impel-cli 0.20.56 → 0.20.58

package/RELEASE_NOTES.md

@@ -1,4 +1,62 @@
 # Release notes
+## 0.20.58 — Provision vendor CLIs on managed enrollment
+
+- Ensures freshly enrolled managed devices receive the reviewed Claude Code and Codex CLI binaries without requiring a personal PAT or interactive vendor login.
+- Keeps provisioning isolated from personal Claude/Codex profiles and reports missing vendor runtimes for follow-up convergence.
+
+## 0.20.57 — Live tenant model catalogs for `impel codex` (`impel models sync`)
+
+- Adds `impel models sync|list`: the isolated `impel codex` Codex picker now
+  follows the tenant's live gateway catalog (`GET /v1/models`) instead of
+  being frozen at CLI release time. `sync` rewrites the tenant `models.json`
+  atomically (with `--stale-only` TTL gating); `list` shows the picker
+  contents, whether they came from a gateway sync or the built-in offline
+  floor, and how stale they are.
+- Launches never block on the network: `ensureImpelCodexProfile` stays
+  synchronous and keeps writing the built-in catalog as the offline floor,
+  while an async, never-throwing `syncCodexModelsSafe` layers the gateway
+  catalog after it — at launch, from the detached 6h stale-only app refresh,
+  from codex session hooks, and from the `impel token` heartbeat Codex calls
+  every ~5 minutes. A valid synced catalog survives relaunches
+  (stale-beats-broken); a failed sync keeps the last good file.
+- Records catalog provenance in `models-manifest.json`
+  (`{schemaVersion, syncedAt, catalogVersion, digest}` plus tenant/gateway/
+  experiment bindings): tampered bytes or changed bindings fall back to the
+  floor, and `impel doctor` reports CLI catalog staleness per tenant.
+- Cross-app models (hidden experiment) now reach the isolated CLI: with
+  `experimental.crossAppModels` enabled, `impel codex` routes through the
+  experimental OpenAI-compatible gateway path and projects tenant Claude
+  models into the Codex picker — fail-closed on each model's verified
+  `client_capabilities.codex`, exactly like the desktop app.
+- Moves the Claude→Codex projection (`foreignClaudeCodexCatalogEntry`) and
+  the gateway catalog fetch (`fetchGatewayModels`) into leaf modules shared
+  by the CLI and desktop writers (re-exported from `src/apps.js`), so the
+  two surfaces can never fork the projection again. Gateway JSON is still
+  reconstructed field-by-field, never written through.
+- Bumps `CURRENT_CONFIG_VERSION` to 45 so existing installs take the slow
+  rewrite path once.
+- Release mechanics: the released-fixture corpus for 0.20.57 was re-captured
+  on the final release tree (after the projection-convergence merge added
+  `additional_speed_tiers` to the shared Codex projection) and is
+  byte-identical to the earlier capture — vendor model catalogs
+  (`models.json`), the only artifacts that projection change touches, are
+  excluded from the corpus by design (offline determinism), so no corpus
+  bytes moved.
+- Skipped the green requirement on the `Pinned ChatGPT/Codex Store install`
+  vendor-contract job because the Microsoft Store now fulfills
+  `OpenAI.Codex 26.818.5229.0` while the reviewed pin tracks `26.818.2441.0`
+  (upstream Store drift; the pin bump is tracked as its own follow-up). The
+  `Pinned Claude MSIX install and replacement` job is required green on the
+  release SHA as usual; the release gate is bypassed only via the documented
+  `workflow_dispatch` + `skip_release_gate` escape hatch with a written
+  reason naming that drift, after manually verifying every other required
+  check green on the tagged SHA.
+- Skipped the prerelease soak (testing-protocol §4.2): 0.20.57 ships stable
+  without a `next`-channel soak.
+- Local `pnpm test` on the release machine shows two known environmental
+  failures (launch.test.js / managed-apps.test.js, caused by this machine's
+  MSC-enrolled managed apps); they reproduce on clean `main` and all six CI
+  `Node {18,24}` legs run the same suite green.
 
