Infrastructure to replace patchWindow.js with MAIN world content scripts.

src/bg/LifeCycle.js

@@ -241,8 +241,17 @@ var LifeCycle = (() => {
       if (!UA.isMozilla) {
         // Chromium does not inject content scripts at startup automatically for already loaded pages,
         // let's hack it manually.
-        const contentScripts = browser.runtime.getManifest().content_scripts.find(s =>
+        const contentScripts = browser.runtime
-          s.js && s.matches.includes("<all_urls>") && s.all_frames && s.match_about_blank).js;
+          .getManifest()
+          .content_scripts.find(
+            (s) =>
+              s.js &&
+              s.matches.includes("<all_urls>") &&
+              s.all_frames &&
+              s.match_about_blank &&
+              // do not expose MAIN world scripts meant to run before untrusted page ones
+              s.world !== "MAIN"
+          ).js;
 
         await Promise.allSettled((await browser.tabs.query({})).map(async tab => {
           try {

src/manifest.json

@@ -117,6 +117,18 @@
         "content/content.js"
       ]
     },
+    {
+      "run_at": "document_start",
+      "matches": ["<all_urls>"],
+      "match_about_blank": true,
+      "match_origin_as_fallback": true,
+      "all_frames": true,
+      "world": "MAIN",
+      "js": [
+        "/nscl/main/uuid.js",
+        "/nscl/main/Worlds.js"
+      ]
+    },
     {
       "run_at": "document_start",
       "matches": ["file://*/*", "ftp://*/*"],

src/nscl

@@ -1 +1 @@
-Subproject commit 36c31a591adc043c0cab12480440469fa54dd0e6
+Subproject commit 4e9966eeb7b50a68b05c079129a1dc6c666c1c8d