fix(seo): request webmasters scope when minting ADC tokens

[thelettere]

Problem

The SEO scripts mint a Google ADC access token by shelling out to:

["gcloud", "auth", "application-default", "print-access-token"]

with no --scopes argument, in four places — analyze_gsc.py, list_gsc_sites.py, url_inspection.py, preflight.py.

With user ADC this works, because the token silently inherits whatever scopes were stored at gcloud auth application-default login.

With service-account ADC (GOOGLE_APPLICATION_CREDENTIALS) it does not. gcloud mints a cloud-platform-only token, and every Search Console call fails:

403 { "message": "Request had insufficient authentication scopes.",
      "reason": "ACCESS_TOKEN_SCOPE_INSUFFICIENT" }

That makes the SEO skills unusable from any unattended or headless context. This matters because a service account is often the only workable credential there — Workspace orgs can enforce Cloud session-control policies that force-expire any credential built on a human's Google session, regardless of how recently it was refreshed, and a headless run has nobody present to complete the reauth prompt.

Fix

Adds adc_access_token() to _gcloud.py. It requests webmasters.readonly,cloud-platform explicitly, and falls back to an unscoped request when the credential cannot mint those scopes — so a user ADC that was not granted them at login behaves exactly as it does today. The four scripts call it instead of shelling out individually.

The fallback is what makes this safe: it repairs the service-account path without changing the user-ADC path.

Verification

Both credential types, against a real Search Console property:

Path	Before	After
Service account (GOOGLE_APPLICATION_CREDENTIALS set)	403 ACCESS_TOKEN_SCOPE_INSUFFICIENT	Summary: 5 clicks | 514 impressions | CTR 0.97% | Avg position 33.5
User ADC without those scopes granted	"Could not get access token. Run: gcloud auth…"	identical message, no regression

Also ruled out as alternatives, in case they come up in review: the CLOUDSDK_AUTH_SCOPES environment variable has no effect on ADC token minting, and gcloud config set auth/scopes errors with Section [auth] has no property [scopes]. A code change is the only route.

🤖 Generated with Claude Code