v1.5.0 — works on strict-CSP sites

Fixes "the tools don't work on some websites" — mainly a Firefox issue.

Strict-CSP sites now work

Firefox blocks a <style> element that an extension injects into a page whose Content-Security-Policy restricts style-src (many big sites do). That's why tint / fonts / spacing / highlight colours did nothing on those sites.

Now the static styles ship as a proper manifest stylesheet and the per-setting styles go through chrome.scripting.insertCSS from the background — both bypass CSP. Verified on a style-src 'self' page: everything applies.

"Allow on all sites" prompt

Firefox (and Chrome, when set to "on click") holds back the run-on-every-site permission until you grant it — until then the extension just doesn't run on the sites you haven't allowed. The popup now shows a red "Allow on all sites" banner when that permission is missing; one click fixes it and reloads the tab.

Also

• Re-applies itself if a single-page app wipes its markers
• Double-click ruler toggle is instant now
• README's "Known limits" rewritten — the things that genuinely can't work (browser-internal pages, the PDF viewer, cross-origin iframes, Google Docs' canvas text, Shadow DOM) are now spelled out

Full changelog: v1.4.0...v1.5.0