fix(launcher): add --remote-allow-origins=* for Chromium 142+ ws origin check

[LeoLin990405]

What

When opencli auto-launches an Electron app (codex, doubao, antigravity, chatgpt), pass --remote-allow-origins=* alongside --remote-debugging-port=<port>.

Why

Chrome / Electron 142+ enforces an Origin allow-list on the CDP WebSocket upgrade at ws://127.0.0.1:<port>/devtools/page/<id>. Without the flag, any external ws client gets HTTP 403:

Rejected an incoming WebSocket connection from the
http://127.0.0.1:<port> origin. Use the command line flag
--remote-allow-origins=http://127.0.0.1:<port> to allow connections
from this origin or --remote-allow-origins=* to allow all origins.

This bites the moment someone pairs opencli with an external CDP ws debugger — Python websocket-client, raw curl, headless Puppeteer attached after launch, custom MCP servers, etc. opencli's own internal CDP client happens to work because chrome-devtools-protocol uses a chrome:// origin, but anything else fails.

How does Puppeteer / Playwright / chrome-devtools-mcp handle this?

Same way — they all set --remote-allow-origins=* by default:

• Puppeteer: puppeteer/lib/cjs/puppeteer/node/ChromeLauncher.ts (--remote-allow-origins=* in DEFAULT_ARGS)
• Playwright: playwright/packages/playwright-core/src/server/registry/dependencies.ts (added in #24517)
• chrome-devtools-mcp: passes --remote-allow-origins=* by default

Side effects

None for opencli's own usage. The flag controls which origins can establish a CDP ws upgrade, not which network interfaces the CDP server binds to. CDP is still localhost-only — Chromium's --remote-debugging-port binds 127.0.0.1.

Tested

• tsc --build clean
• vitest run launcher.test.ts → 9 passed / 1 skipped (pre-existing skipped)
• Verified on macOS 15.4 with Electron 142.0.6953.13 (Antigravity build) — ws upgrade now succeeds from python -m websocket without the 403.

Diff

@@ -253,7 +253,18 @@ export async function ensureCdpEndpoint(...) {

   // Step 4: Launch
-  const args = [`--remote-debugging-port=${port}`, ...(app.extraArgs ?? [])];
+  //
+  // Chrome / Electron 142+ enforces an Origin allow-list on the CDP
+  // WebSocket upgrade ... [see commit message]
+  const args = [
+    `--remote-debugging-port=${port}`,
+    '--remote-allow-origins=*',
+    ...(app.extraArgs ?? []),
+  ];
   await launchElectronApp(appPath, app, args, label);