feat: ai-proxy key safety, grok self-refresh, youtube ask rebuild, codex handoff skills, du edge correctness

[genesiscz]

This branch grew well past its ai-proxy origin. 38 commits, seven themes. Grouped below; each bullet carries its SHA(s).

ai-proxy: no billed key spent implicitly, no traffic lost to the logs

• fa3285456 Api-key accounts (xai-api-key, openai) refuse ambient env keys unless the account opts in (allowEnvApiKey); a key stored on the account is always allowed. Shared guard in providers/api-key-guard.ts. Every account logs its credential source at construction (never the value).
• bbd1644e8 Keys can live in the ai-proxy config (redacted in dumps, fingerprinted for provider rebuilds); dropped the launchd daemon that 52840fe04 had added, since its stripped env caused the dead-account bug in the first place.
• cb9a8dc03 accounts set-key with no key on a TTY becomes an interactive chooser (current state, masked prompt, env var source file); the key no longer travels through argv.
• fa3285456 Realtime WS sessions write transcripts (delta/audio events counted, not stored; long strings elided), and POST /v1/realtime/client_secrets is refused by default (403) because a minted secret bypasses the proxy; realtime.allowClientSecrets opts into the blind spot with every mint logged.
• fa3285456, 52840fe04 A broken account answers 503 with the construction error instead of a bare 500, and can no longer take the whole proxy down.

Grok: the sub token refreshes itself

• f1058493e, 73bbec925 OIDC refresh-token grant done in-process, single-flighted per auth path, temp-file + rename writes so a concurrent CLI never sees a torn file. Verified against the genuinely expired token.
• e87bc752c Refresh also happens in account resolution, not just the HTTP client.

Timely: cookie login and honest token reporting

• 2c3cd2bbf, 2b12722f6 Log in from a browser cookie (pasted, from clipboard, or from a curl command) so memories work again.
• acb76f91f, 40b036103, cb8359ce3 Refresh tokens with unknown lifetimes, report rejected sessions instead of returning empty, stop claiming a fresh token "will be refreshed".

tools du: correctness at filesystem edges

• e5de1a700, b859ad29c, 7291d3e51 Report denials, allocated bytes, sparse files and clone partners with cached extent maps; stop the walk at filesystem and cloud-provider boundaries; detect blocks shared outside the scan root and lead with freeable bytes. ba8d7bd84 benchmark-doc correction.

YouTube: ask pipeline rebuild plus extension/server fixes

• 1e9fdb461, 05c7ab458, f54b26348, 69abc2b82 ask_threads widened into user-scoped ask_sessions; one queue facade behind CLI, HTTP and future MCP doors; a console service account for attribution; command tests moved onto the facade.
• 9408f5d74, e76aac0ea Audited qaIndex stage, fixed the retrieval bucket mismatch, and a captions miss no longer silently escalates to paid ASR.
• 1781d1bf4 One subtitle renderer and one cache-ops module.
• 496957096, 69ce76b2e, 7cb7cc490, bc4ca4c56 Extension: seek the watch-page player directly (the IFrame API message was never received), popup styling, Generate-report button containment; launchd server agent now gets the provider API keys it resolves from env.

Claude teams and cmux

• a20d27b0a, 587de3ae4, c4ce2172d tools claude teams + OAuth for tmux teammates; --cmux launches start/run through cmux claude-teams and keeps the skip-permissions flag the ccc wrapper would have added.
• d37073ca2 dev-dashboard relaunches ttyd when a tmux session is renamed.

Codex handoff: skills that finally teach the app-server path

• c3cf5a233 tools codex sessions seed a receiving-end contract into the worker: report in on the agents bus first, honor "Stop and report" checkpoint blocks, never claim unobserved verification.
• 6e3669afa New plugin skills: gt:handoff-to (model routing: rankings, task table, readiness gate) and gt:handoff-to-codex (self-contained driver manual: spawn/write policies, checkpoint contract, steer, approvals, codex exec fallback), plus a genesis-tools:agent-driver subagent that owns one worker session end to end. agents-talk's Codex section shrank to a pointer.
• 6e7433286 me:wrap-up ported into the plugin as gt:wrap-up with the old gt:handoff skill folded in as PLAN mode (the .claude/plans/*.handoff.md protocol) and retired as a standalone skill. resolve.ts gains a shared plugin config at ~/.genesis-tools/plugins/config.json (registryPath, vaultDir, project-relative docDir) as an automatic fallback tier between the registry and ask-the-user.
• 6aaf774f4 Plugin 1.0.37 to 1.0.38.

Smaller fixes

• cb29f19b3 tools mcp-manager list --json so other tools can consume the registry.
• 0b5dd0144 A targeted provider scan no longer caches itself as the full catalog.
• cfb16d342 Handoff MCP matches a session id abbreviated to its leading segment.

Verification

• ai-proxy + grok: bun run test src/ai-proxy src/utils/ai/grok 272 pass / 0 fail across 51 files; grok refresh exercised against the real expired token; mint refusal, credential-source logs and the interactive chooser exercised live.
• codex seeding: bun run test src/codex/lib/seed-instructions.test.ts 2 pass / 0 fail.
• wrap-up resolver: all three tiers exercised live (registry hit, config vaultDir and project-relative docDir fallbacks under a fake HOME, found:false with neither).
• tsgo --noEmit and biome clean via the pre-commit hook on every commit.

Session narratives live in the vault: GenesisTools/AiProxy/2026-07-27-SentryMcpCodexRouting.handoff.md and GenesisTools/2026-07-28-HandoffToCodex.md.