ENG-9801: sync reflex.lock/package.json to .web/package.json

[masenf]

Every time the framework requests installation of packages, sync the package.json along with the lock files, so out of band changes are picked up.

After init, sync any package.json or lock files to reflex.lock so subsequent installs keep the initialized hooks and overrides.

The reflex.lock/package.json is interesting because it's checked in, and it's the canonical copy of package.json that will replace what exists in .web... but it's also a deletable lock-ish file that will itself be recreated from the compiled app. After this change though, the reflex.lock/package.json is now an appropriate place to keep local changes like package version overrides.

PR written without AI assistance 😅

[linear-code]

ENG-9801

[codspeed-hq]

Merging this PR will not alter performance

✅ 26 untouched benchmarks
⏩ 8 skipped benchmarks¹

---

_{Comparing masenf/sync-package-json-on-install (de029ff) with main (474f5b6)}

Footnotes

1. 8 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[greptile-apps]

Greptile Summary

This PR folds reflex.lock/package.json into the existing lockfile sync machinery so it is copied root→web before every install and persisted web→root after every install and reflex init. It also fixes the pre-existing gap where user-added overrides were silently discarded on init, and adds a passthrough mechanism for arbitrary extra fields (packageManager, engines, etc.) in the persisted package.json.

• NO_PRUNE_LOCKFILE_NAMES gates package.json under prune=False semantics so a missing root copy never deletes the template-provided .web/package.json, while a present root copy takes precedence.
• _compile_package_json now merges user overrides under framework overrides (framework wins on conflict) and forwards any unknown persisted fields via **persisted into the updated package_json_template(**additional_keys).
• initialize_web_directory gains a sync_web_lockfiles_to_root() call after initialize_package_json() so the compiled result is immediately persisted; tests are expanded with coverage for override merging, null fields, non-object root, additional-field passthrough, and the prune=False behavior.

Confidence Score: 5/5

Safe to merge; the changes are well-scoped file-copy utilities with no shared mutable state, and the new test suite thoroughly covers the added paths.

All changed paths are file I/O helpers with straightforward before/after semantics. The previously-noted overrides regression is correctly addressed. No logic paths were found that could silently drop data or corrupt state.

No files require special attention.

Important Files Changed

Filename	Overview
reflex/utils/frontend_skeleton.py	Core logic change: package.json is now included in the lockfile sync cycle (root→web and web→root) using prune=False semantics; user overrides are now correctly merged over framework overrides in _compile_package_json.
packages/reflex-base/src/reflex_base/compiler/templates.py	package_json_template now accepts **additional_keys so extra fields (e.g. packageManager, engines) pass through; type and name are handled explicitly to prevent duplication or misplacement.
reflex/utils/js_runtimes.py	Removes the now-redundant sync_web_package_json_to_root() call (package.json sync is folded into the existing sync_web_lockfiles_to_root path); _existing_web_package_sections switches to the shared get_web_lockfile_path helper.
tests/units/test_prerequisites.py	Test fixture updated to reflect root_package_json as the canonical source; adds new coverage for prune=False semantics, override merging, additional-field passthrough, null-field recovery, and non-object root handling.

_{Reviews (6): Last reviewed commit: "Merge branch 'main' into masenf/sync-pac..." | Re-trigger Greptile}

[masenf]

ideally we would consolidate the package.json combining code in frontend_skeleton.py with that of templates.py... but i'm holding off on that change until 0.10.0 when we combine the compiler into reflex-base, otherwise we'll be introducing cross-package incompatibility for no real gain other than hygiene.

[FarhanAliRaza]

Maybe we want to add tests for these cases
(a) prune=False preserving .web/package.json when
the root copy is absent
(b) initialize_web_directory persisting package.json back to root.