Issue Station
Sign In
Tools hereToolbox

hermes - 💡(How to fix) Fix codex_app_server direct profile smoke fails on ChatGPT plugins/installed Cloudflare challenge; Kanban worker then protocol-violates

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

codex_app_server startup is failing on a direct codex-worker profile smoke because Codex app-server receives Cloudflare challenge HTML from ChatGPT's plugin-installed endpoint. The same environment also causes native Kanban-dispatched Codex workers to repeatedly exit without invoking kanban_complete / kanban_block, producing protocol violations and retry churn.

This looks related to the existing Codex app-server / Kanban callback issues, but the direct-profile repro shows the failure occurs before Kanban is required: a no-tool direct profile prompt cannot start the Codex app-server thread because /backend-api/ps/plugins/installed returns a managed Cloudflare challenge page.

Related issues / PRs I found before filing:

  • #27178 — Kanban worker reports protocol_violation when agent ends with text instead of kanban_complete / kanban_block
  • #26203 — Codex app-server Kanban workers cannot complete tasks under sandbox without board DB writable root
  • #26089 — codex-runtime migrate can duplicate native Codex plugin tables
  • #26529 — /codex-runtime codex_app_server can skip migration when openai_runtime already set
  • #26530 — Codex app-server tool calls fail closed in gateway / non-CLI contexts
  • #29034 — Kanban defaults can auto-launch unbounded paid worker swarms across boards
  • #27233 — open PR gating Codex app-server runtime

Error Message

Error: codex app-server startup failed: codex app-server method 'thread/start' timed out after 15s codex stderr (last 12 lines): ... <span id="challenge-error-text">Enable JavaScript and cookies to continue</span> ... /backend-api/ps/plugins/installed?scope=WORKSPACE&includeDownloadUrls=true&__cf_chl_tk=... ... session_id: 20260521_145044_b9ecae

Root Cause

codex_app_server startup is failing on a direct codex-worker profile smoke because Codex app-server receives Cloudflare challenge HTML from ChatGPT's plugin-installed endpoint. The same environment also causes native Kanban-dispatched Codex workers to repeatedly exit without invoking kanban_complete / kanban_block, producing protocol violations and retry churn.

Fix Action

Fix / Workaround

codex_app_server startup is failing on a direct codex-worker profile smoke because Codex app-server receives Cloudflare challenge HTML from ChatGPT's plugin-installed endpoint. The same environment also causes native Kanban-dispatched Codex workers to repeatedly exit without invoking kanban_complete / kanban_block, producing protocol violations and retry churn.

# ~/.hermes/config.yaml
model:
  default: gpt-5.5
  provider: openai-codex
  base_url: https://chatgpt.com/backend-api/codex
  context_length: 272000
  openai_runtime: codex_app_server
kanban:
  dispatch_in_gateway: true
  failure_limit: 2
  auto_decompose: true
approvals:
  mode: smart

# ~/.hermes/profiles/codex-worker/config.yaml
model:
  default: gpt-5.5
  provider: openai-codex
  base_url: https://chatgpt.com/backend-api/codex
  context_length: 1050000
  openai_runtime: codex_app_server
kanban:
  dispatch_in_gateway: true
  failure_limit: 2
  auto_decompose: true
approvals:
  mode: smart

Code Example

# ~/.hermes/config.yaml
model:
  default: gpt-5.5
  provider: openai-codex
  base_url: https://chatgpt.com/backend-api/codex
  context_length: 272000
  openai_runtime: codex_app_server
kanban:
  dispatch_in_gateway: true
  failure_limit: 2
  auto_decompose: true
approvals:
  mode: smart

# ~/.hermes/profiles/codex-worker/config.yaml
model:
  default: gpt-5.5
  provider: openai-codex
  base_url: https://chatgpt.com/backend-api/codex
  context_length: 1050000
  openai_runtime: codex_app_server
kanban:
  dispatch_in_gateway: true
  failure_limit: 2
  auto_decompose: true
approvals:
  mode: smart

