Is it impossible for this extension to support GM.* APIs in the page scope?

[JasonHK]

I think there are some user scripts that require both the page scope and the GM.* APIs. For example this user script written by me. The alternative way is to inject <script /> tag and use the postMessage() API, which is painful to maintain for a user script.

[ACTCD]

It is possible, but please note that using postMessage is unsafe and not recommended.
It causes advanced APIs to be exposed to page scope, which puts users of your script at risk.

A safer way is to use a custom event with a random name and use closed-shadow-root.

We may integrate this in the future, but for now, you need to implement it yourself.

[JasonHK]

Thanks! Using CustomEvent is way safer than postMessage, I was just thinking on how to deal with leaking communications when using postMessage. CustomEvent approach probably has a better compatibility compare to GM.* APIs in page scope as well.

[ACTCD]

Yes, it uses the native JS API, but you may find it unavailable in some user script managers due to implementation differences.