 ## 0.20.56 — Enforce reviewed Windows vendor CLIs, follow the Store pin, harden convergence
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.56",
+  "version": "0.20.58",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -11,7 +11,7 @@ import {
   secureManagedCodexHome,
 } from "./codexSecurity.js";
 import { normalizeTenantId } from "./tenants.js";
-import { codexCatalogEntry } from "./modelCatalog.js";
+import { codexCatalogEntry, foreignClaudeCodexCatalogEntry } from "./modelCatalog.js";
 import {
   IMPEL_CLI_ENTRYPOINT,
   IMPEL_TASKS_MCP_SERVER_NAME,
@@ -234,7 +234,11 @@ const LEGACY_TRAPPED_CLAUDE_NAME = new RegExp(`^${escapedDisplayPrefix} Claude(
 // modelCatalog.js (a leaf module) so cliProfiles.js can consume them
 // without importing this module's launch-command cycle. Re-exported here
 // for the many existing consumers.
-export { FALLBACK_MODELS, managedCodexCliCatalog } from "./modelCatalog.js";
+// Re-exported from their leaf homes so existing importers keep working;
+// modelCatalog.js and gatewayModels.js must never import from apps.js (the
+// leaf constraint behind the 0.20.39 fork regression).
+export { FALLBACK_MODELS, foreignClaudeCodexCatalogEntry, managedCodexCliCatalog } from "./modelCatalog.js";
+export { fetchGatewayModels } from "./gatewayModels.js";
 
 export function normalizeAppTarget(value) {
   if (value == null || value === "all") return ["claude", "chatgpt"];
@@ -841,33 +845,6 @@ export function migrateLegacyClaudeAppSessions(userData, homeDir = os.homedir())
   return copied;
 }
 
-export async function fetchGatewayModels(config, fetchImpl = fetch, { allowEmpty = false } = {}) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 20000);
-  try {
-    const response = await fetchImpl(`${config.gatewayUrl}/v1/models`, {
-      headers: { authorization: `Bearer ${config.pat}` },
-      signal: controller.signal,
-    });
-    if (!response.ok) throw new Error(`HTTP ${response.status}`);
-    const payload = await response.json();
-    if (config.tenantId && payload?.org_id !== config.tenantId) {
-      throw new Error("gateway model catalog tenant did not match the selected tenant");
-    }
-    if (config.productAccess && payload?.product_access !== config.productAccess) {
-      throw new Error("gateway model catalog product access did not match the live entitlement");
-    }
-    if (!Array.isArray(payload?.data)) throw new Error("response has no model data array");
-    const models = payload.data.filter(isGatewayModel);
-    if (models.length === 0 && !(allowEmpty && isExplicitNoSeatCatalog(payload))) {
-      throw new Error("gateway returned no supported models");
-    }
-    return { models, source: "gateway", version: payload.version ?? null };
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
 export function installManagedAppFiles({
   config,
   targets,
@@ -1555,66 +1532,6 @@ export function projectClaudeDesktopModels(models) {
   });
 }
 