---

hermes -p codex-worker chat -q 'Do not use shell or any tool. Reply exactly DIRECT_CODEX_PROFILE_OK.' -Q > /tmp/direct_codex_worker_smoke.out 2>&1

---

Error: codex app-server startup failed: codex app-server method 'thread/start' timed out after 15s
codex stderr (last 12 lines):
...
<span id="challenge-error-text">Enable JavaScript and cookies to continue</span>
...
/backend-api/ps/plugins/installed?scope=WORKSPACE&includeDownloadUrls=true&__cf_chl_tk=...
...
session_id: 20260521_145044_b9ecae

---

2026-05-21 14:50:46,182 INFO [20260521_145044_b9ecae] agent.conversation_loop: conversation turn: session=20260521_145044_b9ecae model=gpt-5.5 provider=openai-codex platform=cli history=0 msg='Do not use shell or any tool. Reply exactly DIRECT_CODEX_PROFILE_OK.'
2026-05-21 14:51:06,960 WARNING [20260521_145044_b9ecae] agent.codex_runtime: codex app-server session retired (turn error: codex app-server startup failed: codex app-server method 'thread/start' timed out after 15s
  <span id="challenge-error-text">Enable JavaScript and cookies to continue</span>
  ... /backend-api/ps/plugins/installed?scope=WORKSPACE&includeDownloadUrls=true&__cf_chl_tk=...)

---

BOARD=stock-codex-kanban-smoke
hermes kanban boards create "$BOARD" --name "Stock Codex Kanban Smoke" --description "Scratch board for stock Hermes profile-lane Codex app-server lifecycle verification"

hermes kanban --board "$BOARD" create "stock codex-worker lifecycle callback smoke" \
  --body 'STOCK HERMES/CODEX KANBAN LIFECYCLE SMOKE. This is not repo work. Do not create files. Do not use shell unless absolutely necessary. Use only stock Kanban tools: first call kanban_show for this task; then call kanban_comment with body exactly STOCK_CALLBACK_COMMENT_OK; then call kanban_complete with summary exactly STOCK_CALLBACK_COMPLETE_OK and metadata {"stock_codex_kanban_smoke": true, "used_stock_profile_lane": true}. If any Kanban tool is unavailable or fails, call kanban_block with reason starting exactly STOCK_CALLBACK_FAILED: followed by the concrete observed error. Do not invent any sidecar/CLI workaround.' \
  --assignee codex-worker \
  --workspace scratch \
  --priority 1 \
  --max-runtime 8m \
  --json

hermes kanban --board "$BOARD" dispatch --max 1 --json

---

{
  "spawned": [
    {
      "task_id": "t_055aa624",
      "assignee": "codex-worker",
      "workspace": "/home/ubuntu/.hermes/kanban/boards/stock-codex-kanban-smoke/workspaces/t_055aa624"
    }
  ]
}

---

id: t_055aa624
status: blocked
assignee: codex-worker
workspace_kind: scratch
runs:
  1 crashed crashed pid 4008721 not alive
  2 crashed crashed worker exited cleanly (rc=0) without calling kanban_complete or kanban_block — protocol violation
  3 crashed crashed worker exited cleanly (rc=0) without calling kanban_complete or kanban_block — protocol violation
  4 crashed crashed worker exited cleanly (rc=0) without calling kanban_complete or kanban_block — protocol violation
  5 crashed crashed worker exited cleanly (rc=0) without calling kanban_complete or kanban_block — protocol violation
  6 blocked blocked STOCK_CALLBACK_FAILED: stock profile-lane worker spawned through native Kanban but repeatedly exited without calling kanban_complete/kanban_block; no comment reached board. Stopped by operator to prevent retry loop; no sidecar workaround used.

