Skip to content

Codex desktop plugin marketplace unreachable — Cloudflare challenge blocks plugins/featured API, preventing new plugin installs #16808

Open
Open
Codex desktop plugin marketplace unreachable — Cloudflare challenge blocks plugins/featured API, preventing new plugin installs#16808
Labels
appIssues related to the Codex desktop appauthIssues related to authentication and accountsbugSomething isn't workingskillsIssues related to skills

Description

@Pavel-Sennikov
Pavel-Sennikov
opened on Apr 4, 2026

What version of the Codex App are you using (From “About Codex” dialog)?

26.325.31654

What subscription do you have?

chatgpt plus

What platform is your computer?

Darwin 24.6.0

What issue are you seeing?

Related issue
This compounds with the desktop nav wiring bug where Plugins is not exposed in the sidebar unless [features] plugins = true is manually added to ~/.codex/config.toml. CLI plugin installs write per-plugin config but don't set this feature flag, creating a bootstrap deadlock. That issue was worked around manually, but this marketplace fetch failure is a separate problem.

Summary
The plugin manager's background warmup request to https://chatgpt.com/backend-api/plugins/featured?platform=codex receives a Cloudflare JS challenge page (403 Forbidden) instead of the featured plugin list. This prevents the marketplace from populating, so users cannot discover or install new plugins from the desktop app. Existing installed plugins continue to function.

Actual behavior

On app launch, codex_core::plugins::manager attempts to warm the featured plugin IDs cache
Request to https://chatgpt.com/backend-api/plugins/featured?platform=codex returns 403
Response body is a Cloudflare managed challenge page (_cf_chl_opt, challenge-platform/h/b/orchestrate/chl_page/v1) requiring JavaScript execution
Plugin manager logs: WARN codex_core::plugins::manager: failed to warm featured plugin ids cache
Marketplace cannot list available plugins; no new plugins can be installed through UI
CLI /plugins marketplace works (likely uses a different fetch path that can pass Cloudflare)
Expected behavior
Plugin manager's HTTP client should authenticate with chatgpt.com backend-api in a way that bypasses Cloudflare bot protection, or use an API endpoint that doesn't sit behind Cloudflare challenge pages.

Log evidence
From ~/.codex/log/codex-tui.log:

2026-04-04T12:31:28.664894Z WARN codex_core::plugins::manager: failed to warm featured plugin ids cache
error=remote plugin sync request to https://chatgpt.com/backend-api/plugins/featured
failed with status 403 Forbidden: ...

Response contains:

window._cf_chl_opt — Cloudflare challenge configuration
cZone: 'chatgpt.com', cType: 'managed'
cRay: '9e70548c2984f770'
JS script load from /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1
"Enable JavaScript and cookies to continue" noscript fallback
Root cause hypothesis
The desktop plugin manager (codex_core::plugins::manager) makes a plain HTTP request to chatgpt.com/backend-api/plugins/featured. This request:

Likely lacks the session cookies / auth headers that the browser-based CLI marketplace includes
Presents as an automated client to Cloudflare (missing browser fingerprint, no JS execution capability)
Gets classified as bot traffic and receives a managed challenge instead of the API response
The CLI /plugins path works, suggesting it either:

Uses a WebView / embedded browser that passes Cloudflare transparently
Hits a different endpoint or includes ChatGPT session auth that the background warmup does not

What steps can reproduce the bug?

Launch Codex desktop on macOS build 26.325.31654 with ChatGPT auth
Ensure [features] plugins = true in config
Open Plugins in sidebar
Observe marketplace does not populate / shows no available plugins
Check ~/.codex/log/codex-tui.log for failed to warm featured plugin ids cache with 403
Run codex --no-alt-screen → /plugins — CLI marketplace works

What is the expected behavior?

No response

Additional information

No response

Activity

  1. Pavel-Sennikov
    added
    appIssues related to the Codex desktop app
    on Apr 4, 2026
  2. github-actions
    added
    bugSomething isn't working
    skillsIssues related to skills
    authIssues related to authentication and accounts
    on Apr 4, 2026

  3. github-actions commented on Apr 4, 2026

    @github-actions
    github-actionsbot
    on Apr 4, 2026 – with GitHub Actions
    Contributor

    Potential duplicates detected. Please review them and close your issue if it is a duplicate.

    Powered by Codex Action

  4. DrewDawson2027 commented on Apr 20, 2026

    @DrewDawson2027
    DrewDawson2027
    on Apr 20, 2026

    Additional repro/evidence from another macOS app install.