-export function foreignClaudeCodexCatalogEntry(model, index) {
-  const capability = model.client_capabilities?.codex;
-  const levels = capability?.supported_reasoning_levels;
-  const tiers = capability?.service_tiers;
-  const modalities = capability?.input_modalities;
-  const valid = capability && typeof capability === "object"
-    && Number.isInteger(capability.context_window) && capability.context_window > 0
-    && Number.isInteger(capability.max_context_window) && capability.max_context_window >= capability.context_window
-    && Array.isArray(levels) && levels.every((level) => (
-      level && typeof level.effort === "string" && typeof level.description === "string"
-    ))
-    && Array.isArray(tiers) && tiers.every((tier) => (
-      tier && typeof tier.id === "string" && typeof tier.name === "string" && typeof tier.description === "string"
-    ))
-    && Array.isArray(modalities) && modalities.every((value) => typeof value === "string")
-    && ["supports_parallel_tool_calls", "supports_reasoning_summaries", "supports_verbosity", "supports_search_tool", "supports_image_detail_original"]
-      .every((key) => typeof capability[key] === "boolean")
-    && (capability.default_reasoning_level == null
-      || capability.default_reasoning_level === ""
-      || levels.some((level) => level.effort === capability.default_reasoning_level))
-    && (capability.apply_patch_tool_type == null || typeof capability.apply_patch_tool_type === "string")
-    && (capability.web_search_tool_type == null || typeof capability.web_search_tool_type === "string");
-  if (!valid) {
-    console.warn(`impel: omitting model ${redactSecretText(model.id)} from Impel ChatGPT: missing verified Codex capabilities`);
-    return null;
-  }
-  return {
-    slug: model.id,
-    display_name: model.display_name || model.id,
-    description: model.description || `Claude model available through the Impel gateway (${model.id}).`,
-    ...(capability.default_reasoning_level ? { default_reasoning_level: capability.default_reasoning_level } : {}),
-    supported_reasoning_levels: levels,
-    service_tiers: tiers,
-    shell_type: "shell_command",
-    visibility: "list",
-    supported_in_api: true,
-    priority: Number.isInteger(model.priority) ? model.priority : index + 1,
-    base_instructions: "You are an AI coding agent. Follow repository instructions, collaborate with the user, make scoped changes, and verify your work.",
-    include_skills_usage_instructions: false,
-    supports_reasoning_summaries: capability.supports_reasoning_summaries,
-    support_verbosity: capability.supports_verbosity,
-    ...(capability.supports_reasoning_summaries ? { default_reasoning_summary: "none" } : {}),
-    ...(capability.supports_verbosity ? { default_verbosity: "low" } : {}),
-    ...(capability.apply_patch_tool_type ? { apply_patch_tool_type: capability.apply_patch_tool_type } : {}),
-    ...(capability.web_search_tool_type ? { web_search_tool_type: capability.web_search_tool_type } : {}),
-    truncation_policy: { mode: "tokens", limit: 10000 },
-    context_window: capability.context_window,
-    max_context_window: capability.max_context_window,
-    effective_context_window_percent: 95,
-    experimental_supported_tools: [],
-    input_modalities: modalities,
-    supports_parallel_tool_calls: capability.supports_parallel_tool_calls,
-    supports_image_detail_original: capability.supports_image_detail_original,
-    supports_search_tool: capability.supports_search_tool,
-    use_responses_lite: false,
-    tool_mode: null,
-    multi_agent_version: null,
-  };
-}
-
 function readVendorCodexModels(vendorPath) {
   const binary = vendorPath && path.join(vendorPath, "Contents", "Resources", "codex");
   if (!binary || !fs.existsSync(binary)) return new Map();
@@ -3354,21 +3271,6 @@ export function replaceDirectory(destination, staging, options = {}) {
   ));
 }
 
-function isGatewayModel(model) {
-  return model && typeof model.id === "string" && (model.provider === "claude" || model.provider === "codex");
-}
-
-function isExplicitNoSeatCatalog(payload) {
-  const statuses = payload?.provider_status;
-  return Boolean(statuses
-    && typeof statuses === "object"
-    && !Array.isArray(statuses)
-    && ["claude", "codex"].every((provider) => (
-      statuses[provider]?.state === "no_seat"
-      && statuses[provider]?.routable === false
-    )));
-}
-
 function writeAtomic(target, contents, mode) {
   fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
   if (fs.existsSync(target) && fs.readFileSync(target, "utf8") === contents) {

package/src/cli.js

@@ -11,6 +11,7 @@ import { cmdApps } from "./commands/apps.js";
 import { cmdMcp } from "./commands/mcp.js";
 import { cmdLaunch } from "./commands/launch.js";
 import { cmdSkills } from "./commands/skills.js";
+import { cmdModels } from "./commands/models.js";
 import { cmdAgents } from "./commands/agents.js";
 import { cmdTenant } from "./commands/tenant.js";
 import { cmdDoctor } from "./commands/doctor.js";
@@ -21,6 +22,7 @@ import { cmdUpdate } from "./commands/update.js";
 import { cmdNuke } from "./commands/nuke.js";
 import { cmdExperimental } from "./commands/experimental.js";
 import { cmdConverge } from "./commands/converge.js";
+import { cmdProvisionVendorClis } from "./commands/provisionVendorClis.js";
 import { cmdRemote } from "./commands/remote.js";
 import { cmdNative } from "./commands/native.js";
 import { ensureMacDeveloperTools } from "./macDeveloperTools.js";
@@ -68,6 +70,7 @@ Account:
 Diagnostics:
   impel status                                Authentication, current tenant, and local readiness
   impel doctor [--tenant <org>|--all-tenants] Synthetic provider, routing, and latency checks
+  impel models list|sync                      Inspect or refresh the isolated Codex model catalog
   impel report --message "<text>"             Send a bug report; you approve the exact payload
 
