ENG-9801: sync reflex.lock/package.json to .web/package.json

[masenf]

Every time the framework requests installation of packages, sync the package.json along with the lock files, so out of band changes are picked up.

After init, sync any package.json or lock files to reflex.lock so subsequent installs keep the initialized hooks and overrides.

The reflex.lock/package.json is interesting because it's checked in, and it's the canonical copy of package.json that will replace what exists in .web... but it's also a deletable lock-ish file that will itself be recreated from the compiled app. After this change though, the reflex.lock/package.json is now an appropriate place to keep local changes like package version overrides.

PR written without AI assistance 😅

[linear-code]

ENG-9801

[codspeed-hq]

Merging this PR will not alter performance

✅ 26 untouched benchmarks
⏩ 8 skipped benchmarks¹

---

_{Comparing masenf/sync-package-json-on-install (0d4d747) with main (7562344)}

Footnotes

1. 8 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[greptile-apps]

Greptile Summary

This PR unifies package.json handling with the existing lockfile sync pipeline so that reflex.lock/package.json is always kept in sync with .web/package.json — both before and after every package install. The change also fixes the previously reported issue where user-added overrides in reflex.lock/package.json were discarded on reflex init, and extends package_json_template to pass through arbitrary user-defined fields (e.g. packageManager, engines).

• Lockfile pipeline extended: package.json is added to NO_PRUNE_LOCKFILE_NAMES so sync_root_lockfiles_to_web / sync_web_lockfiles_to_root carry it automatically; the separate sync_web_package_json_to_root() helper is removed as redundant.
• _compile_package_json now merges: user overrides are preserved (framework entries win on conflict), user scripts are preserved (framework dev/export entries refresh on top), and any unrecognized fields in the persisted file are passed through unchanged to package_json_template.
• initialize_web_directory round-trips: after initialize_package_json() writes the compiled result, sync_web_lockfiles_to_root() immediately persists it back, so the merged/compiled state is always what is stored in reflex.lock/.

Confidence Score: 5/5

Safe to merge — the changes are well-scoped, the previous concern about overrides being dropped on init has been addressed, and the new test coverage is thorough.

The logic flows (init, install, sync-back) have all been updated consistently, the **persisted spread correctly carries only unrecognised fields after all framework-managed keys are explicitly popped, and the prune=False flag prevents accidental deletion of .web/package.json when no root copy exists yet. Four new unit tests cover null fields, non-object roots, user override merging, and arbitrary pass-through fields. No defects found in the changed paths.

No files require special attention.

Important Files Changed

Filename	Overview
reflex/utils/frontend_skeleton.py	Consolidates package.json into the lockfile sync pipeline: removes dedicated helpers, adds NO_PRUNE_LOCKFILE_NAMES to carry package.json through sync functions, and calls sync_web_lockfiles_to_root() after initialize_package_json() so the compiled result is immediately persisted. _compile_package_json now merges user overrides and passes through arbitrary fields via **persisted.
packages/reflex-base/src/reflex_base/compiler/templates.py	Adds **additional_keys to package_json_template; pops type (always 'module') and name (defaults to 'reflex') before spreading remaining keys into the output JSON, enabling pass-through of user fields like packageManager and engines.
reflex/utils/js_runtimes.py	Removes the now-redundant sync_web_package_json_to_root() call from install_frontend_packages and updates _existing_web_package_sections to use the generic get_web_lockfile_path helper.
tests/units/test_prerequisites.py	Updates all install-flow tests to write to root_package_json instead of web_package_json, aligning with the new data-flow. Adds four new unit tests for null fields, non-object root, user overrides, and additional pass-through fields.
news/6658.bugfix.md	Changelog entry describing the lock-file/package.json alignment fix.
packages/reflex-base/news/6658.feature.md	Changelog entry for the **additional_keys extension to package_json_template.

_{Reviews (4): Last reviewed commit: "Move comment above line (ruff cleanup)" | Re-trigger Greptile}

[masenf]

ideally we would consolidate the package.json combining code in frontend_skeleton.py with that of templates.py... but i'm holding off on that change until 0.10.0 when we combine the compiler into reflex-base, otherwise we'll be introducing cross-package incompatibility for no real gain other than hygiene.