---

codex app-server startup failed: codex app-server method 'initialize' timed out after 10.0s
codex app-server startup failed: codex app-server method 'thread/start' timed out after 15s
<span id="challenge-error-text">Enable JavaScript and cookies to continue</span>
/backend-api/ps/plugins/installed?scope=WORKSPACE...
/backend-api/ps/plugins/installed?scope=GLOBAL...

---

2026-05-21 14:26:18,509 INFO ... codex app-server thread started: id=019e4a80 profile=workspace-write cwd=/home/ubuntu/.hermes/kanban/boards/stock-codex-kanban-smoke/workspaces/t_055aa624
2026-05-21 14:26:23,996 INFO __main__: hermes-tools MCP server registered 24/26 tools

---

t_055aa624
hermes -p codex-worker
codex app-server
hermes_cli.codex_worker
codex_kanban_bridge

---

hermes kanban --board msig-platform dispatch --dry-run

---

Reclaimed:    0
Crashed:      0
Timed out:    0
Stale:        0
Auto-blocked: 0
Promoted:     0
Spawned:      0
RAW_BUFFERClick to expand / collapse

Summary

codex_app_server startup is failing on a direct codex-worker profile smoke because Codex app-server receives Cloudflare challenge HTML from ChatGPT's plugin-installed endpoint. The same environment also causes native Kanban-dispatched Codex workers to repeatedly exit without invoking kanban_complete / kanban_block, producing protocol violations and retry churn.

This looks related to the existing Codex app-server / Kanban callback issues, but the direct-profile repro shows the failure occurs before Kanban is required: a no-tool direct profile prompt cannot start the Codex app-server thread because /backend-api/ps/plugins/installed returns a managed Cloudflare challenge page.

Related issues / PRs I found before filing:

  • #27178 — Kanban worker reports protocol_violation when agent ends with text instead of kanban_complete / kanban_block
  • #26203 — Codex app-server Kanban workers cannot complete tasks under sandbox without board DB writable root
  • #26089 — codex-runtime migrate can duplicate native Codex plugin tables
  • #26529 — /codex-runtime codex_app_server can skip migration when openai_runtime already set
  • #26530 — Codex app-server tool calls fail closed in gateway / non-CLI contexts
  • #29034 — Kanban defaults can auto-launch unbounded paid worker swarms across boards
  • #27233 — open PR gating Codex app-server runtime

Environment

  • Host: Ubuntu/Linux 6.17.0-19-generic
  • Hermes: Hermes Agent v0.14.0 (2026.5.16)
  • Repo path: /home/ubuntu/.hermes/hermes-agent
  • Local Hermes commit: 87d9239009f3dae87effc7735131010b7f72a475
  • Upstream main at time of test: 48be2e0e4dbc4489f418e8d58794790c9c830390
  • Local repo was effectively current; only missing upstream commit was test-infra-only test: use subprocesses for each test file (#29016)
  • Provider/model: openai-codex / gpt-5.5
  • Base URL: https://chatgpt.com/backend-api/codex
  • Profile under test: codex-worker
  • model.openai_runtime: codex_app_server in both root config and codex-worker profile config
  • ~/.codex/config.toml parsed successfully during preflight
  • ~/.codex/config.toml MCP servers: agentmail, hermes-tools, shadcn
  • ~/.codex/config.toml native plugins: none
  • ~/.codex/config.toml native marketplaces: none

Sanitized config snippets:

# ~/.hermes/config.yaml
model:
  default: gpt-5.5
  provider: openai-codex
  base_url: https://chatgpt.com/backend-api/codex
  context_length: 272000
  openai_runtime: codex_app_server
kanban:
  dispatch_in_gateway: true
  failure_limit: 2
  auto_decompose: true
approvals:
  mode: smart

# ~/.hermes/profiles/codex-worker/config.yaml
model:
  default: gpt-5.5
  provider: openai-codex
  base_url: https://chatgpt.com/backend-api/codex
  context_length: 1050000
  openai_runtime: codex_app_server
kanban:
  dispatch_in_gateway: true
  failure_limit: 2
  auto_decompose: true
approvals:
  mode: smart

