fix(cliproxy): make codex defaults free-plan safe

src/cliproxy/executor/index.ts

@@ -32,6 +32,7 @@ import { isAuthenticated } from '../auth-handler';
 import { CLIProxyProvider, CLIProxyBackend, PLUS_ONLY_PROVIDERS, ExecutorConfig } from '../types';
 import { DEFAULT_BACKEND } from '../platform-detector';
 import { configureProviderModel, getCurrentModel } from '../model-config';
+import { reconcileCodexModelForActivePlan } from '../codex-plan-compatibility';
 import { resolveProxyConfig, PROXY_CLI_FLAGS } from '../proxy-config-resolver';
 import { supportsModelConfig, isModelBroken, getModelIssueUrl, findModel } from '../model-catalog';
 import { CodexReasoningProxy } from '../codex-reasoning-proxy';
@@ -731,6 +732,14 @@ export async function execClaudeWithCLIProxy(
   // 6. Ensure user settings file exists
   ensureProviderSettings(provider);
 
+  if (provider === 'codex' && !cfg.isComposite && !skipLocalAuth) {
+    await reconcileCodexModelForActivePlan({
+      settingsPath: cfg.customSettingsPath || getProviderSettingsPath(provider),
+      currentModel: getCurrentModel(provider, cfg.customSettingsPath),
+      verbose,
+    });
+  }
+
   // Local proxy mode: generate config, spawn/join proxy, track session
   let proxy: ChildProcess | null = null;
   let configPath: string | undefined;