundle_name)
         begin
           ReactOnRails::PackerUtils.bundle_js_uri_from_packer(bundle_name)
         rescue Shakapacker::Manifest::MissingEntryError
-          File.expand_path(
-            File.join(ReactOnRails::PackerUtils.packer_public_output_path,
-                      bundle_name)
-          )
+          # When manifest lookup fails, try multiple fallback locations:
+          # 1. Environment-specific path (e.g., public/webpack/test)
+          # 2. Standard Shakapacker location (public/packs)
+          # 3. Generated assets path (for legacy setups)
+          fallback_locations = [
+            File.join(ReactOnRails::PackerUtils.packer_public_output_path, bundle_name),
+            File.join("public", "packs", bundle_name),
+            File.join(generated_assets_full_path, bundle_name)
+          ].uniq
+
+          # Return the first location where the bundle file actually exists
+          fallback_locations.each do |path|
+            expanded_path = File.expand_path(path)
+            return expanded_path if File.exist?(expanded_path)
+          end
+
+          # If none exist, return the environment-specific path (original behavior)
+          File.expand_path(fallback_locations.first)
         end
       end
     end
diff --git a/spec/react_on_rails/utils_spec.rb b/spec/react_on_rails/utils_spec.rb
index dae9850b8..628ee243c 100644
--- a/spec/react_on_rails/utils_spec.rb
+++ b/spec/react_on_rails/utils_spec.rb
@@ -117,6 +117,32 @@ def mock_dev_server_running
 
               it { is_expected.to eq("#{packer_public_output_path}/manifest.json") }
             end
+
+            context "when file not in manifest and fallback to standard location" do
+              before do
+                mock_missing_manifest_entry("webpack-bundle.js")
+              end
+
+              let(:standard_path) { File.expand_path(File.join("public", "packs", "webpack-bundle.js")) }
+              let(:env_specific_path) { File.join(packer_public_output_path, "webpack-bundle.js") }
+
+              it "returns standard path when bundle exists there" do
+                allow(File).to receive(:exist?).and_call_original
+                allow(File).to receive(:exist?).with(File.expand_path(env_specific_path)).and_return(false)
+                allow(File).to receive(:exist?).with(standard_path).and_return(true)
+
+                result = described_class.bundle_js_file_path("webpack-bundle.js")
+                expect(result).to eq(standard_path)
+              end
+
+              it "returns environment-specific path when no bundle exists anywhere" do
+                allow(File).to receive(:exist?).and_call_original
+                allow(File).to receive(:exist?).and_return(false)
+
+                result = described_class.bundle_js_file_path("webpack-bundle.js")
+                expect(result).to eq(File.expand_path(env_specific_path))
+              end
+            end
           end
         end
       end
@@ -166,6 +192,42 @@ def mock_dev_server_running
 
               expect(path).to end_with("public/webpack/development/#{server_bundle_name}")
             end
+
+            context "with bundle file existing in standard location but not environment-specific location" do
+              it "returns the standard location path" do
+                server_bundle_name = "server-bundle.js"
+                mock_bundle_configs(server_bundle_name: server_bundle_name)
+                mock_missing_manifest_entry(server_bundle_name)
+
+                # Mock File.exist? to return false for environment-specific path but true for standard path
+                standard_path = File.expand_path(File.join("public", "packs", server_bundle_name))
+                env_specific_path = File.join(packer_public_output_path, server_bundle_name)
+
+                allow(File).to receive(:exist?).and_call_original
+                allow(File).to receive(:exist?).with(File.expand_path(env_specific_path)).and_return(false)
+                allow(File).to receive(:exist?).with(standard_path).and_return(true)
+
+                path = described_class.server_bundle_js_file_path
+
+                expect(path).to eq(standard_path)
+              end
+            end
+
+            context "with bundle file not existing in any fallback location" do
+              it "returns the environment-specific path as final fallback" do
+                server_bundle_name = "server-bundle.js"
+                mock_bundle_configs(server_bundle_name: server_bundle_name)
+                mock_missing_manifest_entry(server_bundle_name)
+
+                # Mock File.exist? to return false for all paths
+                allow(File).to receive(:exist?).and_call_original
+                allow(File).to receive(:exist?).and_return(false)
+
+                path = described_class.server_bundle_js_file_path
+
+                expect(path).to end_with("public/webpack/development/#{server_bundle_name}")
+              end
+            end
           end
 
           context "with server file in the manifest, used for client", packer_type.to_sym do

From 9e1465abb2f459b2b356ab90c8be72419c7e2483 Mon Sep 17 00:00:00 2001
From: Justin Gordon <justin@shakacode.com>
Date: Sat, 20 Sep 2025 22:32:51 -1000
Subject: [PATCH 02/30] Improve bundle path resolution with secure server
 bundle locations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Major improvements to bundle_js_file_path logic:

**Security & Architecture:**
- Server bundles (SSR/RSC) now try secure non-public locations first:
  - ssr-generated/ (primary)
  - generated/server-bundles/ (secondary)
- Client bundles continue using manifest lookup as primary approach
- Prevents exposure of server-side logic in public directories

**Priority Order:**
- SERVER BUNDLES: secure locations → manifest → legacy public locations
- CLIENT BUNDLES: manifest → fallback locations (original behavior)
- Fixed priority order (normal case first, edge cases second)

**Code Quality:**
- Extracted complex method into smaller, focused private methods
- Reduced cyclomatic complexity and improved maintainability
- Added comprehensive test coverage for all scenarios
- Added ssr-generated/ to .gitignore

**Backwards Compatibility:**
- Legacy public locations still work as fallbacks
- Existing client bundle behavior unchanged
- Gradual migration path for server bundles

This addresses the core architectural issue where server bundles were
unnecessarily exposed in public directories while maintaining full
compatibility with existing setups.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .gitignore                        |   3 +
 lib/react_on_rails/utils.rb       | 100 +++++++++++++++++++++---------
 spec/react_on_rails/utils_spec.rb |  78 +++++++++++++++++++++--
 3 files changed, 144 insertions(+), 37 deletions(-)

diff --git a/.gitignore b/.gitignore
index f0178bd96..aac5c06f9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -61,5 +61,8 @@ yalc.lock
 # Generated by ROR FS-based Registry
 generated
 
+# Server-side rendering generated bundles
+ssr-generated
+
 # Claude Code local settings
 .claude/settings.local.json
diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index 01e7c6681..70494fcdf 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -72,46 +72,84 @@ def self.server_bundle_path_is_http?
     end
 
     def self.bundle_js_file_path(bundle_name)
-      # Either:
-      # 1. Using same bundle for both server and client, so server bundle will be hashed in manifest
-      # 2. Using a different bundle (different Webpack config), so file is not hashed, and
-      #    bundle_js_path will throw so the default path is used without a hash.
-      # 3. The third option of having the server bundle hashed and a different configuration than
-      #    the client bundle is not supported for 2 reasons:
-      #    a. The webpack manifest plugin would have a race condition where the same manifest.json
-      #       is edited by both the webpack-dev-server
-      #    b. There is no good reason to hash the server bundle name.
+      # Priority order depends on bundle type:
+      # SERVER BUNDLES (normal case): Try secure non-public locations first, then manifest, then legacy
+      # CLIENT BUNDLES (normal case): Try manifest first, then fallback locations
       if bundle_name == "manifest.json"
         # Default to the non-hashed name in the specified output directory, which, for legacy
         # React on Rails, this is the output directory picked up by the asset pipeline.
         # For Shakapacker, this is the public output path defined in the (shaka/web)packer.yml file.
         File.join(generated_assets_full_path, bundle_name)
       else
-        begin
-          ReactOnRails::PackerUtils.bundle_js_uri_from_packer(bundle_name)
-        rescue Shakapacker::Manifest::MissingEntryError
-          # When manifest lookup fails, try multiple fallback locations:
-          # 1. Environment-specific path (e.g., public/webpack/test)
-          # 2. Standard Shakapacker location (public/packs)
-          # 3. Generated assets path (for legacy setups)
-          fallback_locations = [
-            File.join(ReactOnRails::PackerUtils.packer_public_output_path, bundle_name),
-            File.join("public", "packs", bundle_name),
-            File.join(generated_assets_full_path, bundle_name)
-          ].uniq
-
-          # Return the first location where the bundle file actually exists
-          fallback_locations.each do |path|
-            expanded_path = File.expand_path(path)
-            return expanded_path if File.exist?(expanded_path)
-          end
-
-          # If none exist, return the environment-specific path (original behavior)
-          File.expand_path(fallback_locations.first)
-        end
+        bundle_js_file_path_with_packer(bundle_name)
       end
     end
 
+    def self.bundle_js_file_path_with_packer(bundle_name)
+      is_server_bundle = server_bundle?(bundle_name)
+
+      if is_server_bundle
+        # NORMAL CASE for server bundles: Try secure non-public locations first
+        secure_path = try_secure_server_locations(bundle_name)
+        return secure_path if secure_path
+      end
+
+      # For client bundles OR server bundle fallback: Try manifest lookup
+      begin
+        ReactOnRails::PackerUtils.bundle_js_uri_from_packer(bundle_name)
+      rescue Shakapacker::Manifest::MissingEntryError
+        handle_missing_manifest_entry(bundle_name, is_server_bundle)
+      end
+    end
+
+    def self.server_bundle?(bundle_name)
+      bundle_name == ReactOnRails.configuration.server_bundle_js_file ||
+        bundle_name == ReactOnRails.configuration.rsc_bundle_js_file
+    end
+
+    def self.try_secure_server_locations(bundle_name)
+      secure_server_locations = [
+        File.join("ssr-generated", bundle_name),
+        File.join("generated", "server-bundles", bundle_name)
+      ]
+
+      secure_server_locations.each do |path|
+        expanded_path = File.expand_path(path)
+        return expanded_path if File.exist?(expanded_path)
+      end
+
+      nil
+    end
+
+    def self.handle_missing_manifest_entry(bundle_name, is_server_bundle)
+      # When manifest lookup fails, try multiple fallback locations:
+      # 1. Environment-specific path (e.g., public/webpack/test)
+      # 2. Standard Shakapacker location (public/packs)
+      # 3. Generated assets path (for legacy setups)
+      fallback_locations = [
+        File.join(ReactOnRails::PackerUtils.packer_public_output_path, bundle_name),
+        File.join("public", "packs", bundle_name),
+        File.join(generated_assets_full_path, bundle_name)
+      ].uniq
+
+      # Return the first location where the bundle file actually exists
+      fallback_locations.each do |path|
+        expanded_path = File.expand_path(path)
+        return expanded_path if File.exist?(expanded_path)
+      end
+
+      # If none exist, return appropriate default based on bundle type
+      if is_server_bundle
+        # For server bundles, prefer secure location as final fallback
+        File.expand_path(File.join("ssr-generated", bundle_name))
+      else
+        # For client bundles, use environment-specific path (original behavior)
+        File.expand_path(fallback_locations.first)
+      end
+    end
+    private_class_method :bundle_js_file_path_with_packer, :server_bundle?, :try_secure_server_locations,
+                         :handle_missing_manifest_entry
+
     def self.server_bundle_js_file_path
       return @server_bundle_path if @server_bundle_path && !Rails.env.development?
 
diff --git a/spec/react_on_rails/utils_spec.rb b/spec/react_on_rails/utils_spec.rb
index 628ee243c..ca5c05c69 100644
--- a/spec/react_on_rails/utils_spec.rb
+++ b/spec/react_on_rails/utils_spec.rb
@@ -88,6 +88,14 @@ def mock_dev_server_running
       end
 
       describe ".bundle_js_file_path" do
+        before do
+          # Mock configuration calls to avoid server bundle detection for regular client bundles
+          allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_js_file")
+            .and_return("server-bundle.js")
+          allow(ReactOnRails).to receive_message_chain("configuration.rsc_bundle_js_file")
+            .and_return("rsc-bundle.js")
+        end
+
         subject do
           described_class.bundle_js_file_path("webpack-bundle.js")
         end
@@ -143,6 +151,64 @@ def mock_dev_server_running
                 expect(result).to eq(File.expand_path(env_specific_path))
               end
             end
+
+            context "with server bundle (SSR/RSC) file not in manifest" do
+              let(:server_bundle_name) { "server-bundle.js" }
+              let(:ssr_generated_path) { File.expand_path(File.join("ssr-generated", server_bundle_name)) }
+              let(:generated_server_path) do
+                File.expand_path(File.join("generated", "server-bundles", server_bundle_name))
+              end
+
+              before do
+                mock_missing_manifest_entry(server_bundle_name)
+                allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_js_file")
+                  .and_return(server_bundle_name)
+              end
+
+              it "tries secure locations first for server bundles" do
+                allow(File).to receive(:exist?).and_call_original
+                allow(File).to receive(:exist?).with(ssr_generated_path).and_return(true)
+
+                result = described_class.bundle_js_file_path(server_bundle_name)
+                expect(result).to eq(ssr_generated_path)
+              end
+
+              it "tries generated/server-bundles as second secure location" do
+                allow(File).to receive(:exist?).and_call_original
+                allow(File).to receive(:exist?).with(ssr_generated_path).and_return(false)
+                allow(File).to receive(:exist?).with(generated_server_path).and_return(true)
+
+                result = described_class.bundle_js_file_path(server_bundle_name)
+                expect(result).to eq(generated_server_path)
+              end
+
+              it "falls back to ssr-generated location when no bundle exists anywhere" do
+                allow(File).to receive(:exist?).and_call_original
+                allow(File).to receive(:exist?).and_return(false)
+
+                result = described_class.bundle_js_file_path(server_bundle_name)
+                expect(result).to eq(ssr_generated_path)
+              end
+            end
+
+            context "with RSC bundle file not in manifest" do
+              let(:rsc_bundle_name) { "rsc-bundle.js" }
+              let(:ssr_generated_path) { File.expand_path(File.join("ssr-generated", rsc_bundle_name)) }
+
+              before do
+                mock_missing_manifest_entry(rsc_bundle_name)
+                allow(ReactOnRails).to receive_message_chain("configuration.rsc_bundle_js_file")
+                  .and_return(rsc_bundle_name)
+              end
+
+              it "treats RSC bundles as server bundles and tries secure locations first" do
+                allow(File).to receive(:exist?).and_call_original
+                allow(File).to receive(:exist?).with(ssr_generated_path).and_return(true)
+
+                result = described_class.bundle_js_file_path(rsc_bundle_name)
+                expect(result).to eq(ssr_generated_path)
+              end
+            end
           end
         end
       end
@@ -183,14 +249,14 @@ def mock_dev_server_running
           include_context "with #{packer_type} enabled"
 
           context "with server file not in manifest", packer_type.to_sym do
-            it "returns the unhashed server path" do
+            it "returns the secure ssr-generated path for server bundles" do
               server_bundle_name = "server-bundle.js"
               mock_bundle_configs(server_bundle_name: server_bundle_name)
               mock_missing_manifest_entry(server_bundle_name)
 
               path = described_class.server_bundle_js_file_path
 
-              expect(path).to end_with("public/webpack/development/#{server_bundle_name}")
+              expect(path).to end_with("ssr-generated/#{server_bundle_name}")
             end
 
             context "with bundle file existing in standard location but not environment-specific location" do
@@ -214,7 +280,7 @@ def mock_dev_server_running
             end
 
             context "with bundle file not existing in any fallback location" do
-              it "returns the environment-specific path as final fallback" do
+              it "returns the secure ssr-generated path as final fallback for server bundles" do
                 server_bundle_name = "server-bundle.js"
                 mock_bundle_configs(server_bundle_name: server_bundle_name)
                 mock_missing_manifest_entry(server_bundle_name)
@@ -225,7 +291,7 @@ def mock_dev_server_running
 
                 path = described_class.server_bundle_js_file_path
 
-                expect(path).to end_with("public/webpack/development/#{server_bundle_name}")
+                expect(path).to end_with("ssr-generated/#{server_bundle_name}")
               end
             end
           end
@@ -282,14 +348,14 @@ def mock_dev_server_running
           include_context "with #{packer_type} enabled"
 
           context "with server file not in manifest", packer_type.to_sym do
-            it "returns the unhashed server path" do
+            it "returns the secure ssr-generated path for RSC bundles" do
               server_bundle_name = "rsc-bundle.js"
               mock_bundle_configs(rsc_bundle_name: server_bundle_name)
               mock_missing_manifest_entry(server_bundle_name)
 
               path = described_class.rsc_bundle_js_file_path
 
-              expect(path).to end_with("public/webpack/development/#{server_bundle_name}")
+              expect(path).to end_with("ssr-generated/#{server_bundle_name}")
             end
           end
 

From 7aff6da5993cd2e3e6c968bbb789f8711aff4298 Mon Sep 17 00:00:00 2001
From: Justin Gordon <justin@shakacode.com>
Date: Sun, 21 Sep 2025 13:37:42 -1000
Subject: [PATCH 03/30] Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 lib/react_on_rails/utils.rb | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index 70494fcdf..fdbea7c8d 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -103,8 +103,9 @@ def self.bundle_js_file_path_with_packer(bundle_name)
     end
 
     def self.server_bundle?(bundle_name)
-      bundle_name == ReactOnRails.configuration.server_bundle_js_file ||
-        bundle_name == ReactOnRails.configuration.rsc_bundle_js_file
+      config = ReactOnRails.configuration
+      bundle_name == config.server_bundle_js_file ||
+        bundle_name == config.rsc_bundle_js_file
     end
 
     def self.try_secure_server_locations(bundle_name)

From b0c4963423451cec169dc90de91472fc4ab61d6d Mon Sep 17 00:00:00 2001
From: Justin Gordon <justin@shakacode.com>
Date: Sun, 21 Sep 2025 12:03:14 -1000
Subject: [PATCH 04/30] Update Gemfile.lock and CHANGELOG.md

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 24c079074..3acae4aff 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,6 +23,8 @@ After a release, please make sure to run `bundle exec rake update_changelog`. Th
 
 Changes since the last non-beta release.
 
+### [16.0.1-rc.2] - 2025-09-20
+
 #### Bug Fixes
 
 - **Packs generator**: Fixed error when `server_bundle_js_file` configuration is empty (default). Added safety check to prevent attempting operations on invalid file paths when server-side rendering is not configured. [PR 1802](https://github.com/shakacode/react_on_rails/pull/1802)

From 61a1254c89a581a300a77db929ca36144379429e Mon Sep 17 00:00:00 2001
From: Justin Gordon <justin@shakacode.com>
Date: Sun, 21 Sep 2025 13:41:15 -1000
Subject: [PATCH 05/30] Add configuration options for secure server bundle
 management
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduces two new configuration options to enhance server bundle path
resolution and security:

- server_bundle_output_path: Configurable directory for server bundle output
  (defaults to "ssr-generated")
- enforce_secure_server_bundles: Optional security enforcement for server
  bundle loading (defaults to false for backward compatibility)

These options work in conjunction with the existing bundle path resolution
improvements to provide better organization and security for server-side
rendering assets.

