Move bun.lock under reflex.lock/bun.lock

[masenf]

This will avoid conflicts with reflex apps that also host some javascript app in the same directory.

Followup for #6289

[greptile-apps]

Greptile Summary

This PR relocates the canonical Bun lockfile from the project root (./bun.lock) into a dedicated reflex.lock/bun.lock subdirectory, preventing collisions when a user also maintains their own Bun-managed JavaScript project in the same directory.

• Adds ROOT_LOCKFILE_DIR = "reflex.lock" constant, updates get_root_bun_lock_path() accordingly, and creates the directory in sync_web_bun_lock_to_root() before copying the file.
• Updates tests and documentation to match the new path; no migration is provided for projects that already have bun.lock at the old project-root location.

Confidence Score: 3/5

Safe to merge for new projects, but existing deployments will silently discard their pinned bun.lock on first run after upgrading.

The path relocation is clean and all new code is correct, but there is no migration for existing ./bun.lock files. Any project that already has a committed lockfile will lose it on the first reflex init post-upgrade: sync_root_bun_lock_to_web will find nothing at the new location, delete the mirrored .web/bun.lock, and allow bun install to regenerate from scratch — potentially floating all package versions to their latest compatible releases.

reflex/utils/frontend_skeleton.py — the sync functions need a one-time migration check for the old ./bun.lock location before this lands for existing users.

Important Files Changed

Filename	Overview
packages/reflex-base/src/reflex_base/constants/installer.py	Adds ROOT_LOCKFILE_DIR = "reflex.lock" constant to the Bun namespace — minimal, well-documented change.
reflex/utils/frontend_skeleton.py	Updates get_root_bun_lock_path() to use the new reflex.lock/ subdirectory and adds mkdir in sync_web_bun_lock_to_root(); lacks migration logic for users who already have bun.lock at the project root.
tests/units/test_prerequisites.py	Tests correctly updated to use the new reflex.lock/bun.lock path and pre-create the parent directory.
docs/getting_started/project-structure.md	Documentation updated to reflect the new reflex.lock/ directory and explain why it exists.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[reflex init / reflex run] --> B[sync_root_bun_lock_to_web]
    B --> C{reflex.lock/bun.lock exists?}
    C -- Yes --> D[Copy reflex.lock/bun.lock to .web/bun.lock]
    C -- No --> E{.web/bun.lock exists?}
    E -- Yes --> F[Delete stale .web/bun.lock]
    E -- No --> G[Skip]
    F --> H[bun install regenerates lockfile]
    G --> H
    H --> I[sync_web_bun_lock_to_root]
    I --> J[mkdir reflex.lock/]
    J --> K[Copy .web/bun.lock to reflex.lock/bun.lock]

Loading

Comments Outside Diff (1)

1. reflex/utils/frontend_skeleton.py, line 174-189 (link)

   No migration path for existing bun.lock at the project root

   When an existing Reflex project upgrades, its committed ./bun.lock sits at the old location. On the first reflex init (or reflex run) after the upgrade, sync_root_bun_lock_to_web() calls get_root_bun_lock_path() which now returns reflex.lock/bun.lock. That path won't exist yet, so the function falls into the "remove stale web copy" branch and deletes .web/bun.lock, then bun install regenerates it from scratch — silently discarding the pinned dependency tree. Adding a one-time migration (detect ./bun.lock and no reflex.lock/bun.lock, then move/copy the file) before the sync would preserve reproducibility without requiring manual user action.

_{Reviews (1): Last reviewed commit: "Move bun.lock under reflex.lock/bun.lock" | Re-trigger Greptile}

[codspeed-hq]

Merging this PR will not alter performance

✅ 24 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing masenf/reflex-lock (01564d4) with main (e5eb243)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[masenf]

LOL hot reload is broken now, because reflex.lock is not excluded from the reload path 🤦