xsync 1.12.0

Breaking for unattended mirrors: xsync --delete with no terminal on stdin now refuses with exit 2 unless --yes (-y) is given. A cron job or script that mirrors with --delete needs --yes added. --dry-run --delete is unaffected.
Changed in xftp: rm -r <folder> deletes a folder without asking, in a terminal too. A plain rm on a folder still asks in a terminal and refuses with no terminal, and a piped session exits 1 if any command failed.
New: xcp prints the uploaded file's browser URL on stdout. xfind --url prints browser URLs in place of paths. xfind --search 'terms' queries SharePoint's search index, matching contents and metadata as well as names. The index trails uploads by many minutes. The Claude Code skill is rescoped and trimmed; run xcp --install-skill to refresh it.
Faster: a walk with no depth limit now fetches the whole tree in one delta query, so xfind, xtree and xsync's remote scan list a 320-folder tree in about 3 seconds instead of 43. Output is unchanged.
Fixed: on Linux, a token cache sealed while the login keyring was unlocked no longer reads as signed out once the keyring locks (graphauth v0.2.0, atrest v0.3.0).
Changelog
- 31ac496: Add xfind --search over the SharePoint search index (@anderix)
- 11abdd6: Give the search fixture a day to reach the index (@anderix)
- 04797c1: Guard unattended deletes and print browser URLs (@anderix)
- 9c33bd6: List an unlimited walk with one delta query (@anderix) …

• Take spauth v0.1.3, which seals the token cache on Linux and macOS too

• Take spauth v0.1.2, which seals the token cache
• Write xftp history 0600, as SECURITY.md says
• Remove author and AI-assistance attribution; it belongs in source file headers
• apt_repo, not apt_package
• Package versions stop coming from Dependabot
• Dependabot merges move to the organisation's sweep
• Packaging starts on the release rather than on the tag
• The profile is targets and names
• Retire the curl installer: apt, Homebrew, winget and cargo are the paths
• Dependabot: monthly, grouped, merged when every run on the commit is green
• Delete the Defender scan caller: the scan never predicted winget's validation
• Delete the release document: ship is the procedure
• Name a command that exists for the skill install
• Stop pegging the support window to a major version
• Regenerate the parameter block from ship.conf
• Rename release.conf to ship.conf
• Take the commands to smoke from release.conf
• Run the arm64 packages before anybody installs them
• Add release.conf, the parameter block a script can read
• Cover all three library-selection rules in the live suite
• Add a live test suite as the pre-release pass