Features:
- Secure server bundle location configuration
- Backward compatibility maintained with sensible defaults
- Comprehensive documentation added to configuration guide
- Full parameter support in Configuration class initialization

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 docs/guides/configuration.md        | 10 ++++++++++
 lib/react_on_rails/configuration.rb | 11 ++++++++---
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/docs/guides/configuration.md b/docs/guides/configuration.md
index 82f673135..c666c0510 100644
--- a/docs/guides/configuration.md
+++ b/docs/guides/configuration.md
@@ -129,6 +129,16 @@ ReactOnRails.configure do |config|
   # This manifest file is automatically generated by the React Server Components Webpack plugin. Only set this if you've configured the plugin to use a different filename.
   config.react_server_client_manifest_file = "react-server-client-manifest.json"
 
+  # Directory where server bundles will be output during build process.
+  # This allows organizing server-side rendering assets separately from client assets.
+  # Default is "ssr-generated"
+  config.server_bundle_output_path = "ssr-generated"
+
+  # When enabled, enforces that server bundles are only loaded from secure, designated locations
+  # to prevent potential security risks from loading untrusted server-side code.
+  # Default is false for backward compatibility.
+  config.enforce_secure_server_bundles = false
+
   # `prerender` means server-side rendering
   # default is false. This is an option for view helpers `render_component` and `render_component_hash`.
   # Set to true to change the default value to true.
diff --git a/lib/react_on_rails/configuration.rb b/lib/react_on_rails/configuration.rb
index d3047a59e..6e1296a1c 100644
--- a/lib/react_on_rails/configuration.rb
+++ b/lib/react_on_rails/configuration.rb
@@ -52,7 +52,9 @@ def self.configuration
       # If exceeded, an error will be thrown for server-side rendered components not registered on the client.
       # Set to 0 to disable the timeout and wait indefinitely for component registration.
       component_registry_timeout: DEFAULT_COMPONENT_REGISTRY_TIMEOUT,
-      generated_component_packs_loading_strategy: nil
+      generated_component_packs_loading_strategy: nil,
+      server_bundle_output_path: "ssr-generated",
+      enforce_secure_server_bundles: false
     )
   end
 
@@ -68,7 +70,8 @@ class Configuration
                   :same_bundle_for_client_and_server, :rendering_props_extension,
                   :make_generated_server_bundle_the_entrypoint,
                   :generated_component_packs_loading_strategy, :immediate_hydration, :rsc_bundle_js_file,
-                  :react_client_manifest_file, :react_server_client_manifest_file, :component_registry_timeout
+                  :react_client_manifest_file, :react_server_client_manifest_file, :component_registry_timeout,
+                  :server_bundle_output_path, :enforce_secure_server_bundles
 
     # rubocop:disable Metrics/AbcSize
     def initialize(node_modules_location: nil, server_bundle_js_file: nil, prerender: nil,
@@ -85,7 +88,7 @@ def initialize(node_modules_location: nil, server_bundle_js_file: nil, prerender
                    random_dom_id: nil, server_render_method: nil, rendering_props_extension: nil,
                    components_subdirectory: nil, auto_load_bundle: nil, immediate_hydration: nil,
                    rsc_bundle_js_file: nil, react_client_manifest_file: nil, react_server_client_manifest_file: nil,
-                   component_registry_timeout: nil)
+                   component_registry_timeout: nil, server_bundle_output_path: nil, enforce_secure_server_bundles: nil)
       self.node_modules_location = node_modules_location.present? ? node_modules_location : Rails.root
       self.generated_assets_dirs = generated_assets_dirs
       self.generated_assets_dir = generated_assets_dir
@@ -130,6 +133,8 @@ def initialize(node_modules_location: nil, server_bundle_js_file: nil, prerender
       self.defer_generated_component_packs = defer_generated_component_packs
       self.immediate_hydration = immediate_hydration
       self.generated_component_packs_loading_strategy = generated_component_packs_loading_strategy
+      self.server_bundle_output_path = server_bundle_output_path
+      self.enforce_secure_server_bundles = enforce_secure_server_bundles
     end
     # rubocop:enable Metrics/AbcSize
 

From d974d82500f74a3ee22a6297a8a8c441ddbf4159 Mon Sep 17 00:00:00 2001
From: Justin Gordon <justin@shakacode.com>
Date: Sun, 21 Sep 2025 17:39:27 -1000
Subject: [PATCH 06/30] Fix breaking change: Set server_bundle_output_path
 default to nil
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Changes default from "ssr-generated" to nil to avoid breaking changes
- Updates documentation to reflect nil default and show example usage
- Feature remains opt-in for backward compatibility
- Can be changed to a sensible default in next major release

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 docs/guides/configuration.md        | 4 ++--
 lib/react_on_rails/configuration.rb | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/guides/configuration.md b/docs/guides/configuration.md
index c666c0510..ca275918e 100644
--- a/docs/guides/configuration.md
+++ b/docs/guides/configuration.md
@@ -131,8 +131,8 @@ ReactOnRails.configure do |config|
 
   # Directory where server bundles will be output during build process.
   # This allows organizing server-side rendering assets separately from client assets.
-  # Default is "ssr-generated"
-  config.server_bundle_output_path = "ssr-generated"
+  # Default is nil (disabled). Set to "ssr-generated" or your preferred directory to enable.
+  # config.server_bundle_output_path = "ssr-generated"
 
   # When enabled, enforces that server bundles are only loaded from secure, designated locations
   # to prevent potential security risks from loading untrusted server-side code.
diff --git a/lib/react_on_rails/configuration.rb b/lib/react_on_rails/configuration.rb
index 6e1296a1c..0b74584e4 100644
--- a/lib/react_on_rails/configuration.rb
+++ b/lib/react_on_rails/configuration.rb
@@ -53,7 +53,7 @@ def self.configuration
       # Set to 0 to disable the timeout and wait indefinitely for component registration.
       component_registry_timeout: DEFAULT_COMPONENT_REGISTRY_TIMEOUT,
       generated_component_packs_loading_strategy: nil,
-      server_bundle_output_path: "ssr-generated",
+      server_bundle_output_path: nil,
       enforce_secure_server_bundles: false
     )
   end

From 60b50d8dd6627e7b5737b918b6cb5d6696508e34 Mon Sep 17 00:00:00 2001
From: Justin Gordon <justin@shakacode.com>
Date: Sun, 21 Sep 2025 21:34:50 -1000
Subject: [PATCH 07/30] Fix CI failures by restoring packer availability check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Restores using_packer? check to handle test scenarios where packer is disabled
- Combines manifest.json check with packer availability in cleaner conditional
- Reverts one inline Packer assignment that breaks when Shakapacker isn't loaded
- Maintains original functionality while keeping code improvements

All failing tests now pass:
- webpack_assets_status_checker_spec.rb (all scenarios)
- utils_spec.rb "without a packer enabled" scenarios

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 lib/react_on_rails/utils.rb                                     | 2 +-
 .../test_helper/webpack_assets_status_checker_spec.rb           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index fdbea7c8d..9fa8e365f 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -75,7 +75,7 @@ def self.bundle_js_file_path(bundle_name)
       # Priority order depends on bundle type:
       # SERVER BUNDLES (normal case): Try secure non-public locations first, then manifest, then legacy
       # CLIENT BUNDLES (normal case): Try manifest first, then fallback locations
-      if bundle_name == "manifest.json"
+      if bundle_name == "manifest.json" || !ReactOnRails::PackerUtils.using_packer?
         # Default to the non-hashed name in the specified output directory, which, for legacy
         # React on Rails, this is the output directory picked up by the asset pipeline.
         # For Shakapacker, this is the public output path defined in the (shaka/web)packer.yml file.
diff --git a/spec/react_on_rails/test_helper/webpack_assets_status_checker_spec.rb b/spec/react_on_rails/test_helper/webpack_assets_status_checker_spec.rb
index 3e48778c9..48f748f45 100644
--- a/spec/react_on_rails/test_helper/webpack_assets_status_checker_spec.rb
+++ b/spec/react_on_rails/test_helper/webpack_assets_status_checker_spec.rb
@@ -62,7 +62,7 @@
         let(:fixture_dirname) { "assets_with_manifest_exist_server_bundle_separate" }
 
         before do
-          Packer = Shakapacker # rubocop:disable Lint/ConstantDefinitionInBlock, RSpec/LeakyConstantDeclaration
+          Packer = ReactOnRails::PackerUtils.packer # rubocop:disable Lint/ConstantDefinitionInBlock, RSpec/LeakyConstantDeclaration
           allow(ReactOnRails::PackerUtils).to receive_messages(
             manifest_exists?: true,
             packer_public_output_path: generated_assets_full_path

From 6a2035fbe6e10286aabb591ca4b9fc68809ac0ce Mon Sep 17 00:00:00 2001
From: Justin Gordon <justin@shakacode.com>
Date: Sun, 21 Sep 2025 22:40:52 -1000
Subject: [PATCH 08/30] Clean solution: Remove redundant using_packer? check
 with proper test handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since Shakapacker is required by gemspec, the using_packer? check in
bundle_js_file_path is unnecessary for production code. However, tests
mock this scenario for validation.

Changes:
- Remove using_packer? check from main bundle_js_file_path logic
- Add guard check in bundle_js_file_path_with_packer for test scenarios
- Maintains clean production code while handling test mocking properly
- All tests pass including "without packer" scenarios

This is the correct approach: main logic assumes Shakapacker is available
(as guaranteed by gemspec), while method implementation handles edge cases
for comprehensive test coverage.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 lib/react_on_rails/utils.rb | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index 9fa8e365f..d80bdad49 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -75,7 +75,7 @@ def self.bundle_js_file_path(bundle_name)
       # Priority order depends on bundle type:
       # SERVER BUNDLES (normal case): Try secure non-public locations first, then manifest, then legacy
       # CLIENT BUNDLES (normal case): Try manifest first, then fallback locations
-      if bundle_name == "manifest.json" || !ReactOnRails::PackerUtils.using_packer?
+      if bundle_name == "manifest.json"
         # Default to the non-hashed name in the specified output directory, which, for legacy
         # React on Rails, this is the output directory picked up by the asset pipeline.
         # For Shakapacker, this is the public output path defined in the (shaka/web)packer.yml file.
@@ -86,6 +86,9 @@ def self.bundle_js_file_path(bundle_name)
     end
 
     def self.bundle_js_file_path_with_packer(bundle_name)
+      # Handle test scenarios where packer is mocked as unavailable
+      return File.join(generated_assets_full_path, bundle_name) unless ReactOnRails::PackerUtils.using_packer?
+
       is_server_bundle = server_bundle?(bundle_name)
 
       if is_server_bundle

From afd06ed4631bd358eacda70e82c653ee519f13f7 Mon Sep 17 00:00:00 2001
From: Justin Gordon <justin@shakacode.com>
Date: Sun, 21 Sep 2025 22:46:31 -1000
Subject: [PATCH 09/30] Implement enforce_secure_server_bundles with
 comprehensive improvements
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Major Features:
- Implement enforce_secure_server_bundles configuration logic
- When enabled, server bundles MUST be found in private locations
- Skip manifest fallback for server bundles when enforcement is active
- Use configured server_bundle_output_path as additional private location

Code Quality Improvements:
- Extract duplicated file existence checking into find_first_existing_path helper
- Use inline private_class_method declarations for better readability
- Rename "secure" to "private" locations for clearer terminology
- Handle Rails.root being nil in test environments
- Use File.join consistently instead of Rails.root.join for compatibility

Test Infrastructure:
- Add comprehensive mocking for new configuration options
- Fix test contexts that override mock_bundle_configs helper
- Ensure all test scenarios properly mock new configuration keys
- All previously failing tests now pass

Security & Performance:
- Private server bundle locations checked first (ssr-generated, generated/server-bundles)
- Configurable server_bundle_output_path included in private location search
- Enforcement prevents fallback to public manifest locations when enabled
- Maintains backward compatibility with enforcement disabled by default

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 lib/react_on_rails/utils.rb       | 61 +++++++++++++++++++------------
 spec/react_on_rails/utils_spec.rb | 12 ++++++
 2 files changed, 50 insertions(+), 23 deletions(-)

diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index d80bdad49..bcad1cec5 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -85,19 +85,22 @@ def self.bundle_js_file_path(bundle_name)
       end
     end
 
-    def self.bundle_js_file_path_with_packer(bundle_name)
+    private_class_method def self.bundle_js_file_path_with_packer(bundle_name)
       # Handle test scenarios where packer is mocked as unavailable
       return File.join(generated_assets_full_path, bundle_name) unless ReactOnRails::PackerUtils.using_packer?
 
       is_server_bundle = server_bundle?(bundle_name)
 
       if is_server_bundle
-        # NORMAL CASE for server bundles: Try secure non-public locations first
-        secure_path = try_secure_server_locations(bundle_name)
-        return secure_path if secure_path
+        # NORMAL CASE for server bundles: Try private non-public locations first
+        private_path = try_private_server_locations(bundle_name)
+        return private_path if private_path
+
+        # If enforcement is enabled and no private path found, skip manifest fallback
+        return handle_missing_manifest_entry(bundle_name, true) if enforce_secure_server_bundles?
       end
 
-      # For client bundles OR server bundle fallback: Try manifest lookup
+      # For client bundles OR server bundle fallback (when enforcement disabled): Try manifest lookup
       begin
         ReactOnRails::PackerUtils.bundle_js_uri_from_packer(bundle_name)
       rescue Shakapacker::Manifest::MissingEntryError
@@ -105,27 +108,35 @@ def self.bundle_js_file_path_with_packer(bundle_name)
       end
     end
 
-    def self.server_bundle?(bundle_name)
+    private_class_method def self.server_bundle?(bundle_name)
       config = ReactOnRails.configuration
       bundle_name == config.server_bundle_js_file ||
-        bundle_name == config.rsc_bundle_js_file
+      bundle_name == config.rsc_bundle_js_file
+    end
+
+    private_class_method def self.enforce_secure_server_bundles?
+      ReactOnRails.configuration.enforce_secure_server_bundles
     end
 
-    def self.try_secure_server_locations(bundle_name)
-      secure_server_locations = [
-        File.join("ssr-generated", bundle_name),
-        File.join("generated", "server-bundles", bundle_name)
+    private_class_method def self.try_private_server_locations(bundle_name)
+      config = ReactOnRails.configuration
+
+      # Build candidate locations, including configured output path
+      root_path = Rails.root || "."
+      candidates = [
+        File.join(root_path, "ssr-generated", bundle_name),
+        File.join(root_path, "generated", "server-bundles", bundle_name)
       ]
 
-      secure_server_locations.each do |path|
-        expanded_path = File.expand_path(path)
-        return expanded_path if File.exist?(expanded_path)
+      # Add configured server_bundle_output_path if present
+      if config.server_bundle_output_path.present?
+        candidates << File.join(root_path, config.server_bundle_output_path, bundle_name)
       end
 
-      nil
+      find_first_existing_path(candidates)
     end
 
-    def self.handle_missing_manifest_entry(bundle_name, is_server_bundle)
+    private_class_method def self.handle_missing_manifest_entry(bundle_name, is_server_bundle)
       # When manifest lookup fails, try multiple fallback locations:
       # 1. Environment-specific path (e.g., public/webpack/test)
       # 2. Standard Shakapacker location (public/packs)
@@ -137,22 +148,26 @@ def self.handle_missing_manifest_entry(bundle_name, is_server_bundle)
       ].uniq
 
       # Return the first location where the bundle file actually exists
-      fallback_locations.each do |path|
-        expanded_path = File.expand_path(path)
-        return expanded_path if File.exist?(expanded_path)
-      end
+      existing_path = find_first_existing_path(fallback_locations)
+      return existing_path if existing_path
 
       # If none exist, return appropriate default based on bundle type
       if is_server_bundle
-        # For server bundles, prefer secure location as final fallback
+        # For server bundles, prefer private location as final fallback
         File.expand_path(File.join("ssr-generated", bundle_name))
       else
         # For client bundles, use environment-specific path (original behavior)
         File.expand_path(fallback_locations.first)
       end
     end
-    private_class_method :bundle_js_file_path_with_packer, :server_bundle?, :try_secure_server_locations,
-                         :handle_missing_manifest_entry
+
+    private_class_method def self.find_first_existing_path(paths)
+      paths.each do |path|
+        expanded_path = File.expand_path(path)
+        return expanded_path if File.exist?(expanded_path)
+      end
+      nil
+    end
 
     def self.server_bundle_js_file_path
       return @server_bundle_path if @server_bundle_path && !Rails.env.development?
diff --git a/spec/react_on_rails/utils_spec.rb b/spec/react_on_rails/utils_spec.rb
index ca5c05c69..832ebc6c9 100644
--- a/spec/react_on_rails/utils_spec.rb
+++ b/spec/react_on_rails/utils_spec.rb
@@ -61,6 +61,10 @@ def mock_bundle_configs(server_bundle_name: random_bundle_name, rsc_bundle_name:
         .and_return(server_bundle_name)
       allow(ReactOnRails).to receive_message_chain("configuration.rsc_bundle_js_file")
         .and_return(rsc_bundle_name)
+      allow(ReactOnRails).to receive_message_chain("configuration.enforce_secure_server_bundles")
+        .and_return(false)
+      allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
+        .and_return(nil)
     end
 
     def mock_dev_server_running
@@ -163,6 +167,10 @@ def mock_dev_server_running
                 mock_missing_manifest_entry(server_bundle_name)
                 allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_js_file")
                   .and_return(server_bundle_name)
+                allow(ReactOnRails).to receive_message_chain("configuration.enforce_secure_server_bundles")
+                  .and_return(false)
+                allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
+                  .and_return(nil)
               end
 
               it "tries secure locations first for server bundles" do
@@ -199,6 +207,10 @@ def mock_dev_server_running
                 mock_missing_manifest_entry(rsc_bundle_name)
                 allow(ReactOnRails).to receive_message_chain("configuration.rsc_bundle_js_file")
                   .and_return(rsc_bundle_name)
+                allow(ReactOnRails).to receive_message_chain("configuration.enforce_secure_server_bundles")
+                  .and_return(false)
+                allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
+                  .and_return(nil)
               end
 
               it "treats RSC bundles as server bundles and tries secure locations first" do

From ed37a2b880e4663aadd351df0996bdb97e85d31d Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Mon, 22 Sep 2025 14:11:39 +0000
Subject: [PATCH 10/30] refactor: Use configuration-based approach for server
 bundle output path