 Reset:
@@ -183,6 +186,10 @@ async function dispatch(cmd, rest) {
     case "skill":
       return cmdSkills(rest);
 
+    case "models":
+    case "model":
+      return cmdModels(rest);
+
     case "agents":
     case "agent":
       return cmdAgents(rest);
@@ -219,6 +226,12 @@ async function dispatch(cmd, rest) {
     case "_converge":
       return cmdConverge(rest);
 
+    // Hidden, unauthenticated vendor-CLI provisioning, called by the managed
+    // enrollment bootstrap. A managed device has no PAT, so it cannot reach
+    // `impel setup` — and without this nothing ever installs Claude Code.
+    case "_provision-vendor-clis":
+      return cmdProvisionVendorClis(rest);
+
     // Hidden OS-shell launcher. Setup/update guarantees the app is ready.
     case "_app-launch": {
       const [target = "all", ...args] = rest;

package/src/cliProfiles.js

@@ -22,6 +22,7 @@ import { renameWithWindowsRetry } from "./windowsFs.js";
 import { ensureClaudeSessionHooks, ensureCodexSessionHooks } from "./sessionHooks.js";
 import { RUNTIME_BRAND } from "./runtimeBrand.js";
 import { managedCodexCliCatalog } from "./modelCatalog.js";
+import { codexModelsManifestPath, syncedCodexCatalogMatches } from "./modelsManifest.js";
 
 export const IMPEL_CLI_PROFILES_DIR = path.join(CONFIG_DIR, "cli");
 export const CODEX_GATEWAY_TOKEN_ENV = `${RUNTIME_BRAND.cli.providerId
@@ -200,14 +201,19 @@ function splitTomlPreamble(text) {
   return { preamble: text.slice(0, table.index), rest: text.slice(table.index) };
 }
 
-function codexManagedBlock(gatewayUrl, tenantId) {
+function codexManagedBlock(gatewayUrl, tenantId, { crossAppModels = false } = {}) {
   const providerId = RUNTIME_BRAND.cli.providerId;
   const lines = [
     CODEX_START_MARK,
     `# Generated for \`${RUNTIME_BRAND.cli.command} codex\`. Other profile settings outside this block are preserved.`,
     `[model_providers.${providerId}]`,
     `name = ${JSON.stringify(`${RUNTIME_BRAND.product.displayName} Gateway`)}`,
-    `base_url = ${JSON.stringify(impelCodexBaseUrl(gatewayUrl))}`,
+    // The experimental OpenAI-compatible route can dispatch both provider
+    // families (the desktop ChatGPT profile's cross-app path); the default
+    // route is the byte-preserving Codex passthrough.
+    `base_url = ${JSON.stringify(crossAppModels
+      ? `${gatewayUrl}/experimental/openai/v1`
+      : impelCodexBaseUrl(gatewayUrl))}`,
     'wire_api = "responses"',
     `env_key = ${JSON.stringify(CODEX_GATEWAY_TOKEN_ENV)}`,
   ];
@@ -233,7 +239,7 @@ function codexManagedBlock(gatewayUrl, tenantId) {
   return lines.join("\n");
 }
 
-export function ensureImpelCodexProfile(gatewayUrl, tenantId) {
+export function ensureImpelCodexProfile(gatewayUrl, tenantId, { crossAppModels = false } = {}) {
   secureAllManagedCodexHomes({ cliRoot: IMPEL_CLI_PROFILES_DIR });
   const { codexHome, codexCatalog } = tenantCliProfilePaths(tenantId);
   secureManagedCodexHome(codexHome);
@@ -269,14 +275,30 @@ export function ensureImpelCodexProfile(gatewayUrl, tenantId) {
     : `${nextPreamble.trimEnd()}\n${catalogLine}\n`;
   nextPreamble = nextPreamble.replace(/^bypass_hook_trust[ \t]*=[ \t]*(?:true|false)[ \t]*\n?/gm, "");
   const restText = rest.trim();
-  const next = [nextPreamble.trimEnd(), codexManagedBlock(gatewayUrl, tenantId), restText]
+  const next = [nextPreamble.trimEnd(), codexManagedBlock(gatewayUrl, tenantId, { crossAppModels }), restText]
     .filter(Boolean)
     .join("\n\n")
     .concat("\n");
 
