Status: needs live verification — reasoned from code + protocol semantics, not yet reproduced.
CriClient.connect() sends Target.setAutoAttach only on its own connection (packages/server/lib/browsers/cdp-protocol/cri-client.ts). Chromium's auto-attach is not recursive: attaching to an OOPIF does not auto-attach that OOPIF's own children — you have to re-issue Target.setAutoAttach on each attached session (Puppeteer does exactly this). We never do.
So a grandchild OOPIF — e.g. a cross-origin iframe embedded inside a page that cy.origin has navigated to an origin-isolated origin, or any cross-site-inside-cross-site embedding — likely never attaches at all. No session, no Fetch.enable, and with the proxy disabled its subresource traffic escapes to the real network invisibly (no hang, unlike #34609 — just silent non-interception).
To verify
Proxy-off, visit a page embedding cross-site frame A which embeds cross-site frame B; check whether B's target ever fires Target.attachedToTarget and whether its requests pause.
Fix direction
On child-target attach in CriClient._onAttachedToTarget, re-issue Target.setAutoAttach (waitForDebuggerOnStart: true, flatten: true) on the new session so the family recurses, and let the existing onChildTargetAttached hook handle each descendant.
Out of scope for the HTTP/2 MVP — backlog.
Status: needs live verification — reasoned from code + protocol semantics, not yet reproduced.
CriClient.connect()sendsTarget.setAutoAttachonly on its own connection (packages/server/lib/browsers/cdp-protocol/cri-client.ts). Chromium's auto-attach is not recursive: attaching to an OOPIF does not auto-attach that OOPIF's own children — you have to re-issueTarget.setAutoAttachon each attached session (Puppeteer does exactly this). We never do.So a grandchild OOPIF — e.g. a cross-origin iframe embedded inside a page that
cy.originhas navigated to an origin-isolated origin, or any cross-site-inside-cross-site embedding — likely never attaches at all. No session, noFetch.enable, and with the proxy disabled its subresource traffic escapes to the real network invisibly (no hang, unlike #34609 — just silent non-interception).To verify
Proxy-off, visit a page embedding cross-site frame A which embeds cross-site frame B; check whether B's target ever fires
Target.attachedToTargetand whether its requests pause.Fix direction
On child-target attach in
CriClient._onAttachedToTarget, re-issueTarget.setAutoAttach(waitForDebuggerOnStart: true, flatten: true) on the new session so the family recurses, and let the existingonChildTargetAttachedhook handle each descendant.Out of scope for the HTTP/2 MVP — backlog.