[Li-john1021]

Summary

Fixes #438.

DOM.focus already used cdpRunnerForTarget for cross-origin iframe nodes, but Input.insertText / Input.dispatchKeyEvent still went through the root tab CDP session. That left fill verification failing with fill_value_mismatch (or typing into the parent page) and let press report success when the child frame never saw the key.

This change sends those Input.* calls through the same node-scoped runner.

Test plan

• vitest run src/tools/__tests__/fill.test.ts — 74 passed (includes new OOPIF routing test that asserts Input.insertText goes to sendToTarget for a cdpSessionId ref)
• Live Chrome OOPIF fill/press (not available in this environment)

Happy to adjust if maintainers prefer a different routing helper.

[Li-john1021]

Browser-level check (requested on #488)

Tried to produce a minimal page that fails on main and passes with this PR. I could not.

Environment

• Google Chrome 155.0.8059.84 (Linux)
• headless=new, --site-per-process
• Cross-site OOPIF (not just cross-origin / different port):
  • parent: http://localhost:8765/parent.html
  • child iframe: http://127.0.0.1:8766/child.html (separate CDP iframe target + sessionId)

Minimal page

Parent:

<iframe src="http://127.0.0.1:8766/child.html"></iframe>
<input id="parent-input">

Child:

<input id="child-input">

Procedure (mirrors current fill / press split)

1. Target.setAutoAttach + attach to the iframe target → child sessionId
2. DOM.focus on the child session (same as main today)
3. Input.insertText / Enter Input.dispatchKeyEvent either:
   • root session (main behavior / deps.cdp.send), or
   • child session (this PR / fix(interaction): route fill and press typing into the ref's CDP session #488)

Results

Step	Root session (main)	Child session (this PR)
Input.insertText into focused OOPIF input	✅ child value set; parent empty	✅ same
Enter dispatchKeyEvent into focused OOPIF	✅ child sees keydown	✅ same
Same with an extra background target open	✅ still fills child	(not required)

So on Chrome 155, root-session Input.* already reaches the focused OOPIF widget after child-session DOM.focus. That matches @iuyo5678's reading on #488 and Chromium's focus-routed input handler. I do not have a failing main reproduction for the original fill_value_mismatch / “types into parent” claim.

Regression signal (same page)

After Tab moves focus from the OOPIF input to a parent <input id="after">:

• root-session Tab keyUp → parent receives keyup (parentKeyUp=true) — good
• child-session Tab keyUp (forced to original OOPIF session) → parent does not get keyup — same class of issue called out on fix(interaction): route fill and press typing into the ref's CDP session #488

Suggestion

Unless someone has an older Chrome / background-tab / different site-isolation setup where root Input.* still misses the OOPIF, I think #439 should be closed rather than merged. Happy to close it myself if maintainers agree. Leaving #488 alone for its author / reviewers.

Unit tests on this PR still only assert which session receives the CDP call; they do not establish a browser failure on main.

[Li-john1021]

Thanks for the discussion. After checking on Chrome 155 I also cannot reproduce a main-branch failure for OOPIF fill/Enter, and the child-session routing path shows the Tab/iframe teardown keyup regressions the maintainer noted on #488. Closing this PR to avoid noise; happy to reopen with a minimal failing repro if one turns up.