ENG-9801: sync reflex.lock/package.json to .web/package.json

[masenf]

Every time the framework requests installation of packages, sync the package.json along with the lock files, so out of band changes are picked up.

After init, sync any package.json or lock files to reflex.lock so subsequent installs keep the initialized hooks and overrides.

The reflex.lock/package.json is interesting because it's checked in, and it's the canonical copy of package.json that will replace what exists in .web... but it's also a deletable lock-ish file that will itself be recreated from the compiled app. After this change though, the reflex.lock/package.json is now an appropriate place to keep local changes like package version overrides.

PR written without AI assistance 😅

[linear-code]

ENG-9801

[codspeed-hq]

Merging this PR will not alter performance

✅ 26 untouched benchmarks
⏩ 8 skipped benchmarks¹

---

_{Comparing masenf/sync-package-json-on-install (4b2dcc4) with main (9378594)}

Footnotes

1. 8 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[greptile-apps]

Greptile Summary

This PR unifies package.json management under the same lockfile sync machinery already used for bun.lock, so that reflex.lock/package.json acts as a durable canonical copy that survives reflex init. _compile_package_json now preserves user-added overrides, scripts, and arbitrary extra fields (e.g. packageManager, engines), with framework-owned entries winning conflicts.

• NO_PRUNE_LOCKFILE_NAMES is introduced for package.json so the .web copy is not deleted when no root counterpart exists (contrast with lock files, which are pruned).
• package_json_template gains **additional_keys to pass extra persisted fields through to the rendered output.
• sync_web_package_json_to_root / get_root_package_json_path / get_web_package_json_path are removed and replaced by the unified get_root_lockfile_path / get_web_lockfile_path helpers; tests are updated accordingly.

Confidence Score: 5/5

Safe to merge — the change is well-scoped, idempotent, and fully tested.

The sync logic is straightforward: package.json is added to the existing lockfile round-trip, prune=False correctly prevents deleting the .web copy when no root counterpart exists, and _compile_package_json handles all the merge cases (user overrides preserved, framework wins conflicts, arbitrary extra fields pass through). Every new behaviour is covered by dedicated unit tests including null-field handling, non-object root, and the full initialize_web_directory round-trip.

No files require special attention.

Important Files Changed

Filename	Overview
reflex/utils/frontend_skeleton.py	Core change: adds package.json to both sync directions via NO_PRUNE_LOCKFILE_NAMES; _compile_package_json now preserves user overrides/scripts/extra fields; dead helpers removed cleanly.
packages/reflex-base/src/reflex_base/compiler/templates.py	Adds **additional_keys to package_json_template; pops type and name before spread to keep field ordering and avoid duplicate keys.
reflex/utils/js_runtimes.py	Removes sync_web_package_json_to_root call (now handled by unified sync_web_lockfiles_to_root) and switches _existing_web_package_sections to use get_web_lockfile_path.
tests/units/test_prerequisites.py	Rewrites test fixtures to use root_package_json as the source of truth; adds comprehensive new tests for prune=False semantics, user override preservation, additional field pass-through, and null/non-object root handling.

_{Reviews (5): Last reviewed commit: "Add tests for package.json prune and ini..." | Re-trigger Greptile}

[masenf]

ideally we would consolidate the package.json combining code in frontend_skeleton.py with that of templates.py... but i'm holding off on that change until 0.10.0 when we combine the compiler into reflex-base, otherwise we'll be introducing cross-package incompatibility for no real gain other than hygiene.

[FarhanAliRaza]

Maybe we want to add tests for these cases
(a) prune=False preserving .web/package.json when
the root copy is absent
(b) initialize_web_directory persisting package.json back to root.