Summary
tests/test_version_sync.py guards 7 of the 8 release version sources, but emrg/gui/package-lock.json is not covered — the release convention (see PR #1064, v0.2.87 bump) treats it as an 8th source (root version + packages[""].version, 2 spots), yet no test fails if a future bump misses it.
Context
Suggested fix (small, hermetic)
Add a helper in tests/test_version_sync.py mirroring _gui_package_version():
def_gui_package_lock_version() ->str:
"""gui package-lock.json 的根 version（npm 由 package.json 生成，须同步）。"""content= (REPO_ROOT/"emrg"/"gui"/"package-lock.json").read_text(encoding="utf-8")
m=re.search(r'"version"\s*:\s*"([^"]+)"', content)
assertm, "emrg/gui/package-lock.json 中找不到根 version"returnm.group(1)
…and assert it equals _base_version() in test_all_version_sources_consistent(). The first "version" match in package-lock.json is the root field (lockfileVersion does not match the quoted regex); the packages[""] copy is npm-generated and stays in sync.
Impact
Prevents a future v0.2.x bump from silently leaving package-lock.json at the old version (the #408 accident class). Pure logic test, no platform/network dependency — runs on all CI platforms.
Summary
tests/test_version_sync.pyguards 7 of the 8 release version sources, butemrg/gui/package-lock.jsonis not covered — the release convention (see PR #1064, v0.2.87 bump) treats it as an 8th source (rootversion+packages[""].version, 2 spots), yet no test fails if a future bump misses it.Context
emrg/__init__.py(base),pyproject.toml,emrg/gui/package.json,uv.lock, and 3 shell fallbacks (make-installer.sh,build-runtime.sh,make-run-installer.sh).emrg/gui/package-lock.json(root +packages[""]) as part of the 8-source convention — so it is now officially a version source, but unguarded.Suggested fix (small, hermetic)
Add a helper in
tests/test_version_sync.pymirroring_gui_package_version():…and assert it equals
_base_version()intest_all_version_sources_consistent(). The first"version"match in package-lock.json is the root field (lockfileVersiondoes not match the quoted regex); thepackages[""]copy is npm-generated and stays in sync.Impact
Prevents a future v0.2.x bump from silently leaving
package-lock.jsonat the old version (the #408 accident class). Pure logic test, no platform/network dependency — runs on all CI platforms.