Fix OSS npm package license metadata

[justin808]

Why

The published open-source react-on-rails@17.0.0 npm artifact reports
SEE LICENSE IN LICENSE.md, even though React on Rails OSS is MIT-licensed.
Its packed license was inherited from the monorepo root and also described the
separately licensed Pro code, making the OSS package metadata ambiguous.

This was reported in the
ShakaCode Slack thread
and reproduced from the real npm tarball. npm versions are immutable, so a new
17.x patch artifact is required.

What changed

• Declare the OSS npm package license as MIT.
• Pack a package-local MIT-only LICENSE.md.
• Add a regression guard that creates the real pnpm pack tarball and checks:
  • packed package.json reports MIT;
  • package/LICENSE.md exists and matches the approved MIT text;
  • no Pro, commercial, or subscription wording is present.
• Run the packed-artifact guard through the existing OSS package test command.

The private workspace metadata and both Pro package license contracts are
unchanged.

Release scope

This PR targets release/17.0.1, cut from the immutable v17.0.0 tag, so the
patch cannot pick up unrelated unreleased work from main. After merge, the
release-train changelog flow will stamp 17.0.1.rc.0; the fix will also be
forward-ported to main.

Verification

• TDD red: the original real tarball reported
  SEE LICENSE IN LICENSE.md and had no package-local license.
• pnpm --filter react-on-rails run test:package-license
• pnpm --filter react-on-rails run test — 26 suites / 361 tests
• pnpm run lint
• pnpm start format.listDifferent
• (cd react_on_rails && BUNDLE_GEMFILE=../Gemfile bundle exec rubocop)
• .agents/bin/validate --changed
• Independent Sol/xhigh QA reproduced the tarball inspection on Node 20.19.0
  and Node 22, confirmed exact MIT metadata/content, clean lifecycle behavior,
  unchanged root/Pro license files, and a clean worktree.

Process gap disposition

• Mechanism target: script
• Motivating miss: package workspace migration allowed the OSS package to
  inherit ambiguous monorepo license material.
• Replay evidence: the guard fails against the v17.0.0 packed artifact and
  passes against this exact head.
• Non-goal: changing the monorepo root license or any Pro licensing terms.

Churn

None. The change is limited to three OSS npm package files.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 61d51e3e-21ae-490e-9a50-45228f6f03c1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/react-on-rails-mit-license-metadata

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[justin808]

+ci-status

[github-actions]

CI Status

Head SHA: 176097f0e59d
Changed files: 3
Docs-only heuristic (matches ci-changes-detector metadata paths): no
ready-for-hosted-ci label: absent
force-full-hosted-ci label: absent
Current hosted-CI waiver: not present for this SHA
Automatic release-target hosted mode: active
Observed exact-head coverage: modes[release-full=9]; successful=3, pending=6, failed=0, missing=0

Release-target policy already enables hosted CI for this same-repository PR.

[greptile-apps]

Greptile Summary

Corrects the OSS npm package’s license metadata.

• Declares the package license as MIT and includes a package-local MIT license.
• Adds a packed-artifact check for the published metadata and license contents.
• Runs the new check through the existing package test command.

Confidence Score: 5/5

The PR appears safe to merge with no actionable defects identified.

The package-local license matches the intended OSS MIT terms, is explicitly included in the artifact, and the regression check validates the same package structure used for publication.

Important Files Changed

Filename	Overview
packages/react-on-rails/LICENSE.md	Adds the package-local MIT license text intended for the OSS artifact.
packages/react-on-rails/package.json	Declares MIT metadata, includes the license in packed files, and wires the artifact check into tests.
packages/react-on-rails/scripts/check-package-license.mjs	Packs the real package and verifies its license metadata, exact license contents, and exclusion of Pro licensing language.

_{Reviews (1): Last reviewed commit: "Fix OSS npm package license metadata" | Re-trigger Greptile}

[claude]

Review summary

Focused, well-scoped fix. Verified:

• The new packages/react-on-rails/LICENSE.md text is byte-for-byte identical to the MIT section of the root LICENSE.md, so the copyright/year notices stay consistent.
• package.json's license field change to MIT and the added LICENSE.md entry in files are correctly scoped to the OSS package only — packages/react-on-rails-pro/package.json and packages/react-on-rails-pro-node-renderer/package.json still correctly declare SEE LICENSE IN LICENSE.md, so Pro licensing terms are untouched.
• No workspace:* dependencies in this package, so pnpm pack in the new guard script packs cleanly standalone; CI (package-js-tests.yml) runs this package's tests only on ubuntu-22.04, so the tar/pnpm pack combo in the script is CI-safe.
• check-package-license.mjs uses execFileSync with argument arrays (no shell interpolation), and cleans up its temp directory in a finally block — good practice for a script that shells out.

One non-blocking nit left as an inline comment: the expected MIT license text is hardcoded as a duplicate literal in the check script rather than read from the shipped LICENSE.md. It's consistent today, but the duplication is a drift risk if the license text is ever edited.

No bugs, security issues, or blockers found. This looks safe to merge for the 17.0.1 patch.

[github-actions]

size-limit report 📦

Path	Size
react-on-rails/client bundled (gzip)	63.54 KB (0%)
react-on-rails/client bundled (gzip) (time)	63.54 KB (0%)
react-on-rails/client bundled (brotli)	54.55 KB (0%)
react-on-rails/client bundled (brotli) (time)	54.55 KB (0%)
react-on-rails-pro/client bundled (gzip)	64.55 KB (0%)
react-on-rails-pro/client bundled (gzip) (time)	64.55 KB (0%)
react-on-rails-pro/client bundled (brotli)	55.49 KB (0%)
react-on-rails-pro/client bundled (brotli) (time)	55.49 KB (0%)
registerServerComponent/client bundled (gzip)	135.08 KB (0%)
registerServerComponent/client bundled (gzip) (time)	135.08 KB (0%)
registerServerComponent/client bundled (brotli)	81.47 KB (0%)
registerServerComponent/client bundled (brotli) (time)	81.47 KB (0%)
wrapServerComponentRenderer/client bundled (gzip)	127.5 KB (0%)
wrapServerComponentRenderer/client bundled (gzip) (time)	127.5 KB (0%)
wrapServerComponentRenderer/client bundled (brotli)	74.61 KB (0%)
wrapServerComponentRenderer/client bundled (brotli) (time)	74.61 KB (0%)

[justin808]

Address-review summary

Scan scope: default scan of the full PR history through 2026-07-26T00:26:24Z; no prior address-review cutoff existed.

Mattered

• None. Claude and Greptile found no blockers on exact head 176097f0e59d; independent Sol/xhigh QA was also clean.

Optional

• Declined Claude’s duplicate-literal nit: the hardcoded MIT text is intentionally independent from the source file so the real tarball is checked against an approved license oracle. A source/license mismatch should fail and require deliberate review; reading LICENSE.md as its own expected value would weaken this guarantee. Replied with the exact-head evidence and resolved the thread.

Skipped

• CodeRabbit’s skipped-review notice, the CI-status request/response, the bundle-size report, and the clean reviewer summary posts were status-only; no action was required.

Deferred-work tracking: none.

Next default scan starts after this comment. Say check all reviews to rescan the full PR.