Safari: using dtrace to investigate iCloud Tab Sync
The file that contains the iCloud tabs is:

~/Library/SyncedPreferences/com.apple.Safari.plist


It's a binary file, so you can use plutil to convert a copy to JSON/XML for processing. I expected the syncing to be via bird but some light spelunking with brctl log -w and other light snooping don't reflect changes I make to the tab database. There are quite a few nice projects on github that parse this file in python, JS as well as a nice menu bar app:


https://github.com/josh-/CloudyTabs


Knowing where the data persists on disk shows that syncdefaultsd is the owning process:

sudo fsusage -w | grep com.apple.Safari


Sadly, that private framework and daemon are basically undocumented by Apple save for what you can glean from the launchd plist for the service.