feat(youtube): read liked videos and playlist contents

[coeur-de-loup]

Summary

Adds two read-only YouTube commands that were missing — there was previously no way to read the videos inside a playlist or to read your liked videos. Both reuse the default youtube.readonly scope (no force-ssl), the existing service/auth/pagination/output helpers, and follow the established command patterns from #767.

New behaviour

• gog yt playlists items list --playlist-id <ID> — enumerate the videos inside a playlist via playlistItems.list. Public playlists work with an API key; private playlists and the special LL liked-videos playlist use account OAuth. Supports --all pagination and JSON/plain/table output.
• gog yt videos list --my-rating like|dislike — read the authenticated user's rated videos. This is a per-user read, so it always uses account OAuth (it is mutually exclusive with --id/--chart).

# videos inside any playlist (paginated)
gog yt playlists items list --playlist-id PLAYLIST_ID --all

# your liked videos (LL playlist, or via --my-rating)
gog yt playlists items list --playlist-id LL -a you@gmail.com --all
gog yt videos list --my-rating like -a you@gmail.com --max 50

Why

playlists list only returns playlist metadata, and videos list only accepted --id/--chart, so neither liked videos nor playlist contents were reachable from the CLI even though the underlying youtube.Service already exposes PlaylistItems.List and Videos.List(...).MyRating(...).

Implementation notes

• videos list now accepts exactly one of --id, --chart, or --my-rating; --my-rating requires an account and validates like|dislike.
• playlists items list is a new items subcommand group under playlists, modelled on subscriptions list (uses loadPagedItems for --all).
• New youtubePlaylistItemColumns() table helper (VIDEO_ID, TITLE, CHANNEL, POSITION, ITEM_ID, PUBLISHED_AT).

Testing

• New unit tests for both commands covering the API-key and OAuth paths, the myRating=like query, the playlistId query, and validation errors.
• make ci passes locally (fmt-check, lint, deadcode, tests, docs-check — 645 command pages).
• Regenerated command reference (make docs-commands) and updated docs/youtube.md, README.md, and CHANGELOG.md.

🤖 Generated with Claude Code

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed June 14, 2026, 12:39 AM ET / 04:39 UTC.

Summary
Adds gog yt playlists items list and gog yt videos list --my-rating, with table output, unit tests, README/generated command docs, YouTube docs, and a changelog entry.

Reproducibility: not applicable. This is a feature PR, and current-main source inspection shows the requested command modes are not present yet.

Review metrics: 2 noteworthy metrics.

• Changed files: 14 files affected. The feature spans command code, presentation, tests, user docs, generated command docs, and release notes.
• Generated command pages: 2 added. The new playlist-item command group adds generated pages that need to stay consistent with the live CLI schema.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P1] Add redacted terminal output or logs showing gog yt playlists items list against a real playlist and gog yt videos list --my-rating like against an authenticated YouTube account.
• Remove the direct CHANGELOG.md edit or leave that release-note wording for the landing/release flow.

Proof guidance:

• [P1] Needs real behavior proof before merge: The PR still needs redacted live proof for both new YouTube command paths; terminal output, logs, terminal screenshots, recordings, or linked artifacts are acceptable, with private details redacted, and updating the PR body should trigger re-review or a maintainer can comment @clawsweeper re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

• [P1] No redacted live YouTube output proves the new playlistItems.list, LL, private playlist, or myRating paths against a real API-key/OAuth setup.
• [P1] The branch still edits release-owned CHANGELOG.md; final release-note wording should be handled by the landing/release flow.

Maintainer options:

1. Decide the mitigation before merge
   Land the focused YouTube read commands after redacted live API proof is added and release-note ownership is handled by the landing flow.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• [P1] Contributor action is needed for real YouTube API proof, which automation cannot supply from the contributor's account setup.

Security
Cleared: No concrete security or supply-chain issue was found; the diff adds read-only YouTube command paths without new dependencies, workflows, credential storage, or broader permissions.

Review findings

• [P3] Remove the release-owned changelog edit — CHANGELOG.md:7

Review details

Best possible solution:

Land the focused YouTube read commands after redacted live API proof is added and release-note ownership is handled by the landing flow.

Do we have a high-confidence way to reproduce the issue?

Not applicable. This is a feature PR, and current-main source inspection shows the requested command modes are not present yet.

Is this the best way to solve the issue?

Mostly yes. The implementation follows existing YouTube read-service, account-routing, output, and pagination patterns, but merge readiness still needs real API proof and release-owned changelog cleanup.

Full review comments:

• [P3] Remove the release-owned changelog edit — CHANGELOG.md:7
CHANGELOG.md is release-owned in this workflow; normal PRs should keep release-note context in the PR body or commit message and let the landing/release flow add the final entry.
  Confidence: 0.87

Overall correctness: patch is correct
Overall confidence: 0.84

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 91532648b7ae.