   writePrivateFile(configPath, hardenManagedCodexToml(next, configPath));
-  writePrivateFile(codexCatalog, `${JSON.stringify(managedCodexCliCatalog(), null, 2)}\n`);
+  // Launch layering (D13), synchronous half: the FALLBACK_MODELS projection
+  // is the offline floor. A catalog that models-manifest.json proves is
+  // exactly what the last gateway sync wrote for THESE bindings (tenant,
+  // gateway, cross-app state) is kept even when its TTL has lapsed —
+  // stale-beats-broken — and syncCodexModelsSafe refreshes it afterwards
+  // without ever blocking this writer on the network. Anything else (first
+  // run, tampered bytes, changed bindings) is reset to the floor, and the
+  // stale manifest is removed so the TTL machinery sees the floor as stale.
+  const keepSyncedCatalog = syncedCodexCatalogMatches(codexHome, codexCatalog, {
+    tenantId: normalizeTenantId(tenantId),
+    gatewayUrl,
+    crossAppModels,
+  });
+  if (!keepSyncedCatalog) {
+    writePrivateFile(codexCatalog, `${JSON.stringify(managedCodexCliCatalog(), null, 2)}\n`);
+    fs.rmSync(codexModelsManifestPath(codexHome), { force: true });
+  }
   if (RUNTIME_BRAND.features.sessions) ensureCodexSessionHooks(codexHome, tenantId, "codex_cli");
   secureManagedCodexHome(codexHome);
-  return { codexHome, configPath, catalogPath: codexCatalog };
+  return { codexHome, configPath, catalogPath: codexCatalog, syncedCatalog: keepSyncedCatalog };
 }

package/src/commands/apps.js

@@ -45,6 +45,7 @@ import {
 import { resolveSkillCredential } from "../skillBundle.js";
 import { resolveSkillsGateway, syncSkillsSafe } from "../skills.js";
 import { syncAgentProfilesSafe } from "../agents.js";
+import { syncCodexModelsSafe } from "../modelSync.js";
 import { secureManagedCodexHome } from "../codexSecurity.js";
 import { impelCliInvocation } from "../selfInvocation.js";
 import { createProgressLogger, withProgress } from "../progress.js";
@@ -749,6 +750,28 @@ export async function cmdWindowsApps(argv, overrides = {}) {
 
   try {
     if (action === "open" && RUNTIME_BRAND.cli.packageName === "impel-cli") maybePrintUpdateNotice();
+    // Windows mirror of refreshApps' CLI-catalog leg: the detached
+    // `app refresh --stale-only` slot also converges the isolated
+    // `impel codex` model catalog (D13). Runs before the desktop manifest
+    // fast-path below because the CLI catalog has its own TTL manifest.
+    if (action === "refresh") {
+      const stored = loadConfig();
+      if (stored?.pat) {
+        const cliTenantId = flags.tenant
+          ? normalizeTenantId(flags.tenant)
+          : stored.tenantId || null;
+        if (cliTenantId) {
+          await (overrides.syncCliModels || syncCodexModelsSafe)({
+            gatewayUrl: normalizeGatewayUrl(stored.gatewayUrl || resolveDefaultGateway()),
+            credential: tenantCredential(stored.pat, cliTenantId),
+            tenantId: cliTenantId,
+            crossAppModels: crossAppModelsEnabled(stored),
+            staleOnly: Boolean(flags["stale-only"]),
+            logger: { warn: () => {} },
+          });
+        }
+      }
+    }
     // Background token-helper refreshes pass --stale-only; honor the manifest
     // TTL here like the darwin refresh path does, so every vendor token call
     // does not become a full catalog fetch + profile rewrite (and its child
@@ -1355,11 +1378,31 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {},
     installFiles: installManagedAppFiles,
     syncSkills: syncSkillsSafe,
     syncAgents: syncAgentProfilesSafe,
+    syncCliModels: syncCodexModelsSafe,
     secureCodexHome: secureManagedCodexHome,
     ...overrides,
   };
   const stored = io.loadStoredConfig();
   if (!stored?.pat) return;
+  // The isolated `impel codex` catalog rides the same detached refresh slot
+  // (D13). Independent of the desktop legs below: a CLI-only machine has no
+  // installed app bundles yet still needs its Codex picker converging.
+  // syncCodexModelsSafe skips uninitialized profiles, honors the 6h manifest
+  // TTL under --stale-only, never throws, and keeps the last good catalog on
+  // failure.
+  {
+    const cliTenantId = tenantId ? normalizeTenantId(tenantId) : stored.tenantId || null;
+    if (cliTenantId) {
+      await io.syncCliModels({
+        gatewayUrl: normalizeGatewayUrl(stored.gatewayUrl || resolveDefaultGateway()),
+        credential: tenantCredential(stored.pat, cliTenantId),
+        tenantId: cliTenantId,
+        crossAppModels: crossAppModelsEnabled(stored),
+        staleOnly,
+        logger: { warn: () => {} },
+      });
+    }
+  }
   const requestedTenantId = tenantId
     ? normalizeTenantId(tenantId)
     : stored.tenantId || null;

