fix(go): replace $1 literal with resp.Body.Close() in 7 files (#1247)

PR #1229 sed command had no capture groups but used $1 in the
replacement, committing the literal string "defer func() { _ = \$1 }()"
instead of "defer func() { _ = resp.Body.Close() }()". Go does not
compile — $1 is not a valid identifier.

Fixed with: sed -i 's/defer func() { _ = \$1 }()/defer func() { _ = resp.Body.Close() }()/g'

Affected (all on origin/staging):
  workspace-server/cmd/server/cp_config.go
  workspace-server/internal/handlers/a2a_proxy.go
  workspace-server/internal/handlers/github_token.go
  workspace-server/internal/handlers/traces.go
  workspace-server/internal/handlers/transcript.go
  workspace-server/internal/middleware/session_auth.go
  workspace-server/internal/provisioner/cp_provisioner.go (3 occurrences)

Closes: #1245

Co-authored-by: Molecule AI Core-BE <core-be@agents.moleculesai.app>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

workspace-server/cmd/server/cp_config.go

@@ -64,7 +64,7 @@ func refreshEnvFromCP() error {
 	if err != nil {
 		return fmt.Errorf("do request: %w", err)
 	}
-	defer func() { _ = $1 }()
+	defer func() { _ = resp.Body.Close() }()
 
 	// 64 KiB cap — the CP only returns small JSON blobs here. An
 	// unbounded read would be weaponizable if a compromised upstream

workspace-server/internal/handlers/a2a_proxy.go

@@ -288,7 +288,7 @@ func (h *WorkspaceHandler) proxyA2ARequest(ctx context.Context, workspaceID stri
 	if err != nil {
 		return h.handleA2ADispatchError(ctx, workspaceID, callerID, body, a2aMethod, err, durationMs, logActivity)
 	}
-	defer func() { _ = $1 }()
+	defer func() { _ = resp.Body.Close() }()
 
 	// Read agent response (capped at 10MB).
 	// #689: Do() succeeded, which means the target received the request and sent

workspace-server/internal/handlers/github_token.go

@@ -163,7 +163,7 @@ func generateAppInstallationToken() (string, time.Time, error) {
 	if err != nil {
 		return "", time.Time{}, err
 	}
-	defer func() { _ = $1 }()
+	defer func() { _ = resp.Body.Close() }()
 	var result struct {
 		Token     string    `json:"token"`
 		ExpiresAt time.Time `json:"expires_at"`

workspace-server/internal/handlers/traces.go

@@ -49,7 +49,7 @@ func (h *TracesHandler) List(c *gin.Context) {
 		c.JSON(http.StatusOK, []interface{}{})
 		return
 	}
-	defer func() { _ = $1 }()
+	defer func() { _ = resp.Body.Close() }()
 
 	body, _ := io.ReadAll(resp.Body)
 	c.Data(resp.StatusCode, "application/json", body)

workspace-server/internal/handlers/transcript.go

@@ -111,7 +111,7 @@ func (h *TranscriptHandler) Get(c *gin.Context) {
 		c.JSON(http.StatusBadGateway, gin.H{"error": "workspace unreachable"})
 		return
 	}
-	defer func() { _ = $1 }()
+	defer func() { _ = resp.Body.Close() }()
 
 	// Cap at 1 MB so a giant transcript doesn't melt the canvas.
 	body, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))

workspace-server/internal/middleware/session_auth.go

@@ -207,7 +207,7 @@ func verifiedCPSession(cookieHeader string) (valid, presented bool) {
 		// for the negative-TTL window. Next request retries.
 		return false, true
 	}
-	defer func() { _ = $1 }()
+	defer func() { _ = resp.Body.Close() }()
 
 	if resp.StatusCode != http.StatusOK {
 		sessionCachePut(key, false)

workspace-server/internal/provisioner/cp_provisioner.go

@@ -129,7 +129,7 @@ func (p *CPProvisioner) Start(ctx context.Context, cfg WorkspaceConfig) (string,
 	if err != nil {
 		return "", fmt.Errorf("cp provisioner: send: %w", err)
 	}
-	defer func() { _ = $1 }()
+	defer func() { _ = resp.Body.Close() }()
 
 	// Cap body read at 64 KiB — the CP only ever returns small JSON
 	// responses; an unbounded read could be weaponized into log-flood
@@ -199,7 +199,7 @@ func (p *CPProvisioner) IsRunning(ctx context.Context, workspaceID string) (bool
 	if err != nil {
 		return true, fmt.Errorf("cp provisioner: status: %w", err)
 	}
-	defer func() { _ = $1 }()
+	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
 		// Don't leak the body — upstream errors may echo headers.
 		return true, fmt.Errorf("cp provisioner: status: unexpected %d", resp.StatusCode)
@@ -231,7 +231,7 @@ func (p *CPProvisioner) GetConsoleOutput(ctx context.Context, workspaceID string
 	if err != nil {
 		return "", fmt.Errorf("cp provisioner: console: %w", err)
 	}
-	defer func() { _ = $1 }()
+	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
 		return "", fmt.Errorf("cp provisioner: console: unexpected %d", resp.StatusCode)
 	}