#34555 fixed service-worker sessions and #34622 fixed OOPIF sessions, but only on the main page client: createCdpFetchRuntime assigns onChildTargetAttached on deps.client only.
The extra-target path never gets the hook. attachExtraTarget (in packages/server/lib/network-runtime.ts) takes client: Pick<ICriClient, 'send' | 'on' | 'off'> — onChildTargetAttached isn't even in the Pick — and nothing assigns it on the popup's CriClient. So when a popup's own child targets attach (a service worker it registers, or a cross-origin iframe it embeds that Chromium promotes to an OOPIF), their sessions are released from the debugger pause without Fetch.enable, and their traffic bypasses interception and goes to the real network.
This was already noted as the open popup-SW gap during the service-worker spike; #34622 widened the family to iframes without covering the popup path for either type.
Fix direction
Widen attachExtraTarget's Pick to include onChildTargetAttached and assign it to the extra-target transport's attachChildSession, mirroring the main-client wiring in createCdpFetchRuntime.start(). Clear it on detach. The ordering guarantee (enable while the target is still debugger-paused) already lives in CriClient._onAttachedToTarget and applies to any client with the hook set.
Out of scope for the HTTP/2 MVP — backlog.
#34555 fixed service-worker sessions and #34622 fixed OOPIF sessions, but only on the main page client:
createCdpFetchRuntimeassignsonChildTargetAttachedondeps.clientonly.The extra-target path never gets the hook.
attachExtraTarget(inpackages/server/lib/network-runtime.ts) takesclient: Pick<ICriClient, 'send' | 'on' | 'off'>—onChildTargetAttachedisn't even in the Pick — and nothing assigns it on the popup'sCriClient. So when a popup's own child targets attach (a service worker it registers, or a cross-origin iframe it embeds that Chromium promotes to an OOPIF), their sessions are released from the debugger pause withoutFetch.enable, and their traffic bypasses interception and goes to the real network.This was already noted as the open popup-SW gap during the service-worker spike; #34622 widened the family to iframes without covering the popup path for either type.
Fix direction
Widen
attachExtraTarget's Pick to includeonChildTargetAttachedand assign it to the extra-target transport'sattachChildSession, mirroring the main-client wiring increateCdpFetchRuntime.start(). Clear it on detach. The ordering guarantee (enable while the target is still debugger-paused) already lives inCriClient._onAttachedToTargetand applies to any client with the hook set.Out of scope for the HTTP/2 MVP — backlog.