Codex desktop plugin marketplace unreachable — Cloudflare challenge blocks plugins/featured API, preventing new plugin installs
What version of the Codex App are you using (From “About Codex” dialog)?
26.325.31654
What subscription do you have?
chatgpt plus
What platform is your computer?
Darwin 24.6.0
What issue are you seeing?
Related issue
This compounds with the desktop nav wiring bug where Plugins is not exposed in the sidebar unless [features] plugins = true is manually added to ~/.codex/config.toml. CLI plugin installs write per-plugin config but don't set this feature flag, creating a bootstrap deadlock. That issue was worked around manually, but this marketplace fetch failure is a separate problem.
Summary
The plugin manager's background warmup request to https://chatgpt.com/backend-api/plugins/featured?platform=codex receives a Cloudflare JS challenge page (403 Forbidden) instead of the featured plugin list. This prevents the marketplace from populating, so users cannot discover or install new plugins from the desktop app. Existing installed plugins continue to function.
Actual behavior
On app launch, codex_core::plugins::manager attempts to warm the featured plugin IDs cache
Request to https://chatgpt.com/backend-api/plugins/featured?platform=codex returns 403
Response body is a Cloudflare managed challenge page (_cf_chl_opt, challenge-platform/h/b/orchestrate/chl_page/v1) requiring JavaScript execution
Plugin manager logs: WARN codex_core::plugins::manager: failed to warm featured plugin ids cache
Marketplace cannot list available plugins; no new plugins can be installed through UI
CLI /plugins marketplace works (likely uses a different fetch path that can pass Cloudflare)
Expected behavior
Plugin manager's HTTP client should authenticate with chatgpt.com backend-api in a way that bypasses Cloudflare bot protection, or use an API endpoint that doesn't sit behind Cloudflare challenge pages.
Log evidence
From ~/.codex/log/codex-tui.log:
2026-04-04T12:31:28.664894Z WARN codex_core::plugins::manager: failed to warm featured plugin ids cache
error=remote plugin sync request to https://chatgpt.com/backend-api/plugins/featured
failed with status 403 Forbidden: <html>...
Response contains:
window._cf_chl_opt — Cloudflare challenge configuration
cZone: 'chatgpt.com', cType: 'managed'
cRay: '9e70548c2984f770'
JS script load from /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1
"Enable JavaScript and cookies to continue" noscript fallback
Root cause hypothesis
The desktop plugin manager (codex_core::plugins::manager) makes a plain HTTP request to chatgpt.com/backend-api/plugins/featured. This request:
Likely lacks the session cookies / auth headers that the browser-based CLI marketplace includes
Presents as an automated client to Cloudflare (missing browser fingerprint, no JS execution capability)
Gets classified as bot traffic and receives a managed challenge instead of the API response
The CLI /plugins path works, suggesting it either:
Uses a WebView / embedded browser that passes Cloudflare transparently
Hits a different endpoint or includes ChatGPT session auth that the background warmup does not
What steps can reproduce the bug?
Launch Codex desktop on macOS build 26.325.31654 with ChatGPT auth
Ensure [features] plugins = true in config
Open Plugins in sidebar
Observe marketplace does not populate / shows no available plugins
Check ~/.codex/log/codex-tui.log for failed to warm featured plugin ids cache with 403
Run codex --no-alt-screen → /plugins — CLI marketplace works
What is the expected behavior?
_No response_
Additional information
_No response_
This issue has 5 comments on GitHub. Read the full discussion on GitHub ↗