package/src/commands/converge.js

@@ -173,6 +173,7 @@ export async function cmdConverge(argv = [], overrides = {}) {
         credential: resolveSkillCredential({ pat: config.pat, tenantId: selected.id }),
         platform: io.platform,
         skipInstall: true,
+        crossAppModels: config.experimental?.crossAppModels === true,
       });
       let prepared = inspected;
       if (inspected.missingAfter.length && !inspectOnly && !skipClis) {
@@ -206,6 +207,7 @@ export async function cmdConverge(argv = [], overrides = {}) {
             platform: io.platform,
             skipInstall: false,
             installTools,
+            crossAppModels: config.experimental?.crossAppModels === true,
           });
         }
       }

package/src/commands/doctor.js

@@ -1,11 +1,12 @@
 import { parseFlags } from "../args.js";
-import { loadConfig, normalizeGatewayUrl, resolveDefaultGateway } from "../config.js";
+import { crossAppModelsEnabled, loadConfig, normalizeGatewayUrl, resolveDefaultGateway } from "../config.js";
 import {
   DEFAULT_TTFT_BUDGET_MS,
   DOCTOR_PROVIDERS,
   probeTenant,
   recordSucceeded,
 } from "../doctor.js";
+import { codexCatalogStatus } from "../modelSync.js";
 import {
   assertProviderScopes,
   fetchTenants,
@@ -85,12 +86,43 @@ function doctorGatewayUrl(value) {
   return parsed.origin;
 }
 
+/**
+ * Local, offline staleness of the isolated `impel codex` model catalog
+ * (models.json + models-manifest.json). Reported beside the live gateway
+ * catalog probe so a device stuck on the offline floor or a months-old sync
+ * is visible from the same diagnosis surface that proves the gateway works.
+ */
+function cliModelCatalogReport(tenantId, { gatewayUrl, crossAppModels }) {
+  try {
+    const status = codexCatalogStatus(tenantId, { gatewayUrl, crossAppModels });
+    return {
+      state: status.catalogError ?? (status.source === "floor" ? "floor" : "synced"),
+      syncedAt: status.syncedAt,
+      catalogVersion: status.manifest?.catalogVersion ?? null,
+      fresh: status.fresh,
+      models: status.models.length,
+    };
+  } catch (error) {
+    return { state: "error", error: String(error?.message || error), fresh: false, models: 0 };
+  }
+}
+
+function cliModelCatalogLine(local) {
+  if (local.state === "missing") return "not initialized (run `impel codex` once)";
+  if (local.state === "floor") return "offline floor (never synced; run `impel models sync`)";
+  if (local.state === "synced") {
+    return `gateway sync ${local.syncedAt ?? "unknown"} (${local.fresh ? "fresh" : "stale"}, ${local.models} models)`;
+  }
+  return `${local.state}${local.error ? ` (${local.error})` : ""}`;
+}
+
 function printHuman(report) {
   for (const tenant of report.tenants) {
     console.log(`Tenant:  ${tenant.tenantId}`);
     console.log(`Access:  ${productAccessLabel(tenant.productAccess)}`);
     console.log(`Catalog: ${tenant.catalog.status ?? "network error"} (${tenant.catalog.models} ready models, ${tenant.catalog.durationMs ?? "?"}ms)`);
     if (tenant.catalog.error) console.log(`  ERROR ${tenant.catalog.error}`);
+    if (tenant.cliModelCatalog) console.log(`CLI models: ${cliModelCatalogLine(tenant.cliModelCatalog)}`);
     for (const record of tenant.records) {
       const ok = recordSucceeded(record);
       const latency = record.ttftMs === null ? "TTFT n/a" : `TTFT ${record.ttftMs}ms, total ${record.totalMs}ms`;
@@ -194,7 +226,7 @@ export async function cmdDoctor(argv) {
 
