fix(app): unbreak the frontend deploy that #10485 broke

[MarkusNeusinger]

Summary

• fix(app): the masthead has been claiming v1.0 since the CSP rollout #10485 broke the Cloud Build frontend deploy. It read the version from the repo-root pyproject.toml at build time, but the frontend image is built with docker build -f app/Dockerfile app — the build context is app/ alone, so nothing above it exists inside the builder. vite build died with ENOENT .../pyproject.toml, Cloud Build failed, and Cloud Run kept serving the previous revision. Every PR check on fix(app): the masthead has been claiming v1.0 since the CSP rollout #10485 was green while the CSP fix never reached anyplot.ai: the exact deploy blind spot CLAUDE.md calls out. My mistake — the four CI commands I validated against all run inside a full checkout, so none of them exercises the Docker build context.
• The version now comes from app/package.json, which is always inside the build context.
• The drift that caused the original bug is closed structurally, not by discipline. Using package.json reintroduces a second version field — the same one that sat at 2.0.0 through the whole 3.x line. tests/unit/test_version_sync.py asserts it equals the pyproject.toml [project] version and runs on every PR that touches pyproject.toml, which is every release PR. Step 4 of agentic/commands/release.md now names the second bump, with the test as the backstop if someone forgets.
• Bonus fix while in the file: global-config.ts imported package.json as a default import, which inlined the entire manifest — every dependency name and version range — into a shipped chunk. It now imports only the version named export.

The user-facing fix from #10485 is unchanged: api.github.com stays allowed in connect-src, and the masthead still falls back to the real project version instead of a hardcoded 'v1.0'.

Test plan

• Reproduced the deploy failure, since no CI job covers it: hid pyproject.toml and ran yarn build — fails with ENOENT ... /pyproject.toml on the merged code, exits 0 on this branch. This is the Cloud Build condition.
• Verified the emitted bundle: appVersion is 3.1.0, the 'v1.0' literal is absent, and the dependency list no longer appears in any chunk (checked for react-force-graph-2d across dist/assets/*.js).
• Verified the drift guard actually fires — set app/package.json back to 2.0.0 and confirmed test_version_sync.py fails with a diff naming both versions, then restored it.
• The repo's four frontend CI commands, green: yarn lint, yarn fm:check, yarn type-check, yarn test --coverage (69 files / 617 tests).
• uv run pytest tests/unit/test_version_sync.py — 2 passed.
• Still not verifiable pre-merge: after this merges, the Cloud Build deploy has to actually succeed. Confirm with curl -sSI https://anyplot.ai/ | grep -i content-security-policy listing https://api.github.com, then a cold load (cleared localStorage) showing v3.1.0.

Checklist

• CHANGELOG.md updated under [Unreleased] — two ### Fixed bullets with PR refs.
• Related documentation updated — agentic/commands/release.md step 4 gained the app/package.json bump; the reasoning for reading package.json rather than pyproject.toml is documented at the point of use in global-config.ts and in the test's module docstring.

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

This PR fixes a frontend Cloud Build deploy failure introduced by #10485 by removing the frontend build-time dependency on the repo-root pyproject.toml (which is not present in the Docker build context) and switching the frontend version source to app/package.json. It also adds a backend unit test and release-procedure documentation to prevent version drift between the two version fields.

Changes:

• Switch CONFIG.appVersion to read from app/package.json and remove the pyproject.toml-based Vite injection path (__APP_VERSION__).
• Add tests/unit/test_version_sync.py to assert app/package.json version matches pyproject.toml version.
• Update release docs and changelog to reflect the new dual-bump requirement and the deploy fix.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/unit/test_version_sync.py	Adds a unit test to prevent version drift between pyproject.toml and app/package.json.
CHANGELOG.md	Documents the deploy fix and the dependency-list bundle reduction.
app/vitest.config.ts	Removes __APP_VERSION__ injection for tests (no longer used).
app/vite.config.ts	Removes __APP_VERSION__ injection for builds (no longer used).
app/tsconfig.node.json	Updates config-file TypeScript include list after removing project-version.ts usage.
app/src/vite-env.d.ts	Removes the __APP_VERSION__ global declaration.
app/src/global-config.ts	Switches CONFIG.appVersion to app/package.json version and adjusts comments accordingly.
app/src/global-config.test.ts	Updates version assertion to reflect the new source of CONFIG.appVersion.
app/project-version.ts	Removes the Node helper that read the repo-root pyproject.toml.
app/package.json	Bumps frontend package version to match the project version.
agentic/commands/release.md	Updates release steps to bump app/package.json alongside pyproject.toml.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated no new comments.

Suppressed comments (1)

app/src/global-config.test.ts:16

• The test claims CONFIG.appVersion is a semver triple, but the regex only asserts a prefix (it would pass e.g. "3.1.0-dev" or "3.1.0placeholder"). If the intent is to enforce exactly X.Y.Z (matching tests/unit/test_version_sync.py), anchor the end of the pattern too.

  it('is a semver triple, not a placeholder', () => {
    expect(CONFIG.appVersion).toMatch(/^\d+\.\d+\.\d+/);
  });

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated no new comments.