    Environment

    • Codex app 26.415.40636
    • codex-cli 0.122.0-alpha.1
    • Darwin 25.4.0
    • codex login status returns Logged in using ChatGPT

    What is new here
    This does not appear to be limited to opening the Plugins UI. I can reproduce the same https://chatgpt.com/backend-api/plugins/featured warmup failure from a normal non-marketplace operator flow.

    Repro

    1. Keep the local plugin catalog lean and local-only.
    2. Run codex exec '$doctor'.
      • In my setup this path is clean after isolating unrelated startup noise.
      • No codex_core::plugins::manager, codex_analytics::client, codex_otel::events::session_telemetry, or codex_core::shell_snapshot warnings appear in the transcript.
    3. Run codex exec '/doctor'.
    4. Before the session starts, Codex emits:
    WARN codex_core::plugins::manager: failed to warm featured plugin ids cache
error=remote plugin sync request to https://chatgpt.com/backend-api/plugins/featured failed with status 403 Forbidden
    1. The session still routes into the local doctor skill after the warning.

    Why this matters
    The plugins/featured warmup seems to run on a slash-command startup path too, even when:

    • the user is already authenticated with ChatGPT
    • the active plugin catalog is already lean and local-only
    • the user never opened /plugins

    So the bug looks broader than just "marketplace UI cannot populate". It also leaks into otherwise unrelated operator flows and makes slash-path behavior noisier / less trustworthy than the equivalent skill path.

    If helpful, I can provide the sanitized transcript grep I used to isolate it:

    • canonical $doctor path: no warning matches
    • slash /doctor path: still shows the plugins/featured 403 at session start

  5. glowcup commented on Apr 24, 2026

    @glowcup
    glowcup
    on Apr 24, 2026

    I’m seeing what appears to be the same/similar failure in Codex desktop.

    Symptom

    The Plugins and Skills pages render with huge white/pale loading blocks over the plugin/skill cards. The page heading and search bar are visible, and some text from the cards is partially visible underneath/around the blocks, but the list is unusable.

    Environment

    • Codex desktop: 26.422.21637
    • Build: 2056
    • macOS: 13.7.8 / build 22H730
    • CPU: Intel x86_64

    Log evidence

    Earlier logs from ~/.codex/log/codex-tui.log showed:

    WARN codex_tui::chatwidget: failed to load full apps list; falling back to installed apps snapshot: Failed to load apps: Request failed with status 403 Forbidden: <html>

    WARN codex_core::plugins::manager: failed to warm featured plugin ids cache error=remote plugin sync request to https://chatgpt.com/backend-api/plugins/featured failed with status 403 Forbidden: <html>

    The returned HTML included Cloudflare challenge text instead of JSON:

    Enable JavaScript and cookies to continue
cZone: 'chatgpt.com'
cType: 'managed'
/backend-api/plugins/featured?platform=codex

    Troubleshooting already tried

    • Restarted Codex.
    • Deleted and reinstalled Codex.
    • Checked macOS Software Update: no updates available.
    • Launched with --disable-gpu: did not resolve it, and caused an app hang during one attempt.
    • Removed com.apple.quarantine metadata to stop App Translocation; Codex then verified as notarized/accepted, but issue persisted.
    • Reset desktop profile/cache under ~/Library/Application Support/Codex and related caches.
    • Moved ~/.codex/.tmp/plugins out of the way to force a fresh temporary plugin marketplace cache.
    • Tested through a VPS/network change; no change.

    At this point it does not look like a local install/cache/GPU/network issue. It looks like Codex desktop is receiving bad HTML/403 challenge content from the plugin marketplace/API path and the UI is failing to recover gracefully, leaving the Plugins/Skills pages visually blocked.

  6. glowcup commented on Apr 24, 2026

    @glowcup
    glowcup
    on Apr 24, 2026

    Additional diagnostics after deeper research:

    Region / network

    Honduras itself does not appear to be the issue. OpenAI’s supported-country list includes Honduras, and I also tested through a VPS/network change with no improvement.

    From the current route, Cloudflare trace reports:

    colo=MIA
loc=US

    So the failing request path is not currently being treated as Honduras-only traffic.

