fix(cdp): give the castle default 1.5s, not 5s, inside upstream's connect budget

2 files changed, 9 insertions, 1 deletions

diff --git a/FORK.md b/FORK.md
index d106983..8464128 100644
--- a/FORK.md
+++ b/FORK.md
@@ -99,6 +99,10 @@ The asymmetry is deliberate. An explicit endpoint is an instruction, so failing
 to reach it must not quietly automate a different browser — that would drive
 your own signed-in Chrome instead of the shared one. The default is only a
 preference, so a laptop away from the wire network still gets the local browser.
+The default is given 1.5s to answer, explicit targets 5s: upstream 0.11 starts
+the bridge's 10s connect timer before discovery, and off wg8 the castle address
+times out rather than being refused, so a 5s probe left a local Chrome only
+about 5s for its "Allow remote debugging?" prompt.
 
 `/browser-status` names the resolved target and whether it is reachable. Note
 the connection is **lazy**: nothing dials the browser until the first `browser_*`
diff --git a/src/cdp/discovery.ts b/src/cdp/discovery.ts
index 84da5f9..7aa35f6 100644
--- a/src/cdp/discovery.ts
+++ b/src/cdp/discovery.ts
@@ -133,7 +133,11 @@ export const discoverEndpoint = async (): Promise<Result<CdpEndpoint, CdpError>>
     return err(cdpError("discovery_failed", describeCdpTarget(target)));
   }
   if (target.kind === "remote") {
-    const ws = await queryLiveWsUrl(target.port, 5_000, target.host);
+    // FORK: the default is only a preference, and this probe now runs inside the
+    // bridge's 10s connect budget (upstream starts that timer before discovery), so
+    // a blackholed castle must not eat the local fallback's time. Explicit targets
+    // keep the longer wait: they fail hard rather than fall back.
+    const ws = await queryLiveWsUrl(target.port, target.source === "default" ? 1_500 : 5_000, target.host);
     if (ws) return ok({ wsUrl: ws });
 
     // An explicitly configured endpoint is an instruction: fail rather than