One product per machine: the CLI and the desktop app share one version, the store accounts and the app folder list

- one version: package.json's version is the desktop app's too (desktopVersion removed); tools/desktop-version.ts
  keeps the plugin manifests and the app's copies equal, desktop-release publish refuses another version, release
  order app first then npm publish; the unpublished desktop 0.1.0 candidate is noted in the docs and CHANGELOG
- storebound desktop installs (per user, no admin: macOS DMG -> /Applications or ~/Applications, Windows NSIS /S,
  Linux AppImage + .desktop with the storebound:// handler), updates an older app, notes a newer one (downgrade only
  with --force), asks once ([Y/n], --yes, exit 3 without a terminal), opens on the folder; --dry / --json / --download;
  the install steps are pure plans (cli/lib/desktop-install.ts); the version's own manifest dl/<version>/latest.json
- credentials: one store, the CLI's credential profiles in ~/.storebound/credentials; the desktop writes and reads
  them (profiles.rs, files 0600), moves old keychain accounts into profiles on first start, shows profiles the CLI
  made; precedence env > named profile > project file > default profile; config `account`, "account" in the
  project's credentials.json; storebound accounts list | import (dedup by key id / service account e-mail, key files
  copied 0600, project file keeps keystore and review contact, backup, --dry, never prints values) | use
- app folders: one list ~/.storebound/projects.json shared by the desktop (registry.rs), storebound desktop,
  apps folders | add | remove, ws init and ws without a workspace file
- desktop: notice when a folder pins another storebound version; storebound-desktop --version
- tests: version drift, desktop decisions and per-OS plans, credential precedence and import, registry (TS + Rust),
  keychain migration and profile round trip (Rust), boot check with old keychain state and the new shared state

tests/desktop-release.test.ts

@@ -3,14 +3,19 @@ import { describe, expect, test } from 'bun:test';
 import { cpSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { artifactName, developerIdIdentity, mergeManifest, pathFreeEnv, releaseUrl, remoteSessionReason, sliceProblems, sumsText, uploadable, archProblems, commitProblems } from '../tools/desktop-release';
+import { artifactName, developerIdIdentity, mergeManifest, pathFreeEnv, releaseUrl, remoteSessionReason, sliceProblems, sumsText, uploadable, archProblems, commitProblems, releaseTogetherProblems } from '../tools/desktop-release';
 import { COPIES, setVersion, versions } from '../tools/desktop-version';
 
 describe('desktop version authority', () => {
-  test('the repository has one desktop version', () => {
+  test('the repository has one version: the CLI, the plugin manifests and the desktop app', () => {
     const { version, drift } = versions();
     expect(version).toMatch(/^\d+\.\d+\.\d+$/);
     expect(drift).toEqual([]);
+    const pkg = JSON.parse(readFileSync(join(import.meta.dir, '../package.json'), 'utf8'));
+    expect(version).toBe(pkg.version);
+    expect(pkg.desktopVersion).toBeUndefined();
+    expect(COPIES.map(c => c.file)).toContain('apps/desktop/src-tauri/tauri.conf.json');
+    expect(COPIES[0]!.file).toBe('package.json');
   });
   test('drift is found and --set fixes every copy', () => {
     const root = mkdtempSync(join(tmpdir(), 'sb-ver-'));
@@ -20,6 +25,8 @@ describe('desktop version authority', () => {
     expect(versions(root).drift.map(d => d.file)).toEqual(['apps/desktop/src-tauri/tauri.conf.json']);
     setVersion('0.2.0-beta.1', root);
     expect(versions(root)).toEqual({ version: '0.2.0-beta.1', drift: [] });
+    expect(JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')).version).toBe('0.2.0-beta.1');
+    expect(JSON.parse(readFileSync(join(root, '.claude-plugin/marketplace.json'), 'utf8')).plugins[0].version).toBe('0.2.0-beta.1');
     // only the package's own version line of Cargo.toml / Cargo.lock changes
     expect(readFileSync(join(root, 'apps/desktop/src-tauri/Cargo.toml'), 'utf8')).toContain('tauri = { version = "2.12"');
     expect(() => setVersion('latest', root)).toThrow();
@@ -27,6 +34,11 @@ describe('desktop version authority', () => {
 });
 
 describe('desktop release', () => {
+  test('the app and the npm CLI are published with one version', () => {
+    expect(releaseTogetherProblems('0.8.0', '0.8.0')).toEqual([]);
+    expect(releaseTogetherProblems('0.1.0', '0.8.0')[0]).toMatch(/one version/);
+    expect(releaseTogetherProblems('0.8.0', null)).toHaveLength(1);
+  });
   test('signing refuses SSH and non-GUI sessions', () => {
     expect(remoteSessionReason({}, 'Aqua')).toBeNull();
     expect(remoteSessionReason({ SSH_CONNECTION: '1 2 3 4' }, 'Aqua')).toMatch(/SSH/);