    Live endpoint probes

    Unauthenticated probes against:

    https://chatgpt.com/backend-api/plugins/featured?platform=codex

    all returned Cloudflare challenge responses:

    HTTP/2 403
cf-mitigated: challenge
server: cloudflare
cf-ray: ...-MIA

    This happened for:

    • default curl/8.7.1
    • User-Agent: reqwest/0.12.0
    • User-Agent: Codex-Desktop/26.422.21637
    • a browser-like Chrome User-Agent sent through curl

    That suggests the mitigation is not explained only by the string User-Agent in this environment; TLS/client fingerprint or missing browser challenge state/cookies may also be part of the block.

    Current official Intel macOS download

    I inspected the current official Intel Mac download from the Codex docs:

    https://persistent.oaistatic.com/codex-app-prod/Codex-latest-x64.dmg

    Headers showed it was last modified on:

    Fri, 24 Apr 2026 01:26:27 GMT

    After mounting the DMG without installing it, the version inside is exactly the same as the installed app:

    Codex desktop: 26.422.21637
Build: 2056
Embedded runtime: codex-cli 0.124.0-alpha.2

    So reinstalling the current official Intel DMG does not provide a newer desktop build.

    Possible version gap

    The open-source rust-v0.124.0 release published Apr 23 includes:

    Preserved Cloudflare cookies across approved ChatGPT hosts, reducing auth breakage in HTTP-backed ChatGPT flows. (#17783)
Remote plugin marketplaces can now be listed and read directly... (#18452, #19079)

    But the current official Intel desktop DMG still embeds:

    codex-cli 0.124.0-alpha.2

    That may mean the current desktop build does not yet include the stable 0.124.0 Cloudflare-cookie/plugin discovery fixes, or those fixes are not wired into the affected desktop plugin/API request path.

    Updated conclusion

    This now looks like a Codex desktop/runtime + Cloudflare interaction rather than local corruption:

    • local profile/cache reset did not help
    • app reinstall did not help
    • current official Intel DMG is not newer
    • VPS/network change did not help
    • plugin endpoint still returns Cloudflare challenge HTML
    • desktop UI does not fail gracefully and leaves Plugins/Skills visually blocked

  7. lycadvice commented on May 15, 2026

    @lycadvice
    lycadvice
    on May 15, 2026

    Adding another affected Codex Desktop case with a slightly different endpoint (/backend-api/ps/plugins/installed).

    Environment:

    • Codex Desktop app-server version from logs: 0.131.0-alpha.9
    • Runtime bundle selected: 26.513.11550
    • Platform: macOS 26.4.1 / build 25E253
    • System proxy: none (scutil --proxy returns an empty dictionary)

    User-visible symptom:

    • Typing @ in Codex Desktop leaves plugins/local files stuck loading.
    • Restarting Codex, re-logging in, disabling proxy, and switching networks did not resolve it.
    • skills/list and app/list can succeed, but plugin/list repeatedly fails when fetching remote installed plugins.

    Log evidence from ~/Library/Logs/com.openai.codex/2026/05/15/codex-desktop-...-t0-i1-032109-0.log:

    2026-05-15T03:21:24.878Z info [AppServerConnection] response_routed ... durationMs=1540 errorCode=-32603 ... method=plugin/list ...
2026-05-15T03:21:24.881Z error [electron-message-handler] Request failed ... error={"code":-32603,"message":"list remote plugin catalog: remote plugin catalog request to https://chatgpt.com/backend-api/ps/plugins/installed failed with status 403 Forbidden: <html> ..."} ... method=plugin/list ...

    The returned HTML contains Cloudflare challenge markers:

    Enable JavaScript and cookies to continue
/cdn-cgi/challenge-platform/...
cZone: 'chatgpt.com'
cType: 'managed'
/backend-api/ps/plugins/installed?scope=WORKSPACE

    Repeated occurrences in the same session:

    • 2026-05-15T03:21:26Z: plugin/list -> 403 Cloudflare challenge
    • 2026-05-15T03:26:56Z: plugin/list -> 403 Cloudflare challenge
    • 2026-05-15T03:27:01Z: plugin/list -> 404 Not Found: {"detail":"Not Found"} for the same installed plugins endpoint

    Earlier in the same logs, some plugin/list calls returned errorCode=null, so this appears intermittent but persistent enough to block the @ mention UI.

    Expected behavior:

    • Codex Desktop should fetch installed/remote plugin metadata through an authenticated path that is not blocked by browser-only Cloudflare challenges.
    • If remote plugin listing fails, the @ mention UI should degrade gracefully and still allow local file mentions to load/use normally.

    I can provide more sanitized log excerpts if useful.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    appIssues related to the Codex desktop appauthIssues related to authentication and accountsbugSomething isn't workingskillsIssues related to skills

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions