0.118.0 gets stuck on startup when plugins/featured returns a Cloudflare challenge page #16543

curl -I 'https://chatgpt.com/backend-api/plugins/featured?platform=codex'

Response:

HTTP/2 403
cf-mitigated: challenge
content-type: text/html; charset=UTF-8

And the body contains:

Enable JavaScript and cookies to continue

What’s confusing is that opening the same URL in a browser works fine for me. So this does not
look like a simple “endpoint is down” issue. It seems more like browser traffic is accepted, but
terminal/CLI traffic gets challenged.

I also checked a couple of other endpoints and they look normal from terminal:

curl -I 'https://auth.openai.com/oauth/token'
curl -I 'https://chatgpt.com/backend-api/codex/responses'

Those return normal API-style responses (405 + JSON), so this doesn’t seem to be a general
connectivity problem.

Relevant log lines from ~/.codex/log/codex-tui.log:

failed to warm featured plugin ids cache error=remote plugin sync request to
https://chatgpt.com/backend-api/plugins/featured failed with status 403 Forbidden: <html>

Later I also see:

failed to load full apps list; falling back to installed apps snapshot: Failed to load apps:
Failed to parse JSON response

So my guess is:

- 0.118.0 is trying to load featured plugins/apps during startup
- that request gets a Cloudflare challenge HTML page instead of JSON
- Codex doesn’t handle that path well enough and startup ends up looking stuck / broken

A couple more notes:

- MCP config exists in my setup, but from the logs it doesn’t look like MCP init is the main
  blocker here
- npx -y @openai/codex@0.118.0 --version works fine, so this does not look like a broken install
  package

Expected behavior:
If plugins/featured is blocked / challenged / returns non-JSON, Codex should probably just skip
featured plugin loading and continue startup normally instead of appearing hung.

If needed I can provide:

- exact curl outputs
- more log lines
- my config.toml
- a quick test with features.apps=false / features.plugins=false

### What steps can reproduce the bug?

codex start  

### What is the expected behavior?

_No response_

### Additional information

_No response_