codex-oauth-plus-onboarding-skill/skill/codex-oauth-plus-onboarding/references/env-parsing-and-cdp-origin-pitfalls-2026-05-10.md

2026-05-10 run pitfall: env parsing and Chrome CDP Origin

During a follow-up run using the low-token Codex OAuth skill, two reusable pitfalls appeared before the flow reached OpenAI signup:

1. Do not blindly source the env file

~/.hermes/env/codex_oauth_onboarding.env may contain unquoted paths with spaces, e.g. Chrome app paths. Plain shell source can fail with an error like:

...codex_oauth_onboarding.env: line 7: Chrome.app/Contents/MacOS/Google: No such file or directory

For validation/probe scripts, parse KEY=VALUE safely in Python instead of shell sourcing, or require quoting before shell use.

Minimal safe parser pattern:

from pathlib import Path
import re, shlex

env = {}
for line in Path.home().joinpath('.hermes/env/codex_oauth_onboarding.env').read_text().splitlines():
    line = line.strip()
    if not line or line.startswith('#') or '=' not in line:
        continue
    if line.startswith('export '):
        line = line[7:].strip()
    k, v = line.split('=', 1)
    k, v = k.strip(), v.strip()
    if not re.match(r'^[A-Za-z_][A-Za-z0-9_]*$', k):
        continue
    try:
        if v and v[0] in '"\'':
            v = shlex.split(v)[0]
    except Exception:
        pass
    env[k] = v.strip('"\'')

2. Chrome CDP WebSocket Origin rejection

When using Python websocket-client against an existing Chrome remote debugging port, Chrome can reject the handshake:

websocket._exceptions.WebSocketBadStatusException:
Handshake status 403 Forbidden
Rejected an incoming WebSocket connection from the http://127.0.0.1:9224 origin.
Use --remote-allow-origins=http://127.0.0.1:9224 or --remote-allow-origins=*

Preferred prevention: launch automation Chrome with:

--remote-allow-origins=*

If the Chrome instance is already running, try a matching Origin when connecting:

import websocket
ws = websocket.create_connection(ws_url, timeout=10, origin='http://127.0.0.1:9224')

Do this before concluding Dashboard CDP is unavailable.