#373 ADC path uses wrong gcloud token store: 'gcloud auth print-access-token' instead of 'gcloud auth application-default print-access-token'

Summary

In models/_lib/gcp.ts, getApplicationDefaultCredentials() shells out to gcloud auth print-access-token to obtain a token. That command returns the user-credentials token (the one populated by gcloud auth login), not the Application Default Credentials token (populated by gcloud auth application-default login). These are two distinct token stores in gcloud, and only the latter is what the README and code comments claim to be using.

The two stores typically have different scope sets:

• gcloud auth login mints a token scoped for gcloud's own surfaces (cloud-platform, etc.). It does not include Drive/Gmail/Calendar scopes by default and offers no override flag.
• gcloud auth application-default login --scopes=... mints a token bound to the scopes the user requested, suitable for SDK consumption.

The result is that even when a user follows the README correctly (runs gcloud auth application-default login with appropriate scopes), the extension silently picks up a different token from a different gcloud store, which usually lacks the API scope, producing 403 ACCESS_TOKEN_SCOPE_INSUFFICIENT.

Reproduction

1. gcloud auth application-default login --scopes=https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/cloud-platform (with a trusted OAuth client, since UCSC and many orgs block gcloud's default client for sensitive Drive scope).
2. Confirm the ADC token has Drive scope:

   curl -s "https://oauth2.googleapis.com/tokeninfo?access_token=$(gcloud auth application-default print-access-token)" | jq .scope
   # → "...cloud-platform ...drive"

3. Create a Drive files model pointing at a real Drive fileId and run get:

   swamp model method run my-drive get --input identifier=<fileId>

4. Observe 403 with ACCESS_TOKEN_SCOPE_INSUFFICIENT despite the ADC token clearly having the scope.
5. Inspect gcloud auth print-access-token (the one the extension actually calls): different token, missing the Drive scope.
6. Workaround that confirms the diagnosis:

   GCP_ACCESS_TOKEN=$(gcloud auth application-default print-access-token) GCP_PROJECT=<id> swamp model method run my-drive get --input identifier=<fileId>

   This succeeds because option 1 in getCredentials() (the explicit GCP_ACCESS_TOKEN path) bypasses the buggy gcloud invocation.

Suggested Fix

In getApplicationDefaultCredentials() (around models/_lib/gcp.ts:201–210), change:

const tokenCmd = new Deno.Command("gcloud", {
  args: ["auth", "print-access-token"],
  ...
});

to:

const tokenCmd = new Deno.Command("gcloud", {
  args: ["auth", "application-default", "print-access-token"],
  ...
});

This affects all auto-generated @swamp/gcp/* extensions sharing this _lib/gcp.ts, not just @swamp/gcp/drive.

Environment

• swamp 20260516.045246.0-sha.e6eda98d
• @swamp/gcp/drive version 2026.05.18.2 (latest)
• macOS 15 (Apple Silicon), Google Cloud SDK current
• Affects all auto-generated GCP extensions that use _lib/gcp.ts

Upstream repository: https://github.com/systeminit/swamp-extensions

Environment

• Extension: @swamp/gcp/[email protected]
• swamp: 20260516.045246.0-sha.e6eda98d
• OS: darwin (aarch64)
• Deno: 2.7.14+19bd3d8
• Shell: /bin/zsh