- Set 'ssr-generated' as default value for server_bundle_output_path
- Remove hard-coded paths from try_private_server_locations
- Update handle_missing_manifest_entry to respect configuration
- Maintain backwards compatibility with 'generated/server-bundles' fallback
- Honor enforce_secure_server_bundles flag to prevent public fallbacks

Co-authored-by: Abanoub Ghadban <AbanoubGhadban@users.noreply.github.com>
---
 lib/react_on_rails/configuration.rb |  2 +-
 lib/react_on_rails/utils.rb         | 26 ++++++++++++++++----------
 spec/react_on_rails/utils_spec.rb   |  4 ++--
 3 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/lib/react_on_rails/configuration.rb b/lib/react_on_rails/configuration.rb
index 0b74584e4..6e1296a1c 100644
--- a/lib/react_on_rails/configuration.rb
+++ b/lib/react_on_rails/configuration.rb
@@ -53,7 +53,7 @@ def self.configuration
       # Set to 0 to disable the timeout and wait indefinitely for component registration.
       component_registry_timeout: DEFAULT_COMPONENT_REGISTRY_TIMEOUT,
       generated_component_packs_loading_strategy: nil,
-      server_bundle_output_path: nil,
+      server_bundle_output_path: "ssr-generated",
       enforce_secure_server_bundles: false
     )
   end
diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index bcad1cec5..9680a7a24 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -120,23 +120,29 @@ def self.bundle_js_file_path(bundle_name)
 
     private_class_method def self.try_private_server_locations(bundle_name)
       config = ReactOnRails.configuration
-
-      # Build candidate locations, including configured output path
       root_path = Rails.root || "."
+
+      # Primary location from configuration (now defaults to "ssr-generated")
       candidates = [
-        File.join(root_path, "ssr-generated", bundle_name),
-        File.join(root_path, "generated", "server-bundles", bundle_name)
+        File.join(root_path, config.server_bundle_output_path, bundle_name)
       ]
 
-      # Add configured server_bundle_output_path if present
-      if config.server_bundle_output_path.present?
-        candidates << File.join(root_path, config.server_bundle_output_path, bundle_name)
-      end
+      # Add legacy fallback for backwards compatibility
+      candidates << File.join(root_path, "generated", "server-bundles", bundle_name)
 
       find_first_existing_path(candidates)
     end
 
     private_class_method def self.handle_missing_manifest_entry(bundle_name, is_server_bundle)
+      config = ReactOnRails.configuration
+      root_path = Rails.root || "."
+
+      # When enforcement is on for server bundles, only use private locations
+      if is_server_bundle && enforce_secure_server_bundles?
+        # Only try private locations, no public fallbacks
+        return File.expand_path(File.join(root_path, config.server_bundle_output_path, bundle_name))
+      end
+
       # When manifest lookup fails, try multiple fallback locations:
       # 1. Environment-specific path (e.g., public/webpack/test)
       # 2. Standard Shakapacker location (public/packs)
@@ -153,8 +159,8 @@ def self.bundle_js_file_path(bundle_name)
 
       # If none exist, return appropriate default based on bundle type
       if is_server_bundle
-        # For server bundles, prefer private location as final fallback
-        File.expand_path(File.join("ssr-generated", bundle_name))
+        # For server bundles, use configured private location as final fallback
+        File.expand_path(File.join(root_path, config.server_bundle_output_path, bundle_name))
       else
         # For client bundles, use environment-specific path (original behavior)
         File.expand_path(fallback_locations.first)
diff --git a/spec/react_on_rails/utils_spec.rb b/spec/react_on_rails/utils_spec.rb
index 832ebc6c9..5f1e19c0b 100644
--- a/spec/react_on_rails/utils_spec.rb
+++ b/spec/react_on_rails/utils_spec.rb
@@ -170,7 +170,7 @@ def mock_dev_server_running
                 allow(ReactOnRails).to receive_message_chain("configuration.enforce_secure_server_bundles")
                   .and_return(false)
                 allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
-                  .and_return(nil)
+                  .and_return("ssr-generated")
               end
 
               it "tries secure locations first for server bundles" do
@@ -210,7 +210,7 @@ def mock_dev_server_running
                 allow(ReactOnRails).to receive_message_chain("configuration.enforce_secure_server_bundles")
                   .and_return(false)
                 allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
-                  .and_return(nil)
+                  .and_return("ssr-generated")
               end
 
               it "treats RSC bundles as server bundles and tries secure locations first" do

From fa07c576f9c644cff493a0d610d69e4f5d3eb7f7 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Mon, 22 Sep 2025 15:36:23 +0000
Subject: [PATCH 11/30] refactor: Use configuration-based approach for server
 bundle output path

- Remove enforce_secure_server_bundles from bundle resolution logic
- Simplify utils.rb by removing hard-coded paths
- Use server_bundle_output_path configuration directly
- Add validation to ensure enforce_secure_server_bundles and server_bundle_output_path are compatible
- Set server_bundle_output_path default to 'ssr-generated'
- Update generator templates to use secure server bundle configuration
- Update tests to match new implementation

Co-authored-by: Abanoub Ghadban <AbanoubGhadban@users.noreply.github.com>
---
 .../react_on_rails/base_generator.rb          | 15 +--
 .../config/initializers/react_on_rails.rb.tt  |  9 ++
 .../config/webpack/serverWebpackConfig.js.tt  |  5 +-
 lib/react_on_rails/configuration.rb           | 22 +++++
 lib/react_on_rails/utils.rb                   | 70 ++++----------
 spec/react_on_rails/configuration_spec.rb     | 51 ++++++++++
 spec/react_on_rails/utils_spec.rb             | 94 ++++++++-----------
 7 files changed, 150 insertions(+), 116 deletions(-)

diff --git a/lib/generators/react_on_rails/base_generator.rb b/lib/generators/react_on_rails/base_generator.rb
index 2b3a197c6..48493ee99 100644
--- a/lib/generators/react_on_rails/base_generator.rb
+++ b/lib/generators/react_on_rails/base_generator.rb
@@ -136,14 +136,17 @@ def update_gitignore_for_auto_registration
         return unless File.exist?(gitignore_path)
 
         gitignore_content = File.read(gitignore_path)
-        return if gitignore_content.include?("**/generated/**")
 
-        append_to_file ".gitignore" do
-          <<~GITIGNORE
+        additions = []
+        additions << "**/generated/**" unless gitignore_content.include?("**/generated/**")
+        additions << "ssr-generated" unless gitignore_content.include?("ssr-generated")
+
+        return if additions.empty?
 
-            # Generated React on Rails packs
-            **/generated/**
-          GITIGNORE
+        append_to_file ".gitignore" do
+          lines = ["\n# Generated React on Rails packs"]
+          lines.concat(additions)
+          lines.join("\n") + "\n"
         end
       end
 
diff --git a/lib/generators/react_on_rails/templates/base/base/config/initializers/react_on_rails.rb.tt b/lib/generators/react_on_rails/templates/base/base/config/initializers/react_on_rails.rb.tt
index 223169639..735ce673e 100644
--- a/lib/generators/react_on_rails/templates/base/base/config/initializers/react_on_rails.rb.tt
+++ b/lib/generators/react_on_rails/templates/base/base/config/initializers/react_on_rails.rb.tt
@@ -43,6 +43,15 @@ ReactOnRails.configure do |config|
   #
   config.server_bundle_js_file = "server-bundle.js"
 
+  # Configure where server bundles are output. Defaults to "ssr-generated".
+  # This should match your webpack configuration for server bundles.
+  config.server_bundle_output_path = "ssr-generated"
+
+  # Enforce that server bundles are only loaded from secure (non-public) directories.
+  # When true, server bundles will only be loaded from the configured server_bundle_output_path.
+  # This is recommended for production to prevent server-side code from being exposed.
+  config.enforce_secure_server_bundles = true
+
   ################################################################################
   ################################################################################
   # FILE SYSTEM BASED COMPONENT REGISTRY
diff --git a/lib/generators/react_on_rails/templates/base/base/config/webpack/serverWebpackConfig.js.tt b/lib/generators/react_on_rails/templates/base/base/config/webpack/serverWebpackConfig.js.tt
index a1f40f065..87a90d37f 100644
--- a/lib/generators/react_on_rails/templates/base/base/config/webpack/serverWebpackConfig.js.tt
+++ b/lib/generators/react_on_rails/templates/base/base/config/webpack/serverWebpackConfig.js.tt
@@ -44,13 +44,14 @@ const configureServer = () => {
 
   // Custom output for the server-bundle that matches the config in
   // config/initializers/react_on_rails.rb
+  // Server bundles are output to a secure directory (not public) for security
   serverWebpackConfig.output = {
     filename: 'server-bundle.js',
     globalObject: 'this',
     // If using the React on Rails Pro node server renderer, uncomment the next line
     // libraryTarget: 'commonjs2',
-    path: config.outputPath,
-    publicPath: config.publicPath,
+    path: require('path').resolve(__dirname, '../../ssr-generated'),
+    // No publicPath needed since server bundles are not served via web
     // https://webpack.js.org/configuration/output/#outputglobalobject
   };
 
diff --git a/lib/react_on_rails/configuration.rb b/lib/react_on_rails/configuration.rb
index 6e1296a1c..d343d2f09 100644
--- a/lib/react_on_rails/configuration.rb
+++ b/lib/react_on_rails/configuration.rb
@@ -151,6 +151,7 @@ def setup_config_values
       adjust_precompile_task
       check_component_registry_timeout
       validate_generated_component_packs_loading_strategy
+      validate_enforce_secure_server_bundles
     end
 
     private
@@ -199,6 +200,27 @@ def validate_generated_component_packs_loading_strategy
       raise ReactOnRails::Error, "generated_component_packs_loading_strategy must be either :async, :defer, or :sync"
     end
 
+    def validate_enforce_secure_server_bundles
+      return unless enforce_secure_server_bundles
+
+      # Check if server_bundle_output_path is nil
+      if server_bundle_output_path.nil?
+        raise ReactOnRails::Error, "enforce_secure_server_bundles is set to true, but " \
+                                   "server_bundle_output_path is nil. Please set server_bundle_output_path " \
+                                   "to a directory outside of the public directory."
+      end
+
+      # Check if server_bundle_output_path is inside public directory
+      public_path = Rails.root.join("public").to_s
+      server_output_path = File.expand_path(server_bundle_output_path, Rails.root.to_s)
+
+      if server_output_path.start_with?(public_path)
+        raise ReactOnRails::Error, "enforce_secure_server_bundles is set to true, but " \
+                                   "server_bundle_output_path (#{server_bundle_output_path}) is inside " \
+                                   "the public directory. Please set it to a directory outside of public."
+      end
+    end
+
     def check_autobundling_requirements
       raise_missing_components_subdirectory if auto_load_bundle && !components_subdirectory.present?
       return unless components_subdirectory.present?
diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index 9680a7a24..a430ae3a8 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -90,17 +90,15 @@ def self.bundle_js_file_path(bundle_name)
       return File.join(generated_assets_full_path, bundle_name) unless ReactOnRails::PackerUtils.using_packer?
 
       is_server_bundle = server_bundle?(bundle_name)
+      config = ReactOnRails.configuration
 
-      if is_server_bundle
-        # NORMAL CASE for server bundles: Try private non-public locations first
-        private_path = try_private_server_locations(bundle_name)
-        return private_path if private_path
-
-        # If enforcement is enabled and no private path found, skip manifest fallback
-        return handle_missing_manifest_entry(bundle_name, true) if enforce_secure_server_bundles?
+      # If server bundle and server_bundle_output_path is configured, try that first
+      if is_server_bundle && config.server_bundle_output_path.present?
+        server_path = try_server_bundle_output_path(bundle_name)
+        return server_path if server_path
       end
 
-      # For client bundles OR server bundle fallback (when enforcement disabled): Try manifest lookup
+      # Try manifest lookup for all bundles
       begin
         ReactOnRails::PackerUtils.bundle_js_uri_from_packer(bundle_name)
       rescue Shakapacker::Manifest::MissingEntryError
@@ -114,66 +112,30 @@ def self.bundle_js_file_path(bundle_name)
       bundle_name == config.rsc_bundle_js_file
     end
 
-    private_class_method def self.enforce_secure_server_bundles?
-      ReactOnRails.configuration.enforce_secure_server_bundles
-    end
-
-    private_class_method def self.try_private_server_locations(bundle_name)
+    private_class_method def self.try_server_bundle_output_path(bundle_name)
       config = ReactOnRails.configuration
       root_path = Rails.root || "."
 
-      # Primary location from configuration (now defaults to "ssr-generated")
-      candidates = [
-        File.join(root_path, config.server_bundle_output_path, bundle_name)
-      ]
-
-      # Add legacy fallback for backwards compatibility
-      candidates << File.join(root_path, "generated", "server-bundles", bundle_name)
-
-      find_first_existing_path(candidates)
+      # Try the configured server_bundle_output_path
+      path = File.join(root_path, config.server_bundle_output_path, bundle_name)
+      expanded_path = File.expand_path(path)
+      File.exist?(expanded_path) ? expanded_path : nil
     end
 
     private_class_method def self.handle_missing_manifest_entry(bundle_name, is_server_bundle)
       config = ReactOnRails.configuration
       root_path = Rails.root || "."
 
-      # When enforcement is on for server bundles, only use private locations
-      if is_server_bundle && enforce_secure_server_bundles?
-        # Only try private locations, no public fallbacks
+      # For server bundles with server_bundle_output_path configured, use that
+      if is_server_bundle && config.server_bundle_output_path.present?
         return File.expand_path(File.join(root_path, config.server_bundle_output_path, bundle_name))
       end
 
-      # When manifest lookup fails, try multiple fallback locations:
-      # 1. Environment-specific path (e.g., public/webpack/test)
-      # 2. Standard Shakapacker location (public/packs)
-      # 3. Generated assets path (for legacy setups)
-      fallback_locations = [
-        File.join(ReactOnRails::PackerUtils.packer_public_output_path, bundle_name),
-        File.join("public", "packs", bundle_name),
-        File.join(generated_assets_full_path, bundle_name)
-      ].uniq
-
-      # Return the first location where the bundle file actually exists
-      existing_path = find_first_existing_path(fallback_locations)
-      return existing_path if existing_path
-
-      # If none exist, return appropriate default based on bundle type
-      if is_server_bundle
-        # For server bundles, use configured private location as final fallback
-        File.expand_path(File.join(root_path, config.server_bundle_output_path, bundle_name))
-      else
-        # For client bundles, use environment-specific path (original behavior)
-        File.expand_path(fallback_locations.first)
-      end
+      # For client bundles and server bundles without special config, use packer's public path
+      # This returns the environment-specific path configured in shakapacker.yml
+      File.expand_path(File.join(ReactOnRails::PackerUtils.packer_public_output_path, bundle_name))
     end
 
-    private_class_method def self.find_first_existing_path(paths)
-      paths.each do |path|
-        expanded_path = File.expand_path(path)
-        return expanded_path if File.exist?(expanded_path)
-      end
-      nil
-    end
 
     def self.server_bundle_js_file_path
       return @server_bundle_path if @server_bundle_path && !Rails.env.development?
diff --git a/spec/react_on_rails/configuration_spec.rb b/spec/react_on_rails/configuration_spec.rb
index c3037546c..bb7fcf2eb 100644
--- a/spec/react_on_rails/configuration_spec.rb
+++ b/spec/react_on_rails/configuration_spec.rb
@@ -459,6 +459,57 @@ module ReactOnRails
         end
       end
     end
+
+    describe "enforce_secure_server_bundles validation" do
+      context "when enforce_secure_server_bundles is true" do
+        it "raises error when server_bundle_output_path is nil" do
+          expect do
+            ReactOnRails.configure do |config|
+              config.server_bundle_output_path = nil
+              config.enforce_secure_server_bundles = true
+            end
+          end.to raise_error(ReactOnRails::Error, /server_bundle_output_path is nil/)
+        end
+
+        it "raises error when server_bundle_output_path is inside public directory" do
+          expect do
+            ReactOnRails.configure do |config|
+              config.server_bundle_output_path = "public/server-bundles"
+              config.enforce_secure_server_bundles = true
+            end
+          end.to raise_error(ReactOnRails::Error, /is inside the public directory/)
+        end
+
+        it "allows server_bundle_output_path outside public directory" do
+          expect do
+            ReactOnRails.configure do |config|
+              config.server_bundle_output_path = "ssr-generated"
+              config.enforce_secure_server_bundles = true
+            end
+          end.not_to raise_error
+        end
+      end
+
+      context "when enforce_secure_server_bundles is false" do
+        it "allows server_bundle_output_path to be nil" do
+          expect do
+            ReactOnRails.configure do |config|
+              config.server_bundle_output_path = nil
+              config.enforce_secure_server_bundles = false
+            end
+          end.not_to raise_error
+        end
+
+        it "allows server_bundle_output_path inside public directory" do
+          expect do
+            ReactOnRails.configure do |config|
+              config.server_bundle_output_path = "public/server-bundles"
+              config.enforce_secure_server_bundles = false
+            end
+          end.not_to raise_error
+        end
+      end
+    end
   end
 end
 
diff --git a/spec/react_on_rails/utils_spec.rb b/spec/react_on_rails/utils_spec.rb
index 5f1e19c0b..bebe676ee 100644
--- a/spec/react_on_rails/utils_spec.rb
+++ b/spec/react_on_rails/utils_spec.rb
@@ -61,8 +61,6 @@ def mock_bundle_configs(server_bundle_name: random_bundle_name, rsc_bundle_name:
         .and_return(server_bundle_name)
       allow(ReactOnRails).to receive_message_chain("configuration.rsc_bundle_js_file")
         .and_return(rsc_bundle_name)
-      allow(ReactOnRails).to receive_message_chain("configuration.enforce_secure_server_bundles")
-        .and_return(false)
       allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
         .and_return(nil)
     end
@@ -130,27 +128,14 @@ def mock_dev_server_running
               it { is_expected.to eq("#{packer_public_output_path}/manifest.json") }
             end
 
-            context "when file not in manifest and fallback to standard location" do
+            context "when file not in manifest" do
               before do
                 mock_missing_manifest_entry("webpack-bundle.js")
               end
 
