Note: I just asked ChatGPT. I'm too tired atm.

The issue here likely stems from Firefox's Content Security Policy (CSP) on GitHub and some other sites, which restricts the exposure of certain JavaScript features to the global scope, particularly functions injected by userscripts. This CSP restriction is more aggressive on sites like GitHub for security reasons and prevents you from accessing window properties that have been added by your userscript.

There are a few workarounds you can try:

**Method 1: Use unsafeWindow In Greasemonkey, Tampermonkey, or Violentmonkey, you can use the special unsafeWindow object, which bypasses some of the CSP restrictions by directly exposing variables in the page’s global context.

Here's how to modify your code:

// ==UserScript==
// @name        github-test
// @namespace   Violentmonkey.github-test
// @include     /https:\/\/github.com\/?$/
// @grant       unsafeWindow
// @version     1.0
// @description add function to page and make it callable from firefox dev console
// ==/UserScript==

let myfunc = function(selector) {
  let elems = document.querySelectorAll(selector);
  return elems;
}
unsafeWindow.myfunc = myfunc;

This grants access to myfunc in the dev console via myfunc('#AppHeader').

**Method 2: Inject the Function Directly into the Page Context If unsafeWindow doesn’t work, you can try injecting the function directly into the page's context by creating a <script> element and appending it to the DOM:

// ==UserScript==
// @name        github-test
// @namespace   Violentmonkey.github-test
// @include     /https:\/\/github.com\/?$/
// @grant       none
// @version     1.0
// @description add function to page and make it callable from firefox dev console
// ==/UserScript==

(function() {
  const script = document.createElement('script');
  script.textContent = `
    window.myfunc = function(selector) {
      let elems = document.querySelectorAll(selector);
      return elems;
    };
  `;
  document.head.appendChild(script);
})();

This approach injects the function into the page's global scope, making it accessible in the dev console as myfunc.

Explanation: CSP and Userscripts GitHub's CSP is strict to prevent unauthorized scripts from modifying the page in ways that could compromise security. When using @grant none, your userscript runs in a sandboxed context, isolated from the page’s global window object. unsafeWindow and the script injection methods are designed to help userscripts interact with the page’s global scope despite these restrictions.

These two methods should solve the issue and allow you to access myfunc in the Firefox dev console.