Label changes

Label justifications:

• P2: This is a bounded user-facing YouTube CLI enhancement with limited blast radius.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR still needs redacted live proof for both new YouTube command paths; terminal output, logs, terminal screenshots, recordings, or linked artifacts are acceptable, with private details redacted, and updating the PR body should trigger re-review or a maintainer can comment @clawsweeper re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

What I checked:

• AGENTS.md policy read: Read the full repository AGENTS.md and applied its PR-link review guidance by using read-only gh pr view / gh pr diff without changing branches. (AGENTS.md:1, 91532648b7ae)
• Current main lacks requested commands: Current main has videos list selectors for IDs or chart only, and YouTubePlaylistsCmd exposes list/create/add/remove/delete without an items group. (internal/cmd/youtube.go:103, 91532648b7ae)
• PR adds rated-video read path: The PR head adds --my-rating, validates like|dislike, requires an account for that mode, and calls Videos.List(...).MyRating(...). (internal/cmd/youtube.go:107, 4b3236d5075d)
• PR adds playlist-item read path: The PR head adds playlists items list, uses OAuth for the LL liked playlist, otherwise follows the existing read service, and pages with loadPagedItems. (internal/cmd/youtube.go:285, 4b3236d5075d)
• Unit coverage exists: The PR includes httptest coverage for myRating=like, playlist-item API-key reads, LL OAuth reads, default-account resolution, and validation errors. (internal/cmd/youtube_test.go:711, 4b3236d5075d)
• Real behavior proof is still absent: The PR body and comments report unit tests and local make ci, but no redacted terminal output, logs, screenshot, recording, or linked artifact showing the new commands against a real YouTube setup. (4b3236d5075d)

Likely related people:

• steipete: Current main blame for the YouTube command surface and read-service helper points to Peter Steinberger's v0.26.0 release commit, and the related YouTube playlist/subscription work includes maintainer landing and docs commits. (role: recent area contributor and current-line owner; confidence: medium; commits: 3a66566be7a4, d2f49ac7ef81, 4344f57f8883; files: internal/cmd/youtube.go, internal/googleapi/youtube.go, docs/youtube.md)
• beezly: The merged related YouTube playlist/subscription PR introduced much of the command surface that this PR follows, including playlist and subscription patterns in internal/cmd/youtube.go. (role: related feature contributor; confidence: medium; commits: fb0774827f76, 065dab2504c3, 9e2e3307d990; files: internal/cmd/youtube.go, internal/cmd/youtube_test.go, docs/youtube.md)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Landed as 21e2c126ba3cbec0160ea9646ea7d7eb9e928e09 with maintainer integration and hardening:

• Added gog yt playlists items list --playlist-id ..., including --all pagination and JSON/plain/table output.
• Added gog yt videos list --my-rating like|dislike through authenticated YouTube OAuth.
• Routed the special LL liked-videos playlist through normal account resolution, preserving explicit, default, and single-token account selection.
• Corrected playlist table metadata: uploader channel stays distinct from playlist owner, and PUBLISHED_AT uses the video's publication time rather than playlist insertion time.
• Regenerated 644 command pages and added the maintainer changelog entry crediting @coeur-de-loup.

Redacted live YouTube proof:

• bin/gog --account <redacted> yt videos list --my-rating like --max 2 --json --wrap-untrusted returned 2 items and a next-page token.
• bin/gog --account <redacted> yt playlists items list --playlist-id LL --max 2 --json --wrap-untrusted returned 2 items and a next-page token.
• A public channel playlist selected with yt playlists list; bin/gog --account <redacted> yt playlists items list --playlist-id <redacted> --max 50 --all --json --wrap-untrusted returned all 14 items with no remaining next-page token.
• The stored OAuth account was reauthorized with its existing broad service set after its previous refresh token had expired; gog auth list --check --json --no-input then reported it valid.

Verification:

• GOTOOLCHAIN=go1.26.2 make ci
• /Users/steipete/Projects/agent-skills/skills/autoreview/scripts/autoreview --mode branch --base origin/main --parallel-tests 'GOTOOLCHAIN=go1.26.2 make ci' --stream-engine-output
• Autoreview accepted and fixed three findings across two passes: default-account resolution for LL, video publication timestamp semantics, and uploader/playlist-owner attribution. Final review returned no actionable findings with 0.93 confidence.
• Exact-head GitHub checks passed for 4b3236d5075d07afcc005ad511fb475da2141801: Linux test, Windows, Darwin cgo build, worker, and Docker image.

Thanks @coeur-de-loup.