-              let(:standard_path) { File.expand_path(File.join("public", "packs", "webpack-bundle.js")) }
               let(:env_specific_path) { File.join(packer_public_output_path, "webpack-bundle.js") }
 
-              it "returns standard path when bundle exists there" do
-                allow(File).to receive(:exist?).and_call_original
-                allow(File).to receive(:exist?).with(File.expand_path(env_specific_path)).and_return(false)
-                allow(File).to receive(:exist?).with(standard_path).and_return(true)
-
-                result = described_class.bundle_js_file_path("webpack-bundle.js")
-                expect(result).to eq(standard_path)
-              end
-
-              it "returns environment-specific path when no bundle exists anywhere" do
-                allow(File).to receive(:exist?).and_call_original
-                allow(File).to receive(:exist?).and_return(false)
-
+              it "returns environment-specific path" do
                 result = described_class.bundle_js_file_path("webpack-bundle.js")
                 expect(result).to eq(File.expand_path(env_specific_path))
               end
@@ -159,43 +144,46 @@ def mock_dev_server_running
             context "with server bundle (SSR/RSC) file not in manifest" do
               let(:server_bundle_name) { "server-bundle.js" }
               let(:ssr_generated_path) { File.expand_path(File.join("ssr-generated", server_bundle_name)) }
-              let(:generated_server_path) do
-                File.expand_path(File.join("generated", "server-bundles", server_bundle_name))
-              end
 
-              before do
-                mock_missing_manifest_entry(server_bundle_name)
-                allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_js_file")
-                  .and_return(server_bundle_name)
-                allow(ReactOnRails).to receive_message_chain("configuration.enforce_secure_server_bundles")
-                  .and_return(false)
-                allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
-                  .and_return("ssr-generated")
+              context "with server_bundle_output_path configured" do
+                before do
+                  mock_missing_manifest_entry(server_bundle_name)
+                  allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_js_file")
+                    .and_return(server_bundle_name)
+                  allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
+                    .and_return("ssr-generated")
+                end
+
+                it "tries configured location first for server bundles" do
+                  allow(File).to receive(:exist?).and_call_original
+                  allow(File).to receive(:exist?).with(ssr_generated_path).and_return(true)
+
+                  result = described_class.bundle_js_file_path(server_bundle_name)
+                  expect(result).to eq(ssr_generated_path)
+                end
+
+                it "falls back to configured path when no bundle exists" do
+                  allow(File).to receive(:exist?).and_call_original
+                  allow(File).to receive(:exist?).and_return(false)
+
+                  result = described_class.bundle_js_file_path(server_bundle_name)
+                  expect(result).to eq(ssr_generated_path)
+                end
               end
 
-              it "tries secure locations first for server bundles" do
-                allow(File).to receive(:exist?).and_call_original
-                allow(File).to receive(:exist?).with(ssr_generated_path).and_return(true)
-
-                result = described_class.bundle_js_file_path(server_bundle_name)
-                expect(result).to eq(ssr_generated_path)
-              end
-
-              it "tries generated/server-bundles as second secure location" do
-                allow(File).to receive(:exist?).and_call_original
-                allow(File).to receive(:exist?).with(ssr_generated_path).and_return(false)
-                allow(File).to receive(:exist?).with(generated_server_path).and_return(true)
-
-                result = described_class.bundle_js_file_path(server_bundle_name)
-                expect(result).to eq(generated_server_path)
-              end
-
-              it "falls back to ssr-generated location when no bundle exists anywhere" do
-                allow(File).to receive(:exist?).and_call_original
-                allow(File).to receive(:exist?).and_return(false)
-
-                result = described_class.bundle_js_file_path(server_bundle_name)
-                expect(result).to eq(ssr_generated_path)
+              context "without server_bundle_output_path configured" do
+                before do
+                  mock_missing_manifest_entry(server_bundle_name)
+                  allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_js_file")
+                    .and_return(server_bundle_name)
+                  allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
+                    .and_return(nil)
+                end
+
+                it "uses packer public output path" do
+                  result = described_class.bundle_js_file_path(server_bundle_name)
+                  expect(result).to eq(File.expand_path(File.join(packer_public_output_path, server_bundle_name)))
+                end
               end
             end
 
@@ -207,13 +195,11 @@ def mock_dev_server_running
                 mock_missing_manifest_entry(rsc_bundle_name)
                 allow(ReactOnRails).to receive_message_chain("configuration.rsc_bundle_js_file")
                   .and_return(rsc_bundle_name)
-                allow(ReactOnRails).to receive_message_chain("configuration.enforce_secure_server_bundles")
-                  .and_return(false)
                 allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
                   .and_return("ssr-generated")
               end
 
-              it "treats RSC bundles as server bundles and tries secure locations first" do
+              it "treats RSC bundles as server bundles and tries configured location first" do
                 allow(File).to receive(:exist?).and_call_original
                 allow(File).to receive(:exist?).with(ssr_generated_path).and_return(true)
 

From 55a30c0cd8a5581bf1b98a1c2fbc791238896212 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Mon, 22 Sep 2025 16:06:52 +0000
Subject: [PATCH 12/30] Fix CI failures: RuboCop violations and test failures

- Fix RuboCop violations:
  - Use string interpolation instead of concatenation in base_generator.rb
  - Apply guard clause pattern in configuration.rb
  - Remove extra blank line in utils.rb

- Fix configuration validation tests:
  - Add Rails.root availability check to prevent nil errors in tests
  - Mock Rails.root in test specs for path validation

- Fix utils tests:
  - Use default 'ssr-generated' path instead of nil in mock_bundle_configs
  - Update test expectations to match new server bundle path behavior
  - Remove outdated test expecting server bundles in public/packs

Co-authored-by: Abanoub Ghadban <AbanoubGhadban@users.noreply.github.com>
---
 lib/generators/react_on_rails/base_generator.rb |  2 +-
 lib/react_on_rails/configuration.rb             | 13 ++++++++-----
 lib/react_on_rails/utils.rb                     |  1 -
 spec/react_on_rails/configuration_spec.rb       |  5 +++++
 spec/react_on_rails/utils_spec.rb               | 16 +++++++---------
 5 files changed, 21 insertions(+), 16 deletions(-)

diff --git a/lib/generators/react_on_rails/base_generator.rb b/lib/generators/react_on_rails/base_generator.rb
index 48493ee99..3d42dbf20 100644
--- a/lib/generators/react_on_rails/base_generator.rb
+++ b/lib/generators/react_on_rails/base_generator.rb
@@ -146,7 +146,7 @@ def update_gitignore_for_auto_registration
         append_to_file ".gitignore" do
           lines = ["\n# Generated React on Rails packs"]
           lines.concat(additions)
-          lines.join("\n") + "\n"
+          "#{lines.join("\n")}\n"
         end
       end
 
diff --git a/lib/react_on_rails/configuration.rb b/lib/react_on_rails/configuration.rb
index d343d2f09..1b3074e29 100644
--- a/lib/react_on_rails/configuration.rb
+++ b/lib/react_on_rails/configuration.rb
@@ -211,14 +211,17 @@ def validate_enforce_secure_server_bundles
       end
 
       # Check if server_bundle_output_path is inside public directory
+      # Skip validation if Rails.root is not available (e.g., in tests)
+      return unless defined?(Rails) && Rails.root
+
       public_path = Rails.root.join("public").to_s
       server_output_path = File.expand_path(server_bundle_output_path, Rails.root.to_s)
 
-      if server_output_path.start_with?(public_path)
-        raise ReactOnRails::Error, "enforce_secure_server_bundles is set to true, but " \
-                                   "server_bundle_output_path (#{server_bundle_output_path}) is inside " \
-                                   "the public directory. Please set it to a directory outside of public."
-      end
+      return unless server_output_path.start_with?(public_path)
+
+      raise ReactOnRails::Error, "enforce_secure_server_bundles is set to true, but " \
+                                 "server_bundle_output_path (#{server_bundle_output_path}) is inside " \
+                                 "the public directory. Please set it to a directory outside of public."
     end
 
     def check_autobundling_requirements
diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index a430ae3a8..2a2018218 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -136,7 +136,6 @@ def self.bundle_js_file_path(bundle_name)
       File.expand_path(File.join(ReactOnRails::PackerUtils.packer_public_output_path, bundle_name))
     end
 
-
     def self.server_bundle_js_file_path
       return @server_bundle_path if @server_bundle_path && !Rails.env.development?
 
diff --git a/spec/react_on_rails/configuration_spec.rb b/spec/react_on_rails/configuration_spec.rb
index bb7fcf2eb..866299aba 100644
--- a/spec/react_on_rails/configuration_spec.rb
+++ b/spec/react_on_rails/configuration_spec.rb
@@ -462,6 +462,11 @@ module ReactOnRails
 
     describe "enforce_secure_server_bundles validation" do
       context "when enforce_secure_server_bundles is true" do
+        before do
+          # Mock Rails.root for tests that need path validation
+          allow(Rails).to receive(:root).and_return(Pathname.new("/test/app"))
+        end
+
         it "raises error when server_bundle_output_path is nil" do
           expect do
             ReactOnRails.configure do |config|
diff --git a/spec/react_on_rails/utils_spec.rb b/spec/react_on_rails/utils_spec.rb
index bebe676ee..4e7dae6c7 100644
--- a/spec/react_on_rails/utils_spec.rb
+++ b/spec/react_on_rails/utils_spec.rb
@@ -62,7 +62,7 @@ def mock_bundle_configs(server_bundle_name: random_bundle_name, rsc_bundle_name:
       allow(ReactOnRails).to receive_message_chain("configuration.rsc_bundle_js_file")
         .and_return(rsc_bundle_name)
       allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
-        .and_return(nil)
+        .and_return("ssr-generated")
     end
 
     def mock_dev_server_running
@@ -257,23 +257,21 @@ def mock_dev_server_running
               expect(path).to end_with("ssr-generated/#{server_bundle_name}")
             end
 
-            context "with bundle file existing in standard location but not environment-specific location" do
-              it "returns the standard location path" do
+            context "with bundle file existing in ssr-generated location" do
+              it "returns the ssr-generated location path" do
                 server_bundle_name = "server-bundle.js"
                 mock_bundle_configs(server_bundle_name: server_bundle_name)
                 mock_missing_manifest_entry(server_bundle_name)
 
-                # Mock File.exist? to return false for environment-specific path but true for standard path
-                standard_path = File.expand_path(File.join("public", "packs", server_bundle_name))
-                env_specific_path = File.join(packer_public_output_path, server_bundle_name)
+                # Mock File.exist? to return true for ssr-generated path
+                ssr_generated_path = File.expand_path(File.join("ssr-generated", server_bundle_name))
 
                 allow(File).to receive(:exist?).and_call_original
-                allow(File).to receive(:exist?).with(File.expand_path(env_specific_path)).and_return(false)
-                allow(File).to receive(:exist?).with(standard_path).and_return(true)
+                allow(File).to receive(:exist?).with(ssr_generated_path).and_return(true)
 
                 path = described_class.server_bundle_js_file_path
 
-                expect(path).to eq(standard_path)
+                expect(path).to eq(ssr_generated_path)
               end
             end
 

From 8936a77c7aaeaf10fd7bb9ae975d1fe6b617c289 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Mon, 22 Sep 2025 16:29:01 +0000
Subject: [PATCH 13/30] Fix dummy app configuration for test environment

Set server_bundle_output_path to nil and enforce_secure_server_bundles to false
in the dummy app's React on Rails configuration. This ensures the dummy app
uses the standard webpack output location (public/webpack/test) where bundles
are actually built during tests, resolving the CI failures.

Co-authored-by: Abanoub Ghadban <AbanoubGhadban@users.noreply.github.com>
---
 spec/dummy/config/initializers/react_on_rails.rb | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/spec/dummy/config/initializers/react_on_rails.rb b/spec/dummy/config/initializers/react_on_rails.rb
index b1c70a972..36c925a72 100644
--- a/spec/dummy/config/initializers/react_on_rails.rb
+++ b/spec/dummy/config/initializers/react_on_rails.rb
@@ -27,6 +27,11 @@ def self.adjust_props_for_client_side_hydration(component_name, props)
   config.server_bundle_js_file = "server-bundle.js"
   config.random_dom_id = false # default is true
 
+  # Set server_bundle_output_path to nil so bundles are read from public path
+  # This ensures the dummy app uses the standard webpack output location
+  config.server_bundle_output_path = nil
+  config.enforce_secure_server_bundles = false
+
   # Uncomment to test these
   # config.build_test_command = "yarn run build:test"
   # config.build_production_command = "RAILS_ENV=production NODE_ENV=production bin/shakapacker"

From 88212b8cf7d736d12a5bf78fdc412b279ed5007d Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Mon, 22 Sep 2025 17:57:41 +0000
Subject: [PATCH 14/30] refactor: Return configured server_bundle_output_path
 directly without existence check

When server_bundle_output_path is configured, the bundle path resolution now returns
the configured path immediately without checking if the file exists. This ensures
predictable behavior and allows the server rendering process to handle missing files
appropriately.

Updates:
- Modified bundle_js_file_path_with_packer to return configured path directly
- Removed try_server_bundle_output_path method (no longer needed)
- Updated tests to reflect new behavior without File.exist? checks

Co-authored-by: Abanoub Ghadban <AbanoubGhadban@users.noreply.github.com>
---
 lib/react_on_rails/utils.rb       | 15 ++--------
 spec/react_on_rails/utils_spec.rb | 50 ++++++++-----------------------
 2 files changed, 15 insertions(+), 50 deletions(-)

diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index 2a2018218..080331e13 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -91,11 +91,11 @@ def self.bundle_js_file_path(bundle_name)
 
       is_server_bundle = server_bundle?(bundle_name)
       config = ReactOnRails.configuration
+      root_path = Rails.root || "."
 
-      # If server bundle and server_bundle_output_path is configured, try that first
+      # If server bundle and server_bundle_output_path is configured, return that path directly
       if is_server_bundle && config.server_bundle_output_path.present?
-        server_path = try_server_bundle_output_path(bundle_name)
-        return server_path if server_path
+        return File.expand_path(File.join(root_path, config.server_bundle_output_path, bundle_name))
       end
 
       # Try manifest lookup for all bundles
@@ -112,15 +112,6 @@ def self.bundle_js_file_path(bundle_name)
       bundle_name == config.rsc_bundle_js_file
     end
 
-    private_class_method def self.try_server_bundle_output_path(bundle_name)
-      config = ReactOnRails.configuration
-      root_path = Rails.root || "."
-
-      # Try the configured server_bundle_output_path
-      path = File.join(root_path, config.server_bundle_output_path, bundle_name)
-      expanded_path = File.expand_path(path)
-      File.exist?(expanded_path) ? expanded_path : nil
-    end
 
     private_class_method def self.handle_missing_manifest_entry(bundle_name, is_server_bundle)
       config = ReactOnRails.configuration
diff --git a/spec/react_on_rails/utils_spec.rb b/spec/react_on_rails/utils_spec.rb
index 4e7dae6c7..756b79ef5 100644
--- a/spec/react_on_rails/utils_spec.rb
+++ b/spec/react_on_rails/utils_spec.rb
@@ -154,17 +154,9 @@ def mock_dev_server_running
                     .and_return("ssr-generated")
                 end
 
-                it "tries configured location first for server bundles" do
-                  allow(File).to receive(:exist?).and_call_original
-                  allow(File).to receive(:exist?).with(ssr_generated_path).and_return(true)
-
-                  result = described_class.bundle_js_file_path(server_bundle_name)
-                  expect(result).to eq(ssr_generated_path)
-                end
-
-                it "falls back to configured path when no bundle exists" do
-                  allow(File).to receive(:exist?).and_call_original
-                  allow(File).to receive(:exist?).and_return(false)
+                it "returns configured path directly without checking existence" do
+                  # Should not check File.exist? - returns path immediately
+                  expect(File).not_to receive(:exist?)
 
                   result = described_class.bundle_js_file_path(server_bundle_name)
                   expect(result).to eq(ssr_generated_path)
@@ -199,9 +191,9 @@ def mock_dev_server_running
                   .and_return("ssr-generated")
               end
 
-              it "treats RSC bundles as server bundles and tries configured location first" do
-                allow(File).to receive(:exist?).and_call_original
-                allow(File).to receive(:exist?).with(ssr_generated_path).and_return(true)
+              it "treats RSC bundles as server bundles and returns configured path directly" do
+                # Should not check File.exist? - returns path immediately
+                expect(File).not_to receive(:exist?)
 
                 result = described_class.bundle_js_file_path(rsc_bundle_name)
                 expect(result).to eq(ssr_generated_path)
@@ -257,33 +249,15 @@ def mock_dev_server_running
               expect(path).to end_with("ssr-generated/#{server_bundle_name}")
             end
 
-            context "with bundle file existing in ssr-generated location" do
-              it "returns the ssr-generated location path" do
-                server_bundle_name = "server-bundle.js"
-                mock_bundle_configs(server_bundle_name: server_bundle_name)
-                mock_missing_manifest_entry(server_bundle_name)
-
-                # Mock File.exist? to return true for ssr-generated path
-                ssr_generated_path = File.expand_path(File.join("ssr-generated", server_bundle_name))
-
-                allow(File).to receive(:exist?).and_call_original
-                allow(File).to receive(:exist?).with(ssr_generated_path).and_return(true)
-
-                path = described_class.server_bundle_js_file_path
-
-                expect(path).to eq(ssr_generated_path)
-              end
-            end
-
-            context "with bundle file not existing in any fallback location" do
-              it "returns the secure ssr-generated path as final fallback for server bundles" do
+            context "with server_bundle_output_path configured" do
+              it "returns the configured path directly without checking file existence" do
                 server_bundle_name = "server-bundle.js"
                 mock_bundle_configs(server_bundle_name: server_bundle_name)
-                mock_missing_manifest_entry(server_bundle_name)
 
-                # Mock File.exist? to return false for all paths
-                allow(File).to receive(:exist?).and_call_original
-                allow(File).to receive(:exist?).and_return(false)
+                # Since server_bundle_output_path is configured, should return path immediately
+                # without trying manifest lookup
+                expect(ReactOnRails::PackerUtils.packer).not_to receive(:manifest)
+                expect(File).not_to receive(:exist?)
 
                 path = described_class.server_bundle_js_file_path
 

From d917bda883a32c4341a1c28e8be38bfc5ad7fd77 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Mon, 22 Sep 2025 18:17:05 +0000
Subject: [PATCH 15/30] Fix CI failures: RuboCop violations and test failures

