Capture iframe and worker telemetry with shared target tracking

[rgarcia]

Summary

• Reuse browsersurface for telemetry target/session discovery while retaining separate CDP connections and tracker instances for telemetry and WebMCP.
• Add configurable extra target types, early session-attachment events, and a session-only mode that avoids window lookup and frame initialization. Preserve the default WebMCP tracker behavior.
• Attach OOPIFs explicitly and dedicated workers through parent-session auto-attachment, including nested workers. Capture shared/service workers and retain background-page support.
• Scope network requests by session and request ID, clear detached-session requests, and discard stale-session data events. Preserve OOPIF parent-frame metadata without assigning top-level screenshot/navigation ownership. Drain old capture work before reconnecting.
• Add real-browser regressions and enable them in CI. Include iframe and worker in the event target-type schema and regenerate the Go OpenAPI output.

Validation

• All 32 iframe matrix cases now pass with -race: top-level, same-origin, cross-origin and nested cross-origin; default/isolated contexts; sent/aborted POSTs; frames created before/after monitor startup.
• Dedicated, shared and service worker request/response body capture passes against real Chromium. A separate real-browser test verifies that closing either client's connection leaves the other usable and that telemetry reconnects with fresh sessions.
• The new real-browser suite passed twice with -race; the entire cdpmonitor suite with real-browser tests enabled also passed. Chromium 151.0.7922.169 on Linux. The dedicated CDP telemetry browser-regression step now runs in CI.
• go vet ./... and the complete non-e2e race suite passed on the latest commit. An earlier run hit a pre-existing Chromium temporary-directory cleanup flake in lib/devtoolsproxy; its retry and the final full run both passed. Focused race tests for cdpmonitor, browsersurface, cdpclient, webmcpclient, oapi, and the API handlers also passed.
• Added unit coverage for worker discovery/lifetimes, stale-session events, OOPIF parent metadata, session-scoped request IDs, and default-mode iframe initialization with matching real-Chrome target/frame IDs. Exactly-once tab-open events and in-flight response draining across reconnect are now fake-server regressions; the new tests passed 10 race-enabled repetitions. The local Chrome fixture terminates its process group to avoid renderer/worker cleanup races.

Run from server/:

KERNEL_CDPMONITOR_CHROME_E2E=1 go test -race ./lib/cdpmonitor -count=1

Scope and generated output

These tests cover settled targets, not requests racing domain initialization. Discovery intentionally covers page, iframe, dedicated/shared/service worker, and background-page targets; worklet/webview/other target capture is not part of this change. Default location-tracked iframe sessions retain their existing independent initialization/lifetime behavior. No production deployment was performed; Docker end-to-end tests run in CI.

The latest commit passes the CDP browser-regression step, unit tests, image builds, and BugBot. Docker end-to-end remains red on the pre-existing TestReplayRecordingIncludesAudioTrack audio-duration assertion, including an unchanged retry: audio duration 8.094458s versus a required minimum of 8.121387s (formatDuration - 2). No audio implementation or audio-test assertions changed in this PR.

The earlier Docker failure was TestReplayRecordingIncludesAudioTrack exceeding the unchanged five-second Playwright daemon-startup deadline. An unchanged rerun passed; the same startup failure also appears in earlier branches without these changes. The test does not enable the telemetry collector.

A subsequent CI run hit the existing Chrome fixture's 20-second startup limit before creating the monitor. The fixture now allows up to 60 seconds (capped by its parent deadline), enforces a real pipe-read deadline, drains stderr after readiness, and reaps the command on cleanup. Capture assertion deadlines are unchanged. Startup deadline/partial-read/EOF tests passed 10 race-enabled repetitions; the connection-ownership browser test passed five repetitions.

OpenAPI regeneration also synchronizes pre-existing embedded-spec drift for WebMCP's awaiting_submission status. The source schema and generated Go status types already used that value; this change does not edit the WebMCP source definition. The generated output was produced using the existing down-conversion/codegen/SSE-patch pipeline, not hand-edited.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 7314252. Configure here.}