fix(browser): resolve HTTP CDP URLs

[MagMueller]

Summary

• treat BU_CDP_URL=http://... as a DevTools HTTP endpoint and resolve its WebSocket URL through /json/version
• retry discovery within the caller’s existing connection timeout so a browser that is still starting can become ready
• surface HTTP 403 as an immediate remote-debugging permission error
• preserve BU_CDP_URL=ws://... compatibility and keep BU_CDP_WS as the highest-priority direct WebSocket setting

Previously an HTTP BU_CDP_URL was passed directly to new WebSocket, which attempted an upgrade on the HTTP root instead of querying /json/version. This matches the public browser-harness endpoint contract.

Validation

• bun test in packages/bcode-browser: 16 pass, 8 environment-gated skips
• deterministic tests cover HTTP discovery, cold-start retries, permission denial, WebSocket compatibility, and env precedence
• package typecheck and root filtered typecheck: pass
• bunx oxlint packages/bcode-browser/test/connect-env.test.ts: clean

---

Summary by cubic

Fixes connection to Chrome when BU_CDP_URL is an HTTP DevTools endpoint by resolving its WebSocket URL via /json/version. Uses a single connection deadline for discovery and WebSocket open, adds retries until the deadline, and clearer 403 permission errors, while keeping BU_CDP_WS priority and BU_CDP_URL WebSocket compatibility.

• Bug Fixes
  • Resolve HTTP BU_CDP_URL through /json/version to obtain webSocketDebuggerUrl.
  • Keep discovery within the caller’s deadline with retries; WebSocket open uses remaining time.
  • Surface HTTP 403 as an immediate remote-debugging permission error.
  • Preserve precedence: BU_CDP_WS over BU_CDP_URL; accept WebSocket values in BU_CDP_URL.

^{Written for commit d3e7b76. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>