- Fix RuboCop Layout/EmptyLines violation in lib/react_on_rails/utils.rb
- Fix 6 failing tests that expect manifest paths for server bundles
- Tests now properly clear server_bundle_output_path when testing manifest fallback behavior

Co-authored-by: Abanoub Ghadban <AbanoubGhadban@users.noreply.github.com>
---
 lib/react_on_rails/utils.rb       |  1 -
 spec/react_on_rails/utils_spec.rb | 18 ++++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index 080331e13..40caa4171 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -112,7 +112,6 @@ def self.bundle_js_file_path(bundle_name)
       bundle_name == config.rsc_bundle_js_file
     end
 
-
     private_class_method def self.handle_missing_manifest_entry(bundle_name, is_server_bundle)
       config = ReactOnRails.configuration
       root_path = Rails.root || "."
diff --git a/spec/react_on_rails/utils_spec.rb b/spec/react_on_rails/utils_spec.rb
index 756b79ef5..644ca9d37 100644
--- a/spec/react_on_rails/utils_spec.rb
+++ b/spec/react_on_rails/utils_spec.rb
@@ -270,6 +270,9 @@ def mock_dev_server_running
             it "returns the correct path hashed server path" do
               packer = ::Shakapacker
               mock_bundle_configs(server_bundle_name: "webpack-bundle.js")
+              # Clear server_bundle_output_path to test manifest behavior
+              allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
+                .and_return(nil)
               allow(ReactOnRails).to receive_message_chain("configuration.same_bundle_for_client_and_server")
                 .and_return(true)
               mock_bundle_in_manifest("webpack-bundle.js", "webpack/development/webpack-bundle-123456.js")
@@ -284,6 +287,9 @@ def mock_dev_server_running
             context "with webpack-dev-server running, and same file used for server and client" do
               it "returns the correct path hashed server path" do
                 mock_bundle_configs(server_bundle_name: "webpack-bundle.js")
+                # Clear server_bundle_output_path to test manifest behavior
+                allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
+                  .and_return(nil)
                 allow(ReactOnRails).to receive_message_chain("configuration.same_bundle_for_client_and_server")
                   .and_return(true)
                 mock_dev_server_running
@@ -300,6 +306,9 @@ def mock_dev_server_running
                   packer_type.to_sym do
             it "returns the correct path hashed server path" do
               mock_bundle_configs(server_bundle_name: "server-bundle.js")
+              # Clear server_bundle_output_path to test manifest behavior
+              allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
+                .and_return(nil)
               allow(ReactOnRails).to receive_message_chain("configuration.same_bundle_for_client_and_server")
                 .and_return(false)
               mock_bundle_in_manifest("server-bundle.js", "webpack/development/server-bundle-123456.js")
@@ -333,6 +342,9 @@ def mock_dev_server_running
             it "returns the correct path hashed server path" do
               packer = ::Shakapacker
               mock_bundle_configs(rsc_bundle_name: "webpack-bundle.js")
+              # Clear server_bundle_output_path to test manifest behavior
+              allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
+                .and_return(nil)
               allow(ReactOnRails).to receive_message_chain("configuration.same_bundle_for_client_and_server")
                 .and_return(true)
               mock_bundle_in_manifest("webpack-bundle.js", "webpack/development/webpack-bundle-123456.js")
@@ -347,6 +359,9 @@ def mock_dev_server_running
             context "with webpack-dev-server running, and same file used for server and client" do
               it "returns the correct path hashed server path" do
                 mock_bundle_configs(rsc_bundle_name: "webpack-bundle.js")
+                # Clear server_bundle_output_path to test manifest behavior
+                allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
+                  .and_return(nil)
                 allow(ReactOnRails).to receive_message_chain("configuration.same_bundle_for_client_and_server")
                   .and_return(true)
                 mock_dev_server_running
@@ -363,6 +378,9 @@ def mock_dev_server_running
                   packer_type.to_sym do
             it "returns the correct path hashed server path" do
               mock_bundle_configs(rsc_bundle_name: "rsc-bundle.js")
+              # Clear server_bundle_output_path to test manifest behavior
+              allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
+                .and_return(nil)
               allow(ReactOnRails).to receive_message_chain("configuration.same_bundle_for_client_and_server")
                 .and_return(false)
               mock_bundle_in_manifest("rsc-bundle.js", "webpack/development/server-bundle-123456.js")

From b478d611218802db1f011afeb3ead4d1642c2d51 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Mon, 22 Sep 2025 18:59:07 +0000
Subject: [PATCH 16/30] refactor: Rename 'secure' to 'private' for server
 bundles terminology

- Renamed enforce_secure_server_bundles to enforce_private_server_bundles
- Updated validation method name to validate_enforce_private_server_bundles
- Updated all comments, test descriptions, and documentation to use 'private' instead of 'secure'
- Updated configuration files, templates, and specs to reflect new terminology

This change provides clearer terminology - 'private' better describes
non-public directories vs 'secure' which has broader security implications

Co-authored-by: Justin Gordon <justin808@users.noreply.github.com>
---
 docs/guides/configuration.md                   |  4 ++--
 .../config/initializers/react_on_rails.rb.tt   |  4 ++--
 .../config/webpack/serverWebpackConfig.js.tt   |  2 +-
 lib/react_on_rails/configuration.rb            | 18 +++++++++---------
 lib/react_on_rails/utils.rb                    |  2 +-
 .../config/initializers/react_on_rails.rb      |  2 +-
 spec/react_on_rails/configuration_spec.rb      | 16 ++++++++--------
 spec/react_on_rails/utils_spec.rb              |  4 ++--
 8 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/docs/guides/configuration.md b/docs/guides/configuration.md
index ca275918e..3122b3790 100644
--- a/docs/guides/configuration.md
+++ b/docs/guides/configuration.md
@@ -134,10 +134,10 @@ ReactOnRails.configure do |config|
   # Default is nil (disabled). Set to "ssr-generated" or your preferred directory to enable.
   # config.server_bundle_output_path = "ssr-generated"
 
-  # When enabled, enforces that server bundles are only loaded from secure, designated locations
+  # When enabled, enforces that server bundles are only loaded from private, designated locations
   # to prevent potential security risks from loading untrusted server-side code.
   # Default is false for backward compatibility.
-  config.enforce_secure_server_bundles = false
+  config.enforce_private_server_bundles = false
 
   # `prerender` means server-side rendering
   # default is false. This is an option for view helpers `render_component` and `render_component_hash`.
diff --git a/lib/generators/react_on_rails/templates/base/base/config/initializers/react_on_rails.rb.tt b/lib/generators/react_on_rails/templates/base/base/config/initializers/react_on_rails.rb.tt
index 735ce673e..f1b1a8665 100644
--- a/lib/generators/react_on_rails/templates/base/base/config/initializers/react_on_rails.rb.tt
+++ b/lib/generators/react_on_rails/templates/base/base/config/initializers/react_on_rails.rb.tt
@@ -47,10 +47,10 @@ ReactOnRails.configure do |config|
   # This should match your webpack configuration for server bundles.
   config.server_bundle_output_path = "ssr-generated"
 
-  # Enforce that server bundles are only loaded from secure (non-public) directories.
+  # Enforce that server bundles are only loaded from private (non-public) directories.
   # When true, server bundles will only be loaded from the configured server_bundle_output_path.
   # This is recommended for production to prevent server-side code from being exposed.
-  config.enforce_secure_server_bundles = true
+  config.enforce_private_server_bundles = true
 
   ################################################################################
   ################################################################################
diff --git a/lib/generators/react_on_rails/templates/base/base/config/webpack/serverWebpackConfig.js.tt b/lib/generators/react_on_rails/templates/base/base/config/webpack/serverWebpackConfig.js.tt
index 87a90d37f..deb724704 100644
--- a/lib/generators/react_on_rails/templates/base/base/config/webpack/serverWebpackConfig.js.tt
+++ b/lib/generators/react_on_rails/templates/base/base/config/webpack/serverWebpackConfig.js.tt
@@ -44,7 +44,7 @@ const configureServer = () => {
 
   // Custom output for the server-bundle that matches the config in
   // config/initializers/react_on_rails.rb
-  // Server bundles are output to a secure directory (not public) for security
+  // Server bundles are output to a private directory (not public) for security
   serverWebpackConfig.output = {
     filename: 'server-bundle.js',
     globalObject: 'this',
diff --git a/lib/react_on_rails/configuration.rb b/lib/react_on_rails/configuration.rb
index 1b3074e29..1cb98cba7 100644
--- a/lib/react_on_rails/configuration.rb
+++ b/lib/react_on_rails/configuration.rb
@@ -54,7 +54,7 @@ def self.configuration
       component_registry_timeout: DEFAULT_COMPONENT_REGISTRY_TIMEOUT,
       generated_component_packs_loading_strategy: nil,
       server_bundle_output_path: "ssr-generated",
-      enforce_secure_server_bundles: false
+      enforce_private_server_bundles: false
     )
   end
 
@@ -71,7 +71,7 @@ class Configuration
                   :make_generated_server_bundle_the_entrypoint,
                   :generated_component_packs_loading_strategy, :immediate_hydration, :rsc_bundle_js_file,
                   :react_client_manifest_file, :react_server_client_manifest_file, :component_registry_timeout,
-                  :server_bundle_output_path, :enforce_secure_server_bundles
+                  :server_bundle_output_path, :enforce_private_server_bundles
 
     # rubocop:disable Metrics/AbcSize
     def initialize(node_modules_location: nil, server_bundle_js_file: nil, prerender: nil,
@@ -88,7 +88,7 @@ def initialize(node_modules_location: nil, server_bundle_js_file: nil, prerender
                    random_dom_id: nil, server_render_method: nil, rendering_props_extension: nil,
                    components_subdirectory: nil, auto_load_bundle: nil, immediate_hydration: nil,
                    rsc_bundle_js_file: nil, react_client_manifest_file: nil, react_server_client_manifest_file: nil,
-                   component_registry_timeout: nil, server_bundle_output_path: nil, enforce_secure_server_bundles: nil)
+                   component_registry_timeout: nil, server_bundle_output_path: nil, enforce_private_server_bundles: nil)
       self.node_modules_location = node_modules_location.present? ? node_modules_location : Rails.root
       self.generated_assets_dirs = generated_assets_dirs
       self.generated_assets_dir = generated_assets_dir
@@ -134,7 +134,7 @@ def initialize(node_modules_location: nil, server_bundle_js_file: nil, prerender
       self.immediate_hydration = immediate_hydration
       self.generated_component_packs_loading_strategy = generated_component_packs_loading_strategy
       self.server_bundle_output_path = server_bundle_output_path
-      self.enforce_secure_server_bundles = enforce_secure_server_bundles
+      self.enforce_private_server_bundles = enforce_private_server_bundles
     end
     # rubocop:enable Metrics/AbcSize
 
@@ -151,7 +151,7 @@ def setup_config_values
       adjust_precompile_task
       check_component_registry_timeout
       validate_generated_component_packs_loading_strategy
-      validate_enforce_secure_server_bundles
+      validate_enforce_private_server_bundles
     end
 
     private
@@ -200,12 +200,12 @@ def validate_generated_component_packs_loading_strategy
       raise ReactOnRails::Error, "generated_component_packs_loading_strategy must be either :async, :defer, or :sync"
     end
 
-    def validate_enforce_secure_server_bundles
-      return unless enforce_secure_server_bundles
+    def validate_enforce_private_server_bundles
+      return unless enforce_private_server_bundles
 
       # Check if server_bundle_output_path is nil
       if server_bundle_output_path.nil?
-        raise ReactOnRails::Error, "enforce_secure_server_bundles is set to true, but " \
+        raise ReactOnRails::Error, "enforce_private_server_bundles is set to true, but " \
                                    "server_bundle_output_path is nil. Please set server_bundle_output_path " \
                                    "to a directory outside of the public directory."
       end
@@ -219,7 +219,7 @@ def validate_enforce_secure_server_bundles
 
       return unless server_output_path.start_with?(public_path)
 
-      raise ReactOnRails::Error, "enforce_secure_server_bundles is set to true, but " \
+      raise ReactOnRails::Error, "enforce_private_server_bundles is set to true, but " \
                                  "server_bundle_output_path (#{server_bundle_output_path}) is inside " \
                                  "the public directory. Please set it to a directory outside of public."
     end
diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index 40caa4171..0d279a5cd 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -73,7 +73,7 @@ def self.server_bundle_path_is_http?
 
     def self.bundle_js_file_path(bundle_name)
       # Priority order depends on bundle type:
-      # SERVER BUNDLES (normal case): Try secure non-public locations first, then manifest, then legacy
+      # SERVER BUNDLES (normal case): Try private non-public locations first, then manifest, then legacy
       # CLIENT BUNDLES (normal case): Try manifest first, then fallback locations
       if bundle_name == "manifest.json"
         # Default to the non-hashed name in the specified output directory, which, for legacy
diff --git a/spec/dummy/config/initializers/react_on_rails.rb b/spec/dummy/config/initializers/react_on_rails.rb
index 36c925a72..b1a46ea5d 100644
--- a/spec/dummy/config/initializers/react_on_rails.rb
+++ b/spec/dummy/config/initializers/react_on_rails.rb
@@ -30,7 +30,7 @@ def self.adjust_props_for_client_side_hydration(component_name, props)
   # Set server_bundle_output_path to nil so bundles are read from public path
   # This ensures the dummy app uses the standard webpack output location
   config.server_bundle_output_path = nil
-  config.enforce_secure_server_bundles = false
+  config.enforce_private_server_bundles = false
 
   # Uncomment to test these
   # config.build_test_command = "yarn run build:test"
diff --git a/spec/react_on_rails/configuration_spec.rb b/spec/react_on_rails/configuration_spec.rb
index 866299aba..d047a5b53 100644
--- a/spec/react_on_rails/configuration_spec.rb
+++ b/spec/react_on_rails/configuration_spec.rb
@@ -460,8 +460,8 @@ module ReactOnRails
       end
     end
 
-    describe "enforce_secure_server_bundles validation" do
-      context "when enforce_secure_server_bundles is true" do
+    describe "enforce_private_server_bundles validation" do
+      context "when enforce_private_server_bundles is true" do
         before do
           # Mock Rails.root for tests that need path validation
           allow(Rails).to receive(:root).and_return(Pathname.new("/test/app"))
@@ -471,7 +471,7 @@ module ReactOnRails
           expect do
             ReactOnRails.configure do |config|
               config.server_bundle_output_path = nil
-              config.enforce_secure_server_bundles = true
+              config.enforce_private_server_bundles = true
             end
           end.to raise_error(ReactOnRails::Error, /server_bundle_output_path is nil/)
         end
@@ -480,7 +480,7 @@ module ReactOnRails
           expect do
             ReactOnRails.configure do |config|
               config.server_bundle_output_path = "public/server-bundles"
-              config.enforce_secure_server_bundles = true
+              config.enforce_private_server_bundles = true
             end
           end.to raise_error(ReactOnRails::Error, /is inside the public directory/)
         end
@@ -489,18 +489,18 @@ module ReactOnRails
           expect do
             ReactOnRails.configure do |config|
               config.server_bundle_output_path = "ssr-generated"
-              config.enforce_secure_server_bundles = true
+              config.enforce_private_server_bundles = true
             end
           end.not_to raise_error
         end
       end
 
-      context "when enforce_secure_server_bundles is false" do
+      context "when enforce_private_server_bundles is false" do
         it "allows server_bundle_output_path to be nil" do
           expect do
             ReactOnRails.configure do |config|
               config.server_bundle_output_path = nil
-              config.enforce_secure_server_bundles = false
+              config.enforce_private_server_bundles = false
             end
           end.not_to raise_error
         end
@@ -509,7 +509,7 @@ module ReactOnRails
           expect do
             ReactOnRails.configure do |config|
               config.server_bundle_output_path = "public/server-bundles"
-              config.enforce_secure_server_bundles = false
+              config.enforce_private_server_bundles = false
             end
           end.not_to raise_error
         end
diff --git a/spec/react_on_rails/utils_spec.rb b/spec/react_on_rails/utils_spec.rb
index 644ca9d37..cc8a3a44a 100644
--- a/spec/react_on_rails/utils_spec.rb
+++ b/spec/react_on_rails/utils_spec.rb
@@ -239,7 +239,7 @@ def mock_dev_server_running
           include_context "with #{packer_type} enabled"
 
           context "with server file not in manifest", packer_type.to_sym do
-            it "returns the secure ssr-generated path for server bundles" do
+            it "returns the private ssr-generated path for server bundles" do
               server_bundle_name = "server-bundle.js"
               mock_bundle_configs(server_bundle_name: server_bundle_name)
               mock_missing_manifest_entry(server_bundle_name)
@@ -327,7 +327,7 @@ def mock_dev_server_running
           include_context "with #{packer_type} enabled"
 
           context "with server file not in manifest", packer_type.to_sym do
-            it "returns the secure ssr-generated path for RSC bundles" do
+            it "returns the private ssr-generated path for RSC bundles" do
               server_bundle_name = "rsc-bundle.js"
               mock_bundle_configs(rsc_bundle_name: server_bundle_name)
               mock_missing_manifest_entry(server_bundle_name)

From 3cb7cdc571ee903774f908a2cf9829f89bf06ef7 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Tue, 23 Sep 2025 14:39:36 +0000
Subject: [PATCH 17/30] fix: Remove obsolete using_packer? method references
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Remove call to undefined ReactOnRails::PackerUtils.using_packer? method
- Update test mocks to use Shakapacker directly instead of packer abstraction
- Fix Shakapacker::Manifest::MissingEntryError reference in tests

The using_packer? method was removed in a recent refactor that eliminated
the unnecessary packer abstraction layer. This commit aligns the code with
those changes.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 lib/react_on_rails/utils.rb                                    | 3 ---
 .../test_helper/webpack_assets_status_checker_spec.rb          | 3 +--
 spec/react_on_rails/utils_spec.rb                              | 2 +-
 3 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index 0d279a5cd..e19522b35 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -86,9 +86,6 @@ def self.bundle_js_file_path(bundle_name)
     end
 
     private_class_method def self.bundle_js_file_path_with_packer(bundle_name)
-      # Handle test scenarios where packer is mocked as unavailable
-      return File.join(generated_assets_full_path, bundle_name) unless ReactOnRails::PackerUtils.using_packer?
-
       is_server_bundle = server_bundle?(bundle_name)
       config = ReactOnRails.configuration
       root_path = Rails.root || "."
diff --git a/spec/react_on_rails/test_helper/webpack_assets_status_checker_spec.rb b/spec/react_on_rails/test_helper/webpack_assets_status_checker_spec.rb
index 48f748f45..aa7e1eab8 100644
--- a/spec/react_on_rails/test_helper/webpack_assets_status_checker_spec.rb
+++ b/spec/react_on_rails/test_helper/webpack_assets_status_checker_spec.rb
@@ -62,7 +62,6 @@
         let(:fixture_dirname) { "assets_with_manifest_exist_server_bundle_separate" }
 
         before do
-          Packer = ReactOnRails::PackerUtils.packer # rubocop:disable Lint/ConstantDefinitionInBlock, RSpec/LeakyConstantDeclaration
           allow(ReactOnRails::PackerUtils).to receive_messages(
             manifest_exists?: true,
             packer_public_output_path: generated_assets_full_path
@@ -73,7 +72,7 @@
             .and_return(File.join(generated_assets_full_path, "manifest.json"))
           allow(ReactOnRails::PackerUtils).to receive(:bundle_js_uri_from_packer)
             .with("server-bundle.js")
-            .and_raise(Packer::Manifest::MissingEntryError)
+            .and_raise(Shakapacker::Manifest::MissingEntryError)
           touch_files_in_dir(generated_assets_full_path)
         end
 
diff --git a/spec/react_on_rails/utils_spec.rb b/spec/react_on_rails/utils_spec.rb
index cc8a3a44a..8f5744dce 100644
--- a/spec/react_on_rails/utils_spec.rb
+++ b/spec/react_on_rails/utils_spec.rb
@@ -256,7 +256,7 @@ def mock_dev_server_running
 
                 # Since server_bundle_output_path is configured, should return path immediately
                 # without trying manifest lookup
-                expect(ReactOnRails::PackerUtils.packer).not_to receive(:manifest)
+                expect(::Shakapacker).not_to receive(:manifest)
                 expect(File).not_to receive(:exist?)
 
                 path = described_class.server_bundle_js_file_path

From 60d498d2b1c862b1e9a9ad4949930ef39ac55428 Mon Sep 17 00:00:00 2001
From: Abanoub Ghadban <abanoub@shakacode.com>
Date: Tue, 23 Sep 2025 17:45:03 +0300
Subject: [PATCH 18/30] update changelog.md

---
 CHANGELOG.md | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3acae4aff..bafe0f588 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,6 +23,30 @@ After a release, please make sure to run `bundle exec rake update_changelog`. Th
 
 Changes since the last non-beta release.
 
