fix(review): address PR feedback from Copilot review

- Fix double-close of response body by using explicit close in 401 path
  and defer in else branch instead of unconditional defer
- Increase slow_down test timeout from 15s to 25s to prevent flakiness
- Update pollForTokenWithProgress doc comment to say "additive backoff"
  instead of "exponential backoff"

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: appleboy

main.go

@@ -527,7 +527,7 @@ func performDeviceFlow(ctx context.Context, d tui.Displayer) (credstore.Token, e
 }
 
 // pollForTokenWithProgress polls for token while reporting progress via Displayer.
-// Implements exponential backoff for slow_down errors per RFC 8628.
+// Implements additive backoff (+5s) for slow_down errors per RFC 8628 §3.5.
 func pollForTokenWithProgress(
 	ctx context.Context,
 	config *oauth2.Config,
@@ -824,7 +824,6 @@ func makeAPICallWithAutoRefresh(
 	if err != nil {
 		return fmt.Errorf("API request failed: %w", err)
 	}
-	defer resp.Body.Close()
 
 	// If 401, drain and close the first response body to allow connection reuse,
 	// then refresh the token and retry.
@@ -866,6 +865,8 @@ func makeAPICallWithAutoRefresh(
 			return fmt.Errorf("retry failed: %w", err)
 		}
 		defer resp.Body.Close()
+	} else {
+		defer resp.Body.Close()
 	}
 
 	body, err := io.ReadAll(resp.Body)

polling_test.go

@@ -125,8 +125,9 @@ func TestPollForToken_SlowDown(t *testing.T) {
 		Interval:   1, // 1 second for testing
 	}
 
-	// After 1 slow_down the interval becomes 1+5=6s, so we need ~8s total.
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	// After 1 slow_down the interval becomes 1+5=6s; with an additional authorization_pending
+	// before success, the third attempt occurs after ~1s + 6s + 6s ≈ 13s, so use a generous timeout.
+	ctx, cancel := context.WithTimeout(context.Background(), 25*time.Second)
 	defer cancel()
 
 	token, err := pollForTokenWithProgress(ctx, config, deviceAuth, tui.NoopDisplayer{})