The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
holon	Ready	Preview, Comment	Jul 13, 2026 5:34pm

Holon Review: fix: prioritize Codex credential profiles

Summary

This PR correctly fixes the credential selection priority issue described in #2234. All three root causes are addressed:

1. Profile-first selection: choose_openai_codex_credential now uses profile.or(cli) — profile always wins when available.
2. Removed broken freshness ranking: The openai_codex_credential_freshness_key function and its source_rank logic are removed entirely.
3. Expiry-aware refresh with CLI fallback: resolve_fresh_credential() now checks profile expiry, attempts refresh, and falls back to CLI only when profile is absent or refresh fails.

The changes are focused, the diff is clean, and the test coverage is good — both the renamed priority test and the new refresh-failure fallback test validate the core behavioral changes.

Findings

warn — Silent refresh error on CLI fallback path (see inline comment on line 603)

When profile refresh fails and a CLI credential is available, the refresh error is silently discarded. This hurts observability: if the profile's refresh token is permanently broken, the system will silently fall back to CLI credentials on every call with no diagnostic signal for operators.

Other transports in this codebase use tracing::warn (see anthropic.rs, fallback.rs). Adding a warning log here would be consistent and help detect broken profile configurations.

nit — choose_openai_codex_credential is now test-only

The function is simplified to profile.or(cli) and is only called from test code. Consider annotating it with #[cfg(test)] to make its test-only status explicit, or inlining it into the test.

Verdict

The core logic is correct and well-tested. One observability improvement recommended (logging the refresh failure), one minor cleanup suggestion. Safe to merge.

Holon Run Report

• Result: completed
• Target: fix: prioritize Codex credential profiles #2236
• Workflow run: https://github.com/holon-run/holon/actions/runs/29270143792
• Model: dashscope@token-plan/qwen3.7-max
• Requested model: dashscope@token-plan/qwen3.7-max
• Fallback active: false
• Token usage: input 83445, output 15604, total 99049
• Provider cache: read 959399, created 47727, cacheable 1007126, hit rate 95.26%
• Model rounds: 32
• Tool calls: 48

已处理 review 的 observability warning：0cc300e7 在 profile refresh 失败并回退 CLI credential 前记录结构化 tracing::warn!。补充说明：choose_openai_codex_credential 并非 test-only，它仍由同步 load_openai_codex_credential 生产路径调用，因此不添加 #[cfg(test)]。