+#### New Features
+
+- **Server Bundle Security**: Added new configuration options for enhanced server bundle security and organization:
+  - `server_bundle_output_path`: Configurable directory (relative to the Rails root) for server bundle output (default: "ssr-generated"). If set to `nil`, the server bundle will be loaded from the same public directory as client bundles.
+  - `enforce_private_server_bundles`: When enabled, ensures server bundles are only loaded from private directories outside the public folder (default: false for backward compatibility)
+
+- **Improved Bundle Path Resolution**: Bundle path resolution for server bundles now works as follows:
+  - If `server_bundle_output_path` is set, the server bundle is loaded from that directory.
+  - If `server_bundle_output_path` is not set, the server bundle falls back to the client bundle directory (typically the public output path).
+  - If `enforce_private_server_bundles` is enabled:
+    - The server bundle will only be loaded from the private directory specified by `server_bundle_output_path`.
+    - If the bundle is not found there, it will *not* fall back to the public directory.
+  - If `enforce_private_server_bundles` is not enabled and the bundle is not found in the private directory, it will fall back to the public directory.
+  - This logic ensures that, when strict enforcement is enabled, server bundles are never loaded from public directories, improving security and clarity of bundle resolution.
+
+#### Security Enhancements
+
+- **Private Server Bundle Enforcement**: When `enforce_private_server_bundles` is enabled, server bundles bypass public directory fallbacks and are only loaded from designated private locations
+- **Path Validation**: Added validation to ensure `server_bundle_output_path` points to private directories when enforcement is enabled
+
+#### Bug Fixes
+
+- **Non-Packer Environment Compatibility**: Fixed potential NoMethodError when using bundle path resolution in environments without Shakapacker
+
 ### [16.0.1-rc.2] - 2025-09-20
 
 #### Bug Fixes

From 3d5c7eae08c780365e5b64bcd282221426dc893c Mon Sep 17 00:00:00 2001
From: Justin Gordon <justin@shakacode.com>
Date: Mon, 22 Sep 2025 17:00:40 -1000
Subject: [PATCH 19/30] =?UTF-8?q?Clarify=20method=20naming:=20rename=20gen?=
 =?UTF-8?q?erated=5Fassets=5Ffull=5Fpath=20=E2=86=92=20public=5Fassets=5Ff?=
 =?UTF-8?q?ull=5Fpath?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add new `public_assets_full_path` method to be explicit about public asset paths
- Keep `generated_assets_full_path` as backwards-compatible deprecated alias
- Update internal references to use clearer `public_assets_full_path` method
- Addresses naming ambiguity concern about whether paths are public or private
- Prepares for future evolution toward simplified public-only asset resolution

This improvement clarifies the distinction between:
- Public asset paths (client bundles, manifests) → public_assets_full_path
- Private asset paths (server bundles with enforcement) → server_bundle_private_path

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 lib/react_on_rails/utils.rb | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index e19522b35..ff75f7aef 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -79,7 +79,7 @@ def self.bundle_js_file_path(bundle_name)
         # Default to the non-hashed name in the specified output directory, which, for legacy
         # React on Rails, this is the output directory picked up by the asset pipeline.
         # For Shakapacker, this is the public output path defined in the (shaka/web)packer.yml file.
-        File.join(generated_assets_full_path, bundle_name)
+        File.join(public_assets_full_path, bundle_name)
       else
         bundle_js_file_path_with_packer(bundle_name)
       end
@@ -155,7 +155,7 @@ def self.react_server_client_manifest_file_path
               "react_server_client_manifest_file is nil, ensure it is set in your configuration"
       end
 
-      @react_server_manifest_path = File.join(generated_assets_full_path, asset_name)
+      @react_server_manifest_path = File.join(public_assets_full_path, asset_name)
     end
 
     def self.running_on_windows?
@@ -191,10 +191,15 @@ def self.using_packer_source_path_is_not_defined_and_custom_node_modules?
         ReactOnRails.configuration.node_modules_location.present?
     end
 
-    def self.generated_assets_full_path
+    def self.public_assets_full_path
       ReactOnRails::PackerUtils.packer_public_output_path
     end
 
+    # DEPRECATED: Use public_assets_full_path for clarity about public vs private asset paths
+    def self.generated_assets_full_path
+      public_assets_full_path
+    end
+
     def self.gem_available?(name)
       Gem.loaded_specs[name].present?
     rescue Gem::LoadError

From 42523685b99947b5db4903275e116da4a3a1423e Mon Sep 17 00:00:00 2001
From: Justin Gordon <justin@shakacode.com>
Date: Mon, 22 Sep 2025 17:02:42 -1000
Subject: [PATCH 20/30] Improve method naming: use public_bundles_full_path
 instead of public_assets_full_path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Rename public_assets_full_path → public_bundles_full_path for specificity
- "public_bundles" is clearer than "public_assets" in Rails context
- Avoids confusion with general Rails public assets (images, stylesheets, etc.)
- Method specifically handles webpack bundles, not general assets
- Update all internal references to use the more specific naming
- Maintain backwards compatibility through generated_assets_full_path alias

This creates clear semantic distinction:
- public_bundles_full_path → webpack bundles in public directories
- server_bundle_private_path → server bundles in private directories

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 lib/react_on_rails/utils.rb | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index ff75f7aef..7954811ba 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -79,7 +79,7 @@ def self.bundle_js_file_path(bundle_name)
         # Default to the non-hashed name in the specified output directory, which, for legacy
         # React on Rails, this is the output directory picked up by the asset pipeline.
         # For Shakapacker, this is the public output path defined in the (shaka/web)packer.yml file.
-        File.join(public_assets_full_path, bundle_name)
+        File.join(public_bundles_full_path, bundle_name)
       else
         bundle_js_file_path_with_packer(bundle_name)
       end
@@ -155,7 +155,7 @@ def self.react_server_client_manifest_file_path
               "react_server_client_manifest_file is nil, ensure it is set in your configuration"
       end
 
-      @react_server_manifest_path = File.join(public_assets_full_path, asset_name)
+      @react_server_manifest_path = File.join(public_bundles_full_path, asset_name)
     end
 
     def self.running_on_windows?
@@ -191,13 +191,13 @@ def self.using_packer_source_path_is_not_defined_and_custom_node_modules?
         ReactOnRails.configuration.node_modules_location.present?
     end
 
-    def self.public_assets_full_path
+    def self.public_bundles_full_path
       ReactOnRails::PackerUtils.packer_public_output_path
     end
 
-    # DEPRECATED: Use public_assets_full_path for clarity about public vs private asset paths
+    # DEPRECATED: Use public_bundles_full_path for clarity about public vs private bundle paths
     def self.generated_assets_full_path
-      public_assets_full_path
+      public_bundles_full_path
     end
 
     def self.gem_available?(name)

From 6c38c6f1f6784c22a0716150ff91be4733869a59 Mon Sep 17 00:00:00 2001
From: Abanoub Ghadban <abanoub@shakacode.com>
Date: Tue, 23 Sep 2025 18:01:48 +0300
Subject: [PATCH 21/30] Refactor: Update test mocks to use
 public_bundles_full_path

- Replace all instances of generated_assets_full_path with public_bundles_full_path in utils_spec.rb
- Ensures consistency in method naming across test cases
- Aligns with recent changes for clearer asset path handling

This change enhances clarity and maintains alignment with the updated method naming conventions.
---
 CHANGELOG.md                      | 10 +++++++++-
 spec/react_on_rails/utils_spec.rb |  8 ++++----
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bafe0f588..6c9a70a96 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,6 +26,7 @@ Changes since the last non-beta release.
 #### New Features
 
 - **Server Bundle Security**: Added new configuration options for enhanced server bundle security and organization:
+
   - `server_bundle_output_path`: Configurable directory (relative to the Rails root) for server bundle output (default: "ssr-generated"). If set to `nil`, the server bundle will be loaded from the same public directory as client bundles.
   - `enforce_private_server_bundles`: When enabled, ensures server bundles are only loaded from private directories outside the public folder (default: false for backward compatibility)
 
@@ -34,10 +35,17 @@ Changes since the last non-beta release.
   - If `server_bundle_output_path` is not set, the server bundle falls back to the client bundle directory (typically the public output path).
   - If `enforce_private_server_bundles` is enabled:
     - The server bundle will only be loaded from the private directory specified by `server_bundle_output_path`.
-    - If the bundle is not found there, it will *not* fall back to the public directory.
+    - If the bundle is not found there, it will _not_ fall back to the public directory.
   - If `enforce_private_server_bundles` is not enabled and the bundle is not found in the private directory, it will fall back to the public directory.
   - This logic ensures that, when strict enforcement is enabled, server bundles are never loaded from public directories, improving security and clarity of bundle resolution.
 
+#### API Improvements
+
+- **Method Naming Clarification**: Added `public_bundles_full_path` method to clarify bundle path handling:
+  - `public_bundles_full_path`: New method specifically for webpack bundles in public directories
+  - `generated_assets_full_path`: Now deprecated (backwards-compatible alias)
+  - This eliminates confusion between webpack bundles and general Rails public assets
+
 #### Security Enhancements
 
 - **Private Server Bundle Enforcement**: When `enforce_private_server_bundles` is enabled, server bundles bypass public directory fallbacks and are only loaded from designated private locations
diff --git a/spec/react_on_rails/utils_spec.rb b/spec/react_on_rails/utils_spec.rb
index 8f5744dce..fd0a6d066 100644
--- a/spec/react_on_rails/utils_spec.rb
+++ b/spec/react_on_rails/utils_spec.rb
@@ -650,7 +650,7 @@ def mock_dev_server_running
       context "when in development environment" do
         before do
           allow(Rails.env).to receive(:development?).and_return(true)
-          allow(described_class).to receive(:generated_assets_full_path)
+          allow(described_class).to receive(:public_bundles_full_path)
             .and_return("/path/to/generated/assets")
         end
 
@@ -670,7 +670,7 @@ def mock_dev_server_running
 
       context "when not in development environment" do
         before do
-          allow(described_class).to receive(:generated_assets_full_path)
+          allow(described_class).to receive(:public_bundles_full_path)
             .and_return("/path/to/generated/assets")
         end
 
@@ -690,7 +690,7 @@ def mock_dev_server_running
 
       context "with different manifest file names" do
         before do
-          allow(described_class).to receive(:generated_assets_full_path)
+          allow(described_class).to receive(:public_bundles_full_path)
             .and_return("/path/to/generated/assets")
         end
 
@@ -715,7 +715,7 @@ def mock_dev_server_running
         before do
           allow(ReactOnRails.configuration).to receive(:react_server_client_manifest_file)
             .and_return(nil)
-          allow(described_class).to receive(:generated_assets_full_path)
+          allow(described_class).to receive(:public_bundles_full_path)
             .and_return("/path/to/generated/assets")
         end
 

From a9aff90a77ffce3a98d1c0f714dd5dce95b53837 Mon Sep 17 00:00:00 2001
From: Abanoub Ghadban <abanoub@shakacode.com>
Date: Tue, 23 Sep 2025 18:21:32 +0300
Subject: [PATCH 22/30] Enhance configuration documentation and clarify
 directory structure for server and client bundles

- Added detailed comments in configuration.md to explain server bundle output path and security measures for loading server bundles.
- Introduced examples for organizing client and server assets to improve clarity for users.
- Updated comments in base_generator.rb and react_with_redux_generator.rb to reflect changes from 'auto-registration' to 'auto-bundling' terminology for consistency.

These changes aim to improve the understanding of asset management and security practices within the React on Rails framework.
---
 docs/guides/configuration.md                  | 49 ++++++++++++++++---
 .../react_on_rails/base_generator.rb          |  2 +-
 .../react_with_redux_generator.rb             |  4 +-
 3 files changed, 45 insertions(+), 10 deletions(-)

diff --git a/docs/guides/configuration.md b/docs/guides/configuration.md
index 3122b3790..769b9467a 100644
--- a/docs/guides/configuration.md
+++ b/docs/guides/configuration.md
@@ -129,16 +129,51 @@ ReactOnRails.configure do |config|
   # This manifest file is automatically generated by the React Server Components Webpack plugin. Only set this if you've configured the plugin to use a different filename.
   config.react_server_client_manifest_file = "react-server-client-manifest.json"
 
-  # Directory where server bundles will be output during build process.
-  # This allows organizing server-side rendering assets separately from client assets.
-  # Default is nil (disabled). Set to "ssr-generated" or your preferred directory to enable.
+  ################################################################################
+  # SERVER BUNDLE SECURITY AND ORGANIZATION
+  ################################################################################
+
+  # This configures the directory (relative to the Rails root) where the server bundle will be output.
+  # By default, this is "ssr-generated". If set to nil, the server bundle will be loaded from the same
+  # public directory as client bundles. For enhanced security, use this option in conjunction with
+  # `enforce_private_server_bundles` to ensure server bundles are only loaded from private directories
   # config.server_bundle_output_path = "ssr-generated"
 
-  # When enabled, enforces that server bundles are only loaded from private, designated locations
-  # to prevent potential security risks from loading untrusted server-side code.
-  # Default is false for backward compatibility.
+  # When set to true, React on Rails will only load server bundles from private, explicitly configured directories (such as `ssr-generated`), and will raise an error if a server bundle is found in a public or untrusted location. This helps prevent accidental or malicious execution of untrusted JavaScript on the server, and is strongly recommended for production environments. And prevent leakage of server-side code to the client (Especially in the case of RSC).
+  # Default is false for backward compatibility, but enabling this option is a best practice for security.
   config.enforce_private_server_bundles = false
 
+  ################################################################################
+  # BUNDLE ORGANIZATION EXAMPLES
+  ################################################################################
+  #
+  # This configuration creates a clear separation between client and server assets:
+  #
+  # CLIENT BUNDLES (Public, Web-Accessible):
+  #   Location: public/webpack/[environment]/ or public/packs/ (According to your shakapacker.yml configuration)
+  #   Files: application.js, manifest.json, CSS files
+  #   Served by: Web server directly
+  #   Access: ReactOnRails::Utils.public_bundles_full_path
+  #
+  # SERVER BUNDLES (Private, Server-Only):
+  #   Location: ssr-generated/ (when server_bundle_output_path configured)
+  #   Files: server-bundle.js, rsc-bundle.js
+  #   Served by: Never served to browsers
+  #   Access: ReactOnRails::Utils.server_bundle_js_file_path
+  #
+  # Example directory structure with recommended configuration:
+  #   app/
+  #   ├── ssr-generated/           # Private server bundles
+  #   │   ├── server-bundle.js
+  #   │   └── rsc-bundle.js
+  #   └── public/
+  #       └── webpack/development/ # Public client bundles
+  #           ├── application.js
+  #           ├── manifest.json
+  #           └── styles.css
+  #
+  ################################################################################
+
   # `prerender` means server-side rendering
   # default is false. This is an option for view helpers `render_component` and `render_component_hash`.
   # Set to true to change the default value to true.
@@ -219,7 +254,7 @@ ReactOnRails.configure do |config|
   # | 8.2.0+            | ✅ Yes                | ✅ Yes             | ✅ Yes          | ✅ Yes         |
   #
   ################################################################################
-  # components_subdirectory is the name of the subdirectory matched to detect and register components automatically
+  # components_subdirectory is the name of the subdirectory matched to detect components for auto-bundle-loading
   # The default is nil. You can enable the feature by updating it in the next line.
   config.components_subdirectory = nil
   # Change to a value like this example to enable this feature
diff --git a/lib/generators/react_on_rails/base_generator.rb b/lib/generators/react_on_rails/base_generator.rb
index 3d42dbf20..06f5c208f 100644
--- a/lib/generators/react_on_rails/base_generator.rb
+++ b/lib/generators/react_on_rails/base_generator.rb
@@ -24,7 +24,7 @@ def add_hello_world_route
       end
 
       def create_react_directories
-        # Create auto-registration directory structure for non-Redux components only
+        # Create auto-bundling directory structure for non-Redux components only
         # Redux components handle their own directory structure
         return if options.redux?
 
diff --git a/lib/generators/react_on_rails/react_with_redux_generator.rb b/lib/generators/react_on_rails/react_with_redux_generator.rb
index 19076b471..643b306cf 100644
--- a/lib/generators/react_on_rails/react_with_redux_generator.rb
+++ b/lib/generators/react_on_rails/react_with_redux_generator.rb
@@ -19,7 +19,7 @@ class ReactWithReduxGenerator < Rails::Generators::Base
                    aliases: "-T"
 
       def create_redux_directories
-        # Create auto-registration directory structure for Redux
+        # Create auto-bundling directory structure for Redux
         empty_directory("app/javascript/src/HelloWorldApp/ror_components")
 
         # Create Redux support directories within the component directory
@@ -31,7 +31,7 @@ def copy_base_files
         base_js_path = "redux/base"
         ext = component_extension(options)
 
-        # Copy Redux-connected component to auto-registration structure
+        # Copy Redux-connected component to auto-bundling structure
         copy_file("#{base_js_path}/app/javascript/bundles/HelloWorld/startup/HelloWorldApp.client.#{ext}",
                   "app/javascript/src/HelloWorldApp/ror_components/HelloWorldApp.client.#{ext}")
         copy_file("#{base_js_path}/app/javascript/bundles/HelloWorld/startup/HelloWorldApp.server.#{ext}",

From 92b58ead30836c73e6c81fcab6f217e519558d5e Mon Sep 17 00:00:00 2001
From: Abanoub Ghadban <abanoub@shakacode.com>
Date: Tue, 23 Sep 2025 19:02:34 +0300
Subject: [PATCH 23/30] Update changelog and configuration to reflect breaking
 changes and enhancements

- Added a breaking change note regarding the removal of `generated_assets_dirs` configuration, emphasizing the transition to Shakapacker for asset path management.
- Updated documentation in configuration.md to clarify the purpose of `components_subdirectory` for automatic component registration.
- Refactored version constants for Shakapacker compatibility, ensuring consistent terminology for auto-bundling features.

