fix(release): keep package-lock.json in sync with the version bump

Release commits bumped package.json, manifest.json and versions.json but
left package-lock.json carrying the previous version, so every npm install
rewrote the lock's root version and showed the file as dirty in every
worktree. sync-version now rewrites the lock's root entries too, the version
script stages it, and release:check fails when the two disagree.

Co-authored-by: QoderAI (Qwen 3.8 Max) <qoder_ai@qoder.com>

Author: luoxuanzao

package.json

@@ -23,7 +23,7 @@
     "smoke:qoder": "node scripts/smoke-qoder-sdk.mjs",
     "audit:prod": "npm audit --omit=dev",
     "release:check": "node scripts/validate-release.mjs",
-    "version": "node scripts/sync-version.js && git add manifest.json versions.json"
+    "version": "node scripts/sync-version.js && git add manifest.json versions.json package-lock.json"
   },
   "keywords": [
     "qodercli",

scripts/sync-version.js

@@ -7,6 +7,7 @@ const rootDir = path.join(__dirname, '..');
 const packagePath = path.join(rootDir, 'package.json');
 const manifestPath = path.join(rootDir, 'manifest.json');
 const versionsPath = path.join(rootDir, 'versions.json');
+const lockPath = path.join(rootDir, 'package-lock.json');
 
 const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
 
@@ -15,6 +16,13 @@ manifestJson.version = packageJson.version;
 const minAppVersion = manifestJson.minAppVersion;
 fs.writeFileSync(manifestPath, `${JSON.stringify(manifestJson, null, 2)}\n`);
 
+const lockJson = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+lockJson.version = packageJson.version;
+if (lockJson.packages && lockJson.packages['']) {
+  lockJson.packages[''].version = packageJson.version;
+}
+fs.writeFileSync(lockPath, `${JSON.stringify(lockJson, null, 2)}\n`);
+
 const versions = JSON.parse(fs.readFileSync(versionsPath, 'utf8'));
 versions[packageJson.version] = minAppVersion;
 const sortedVersions = Object.fromEntries(
@@ -24,4 +32,4 @@ const sortedVersions = Object.fromEntries(
 );
 fs.writeFileSync(versionsPath, `${JSON.stringify(sortedVersions, null, 2)}\n`);
 
-console.log(`Synced manifest.json and versions.json to ${packageJson.version}`);
+console.log(`Synced manifest.json, versions.json and package-lock.json to ${packageJson.version}`);

scripts/validate-release.mjs

@@ -11,6 +11,7 @@ const readJson = (relativePath) =>
 const packageJson = readJson('package.json');
 const rootManifest = readJson('manifest.json');
 const versions = readJson('versions.json');
+const lock = readJson('package-lock.json');
 const changelog = fs.readFileSync(path.join(rootDir, 'CHANGELOG.md'), 'utf8');
 const errors = [];
 
@@ -39,6 +40,10 @@ requireCondition(
   packageJson.version === rootManifest.version,
   `package.json version (${packageJson.version}) does not match manifest version (${rootManifest.version})`,
 );
+requireCondition(
+  lock.version === packageJson.version && lock.packages?.['']?.version === packageJson.version,
+  `package-lock.json version (${lock.version}) does not match package.json version (${packageJson.version}); run "node scripts/sync-version.js"`,
+);
 requireCondition(
   versions[rootManifest.version] === rootManifest.minAppVersion,
   `versions.json must map ${rootManifest.version} to ${rootManifest.minAppVersion}`,