VS Code Codex extension receives Cloudflare challenge HTML (403) instead of JSON, causing authentication failure and unstable state

[junetech]

What version of the IDE extension are you using?

openai.chatgpt-26.325.31654 (VS Code Codex extension)

What subscription do you have?

ChatGPT Business

Which IDE are you using?

VS Code (Remote SSH environment with .vscode-server)

What platform is your computer?

Windows x64 (host) + Linux (remote via VS Code server)

What issue are you seeing?

The Codex extension fails to properly authenticate backend/plugin endpoints and enters an unstable state.

Observed behavior:

• Repeated 403 Forbidden responses from backend endpoints
• Response body contains Cloudflare challenge HTML:
  "Enable JavaScript and cookies to continue"
• Extension logs show:
  • chatgpt authentication required to sync remote plugins
  • failed to warm featured plugin ids cache
• After repeated failures:
  • outbound queue is full
  • Server overloaded; retry later.
• Streaming responses frequently stall or disconnect
• Extension becomes slow and unreliable over time

This strongly suggests the extension is receiving HTML challenge responses instead of expected JSON API responses.

What steps can reproduce the bug?

1. Use VS Code with Codex extension in a Remote SSH environment (.vscode-server)
2. (Optional but likely relevant) Use overlay networking such as Tailscale or ZeroTier
3. Ensure ChatGPT web login and codex-cli login are both active
4. Start using the Codex extension (prompt, plugin usage, etc.)
5. After initial usage, backend requests begin failing with 403 and Cloudflare challenge
6. Extension gradually degrades into queue overflow and unstable state

What is the expected behavior?

• Backend/plugin endpoints should return valid JSON responses
• Extension should authenticate successfully using existing session
• No Cloudflare challenge HTML should be returned to the extension
• Extension should remain stable without queue overflow or streaming interruptions

Additional information

• ChatGPT web login is active and works normally
• codex-cli login is also active and functional
• Issue persists after:
  • Reinstalling extension
  • Deleting ~/.codex
  • Using clean VS Code profile (--user-data-dir)
• Logs indicate that the extension cannot handle Cloudflare challenge responses and treats them as API failures

This appears to be a structural issue where non-browser clients (extension/app-server) cannot pass Cloudflare challenge, leading to authentication failure and cascading errors.

[github-actions]

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• codex login fails: Cloudflare challenge blocks CLI token exchange (Australia/Linux) #16052
• Resuming same thread crashes Codex #16143

Powered by Codex Action

[junetech]

Thanks for pointing out the potential duplicates. I reviewed both issues:

• codex login fails: Cloudflare challenge blocks CLI token exchange (Australia/Linux) #16052
• Resuming same thread crashes Codex #16143

While they seem related at a high level (extension instability / auth issues), my case appears to be different in root cause.

In my case, the backend requests are explicitly returning Cloudflare challenge HTML (e.g., "Enable JavaScript and cookies to continue") instead of JSON. This leads to:

• 403 Forbidden responses on plugin/backend endpoints
• chatgpt authentication required to sync remote plugins
• cascading failures (outbound queue is full, Server overloaded)

This suggests the extension is failing due to receiving HTML challenge responses (likely Cloudflare) that it cannot handle, rather than just a generic auth/session issue.

I did not see Cloudflare challenge / HTML response behavior mentioned in those issues, so this may be a distinct failure mode.

[junetech]

I disabled Tailscale from Windows startup and rebooted, but the issue still reproduces with identical logs.

So this does not appear to be caused solely by Tailscale / overlay networking. The extension still receives a Cloudflare challenge response on the plugin sync endpoints (/backend-api/plugins/list, /featured), resulting in 403 errors during startup.

Also confirmed this happens even when opening a local repository (no Remote SSH).

Let me know if there are additional diagnostics I can provide.

[miguelmanlyx]

From this stack trace, this could be a openai side auth issue. A quick npx ai-doctor run might help. It can fix auth handling by validating api keys and provider auth flow.

[junetech]

I ran npx ai-doctor --ci, but it only detected Gemini (generativelanguage.googleapis.com) and did not appear to inspect Codex / ChatGPT extension auth flows at all.

My Codex issue is still the same: the extension startup/plugin sync requests to chatgpt.com/backend-api/plugins/... are getting 403 Forbidden with Cloudflare challenge HTML instead of normal API responses.

So I do not think ai-doctor is relevant for this specific failure mode.

[gobusutan]

I’m having the exact same issue using codex cli(codex-cli 0.118.0).
Following backend requests fail with Cloudflare challenge 403 Forbidden/Enable JavaScript and cookies to continue

• /backend-api/plugins/featured
• /backend-api/plugins/list
• /backend-api/connectors/directory/list

It also happens across multiple machines and networks, including a fresh aws linux instance.