fix(cli): give shipped web search a 60s budget

apps/cli/config/base.cordis.yml

@@ -332,7 +332,9 @@
 # chat, at each search; its Messages endpoint is separate from the
 # chat-completions endpoint, so it takes its own base-URL override. Fetch stays
 # disabled and no fetch provider is mounted: that provider defers SSRF
-# protection and the model would choose the request target.
+# protection and the model would choose the request target. Search is a full
+# auxiliary model request with server-side retrieval, so this shipped DeepSeek
+# route gets 60s while the provider-neutral tool default remains 30s.
 - id: web
   name: '@deepseek-ai/dsh-web'
   config:
@@ -348,6 +350,7 @@
   name: '@deepseek-ai/dsh-tool-web'
   config:
     fetch: false
+    searchTimeoutMs: 60000
 
 # ── rows every surface mounts, whose values each overlay states ──────────────
 

apps/cli/tests/built-bin.e2e.ts

@@ -94,6 +94,13 @@ describe.skipIf(!existsSync(dshBin))('dsh BUILT bin (node lib/bin.js, no tsx)',
       expect(stdout).toContain('model: deepseek-v4-pro')
       expect(stdout).toContain('cwd: !!js process.cwd()')
       expect(stdout).toContain("name: '@deepseek-ai/dsh-tui'")
+      expect(stdout).toContain([
+        '- id: tool-web',
+        "  name: '@deepseek-ai/dsh-tool-web'",
+        '  config:',
+        '    fetch: false',
+        '    searchTimeoutMs: 60000',
+      ].join('\n'))
       // Provenance comment separators name each section's source file.
       expect(stdout).toContain('# == base.cordis.yml')
       expect(stdout).toContain('# == base.cordis.yml, patched by tui.cordis.yml')