Reproduction A: direct profile smoke, no Kanban

This direct smoke avoids Kanban entirely and asks the worker not to use tools:

hermes -p codex-worker chat -q 'Do not use shell or any tool. Reply exactly DIRECT_CODEX_PROFILE_OK.' -Q > /tmp/direct_codex_worker_smoke.out 2>&1

Observed output:

Error: codex app-server startup failed: codex app-server method 'thread/start' timed out after 15s
codex stderr (last 12 lines):
...
<span id="challenge-error-text">Enable JavaScript and cookies to continue</span>
...
/backend-api/ps/plugins/installed?scope=WORKSPACE&includeDownloadUrls=true&__cf_chl_tk=...
...
session_id: 20260521_145044_b9ecae

Log excerpt from ~/.hermes/profiles/codex-worker/logs/agent.log:

2026-05-21 14:50:46,182 INFO [20260521_145044_b9ecae] agent.conversation_loop: conversation turn: session=20260521_145044_b9ecae model=gpt-5.5 provider=openai-codex platform=cli history=0 msg='Do not use shell or any tool. Reply exactly DIRECT_CODEX_PROFILE_OK.'
2026-05-21 14:51:06,960 WARNING [20260521_145044_b9ecae] agent.codex_runtime: codex app-server session retired (turn error: codex app-server startup failed: codex app-server method 'thread/start' timed out after 15s
  <span id="challenge-error-text">Enable JavaScript and cookies to continue</span>
  ... /backend-api/ps/plugins/installed?scope=WORKSPACE&includeDownloadUrls=true&__cf_chl_tk=...)

Expected: direct profile smoke replies exactly DIRECT_CODEX_PROFILE_OK.

Actual: Codex app-server startup times out while stderr contains Cloudflare challenge HTML from ChatGPT's plugin-installed endpoint.

Reproduction B: native Kanban scratch smoke

I also tested the stock native Kanban profile lane on a scratch board. No repo work, no custom sidecar, no external CLI lane.

Commands:

BOARD=stock-codex-kanban-smoke
hermes kanban boards create "$BOARD" --name "Stock Codex Kanban Smoke" --description "Scratch board for stock Hermes profile-lane Codex app-server lifecycle verification"

hermes kanban --board "$BOARD" create "stock codex-worker lifecycle callback smoke" \
  --body 'STOCK HERMES/CODEX KANBAN LIFECYCLE SMOKE. This is not repo work. Do not create files. Do not use shell unless absolutely necessary. Use only stock Kanban tools: first call kanban_show for this task; then call kanban_comment with body exactly STOCK_CALLBACK_COMMENT_OK; then call kanban_complete with summary exactly STOCK_CALLBACK_COMPLETE_OK and metadata {"stock_codex_kanban_smoke": true, "used_stock_profile_lane": true}. If any Kanban tool is unavailable or fails, call kanban_block with reason starting exactly STOCK_CALLBACK_FAILED: followed by the concrete observed error. Do not invent any sidecar/CLI workaround.' \
  --assignee codex-worker \
  --workspace scratch \
  --priority 1 \
  --max-runtime 8m \
  --json

hermes kanban --board "$BOARD" dispatch --max 1 --json

Created task: t_055aa624

Dispatch did spawn the real profile lane:

{
  "spawned": [
    {
      "task_id": "t_055aa624",
      "assignee": "codex-worker",
      "workspace": "/home/ubuntu/.hermes/kanban/boards/stock-codex-kanban-smoke/workspaces/t_055aa624"
    }
  ]
}

Final task state after operator block to stop retry churn:

id: t_055aa624
status: blocked
assignee: codex-worker
workspace_kind: scratch
runs:
  1 crashed crashed pid 4008721 not alive
  2 crashed crashed worker exited cleanly (rc=0) without calling kanban_complete or kanban_block — protocol violation
  3 crashed crashed worker exited cleanly (rc=0) without calling kanban_complete or kanban_block — protocol violation
  4 crashed crashed worker exited cleanly (rc=0) without calling kanban_complete or kanban_block — protocol violation
  5 crashed crashed worker exited cleanly (rc=0) without calling kanban_complete or kanban_block — protocol violation
  6 blocked blocked STOCK_CALLBACK_FAILED: stock profile-lane worker spawned through native Kanban but repeatedly exited without calling kanban_complete/kanban_block; no comment reached board. Stopped by operator to prevent retry loop; no sidecar workaround used.

