Recently while writing a userscript and I found out that variables in the page context are available.
console.log(window) did not result in an error in neither Tampermonkey nor Greasemonkey.
I am confused. Shouldn't global variables only be accessible through unsafeWindow?
Global variables are only available that way in @grant none mode. As of Greasemonkey 2.0 (June 17, 2014), @grant none mode became the default. Tampermonkey quickly followed suit, to maintain compatibility.
If you never had the habit of using @grant, this will seem like a recent (unexpected) change.
You should now always use the @grant directive so that you are conscious of what mode the script is operating in.
I also recommend using @grant GM_addStyle, at a minimum, except in those rather rare cases when @grant none is appropriate. This avoids a unexpected conflicts and side effects, and is closest to both how scripts used to work and to how many script engines still operate. (That is, such scripts are more reliable and more cross-platform compatible.)
The way Greasemonkey handles @grant is now a leading cause of many, many problems.