   const tenantReports = [];
   for (const tenant of tenants) {
-    tenantReports.push(await probeTenant({
+    const tenantReport = await probeTenant({
       config: doctorConfig,
       tenantId: tenant.id,
       productAccess: listing.productAccess,
@@ -203,7 +235,13 @@ export async function cmdDoctor(argv) {
       timeoutMs,
       ttftBudgets,
       strictLatency: Boolean(flags["strict-latency"]),
-    }));
+    });
+    // Offline and advisory: catalog staleness never flips the probe verdict.
+    tenantReport.cliModelCatalog = cliModelCatalogReport(tenant.id, {
+      gatewayUrl,
+      crossAppModels: crossAppModelsEnabled(config),
+    });
+    tenantReports.push(tenantReport);
   }
   const report = {
     generatedAt: new Date().toISOString(),

package/src/commands/launch.js

@@ -20,6 +20,7 @@ import {
   saveConfig,
 } from "../config.js";
 import { impelClaudeBaseUrl, impelCrossAppClaudeBaseUrl } from "../claudeSetup.js";
+import { syncCodexModelsSafe } from "../modelSync.js";
 import { parentVerbatimRelayAppendix } from "../verbatimRelay.js";
 import { withGitEnvironment } from "../skills.js";
 import { assertProviderScopes, ensureTenantSelection, tenantCredential } from "../tenants.js";
@@ -501,7 +502,7 @@ export async function cmdLaunch(tool, argv) {
   if (RUNTIME_BRAND.cli.packageName === "impel-cli") maybePrintUpdateNotice();
 
   const gatewayUrl = normalizeGatewayUrl(config.gatewayUrl || resolveDefaultGateway());
-  const crossAppModels = tool === "claude" && crossAppModelsEnabled(config);
+  const crossAppModels = crossAppModelsEnabled(config);
   let tenantId;
   try {
     // PAT scopes are immutable. Refresh legacy configs once, then use the
@@ -565,7 +566,7 @@ export async function cmdLaunch(tool, argv) {
       ? `${environment.ANTHROPIC_CUSTOM_HEADERS}\n${versionHeader}`
       : versionHeader;
   } else if (tool === "codex") {
-    const profile = ensureImpelCodexProfile(gatewayUrl, tenantId);
+    const profile = ensureImpelCodexProfile(gatewayUrl, tenantId, { crossAppModels });
     agentProfile = {
       client: "codex",
       root: profile.codexHome,
@@ -575,6 +576,19 @@ export async function cmdLaunch(tool, argv) {
     deleteEnvironmentKeys(environment, CODEX_DIRECT_AUTH_ENV);
     environment.CODEX_HOME = profile.codexHome;
     environment[CODEX_GATEWAY_TOKEN_ENV] = gatewayCredential;
+    // Launch layering (D13): the synchronous writer above guaranteed a valid
+    // catalog (offline floor, or the intact last sync). Refresh it from the
+    // gateway at most every six hours; a network/catalog failure keeps the
+    // last good file and never blocks this launch. Codex reads
+    // model_catalog_json at startup, so a fresh sync lands next launch.
+    await syncCodexModelsSafe({
+      gatewayUrl,
+      credential: gatewayCredential,
+      tenantId,
+      crossAppModels,
+      staleOnly: true,
+      logger: agentSyncLogger(nativeArgv),
+    });
   } else {
     throw new Error(`unsupported CLI launcher: ${tool}`);
   }