The scripts currently run on a remote machine without GUI. When the authentication tokens expire, the scripts ask the user to open a URL in a browser or rerun with --noauth_local_webserver. However, --noauth_local_webserver is not passed properly to the OAuth2 library, so there is no easy way to refresh the tokens.

There are 2 possible ways of mitigation:
(1) Pass noauth_local_webserver to the library.
(2) Make --noauth_local_webserver the default.

Because the scripts will likely always be run remotely, there is hardly a chance that noauth_local_webserver will be useful when disabled. And even if run on a machine with GUI, noauth_local_webserver enabled still allows the auth flow to proceed. So I suggest doing (2). Will submit a CL shortly.