Disable browser cookie fallback for local X auth

Prefer injected AUTH_TOKEN/CT0 for bundled Bird, disable browser-cookie probing in repo-invoked subprocesses, and keep repo-invoked yt-dlp from inheriting browser-cookie settings.

Validation: uv run python -m unittest tests.test_bird_x tests.test_youtube_yt

tests/test_bird_x.py

@@ -11,6 +11,9 @@ from lib import bird_x
 
 
 class TestExtractCoreSubject(unittest.TestCase):
+    def tearDown(self):
+        bird_x._credentials.clear()
+
     def test_strips_trending_noise(self):
         result = bird_x._extract_core_subject("trendiest Claude Code skills")
         self.assertNotIn("trendiest", result)
@@ -28,6 +31,9 @@ class TestExtractCoreSubject(unittest.TestCase):
 
 
 class TestBirdSearchRetries(unittest.TestCase):
+    def tearDown(self):
+        bird_x._credentials.clear()
+
     def test_last_chance_retry_uses_strongest_token(self):
         """When shorter retry also returns 0, uses longest non-noise token."""
         empty = {"items": []}
@@ -53,5 +59,29 @@ class TestBirdSearchRetries(unittest.TestCase):
         self.assertEqual(run_mock.call_count, 1)
 
 
+class TestBirdAuthEnvironment(unittest.TestCase):
+    def tearDown(self):
+        bird_x._credentials.clear()
+
+    def test_subprocess_env_disables_browser_cookie_fallback_when_injected(self):
+        bird_x.set_credentials("auth-token", "ct0-token")
+
+        env = bird_x._subprocess_env()
+
+        self.assertEqual(env["AUTH_TOKEN"], "auth-token")
+        self.assertEqual(env["CT0"], "ct0-token")
+        self.assertEqual(env["BIRD_DISABLE_BROWSER_COOKIES"], "1")
+
+    def test_is_bird_authenticated_short_circuits_when_credentials_injected(self):
+        bird_x.set_credentials("auth-token", "ct0-token")
+
+        with mock.patch.object(bird_x, "is_bird_installed", return_value=True), \
+             mock.patch.object(bird_x.subprocess, "run") as run_mock:
+            result = bird_x.is_bird_authenticated()
+
+        self.assertEqual(result, "env AUTH_TOKEN")
+        run_mock.assert_not_called()
+
+
 if __name__ == "__main__":
     unittest.main()

tests/test_youtube_yt.py

@@ -0,0 +1,49 @@
+"""Tests for yt-dlp invocation safety flags."""
+
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).parent.parent / "scripts"))
+
+from lib import youtube_yt
+
+
+class _DummyProc:
+    def __init__(self):
+        self.pid = 12345
+        self.returncode = 0
+
+    def communicate(self, timeout=None):
+        return "", ""
+
+    def wait(self, timeout=None):
+        return 0
+
+
+class TestYtDlpFlags(unittest.TestCase):
+    def test_search_ignores_global_config_and_browser_cookies(self):
+        proc = _DummyProc()
+        with mock.patch.object(youtube_yt, "is_ytdlp_installed", return_value=True), \
+             mock.patch.object(youtube_yt.subprocess, "Popen", return_value=proc) as popen_mock:
+            youtube_yt.search_youtube("Claude Code", "2026-02-01", "2026-03-01")
+
+        cmd = popen_mock.call_args.args[0]
+        self.assertIn("--ignore-config", cmd)
+        self.assertIn("--no-cookies-from-browser", cmd)
+
+    def test_transcript_fetch_ignores_global_config_and_browser_cookies(self):
+        proc = _DummyProc()
+        with tempfile.TemporaryDirectory() as temp_dir, \
+             mock.patch.object(youtube_yt.subprocess, "Popen", return_value=proc) as popen_mock:
+            youtube_yt.fetch_transcript("abc123", temp_dir)
+
+        cmd = popen_mock.call_args.args[0]
+        self.assertIn("--ignore-config", cmd)
+        self.assertIn("--no-cookies-from-browser", cmd)
+
+
+if __name__ == "__main__":
+    unittest.main()