[shrey16]

Build-only candidate for the reconciled contributions: auth refresh (#64), metadata-only support bundles (#59/#71), and secure mobile access (#60).

This PR only advances the Desktop, app and CLI package metadata plus lockfile to 1.15.47. No new runtime changes.

Verification:

• Integrated Desktop source: 206 tests pass; Desktop typecheck passes.
• Connector: 65 tests pass.
• Candidate/packaging/publication guardrails: 18 tests pass.
• Hosted candidate packaging will use exact source f0b6b6a.

Publication is NOT authorized. Native installed acceptance and Mobile's Expo dependency follow-up remain separate. No production or installed-user update is triggered by this PR or the build-only workflow.

[shrey16]

Candidate build started: https://github.com/BharatCode-ai/bharatcode-desktop/actions/runs/41194699892 (exact source f0b6b6a). This is packaging only, not publication or installed acceptance.

Pre-publication checklist:

• Native sign-in/resume and sign-out race acceptance.
• Metadata-only support export and pairing/revocation acceptance (test(desktop): verify support export and resume on native Windows/macOS #73 and the mobile checklist).
• Triage/update the existing high-severity Electron and MCP SDK dependency alerts; this version-only PR does not resolve them.
• Mobile companion CI remains separate (Product Head - Desktop: open-source readiness review #2/[codex] prune Desktop public repository scope #3 in the Mobile repository).

No tag, updater feed, release, npm publication or production deployment has been changed.

[shrey16]

Candidate-only follow-up at 0e761cf:

• Electron 42.11.16 and MCP SDK 1.32.0 address the current high-severity dependency alerts.
• Ported the SDK patch without dropping bounded session recovery, cancellation checks, pagination metadata or refresh scopes. Retained upstream redirect/issuer protections and persisted issuer bindings for registered/configured credentials.
• Bun 1.4.2 includes patched-dependency install fixes; caches now separate Bun version, architecture and patch content. Windows success remains to be verified by the fresh build.
• Critical checks: 71 MCP tests; 224 Desktop/release-guard tests; Desktop and CLI typechecks all passed. Desktop source tests deliberately do not launch Electron; native acceptance remains pending.
  Previous candidate 41194699892: Windows failed during Bun patch installation; Intel macOS hosted runner lost communication during packaging; Apple Silicon/Linux/WSL succeeded. Not treating that partial run as a releasable cohort.
  A fresh exact-source all-platform candidate build is dispatched. No release, updater, npm publication or production change.

[shrey16]

Follow-up 9672f2f keeps Bun runtime/compilation at 1.3.14. Run 41200092254 correctly failed the packaged Linux --version smoke: Bun 1.4.2 compiled Effect graph startup regressed. New Bun is now Windows dependency-installer-only and restored to the runtime pin before builds, with an explicit version assertion. All 71 MCP checks pass on 1.3.14; all 206 Desktop source tests pass. The 19 packaging/release guards pass, including a newly explicit invalid-target exit (the prior throw-only bun -e exited zero on 1.3.14). Fresh all-platform candidate dispatched. Still build-only, no publication.