Relevant logs showed a mixture of:

codex app-server startup failed: codex app-server method 'initialize' timed out after 10.0s
codex app-server startup failed: codex app-server method 'thread/start' timed out after 15s
<span id="challenge-error-text">Enable JavaScript and cookies to continue</span>
/backend-api/ps/plugins/installed?scope=WORKSPACE...
/backend-api/ps/plugins/installed?scope=GLOBAL...

One later run did get further:

2026-05-21 14:26:18,509 INFO ... codex app-server thread started: id=019e4a80 profile=workspace-write cwd=/home/ubuntu/.hermes/kanban/boards/stock-codex-kanban-smoke/workspaces/t_055aa624
2026-05-21 14:26:23,996 INFO __main__: hermes-tools MCP server registered 24/26 tools

…but the task still exited without board callback and was recorded as protocol violation.

Cleanup / safety checks performed

After the scratch smoke failed, I manually blocked the scratch task and killed lingering codex app-server processes from the smoke.

Verified no active process remained matching:

t_055aa624
hermes -p codex-worker
codex app-server
hermes_cli.codex_worker
codex_kanban_bridge

Also verified the real project board would not dispatch anything:

hermes kanban --board msig-platform dispatch --dry-run

Output:

Reclaimed:    0
Crashed:      0
Timed out:    0
Stale:        0
Auto-blocked: 0
Promoted:     0
Spawned:      0

Why this may not be a duplicate of only #27178 / #26203

The Kanban failure does overlap with the protocol-violation and callback issues. However, the direct no-Kanban profile smoke fails the same day with the same Cloudflare plugin-installed endpoint challenge before it can produce a simple text response. That suggests at least one root cause is in Codex app-server startup / plugin discovery / ChatGPT session handling, not only the Kanban callback protocol.

Expected behavior

  • If codex_app_server cannot start because ChatGPT/Codex plugin discovery receives Cloudflare challenge HTML, Hermes should fail loudly with a concise diagnostic naming the endpoint and likely auth/session remediation.
  • A direct no-tool profile smoke should either work or produce a clear auth/plugin-startup error.
  • Native Kanban workers should not retry indefinitely/opaquely when the worker process exits cleanly without callback due to Codex startup/runtime failure.

Questions for maintainers

  1. Should this be tracked as a duplicate of #27178, #26203, #26529/#26089, or under #27233?
  2. Is /backend-api/ps/plugins/installed?... expected to be called during codex app-server thread/start even when there are no native Codex plugins configured in ~/.codex/config.toml?
  3. Is there a stock remediation path for this state besides re-running Codex/Hermes auth or disabling plugin discovery?
  4. Should Hermes detect Cloudflare challenge HTML in Codex app-server stderr and surface a first-class diagnostic instead of timing out and causing Kanban retry/protocol churn?

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

  • If codex_app_server cannot start because ChatGPT/Codex plugin discovery receives Cloudflare challenge HTML, Hermes should fail loudly with a concise diagnostic naming the endpoint and likely auth/session remediation.
  • A direct no-tool profile smoke should either work or produce a clear auth/plugin-startup error.
  • Native Kanban workers should not retry indefinitely/opaquely when the worker process exits cleanly without callback due to Codex startup/runtime failure.

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

hermes - 💡(How to fix) Fix codex_app_server direct profile smoke fails on ChatGPT plugins/installed Cloudflare challenge; Kanban worker then protocol-violates