Codex Couldn't Load Its Resources? Roll Back the Extension

If the Codex sidebar started showing The extension couldn't load its resources immediately after openai.chatgpt updated to 26.803.41515, roll the extension back to the last working Marketplace version and temporarily disable auto-update for that extension. Current reports reproduce the same startup timeout on Windows, Linux cloud environments, and VS Code Remote-SSH. A blocked data:font request may appear nearby, but it is not a confirmed root cause, so do not weaken VS Code's Content Security Policy.

This is a version-boundary workaround, not a permanent fix. Preserve the failing version, exact error, and logs before changing anything, then retest the next stable extension release against the same workspace.

Match the 26.803.41515 Regression

Use this guide when most of the following are true:

• The installed extension is openai.chatgpt 26.803.41515.

• The Codex extension host activates, but the sidebar never becomes ready.

• After roughly 30 seconds, VS Code shows Codex could not start and The extension couldn't load its resources.

• Codex logs include Webview did not finish starting.

• Developer Tools may show a font-src violation for a data:font/woff2 resource.

• Reloading the window, restarting VS Code, reinstalling the same version, or using a clean profile does not help.

OpenAI's Codex IDE guide confirms that VS Code and compatible editors use the Codex extension and normally open it through the Codex sidebar. The current failure happens before that sidebar finishes initializing.

Two independent reports on issue 37458 reproduced the same error on VS Code 1.132.0 for Windows. One verified that all 4,516 packaged files were present and that a clean profile still failed. A separate Remote-SSH report in issue 37517 found the same message with the extension running on a Linux remote host.

Do not conclude that the CSP warning alone caused the failure. One reporter locally bypassed that warning for diagnosis and the webview still timed out. The strongest shared evidence is the controlled version comparison: 26.803.41515 fails, while the reporter-confirmed earlier Marketplace version works in the same environment.

Record the Failing State First

Save open files and let any active terminal command finish. Then record the VS Code and extension versions:

code --version
code --list-extensions --show-versions

Find the openai.chatgpt@... line in the second command. Also copy these details into a private diagnostic note:

• operating system and architecture;

• local, WSL, container, or Remote-SSH context;

• VS Code version and commit;

• Codex extension version;

• the two-line visible error;

• whether Webview did not finish starting appears;

• whether the data:font CSP warning appears;

• UTC time of the failed startup.

Do not include ChatGPT tokens, API keys, private repository paths, workspace source, or unrelated log content. If the sidebar opens but an existing conversation reports an ownership error instead, use the separate active-writer handoff guide. That is a session-lifecycle problem, not this webview startup regression.

Roll Back Through the VS Code Marketplace

VS Code officially supports installing a specific extension version. Use that built-in path:

1. Open Extensions with Ctrl+Shift+X on Windows or Linux, or Cmd+Shift+X on macOS.

2. Search for @id:openai.chatgpt.

3. Open the Codex extension's Manage menu.

4. Choose Install Another Version.

5. Select the most recent available version before 26.803.41515. The upstream Windows reproduction specifically reports 26.5730.61639 as working.

6. Restart the extension host when prompted.

7. Open the Codex sidebar and wait for it to become interactive.

If your organization pins approved extension versions, stop and ask the administrator to perform the rollback. Do not work around an enterprise allowlist or install an unapproved package.

Once the earlier build works, turn off auto-update only for Codex from the same extension menu. VS Code supports per-extension auto-update control. Keep other extension and editor updates enabled unless your administrator says otherwise.

This mirrors the safest pattern for any version-boundary regression: hold the workspace, account, editor, and network constant while changing only the affected extension version. The same controlled comparison is useful when diagnosing Codex CLI custom-provider regressions.

Handle Remote-SSH Separately

Remote environments can run a Marketplace extension on the remote extension host even when a different version is installed locally. VS Code's remote extension documentation explains that Remote-SSH, containers, WSL, and Codespaces can install their own Marketplace copy.

For Remote-SSH:

1. Connect to the affected host and keep that remote VS Code window focused.

2. Run Developer: Show Running Extensions.

3. Confirm whether openai.chatgpt is running locally or remotely.

4. Open Extensions in that same remote window.

5. Apply Install Another Version to the affected instance.

6. Reload the remote window and retest the sidebar.

A successful local rollback does not prove the remote copy changed. Record both versions when both instances exist.

Use a Signed VSIX Only When the Version Picker Fails

If Install Another Version cannot download the package, stay inside the official Marketplace workflow:

1. On the extension's Marketplace entry, choose Download Specific Version VSIX for the approved earlier build.

2. In the affected VS Code window, run Extensions: Install from VSIX.

3. Select the signed file you downloaded from the Marketplace.

4. Reload VS Code and verify the installed version again.

For Remote-SSH, run Install from VSIX while connected to the remote window so the package reaches the affected extension host. Do not download VSIX files from mirrors, disable extension signature checks, or modify the package.

Verify the Rollback

The workaround passes only when all of these are true:

• code --list-extensions --show-versions reports the intended earlier openai.chatgpt version;

• the Codex sidebar becomes interactive without the 30-second timeout;

• a new disposable chat accepts a short read-only question;

• Webview did not finish starting does not recur;

• the workspace and repository files are unchanged;

• the affected remote instance, if any, reports the same working result.

Do not use an old production conversation as the first canary. A fresh read-only chat separates sidebar startup from session history, tool permissions, MCP servers, and repository state.

If the Earlier Version Still Fails

Stop treating 26.803.41515 as the confirmed boundary when the earlier build produces the same error. Check these narrower branches instead:

• Run Developer: Show Running Extensions and confirm which host owns Codex.

• Run VS Code's Extension Bisect to detect an interaction with another extension.

• Test a clean profile without deleting the normal profile.

• Check whether the Marketplace download or enterprise policy selected a different version than requested.

• Compare local and remote extension versions independently.

• Attach sanitized startup evidence to the matching upstream issue.

Avoid broad cleanup. Deleting the whole VS Code profile, changing webview CSP rules, disabling signature verification, or repeatedly reinstalling the same broken build removes evidence without proving a cause.

Monitor the Fix Without Reopening GitHub Manually

Aident Loadout can check the upstream reports through a schema-inspected, read-only GitHub Action. Install or update Aident with this exact instruction:

Follow https://aident.ai/SETUP.md

Then give your agent this prompt:

Check my Aident Loadout account authentication and Vault status. Search the staging capability catalog for a connected read-only GitHub issue Action, inspect its current schema, and preflight the exact request. If the estimate is free, return only the state, updated time, title, comment count, reaction count, and URL for openai/codex issues 37458 and 37517. Do not comment, edit, close, label, publish, install, change files, start OAuth, or ask me for GitHub credentials.

Success is measurable: authentication and Vault checks complete; capability discovery, schema inspection, and preflight succeed; both issue summaries return; and no GitHub write or credential request occurs. Set up Aident Loadout and monitor the Codex extension fix.

Sources

• OpenAI Codex issue 37458: extension fails to load resources on 26.803.41515

• OpenAI Codex issue 37517: Remote-SSH webview startup failure

• OpenAI Codex issue 37508: related extension startup report

• Official OpenAI Codex IDE extension guide

• Official VS Code extension Marketplace documentation

• Official VS Code remote extension documentation

Refresh this guide when issues 37458 or 37517 change state, OpenAI names a root cause, a stable extension release passes local and Remote-SSH startup canaries, or VS Code changes its specific-version installation workflow.