These changes improve clarity and guide users through the updated configuration requirements.
---
 CHANGELOG.md                             |  5 ++
 docs/guides/configuration.md             |  2 +-
 lib/react_on_rails/configuration.rb      | 58 ++++++++++--------------
 lib/react_on_rails/packer_utils.rb       | 20 ++------
 lib/react_on_rails/packs_generator.rb    |  4 +-
 lib/react_on_rails/system_checker.rb     |  4 +-
 spec/react_on_rails/packer_utils_spec.rb | 10 ++--
 7 files changed, 44 insertions(+), 59 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6c9a70a96..3ff1de26d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,6 +23,10 @@ After a release, please make sure to run `bundle exec rake update_changelog`. Th
 
 Changes since the last non-beta release.
 
+#### Breaking Changes
+
+- **Removed `generated_assets_dirs` configuration**: The legacy `config.generated_assets_dirs` option is no longer supported and will raise an error if used. Since Shakapacker is now required, asset paths are automatically determined from `shakapacker.yml` configuration. Remove any `config.generated_assets_dirs` from your `config/initializers/react_on_rails.rb` file. Use `public_output_path` in `config/shakapacker.yml` to customize asset output location instead. [PR 1798](https://github.com/shakacode/react_on_rails/pull/1798)
+
 #### New Features
 
 - **Server Bundle Security**: Added new configuration options for enhanced server bundle security and organization:
@@ -54,6 +58,7 @@ Changes since the last non-beta release.
 #### Bug Fixes
 
 - **Non-Packer Environment Compatibility**: Fixed potential NoMethodError when using bundle path resolution in environments without Shakapacker
+- **Shakapacker version requirements**: Fixed inconsistent version requirements between basic pack generation (6.5.1+) and advanced auto-bundling features (7.0.0+). Added backward compatibility for users on Shakapacker 6.5.1-6.9.x while providing clear upgrade guidance for advanced features. Added new constants `MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_BUNDLING` and improved version checking performance with caching. [PR 1798](https://github.com/shakacode/react_on_rails/pull/1798)
 
 ### [16.0.1-rc.2] - 2025-09-20
 
diff --git a/docs/guides/configuration.md b/docs/guides/configuration.md
index 769b9467a..1d7a7e4b9 100644
--- a/docs/guides/configuration.md
+++ b/docs/guides/configuration.md
@@ -254,7 +254,7 @@ ReactOnRails.configure do |config|
   # | 8.2.0+            | ✅ Yes                | ✅ Yes             | ✅ Yes          | ✅ Yes         |
   #
   ################################################################################
-  # components_subdirectory is the name of the subdirectory matched to detect components for auto-bundle-loading
+  # components_subdirectory is the name of the subdirectory matched to detect and register components automatically
   # The default is nil. You can enable the feature by updating it in the next line.
   config.components_subdirectory = nil
   # Change to a value like this example to enable this feature
diff --git a/lib/react_on_rails/configuration.rb b/lib/react_on_rails/configuration.rb
index 1cb98cba7..5cece8275 100644
--- a/lib/react_on_rails/configuration.rb
+++ b/lib/react_on_rails/configuration.rb
@@ -144,7 +144,6 @@ def setup_config_values
       ensure_webpack_generated_files_exists
       configure_generated_assets_dirs_deprecation
       configure_skip_display_none_deprecation
-      ensure_generated_assets_dir_present
       check_server_render_method_is_only_execjs
       error_if_using_packer_and_generated_assets_dir_not_match_public_output_path
       # check_deprecated_settings
@@ -224,23 +223,17 @@ def validate_enforce_private_server_bundles
                                  "the public directory. Please set it to a directory outside of public."
     end
 
-    def check_autobundling_requirements
-      raise_missing_components_subdirectory if auto_load_bundle && !components_subdirectory.present?
-      return unless components_subdirectory.present?
-
-      # Check basic pack generation support for auto_load_bundle
+    def check_minimum_shakapacker_version
       ReactOnRails::PackerUtils.raise_shakapacker_version_incompatible_for_basic_pack_generation unless
         ReactOnRails::PackerUtils.supports_basic_pack_generation?
+    end
 
-      # Additional checks for advanced features requiring nested entries
-      if ReactOnRails::PackerUtils.supports_autobundling?
-        ReactOnRails::PackerUtils.raise_nested_entries_disabled unless ReactOnRails::PackerUtils.nested_entries?
-      else
-        # Warn users about missing advanced features but don't block basic functionality
-        min_version = ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_REGISTRATION
-        Rails.logger.warn("React on Rails: Basic pack generation enabled. " \
-                          "Upgrade to Shakapacker #{min_version}+ for advanced auto-registration features.")
-      end
+    def check_autobundling_requirements
+      raise_missing_components_subdirectory unless components_subdirectory.present?
+
+      ReactOnRails::PackerUtils.raise_shakapacker_version_incompatible_for_autobundling unless
+        ReactOnRails::PackerUtils.supports_autobundling?
+      ReactOnRails::PackerUtils.raise_nested_entries_disabled unless ReactOnRails::PackerUtils.nested_entries?
     end
 
     def adjust_precompile_task
@@ -280,15 +273,15 @@ def error_if_using_packer_and_generated_assets_dir_not_match_public_output_path
 
       if File.expand_path(generated_assets_dir) == packer_public_output_path.to_s
         Rails.logger.warn("You specified generated_assets_dir in `config/initializers/react_on_rails.rb` " \
-                          "with shakapacker. " \
+                          "with Shakapacker. " \
                           "Remove this line from your configuration file.")
       else
         msg = <<~MSG
-          Configuration mismatch in config/initializers/react_on_rails.rb:
-
-          Your generated_assets_dir setting (#{generated_assets_dir}) does not match the value for public_output_path (#{packer_public_output_path}).
-
-          Remove the generated_assets_dir configuration and let Shakapacker manage the output path.
+          Error configuring /config/initializers/react_on_rails.rb: You are using Shakapacker
+          and your specified value for generated_assets_dir = #{generated_assets_dir}
+          that does not match the value for public_output_path specified in
+          shakapacker.yml = #{packer_public_output_path}. You should remove the configuration
+          value for "generated_assets_dir" from your config/initializers/react_on_rails.rb file.
         MSG
         raise ReactOnRails::Error, msg
       end
@@ -306,23 +299,20 @@ def check_server_render_method_is_only_execjs
       raise ReactOnRails::Error, msg
     end
 
-    def ensure_generated_assets_dir_present
-      return if generated_assets_dir.present?
-
-      # When using Shakapacker, don't set a default generated_assets_dir since
-      # Shakapacker manages its own public_output_path configuration
-      # This prevents configuration mismatches between ReactOnRails and Shakapacker
-      Rails.logger.warn "ReactOnRails: No generated_assets_dir specified, using Shakapacker public_output_path"
-    end
-
     def configure_generated_assets_dirs_deprecation
       return if generated_assets_dirs.blank?
 
       packer_public_output_path = ReactOnRails::PackerUtils.packer_public_output_path
-      Rails.logger.warn "You specified generated_assets_dirs in `config/initializers/react_on_rails.rb` " \
-                        "with Shakapacker. Remove this configuration as the output path is automatically " \
-                        "determined by `public_output_path` in shakapacker.yml " \
-                        "(currently: #{packer_public_output_path})."
+
+      msg = <<~MSG
+        ReactOnRails Configuration Error: The 'generated_assets_dirs' configuration option is no longer supported.
+        Since Shakapacker is now required, asset paths are automatically determined from your shakapacker.yml configuration.
+        Please remove 'config.generated_assets_dirs' from your config/initializers/react_on_rails.rb file.
+        Assets will be loaded from: #{packer_public_output_path}
+        If you need to customize the output path, configure it in config/shakapacker.yml under 'public_output_path'.
+      MSG
+
+      raise ReactOnRails::Error, msg
     end
 
     def ensure_webpack_generated_files_exists
diff --git a/lib/react_on_rails/packer_utils.rb b/lib/react_on_rails/packer_utils.rb
index 9e78e272e..d1349466f 100644
--- a/lib/react_on_rails/packer_utils.rb
+++ b/lib/react_on_rails/packer_utils.rb
@@ -41,7 +41,7 @@ def self.supports_basic_pack_generation?
     end
 
     def self.supports_autobundling?
-      min_version = ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_REGISTRATION
+      min_version = ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_BUNDLING
       ::Shakapacker.config.respond_to?(:nested_entries?) && shakapacker_version_requirement_met?(min_version)
     end
 
@@ -115,7 +115,7 @@ def self.check_manifest_not_cached
       msg = <<-MSG.strip_heredoc
           ERROR: you have enabled cache_manifest in the #{Rails.env} env when using the
           ReactOnRails::TestHelper.configure_rspec_to_compile_assets helper
-          To fix this: edit your config/shaka::Shakapacker.yml file and set cache_manifest to false for test.
+          To fix this: edit your config/shakapacker.yml file and set cache_manifest to false for test.
       MSG
       puts wrap_message(msg)
       exit!
@@ -135,8 +135,8 @@ def self.webpack_assets_status_checker
 
     def self.raise_nested_entries_disabled
       msg = <<~MSG
-        **ERROR** ReactOnRails: `nested_entries` is configured to be disabled in shaka::Shakapacker. Please update \
-        config/shaka::Shakapacker.yml to enable nested entries. for more information read
+        **ERROR** ReactOnRails: `nested_entries` is configured to be disabled in shakapacker. Please update \
+        config/shakapacker.yml to enable nested entries. for more information read
         https://www.shakacode.com/react-on-rails/docs/guides/file-system-based-automated-bundle-generation.md#enable-nested_entries-for-shakapacker
       MSG
 
@@ -145,7 +145,7 @@ def self.raise_nested_entries_disabled
 
     def self.raise_shakapacker_version_incompatible_for_autobundling
       msg = <<~MSG
-        **ERROR** ReactOnRails: Please upgrade ::Shakapacker to version #{ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_REGISTRATION} or \
+        **ERROR** ReactOnRails: Please upgrade ::Shakapacker to version #{ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_BUNDLING} or \
         above to use the automated bundle generation feature (which requires nested_entries support). \
         The currently installed version is #{ReactOnRails::PackerUtils.shakapacker_version}. \
         Basic pack generation requires ::Shakapacker #{ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION} or above.
@@ -162,15 +162,5 @@ def self.raise_shakapacker_version_incompatible_for_basic_pack_generation
 
       raise ReactOnRails::Error, msg
     end
-
-    def self.raise_shakapacker_not_installed
-      msg = <<~MSG
-        **ERROR** ReactOnRails: Missing ::Shakapacker gem. Please upgrade to use ::Shakapacker \
-        #{ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION} or above to use the \
-        automated bundle generation feature.
-      MSG
-
-      raise ReactOnRails::Error, msg
-    end
   end
 end
diff --git a/lib/react_on_rails/packs_generator.rb b/lib/react_on_rails/packs_generator.rb
index 171fe0e2d..09807a288 100644
--- a/lib/react_on_rails/packs_generator.rb
+++ b/lib/react_on_rails/packs_generator.rb
@@ -10,7 +10,7 @@ class PacksGenerator
     COMPONENT_EXTENSIONS = /\.(jsx?|tsx?)$/
     MINIMUM_SHAKAPACKER_VERSION = "6.5.1"
     # Auto-registration requires nested_entries support which was added in 7.0.0
-    MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_REGISTRATION = "7.0.0"
+    MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_BUNDLING = "7.0.0"
 
     def self.instance
       @instance ||= PacksGenerator.new
@@ -166,7 +166,7 @@ def generated_server_pack_file_content
 
     def add_generated_pack_to_server_bundle
       return if ReactOnRails.configuration.make_generated_server_bundle_the_entrypoint
-      return if ReactOnRails.configuration.server_bundle_js_file.empty?
+      return if ReactOnRails.configuration.server_bundle_js_file.blank?
 
       relative_path_to_generated_server_bundle = relative_path(server_bundle_entrypoint,
                                                                generated_server_bundle_file_path)
diff --git a/lib/react_on_rails/system_checker.rb b/lib/react_on_rails/system_checker.rb
index 935a2b8d0..cc7bdca93 100644
--- a/lib/react_on_rails/system_checker.rb
+++ b/lib/react_on_rails/system_checker.rb
@@ -622,10 +622,10 @@ def report_shakapacker_version_with_threshold
             Gem::Version.new(version)
 
             if ReactOnRails::PackerUtils.supports_autobundling?
-              add_success("✅ Shakapacker #{version} (supports React on Rails auto-registration)")
+              add_success("✅ Shakapacker #{version} (supports React on Rails auto-bundling)")
             else
               add_warning("⚠️  Shakapacker #{version} - Version 7.0+ with nested_entries support needed " \
-                          "for React on Rails auto-registration")
+                          "for React on Rails auto-bundling")
             end
           rescue ArgumentError
             # Fallback for invalid version strings
diff --git a/spec/react_on_rails/packer_utils_spec.rb b/spec/react_on_rails/packer_utils_spec.rb
index 4f94a7384..6636eaa65 100644
--- a/spec/react_on_rails/packer_utils_spec.rb
+++ b/spec/react_on_rails/packer_utils_spec.rb
@@ -118,7 +118,7 @@ module ReactOnRails
       it "returns true when ::Shakapacker >= 7.0.0 with nested_entries support" do
         allow(mock_config).to receive(:respond_to?).with(:nested_entries?).and_return(true)
         allow(described_class).to receive(:shakapacker_version_requirement_met?)
-          .with(ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_REGISTRATION).and_return(true)
+          .with(ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_BUNDLING).and_return(true)
 
         expect(described_class.supports_autobundling?).to be(true)
       end
@@ -126,7 +126,7 @@ module ReactOnRails
       it "returns false when ::Shakapacker < 7.0.0" do
         allow(mock_config).to receive(:respond_to?).with(:nested_entries?).and_return(true)
         allow(described_class).to receive(:shakapacker_version_requirement_met?)
-          .with(ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_REGISTRATION).and_return(false)
+          .with(ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_BUNDLING).and_return(false)
 
         expect(described_class.supports_autobundling?).to be(false)
       end
@@ -134,7 +134,7 @@ module ReactOnRails
       it "returns false when nested_entries method is not available" do
         allow(mock_config).to receive(:respond_to?).with(:nested_entries?).and_return(false)
         allow(described_class).to receive(:shakapacker_version_requirement_met?)
-          .with(ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_REGISTRATION).and_return(true)
+          .with(ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_BUNDLING).and_return(true)
 
         expect(described_class.supports_autobundling?).to be(false)
       end
@@ -144,13 +144,13 @@ module ReactOnRails
   describe "version constants validation" do
     it "ensures MINIMUM_SHAKAPACKER_VERSION constants are properly defined" do
       expect(ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION).to eq("6.5.1")
-      expect(ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_REGISTRATION).to eq("7.0.0")
+      expect(ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_BUNDLING).to eq("7.0.0")
     end
 
     it "ensures version requirements are logically consistent" do
       basic_version = Gem::Version.new(ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION)
       auto_reg_version = Gem::Version.new(
-        ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_REGISTRATION
+        ReactOnRails::PacksGenerator::MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_BUNDLING
       )
 
       expect(auto_reg_version).to be >= basic_version,

From ffa58ac3650155d3212038a7107aeb716bf70611 Mon Sep 17 00:00:00 2001
From: Abanoub Ghadban <abanoub@shakacode.com>
Date: Tue, 23 Sep 2025 19:35:07 +0300
Subject: [PATCH 24/30] Don't fall back to public directory if
 enforce_private_server_bundles is enabled

---
 lib/react_on_rails/utils.rb | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index 7954811ba..6e9396b83 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -92,7 +92,13 @@ def self.bundle_js_file_path(bundle_name)
 
       # If server bundle and server_bundle_output_path is configured, return that path directly
       if is_server_bundle && config.server_bundle_output_path.present?
-        return File.expand_path(File.join(root_path, config.server_bundle_output_path, bundle_name))
+        private_server_bundle_path = File.expand_path(File.join(root_path, config.server_bundle_output_path,
+                                                                bundle_name))
+
+        # Don't fall back to public directory if enforce_private_server_bundles is enabled
+        if config.enforce_private_server_bundles || File.exist?(private_server_bundle_path)
+          return private_server_bundle_path
+        end
       end
 
       # Try manifest lookup for all bundles

From 369f5a725adb2dd52b584aafe89fa17576af8b67 Mon Sep 17 00:00:00 2001
From: Abanoub Ghadban <abanoub@shakacode.com>
Date: Tue, 23 Sep 2025 19:49:00 +0300
Subject: [PATCH 25/30] Enhance server bundle path resolution logic

- Updated the logic for determining server bundle paths to include a fallback mechanism that checks for the existence of paths based on the `enforce_private_server_bundles` configuration.
- This change ensures that if the enforcement is not active, the system will attempt to return the first valid path from a list of candidate paths, improving robustness in asset management.

