Cross-origin iframe sessions not tracked for dynamically injected iframes

[sourman]

Version: 0.27.1 (Linux x86_64, Chromium 149)

Summary

Target.setAutoAttach only populates iframe_sessions for iframes present during initial page attach. Iframes added later via document.createElement('iframe') are never tracked, so frame <ref> + snapshot fail with "Frame not found" / "Unknown ref."

Reproduction

agent-browser open https://example.com

# Inject a cross-origin iframe after page load
agent-browser eval --stdin <<'JS'
const f = document.createElement('iframe');
f.src = 'http://localhost:8080/';
f.id = 'test-iframe';
document.body.appendChild(f);
'injected';
JS

# Wait for load
sleep 2

# The iframe appears as a leaf node with no children
agent-browser snapshot -i
# - Iframe [ref=e2]   ← no child elements

# Frame switching fails
agent-browser frame "#test-iframe"
# ✗ Frame not found

The iframe target does appear in /json/list with its own webSocketDebuggerUrl, confirming Chrome created the OOPIF target. But the daemon's iframe_sessions map is empty because Target.attachedToTarget was not captured.

Root cause

Target.setAutoAttach({ autoAttach: true, flatten: true }) is called once during attach_to_page (browser.rs:615). For dynamically added iframes, Chrome fires Target.attachedToTarget later, but the daemon's drain_events loop may have already returned or the event is dropped.

Workaround

Connect directly to the iframe's CDP target via its webSocketDebuggerUrl from /json/list. This bypasses the daemon entirely and works for Runtime.evaluate, Runtime.enable (console capture), etc.

Suggested fix

Listen for Target.attachedToTarget events continuously (not just during initial drain) when the iframe type is detected, and insert entries into iframe_sessions on the fly. Alternatively, re-issue Target.setAutoAttach or explicitly attach to new iframe targets when frame <selector> encounters an unknown frame ID.