From 91733f54608315578534825a983da5ad6a224cfc Mon Sep 17 00:00:00 2001
From: OpenCode Test <test@opencode.ai>
Date: Mon, 5 Jan 2026 13:00:46 -0800
Subject: [PATCH] Fix gtasks OAuth scope handling and add ArgoCD docs to RAG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- gtasks: Add force_reauth option to recover from invalid_scope errors
- rag-search: Index ArgoCD documentation for semantic search

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 .../scripts/collectors/gtasks.py              | 25 +++++++++++++------
 skills/rag-search/references/sources.json     |  9 +++++++
 2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/skills/morning-report/scripts/collectors/gtasks.py b/skills/morning-report/scripts/collectors/gtasks.py
index e593265..20bb44c 100755
--- a/skills/morning-report/scripts/collectors/gtasks.py
+++ b/skills/morning-report/scripts/collectors/gtasks.py
@@ -29,17 +29,26 @@ TOKEN_PATH = Path.home() / ".gmail-mcp/tasks_token.json"
 CREDS_PATH = Path.home() / ".gmail-mcp/credentials.json"
 
 
-def get_credentials():
-    """Get or refresh Google credentials for Tasks API."""
+def get_credentials(force_reauth: bool = False):
+    """Get or refresh Google credentials for Tasks API.
+
+    If ``force_reauth`` is True, skip refresh and run a new OAuth flow.
+    This is useful when a stored refresh token is bound to a different
+    scope set and refresh keeps failing with invalid_scope.
+    """
     creds = None
 
     if TOKEN_PATH.exists():
         creds = Credentials.from_authorized_user_file(str(TOKEN_PATH), SCOPES)
 
-    if not creds or not creds.valid:
-        if creds and creds.expired and creds.refresh_token:
-            creds.refresh(Request())
-        else:
+    if not creds or not creds.valid or force_reauth:
+        if not force_reauth and creds and creds.expired and creds.refresh_token:
+            try:
+                creds.refresh(Request())
+            except Exception:
+                creds = None
+
+        if not creds or not creds.valid:
             if not CREDS_PATH.exists():
                 return None
             flow = InstalledAppFlow.from_client_secrets_file(str(CREDS_PATH), SCOPES)
@@ -168,7 +177,9 @@ if __name__ == "__main__":
 
     if "--auth" in sys.argv:
         print("Starting Tasks API authentication...")
-        creds = get_credentials()
+        # Force a fresh OAuth flow so we can recover from invalid_scope
+        # errors caused by stale refresh tokens.
+        creds = get_credentials(force_reauth=True)
         if creds:
             print(f"✅ Authentication successful! Token saved to {TOKEN_PATH}")
         else:
diff --git a/skills/rag-search/references/sources.json b/skills/rag-search/references/sources.json
index 3c548a4..2d4ca69 100644
--- a/skills/rag-search/references/sources.json
+++ b/skills/rag-search/references/sources.json
@@ -9,6 +9,15 @@
       "glob": "**/*.md",
       "version": "main",
       "last_indexed": "2026-01-04T23:27:40.175671"
+    },
+    {
+      "id": "argocd",
+      "name": "ArgoCD Documentation",
+      "type": "git",
+      "url": "https://github.com/argoproj/argo-cd.git",
+      "path": "docs/",
+      "glob": "**/*.md",
+      "last_indexed": "2026-01-05T01:04:53.930441"
     }
   ]
 }
\ No newline at end of file