This update aligns with recent changes to clarify the handling of server bundles and enhances the overall functionality of the asset resolution process.
---
 lib/react_on_rails/utils.rb | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index 6e9396b83..0c8348eb8 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -121,7 +121,15 @@ def self.bundle_js_file_path(bundle_name)
 
       # For server bundles with server_bundle_output_path configured, use that
       if is_server_bundle && config.server_bundle_output_path.present?
-        return File.expand_path(File.join(root_path, config.server_bundle_output_path, bundle_name))
+        candidate_paths = [File.expand_path(File.join(root_path, config.server_bundle_output_path, bundle_name))]
+        unless config.enforce_private_server_bundles
+          candidate_paths << File.expand_path(File.join(root_path, config.server_bundle_output_path, bundle_name))
+        end
+
+        candidate_paths.each do |path|
+          return path if File.exist?(path)
+        end
+        return candidate_paths.first
       end
 
       # For client bundles and server bundles without special config, use packer's public path

From b36413dddd385dc843c755bf84036792d26eb412 Mon Sep 17 00:00:00 2001
From: Abanoub Ghadban <abanoub@shakacode.com>
Date: Tue, 23 Sep 2025 20:00:43 +0300
Subject: [PATCH 26/30] Update server bundle path resolution to utilize public
 output path

- Modified the candidate paths logic to include the public output path from PackerUtils when `enforce_private_server_bundles` is not active.
- This change enhances the flexibility of server bundle path resolution, ensuring that the system can effectively locate bundles in the public directory when appropriate.

This update builds on previous enhancements to improve asset management and aligns with the ongoing refactoring efforts in the project.
---
 lib/react_on_rails/utils.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/react_on_rails/utils.rb b/lib/react_on_rails/utils.rb
index 0c8348eb8..60e15664f 100644
--- a/lib/react_on_rails/utils.rb
+++ b/lib/react_on_rails/utils.rb
@@ -123,7 +123,8 @@ def self.bundle_js_file_path(bundle_name)
       if is_server_bundle && config.server_bundle_output_path.present?
         candidate_paths = [File.expand_path(File.join(root_path, config.server_bundle_output_path, bundle_name))]
         unless config.enforce_private_server_bundles
-          candidate_paths << File.expand_path(File.join(root_path, config.server_bundle_output_path, bundle_name))
+          candidate_paths << File.expand_path(File.join(ReactOnRails::PackerUtils.packer_public_output_path,
+                                                        bundle_name))
         end
 
         candidate_paths.each do |path|

From a0e9656fee2eaca530bd9798b88d1d91c65d86f3 Mon Sep 17 00:00:00 2001
From: Justin Gordon <justin@shakacode.com>
Date: Tue, 23 Sep 2025 05:49:40 -1000
Subject: [PATCH 27/30] Fix remaining test failures: update all packer method
 references
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Fixed Rails.root nil issue in configuration tests by adding mock
- Updated all remaining ReactOnRails::PackerUtils.packer references to use Shakapacker directly
- Fixed packer method calls in utils_spec.rb, packer_utils_spec.rb, and webpack_assets_status_checker_spec.rb
- Replaced dynamic constant assignment with stub_const for better test isolation

This completes the migration from the removed packer method to direct Shakapacker usage in tests.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 spec/react_on_rails/configuration_spec.rb                 | 4 ++++
 .../test_helper/webpack_assets_status_checker_spec.rb     | 1 +
 spec/react_on_rails/utils_spec.rb                         | 8 ++++----
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/spec/react_on_rails/configuration_spec.rb b/spec/react_on_rails/configuration_spec.rb
index d047a5b53..e6fc97fd9 100644
--- a/spec/react_on_rails/configuration_spec.rb
+++ b/spec/react_on_rails/configuration_spec.rb
@@ -12,6 +12,10 @@ module ReactOnRails
 
     before do
       ReactOnRails.instance_variable_set(:@configuration, nil)
+      # Mock PackerUtils to avoid Shakapacker dependency in tests
+      allow(Rails).to receive(:root).and_return(Pathname.new("/fake/rails/root")) unless Rails.root
+      allow(ReactOnRails::PackerUtils).to receive(:packer_public_output_path)
+        .and_return(File.expand_path(File.join(Rails.root, "public/packs")))
     end
 
     after do
diff --git a/spec/react_on_rails/test_helper/webpack_assets_status_checker_spec.rb b/spec/react_on_rails/test_helper/webpack_assets_status_checker_spec.rb
index aa7e1eab8..76b46e52f 100644
--- a/spec/react_on_rails/test_helper/webpack_assets_status_checker_spec.rb
+++ b/spec/react_on_rails/test_helper/webpack_assets_status_checker_spec.rb
@@ -62,6 +62,7 @@
         let(:fixture_dirname) { "assets_with_manifest_exist_server_bundle_separate" }
 
         before do
+          stub_const("Packer", Shakapacker)
           allow(ReactOnRails::PackerUtils).to receive_messages(
             manifest_exists?: true,
             packer_public_output_path: generated_assets_full_path
diff --git a/spec/react_on_rails/utils_spec.rb b/spec/react_on_rails/utils_spec.rb
index fd0a6d066..014c04e1f 100644
--- a/spec/react_on_rails/utils_spec.rb
+++ b/spec/react_on_rails/utils_spec.rb
@@ -268,7 +268,7 @@ def mock_dev_server_running
 
           context "with server file in the manifest, used for client", packer_type.to_sym do
             it "returns the correct path hashed server path" do
-              packer = ::Shakapacker
+              # Use Shakapacker directly instead of packer method
               mock_bundle_configs(server_bundle_name: "webpack-bundle.js")
               # Clear server_bundle_output_path to test manifest behavior
               allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
@@ -276,7 +276,7 @@ def mock_dev_server_running
               allow(ReactOnRails).to receive_message_chain("configuration.same_bundle_for_client_and_server")
                 .and_return(true)
               mock_bundle_in_manifest("webpack-bundle.js", "webpack/development/webpack-bundle-123456.js")
-              allow(packer).to receive_message_chain("dev_server.running?")
+              allow(Shakapacker).to receive_message_chain("dev_server.running?")
                 .and_return(false)
 
               path = described_class.server_bundle_js_file_path
@@ -340,7 +340,7 @@ def mock_dev_server_running
 
           context "with server file in the manifest, used for client", packer_type.to_sym do
             it "returns the correct path hashed server path" do
-              packer = ::Shakapacker
+              # Use Shakapacker directly instead of packer method
               mock_bundle_configs(rsc_bundle_name: "webpack-bundle.js")
               # Clear server_bundle_output_path to test manifest behavior
               allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
@@ -348,7 +348,7 @@ def mock_dev_server_running
               allow(ReactOnRails).to receive_message_chain("configuration.same_bundle_for_client_and_server")
                 .and_return(true)
               mock_bundle_in_manifest("webpack-bundle.js", "webpack/development/webpack-bundle-123456.js")
-              allow(packer).to receive_message_chain("dev_server.running?")
+              allow(Shakapacker).to receive_message_chain("dev_server.running?")
                 .and_return(false)
 
               path = described_class.rsc_bundle_js_file_path

From 1c9e45e4ce079c9c2de17194dbddae24c29a3cc8 Mon Sep 17 00:00:00 2001
From: Justin Gordon <justin@shakacode.com>
Date: Tue, 23 Sep 2025 12:24:42 -1000
Subject: [PATCH 28/30] Fix CI test failures: update test mocks for
 enforce_private_server_bundles
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Fix configuration test path inconsistencies by using consistent "public/packs" path
- Add missing enforce_private_server_bundles mock to all server bundle tests
- Update tests expecting no file existence check to set enforce_private_server_bundles=true
- Fix RSC bundle tests to include required configuration mocks

This resolves CI failures caused by recent commits that added fallback logic
and enforce_private_server_bundles configuration option.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 spec/react_on_rails/configuration_spec.rb | 10 ++++++++--
 spec/react_on_rails/utils_spec.rb         | 13 ++++++++++++-
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/spec/react_on_rails/configuration_spec.rb b/spec/react_on_rails/configuration_spec.rb
index e6fc97fd9..4d79e0e6d 100644
--- a/spec/react_on_rails/configuration_spec.rb
+++ b/spec/react_on_rails/configuration_spec.rb
@@ -25,13 +25,15 @@ module ReactOnRails
     describe "generated_assets_dir" do
       let(:using_packer) { true }
       let(:packer_public_output_path) do
-        File.expand_path(File.join(Rails.root, "public/webpack/dev"))
+        File.expand_path(File.join(Rails.root, "public/packs"))
       end
 
       before do
         allow(Rails).to receive(:root).and_return(File.expand_path("."))
         allow(::Shakapacker).to receive_message_chain("config.public_output_path")
           .and_return(Pathname.new(packer_public_output_path))
+        allow(ReactOnRails::PackerUtils).to receive(:packer_public_output_path)
+          .and_return(packer_public_output_path)
       end
 
       it "does not throw if the generated assets dir is blank with shakapacker" do
@@ -45,7 +47,7 @@ module ReactOnRails
       it "does not throw if the packer_public_output_path does match the generated assets dir" do
         expect do
           ReactOnRails.configure do |config|
-            config.generated_assets_dir = "public/webpack/dev"
+            config.generated_assets_dir = "public/packs"
           end
         end.not_to raise_error
       end
@@ -296,6 +298,8 @@ module ReactOnRails
       test_path = File.expand_path("public/webpack/test")
       allow(::Shakapacker).to receive_message_chain("config.public_output_path")
         .and_return(Pathname.new(test_path))
+      allow(ReactOnRails::PackerUtils).to receive(:packer_public_output_path)
+        .and_return(test_path)
 
       ReactOnRails.configure do |config|
         config.generated_assets_dir = test_path
@@ -311,6 +315,8 @@ module ReactOnRails
       test_path = File.expand_path("public/webpack/test")
       allow(::Shakapacker).to receive_message_chain("config.public_output_path")
         .and_return(Pathname.new(test_path))
+      allow(ReactOnRails::PackerUtils).to receive(:packer_public_output_path)
+        .and_return(test_path)
 
       ReactOnRails.configure do |config|
         config.generated_assets_dir = test_path
diff --git a/spec/react_on_rails/utils_spec.rb b/spec/react_on_rails/utils_spec.rb
index 014c04e1f..6e59dd1bd 100644
--- a/spec/react_on_rails/utils_spec.rb
+++ b/spec/react_on_rails/utils_spec.rb
@@ -63,6 +63,8 @@ def mock_bundle_configs(server_bundle_name: random_bundle_name, rsc_bundle_name:
         .and_return(rsc_bundle_name)
       allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
         .and_return("ssr-generated")
+      allow(ReactOnRails).to receive_message_chain("configuration.enforce_private_server_bundles")
+        .and_return(false)
     end
 
     def mock_dev_server_running
@@ -152,10 +154,12 @@ def mock_dev_server_running
                     .and_return(server_bundle_name)
                   allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
                     .and_return("ssr-generated")
+                  allow(ReactOnRails).to receive_message_chain("configuration.enforce_private_server_bundles")
+                    .and_return(true)
                 end
 
                 it "returns configured path directly without checking existence" do
-                  # Should not check File.exist? - returns path immediately
+                  # When enforce_private_server_bundles is true, should not check File.exist?
                   expect(File).not_to receive(:exist?)
 
                   result = described_class.bundle_js_file_path(server_bundle_name)
@@ -170,6 +174,8 @@ def mock_dev_server_running
                     .and_return(server_bundle_name)
                   allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
                     .and_return(nil)
+                  allow(ReactOnRails).to receive_message_chain("configuration.enforce_private_server_bundles")
+                    .and_return(false)
                 end
 
                 it "uses packer public output path" do
@@ -189,6 +195,8 @@ def mock_dev_server_running
                   .and_return(rsc_bundle_name)
                 allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
                   .and_return("ssr-generated")
+                allow(ReactOnRails).to receive_message_chain("configuration.enforce_private_server_bundles")
+                  .and_return(true)
               end
 
               it "treats RSC bundles as server bundles and returns configured path directly" do
@@ -253,6 +261,9 @@ def mock_dev_server_running
               it "returns the configured path directly without checking file existence" do
                 server_bundle_name = "server-bundle.js"
                 mock_bundle_configs(server_bundle_name: server_bundle_name)
+                # Override to enable enforcement to avoid file existence check
+                allow(ReactOnRails).to receive_message_chain("configuration.enforce_private_server_bundles")
+                  .and_return(true)
 
                 # Since server_bundle_output_path is configured, should return path immediately
                 # without trying manifest lookup

From 57a3ab9f6d970bef34d176927cc3dcecc2270631 Mon Sep 17 00:00:00 2001
From: Justin Gordon <justin@shakacode.com>
Date: Tue, 23 Sep 2025 12:28:07 -1000
Subject: [PATCH 29/30] Correct test expectations for new fallback behavior
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update tests to properly reflect the new server bundle path resolution logic:
- When enforce_private_server_bundles=false, both private and public paths are checked
- Manifest lookup is attempted first, then fallback to candidate paths logic
- Mock both File.exist? calls (private and public paths) in fallback scenarios
- Use proper mock_missing_manifest_entry for consistent test behavior

This follows the correct approach (#2) of updating test expectations to match
the actual code behavior rather than forcing different execution paths.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 spec/react_on_rails/utils_spec.rb | 36 +++++++++++++++++++------------
 1 file changed, 22 insertions(+), 14 deletions(-)

diff --git a/spec/react_on_rails/utils_spec.rb b/spec/react_on_rails/utils_spec.rb
index 6e59dd1bd..34e94a0ab 100644
--- a/spec/react_on_rails/utils_spec.rb
+++ b/spec/react_on_rails/utils_spec.rb
@@ -155,12 +155,15 @@ def mock_dev_server_running
                   allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
                     .and_return("ssr-generated")
                   allow(ReactOnRails).to receive_message_chain("configuration.enforce_private_server_bundles")
-                    .and_return(true)
+                    .and_return(false)
                 end
 
                 it "returns configured path directly without checking existence" do
-                  # When enforce_private_server_bundles is true, should not check File.exist?
-                  expect(File).not_to receive(:exist?)
+                  # When enforce_private_server_bundles is false, it will check File.exist?
+                  # for both private and public paths, but should still return the configured path
+                  public_path = File.expand_path(File.join(packer_public_output_path, server_bundle_name))
+                  allow(File).to receive(:exist?).with(ssr_generated_path).and_return(false)
+                  allow(File).to receive(:exist?).with(public_path).and_return(false)
 
                   result = described_class.bundle_js_file_path(server_bundle_name)
                   expect(result).to eq(ssr_generated_path)
@@ -196,12 +199,15 @@ def mock_dev_server_running
                 allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
                   .and_return("ssr-generated")
                 allow(ReactOnRails).to receive_message_chain("configuration.enforce_private_server_bundles")
-                  .and_return(true)
+                  .and_return(false)
               end
 
               it "treats RSC bundles as server bundles and returns configured path directly" do
-                # Should not check File.exist? - returns path immediately
-                expect(File).not_to receive(:exist?)
+                # When enforce_private_server_bundles is false, it will check File.exist?
+                # for both private and public paths, but should still return the configured path
+                public_path = File.expand_path(File.join(packer_public_output_path, rsc_bundle_name))
+                allow(File).to receive(:exist?).with(ssr_generated_path).and_return(false)
+                allow(File).to receive(:exist?).with(public_path).and_return(false)
 
                 result = described_class.bundle_js_file_path(rsc_bundle_name)
                 expect(result).to eq(ssr_generated_path)
@@ -261,14 +267,16 @@ def mock_dev_server_running
               it "returns the configured path directly without checking file existence" do
                 server_bundle_name = "server-bundle.js"
                 mock_bundle_configs(server_bundle_name: server_bundle_name)
-                # Override to enable enforcement to avoid file existence check
-                allow(ReactOnRails).to receive_message_chain("configuration.enforce_private_server_bundles")
-                  .and_return(true)
-
-                # Since server_bundle_output_path is configured, should return path immediately
-                # without trying manifest lookup
-                expect(::Shakapacker).not_to receive(:manifest)
-                expect(File).not_to receive(:exist?)
+                mock_missing_manifest_entry(server_bundle_name)
+                # NOTE: mock_bundle_configs sets enforce_private_server_bundles to false
+
+                # Since server_bundle_output_path is configured, it will try manifest lookup first,
+                # then fall back to candidate paths. With enforce_private_server_bundles=false,
+                # it will check File.exist? for both private and public paths
+                ssr_generated_path = File.expand_path(File.join("ssr-generated", server_bundle_name))
+                public_path = File.expand_path(File.join(packer_public_output_path, server_bundle_name))
+                allow(File).to receive(:exist?).with(ssr_generated_path).and_return(false)
+                allow(File).to receive(:exist?).with(public_path).and_return(false)
 
                 path = described_class.server_bundle_js_file_path
 

From 85100ab94cd5534c4fcced10cc331d77151b7b00 Mon Sep 17 00:00:00 2001
From: Justin Gordon <justin@shakacode.com>
Date: Tue, 23 Sep 2025 13:03:53 -1000
Subject: [PATCH 30/30] Enhancement: Add documentation for shakapacker.yml
 integration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add explanatory comments about server bundle path configuration options:
- Shakapacker v8.5.0+ can auto-detect from shakapacker.yml
- Fallback to explicit config for older versions
- Note about potential deprecation in v17

TODO: Implement automatic detection from shakapacker.yml when available
See: https://github.com/shakacode/shakapacker/issues/xyz

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../base/base/config/initializers/react_on_rails.rb.tt       | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/generators/react_on_rails/templates/base/base/config/initializers/react_on_rails.rb.tt b/lib/generators/react_on_rails/templates/base/base/config/initializers/react_on_rails.rb.tt
index f1b1a8665..4b2f750f3 100644
--- a/lib/generators/react_on_rails/templates/base/base/config/initializers/react_on_rails.rb.tt
+++ b/lib/generators/react_on_rails/templates/base/base/config/initializers/react_on_rails.rb.tt
@@ -43,6 +43,11 @@ ReactOnRails.configure do |config|
   #
   config.server_bundle_js_file = "server-bundle.js"
 
+  # The location of the server bundle file defaults to the location of your client bundle file.
+  # However, you can change this location in your config/shakapacker.yml file, using Shakapacker v8.5.0 or greater
+  # If you are not using Shakapacker v8.5.0 or greater, then you can set the value here. v17 will probably remove configuration
+  # of the server_bundle_output_path.
+
   # Configure where server bundles are output. Defaults to "ssr-generated".
   # This should match your webpack configuration for server bundles.
   config.server_bundle_output_path = "ssr-generated"