Document the popover scroll trap and the dropped root-absolute imports
Safari Quirks F5 (the popover never scrolls its main frame) and G1a (a
root-absolute importScripts target resolved to nowhere, so the background
page loaded none of its libraries), plus the Runtime Shim notes for both and
a Tested Extensions row for Replace AI Translator API 1.0.21.
Document D4a (iframe loads labeled main_frame), the --debug/--logs pair, and today's corrections
New Safari-Quirks entry D4a: webRequest reports every frame's document
load as main_frame with a raw 64-bit frameId, which made uBlock's strict
blocker hijack the tab over ad-iframe cookie syncs, plus the WebKit
weak-wrapper lesson that forced the fix onto the event prototype. D4
gains the main-frame-vs-subresource split with the live tabs-API
strict-blocking evidence. B4's Handling paragraph is brought back in
line with the source (the empty getURL arg IS lowercased) and gains the
port path. C3 and both Tampermonkey rows drop the sandbox-setter
misdiagnosis, a Firefox-only code path, and name the real remaining
suspects. The uBlock row records the live verifications and explains
the serverlist.txt console noise. CLI-Reference, Testing-and-Debugging
and Runtime-Shim document --debug conversions and the --logs reader.
Document why the color-scheme floor paints body and not html (F2a)
Document E15 (dispatch resolves through the global chrome/browser) and the menus.create rejections
TWP 10.2.5 (MV3): the webRequest sanitizer's global-root republish silently detached the background from all message dispatch (fixed in 895e7a3), and menus.create threw on file://*/* and page_action (fixed in cf96d63). New quirk entry E15 with the WebKit mechanism, F4 extended, shim table and tested-extensions rows updated.
Document the two Safari behaviors behind a login that never persisted
E13a: no webNavigation event reaches a listener the background added after it
evaluated, so the auth tab's redirect went unseen and every silent re-auth timed
out. E13b: neither minimized nor off-screen hides a window, so the flow keeps a
background tab. E14a: the owner's storage.session dies with its page, hence the
mirror. Plus the __c2sAuthLog record and how to read it from outside the browser.
Document the navigation the emulation used to miss
Safari 26, measured with a probe extension: a page-world pushState re-injects no
content script and produced no report at all, so the burst-after-input watcher
missed any route change the page made on its own. C5 said SPA navigation was an
open gap; it now records what was measured, the standing watch armed by the
background's answer to a report, and the round trip confirmed working.
The Cloaked row gets the user report that found it and what is still untested, the
shim table names the emulated pair, and 1.11.2 gets its release entry.
Document the serviceWorker bridge and cookies.get precedence for v1.10.1
Record the four Honey fixes and how they were found
Honey converts and works now: popup renders, session is recognized. Four
shim bugs came out of it, none of them Honey-specific.
- B4 is new: Safari reports the UUID in different cases per API, and getURL
can only return one of them. Says why the fix moved onto the sender.
- C6 is new: no tab or window events reach a converted background page, so
an extension caching the selected tab from them stays blind, and the shim
now polls for it.
- B2 and F3 were wrong about ?tabId. It is our own injection, not Safari's,
and it no longer goes into action popups.
- Runtime-Shim's getURL and onMessage rows described the old lowercasing.
Also writes down the storage.local instrumentation used throughout, since
the background console was never reachable in that session and every
conclusion had to come from a log the popup could read.
Document the content-script / MV2-background native messaging carve-out
The storage relay wraps chrome/browser in a Proxy for extension-page to
background messaging. That Proxy breaks Safari's native content-to-background
delivery, and the relay can't cross a content script's separate storage.local
partition anyway, so the relay must never touch a content script or the MV2
background. Records the quirk (Safari-Quirks E6), the relay scoping in the
runtime shim, and the corrected MV2 background.scripts row in Manifest-Transform.
Document getManifest content_scripts stripping breaking the action hotkey
The shim's __viaductMsgListeners capture was gated on getManifest().content_scripts,
which Safari strips inside a content script; ungating it fixed SuperDev Pro's
Cmd+Shift+S. Update A5, Runtime-Shim, and Release-History.
Document polyfill-clobber content-script failure (#10)
Add Safari-Quirks E5, a Release-History bullet, and a Runtime-Shim note for
the browser-polyfill.min.js overwrite that killed uBlock's content scripts.
Document the pipeline bug-hunt fixes (92fa2ee)
Add an Unreleased section to Release-History and update the matching subsystem
references for the eight fixes: CRX-key lenient parse (Input Handling), the
defaultBundleId slug-collision fix and uninstall broker id read (Build and
Install), the shared redirect deadline (Input Handling), the ancestorOrigins
guard hardening (Safari Quirks E3), the hotkey key mapping (Safari Quirks A5),
the deriveChromeId dead-catch removal (OAuth Bridge), and the importScripts
comment-in-static-args fix (Runtime Shim).
Humanize wiki prose: remove em/en dashes and curly quotes
Replace em/en dashes with commas, colons, or sentence breaks per context,
and normalize curly quotes to straight. Dashes inside code blocks, diagrams,
and range expressions are preserved.
Add Viaduct CLI wiki
Contributor-grade documentation for viaduct-cli, verified against src/ and
grounded in the git history. 14 content pages plus Home, sidebar, and footer:
architecture, conversion pipeline, CLI reference, input handling, manifest
transform, analyzer, runtime shim, OAuth bridge, build/install, Safari quirks,
testing/debugging, limitations/FAQ, and a commit-grounded release history.