BigPizzaV3/CodexPlusPlus · error · anyhow::Error

CDP WebSocket URL must use ws or wss

Error message

CDP WebSocket URL must use ws or wss

What it means

Security guard in validate_cdp_websocket_url: the DevTools WebSocket URL returned by the browser or a target uses a scheme other than ws/wss (e.g. http), so it cannot be a valid WebSocket endpoint and is rejected before connecting. The offending input is the URL string from the CDP response.

Source

Thrown at crates/codex-plus-core/src/cdp.rs:214

    let targets = response
        .json::<Vec<CdpTarget>>()
        .await
        .context("failed to deserialize CDP targets")?;
    for target in &targets {
        if let Some(websocket_url) = target.web_socket_debugger_url.as_deref() {
            validate_cdp_websocket_url(websocket_url, debug_port).with_context(|| {
                format!("unsafe CDP target WebSocket URL for target {}", target.id)
            })?;
        }
    }
    Ok(targets)
}

pub fn validate_cdp_websocket_url(url: &str, expected_port: u16) -> anyhow::Result<()> {
    let parsed = reqwest::Url::parse(url).context("invalid CDP WebSocket URL")?;
    if !matches!(parsed.scheme(), "ws" | "wss") {
        bail!("CDP WebSocket URL must use ws or wss");
    }
    let host = parsed
        .host_str()
        .ok_or_else(|| anyhow::anyhow!("CDP WebSocket URL has no host"))?;
    let address = host
        .trim_start_matches('[')
        .trim_end_matches(']')
        .parse::<IpAddr>()
        .with_context(|| "CDP WebSocket host must be a loopback IP address")?;
    if !address.is_loopback() {
        bail!("CDP WebSocket host must be loopback");
    }
    let port = parsed
        .port()
        .ok_or_else(|| anyhow::anyhow!("CDP WebSocket URL must include an explicit port"))?;
    if port != expected_port {
        bail!("CDP WebSocket port {port} does not match debug port {expected_port}");
    }

View on GitHub (pinned to f2074595a2)

Solutions

1. Use the webSocketDebuggerUrl as returned by the CDP endpoint unmodified
2. Check for proxies/rewriters mangling the returned URL
3. Update the browser if it returns malformed DevTools URLs

When it happens

Trigger: Thrown at crates/codex-plus-core/src/cdp.rs:214 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BigPizzaV3/CodexPlusPlus@f2074595a2 (2026-08-23). Data as JSON: /api/errors/1b4d7ff33d97c635. Report an issue: GitHub.