Is Stylish - Custom themes for any website safe?

// Replaces window.fetch with an intercepting version.
// Only activates if localStorage['interpolation'] === ACTIVATION_KEY.
// For each fetch call:
//   1. Check if current page URL matches any rule's page_url_match regex.
//   2. Check if request URL matches the rule's request_url_match regex.
//   3. If both match, read the response AND let the original proceed.
window.fetch = function interceptedFetch(input, init) {
  const originalFetch = nativeFetch; // saved reference to real fetch

  // Pass through if no rules loaded yet, or page/request URL doesn't match
  if (!rules.length) return originalFetch(input, init);
  if (!rules.find(r => new RegExp(r.page_url_match).test(location.href)))
    return originalFetch(input, init);
  const requestUrl = typeof input === 'string' ? input : input.url || input;
  if (!rules.find(r => new RegExp(r.request_url_match).test(requestUrl)))
    return originalFetch(input, init);

  // For streaming requests (ReadableStream body), tee the stream:
  // one copy goes to the server, one copy is read by the hook.
  if (input instanceof Request && input.body instanceof ReadableStream) {
    const [stream1, stream2] = input.body.tee();
    // stream1 -> original request (page is unaffected)
    // stream2 -> read by hook below
    metadata = { hasForkStream: true, forkStream: stream2, ... };
  }

  // Make the real request, return it to the page
  const realResponse = originalFetch.apply(this, interceptedArgs);
  readAndForward(interceptedArgs, realResponse); // <- this is the intercept
  return realResponse; // page gets normal response
}

// For streaming responses (Content-Type includes 'stream' — SSE from ChatGPT/Gemini):
// Read each chunk as it arrives, accumulate into a buffer.
// Fire 'antifork' CustomEvent every 5 seconds (timeout flush) AND when stream ends.
async function readStreamingResponse(responseBody, metadata) {
  const reader = responseBody.getReader();
  const decoder = new TextDecoder('utf-8');
  const state = { buffer: '' };

  function flush(reason) {
    // 'reason' is 'done', 'timeout', or 'stream-end-unexpected'
    const event = new CustomEvent('antifork', {
      detail: { ...metadata, message: state.buffer, reason }
    });
    state.buffer = '';
    self.dispatchEvent(event); // contentDE.js receives this
  }

  // Timeout flush every 5 seconds to prevent data loss if stream hangs
  const timer = setInterval(() => flush('timeout'), 5000);
  try {
    for (let chunk = await reader.read(); !chunk.done; chunk = await reader.read())
      state.buffer += decoder.decode(chunk.value, { stream: true });
    flush('done'); // final flush with complete response
  } catch (e) {
    flush('stream-end-unexpected');
  } finally {
    clearInterval(timer);
  }
}

// Runs every time a tab finishes loading any page.
chrome.tabs.onUpdated.addListener((tabId, changeInfo, tab) => {
  if (changeInfo.status === 'complete') {
    TabTracker.setUpResult(tabId, tab);   // stores URL + transition type
    TabTracker.TrackCurrent(tabId, tab);  // fires payload assembly + POST
  }
});

// Builds the exact object shown in the decoded view above.
function assemblePayload(tabId, tab, transitionType) {
  return {
    di:  'a3e3e2a81',                            // hardcoded partner ID
    gp:  tab.url,                                  // current page URL
    klm: TabState.getPrevUrl(tabId),               // previous URL on this tab
    ver: TabState.getCounter(tabId),               // per-tab counter
    trp: transitionType,                           // 'link' | 'typed' | 'bookmark'
    knl: TabState.getOpenerRef(tabId),             // opener tab URL
    dig: [tabId],
    gr:  chrome.runtime.getManifest().version,
    pxe: Settings.instance.appUniqueId             // persistent device UUID
  };
}

// Runs 1 second after an XHR.send() call.
// If the request carries a File (i.e. a file upload) and the rule matched:
setTimeout(() => {
  if (this["antifork+"] && arguments[0] instanceof File) {
    const fileName = arguments[0].name;
    const fileType = arguments[0].type;
    const blobUrl  = URL.createObjectURL(arguments[0]); // wrap file in memory blob URL
    self.dispatchEvent(new CustomEvent("antifork-fk", {
      detail: {
        way:  "xhr",
        ab:   blobUrl,          // blob URL pointing to the file data
        url:  this.unsafeHeaders, // original upload destination (oaiusercontent.com)
        name: fileName,
        type: fileType,
        fth:  this["fork_to_host"],  // = "fs.userstylesapi.com"
        c:    this[rule_object]       // the matching rule
      }
    }));
  }
}, 1000);

{
  "configTarget": "content_request_fork_and_proxy",
  "type": "gpt_con_fork_upload",
  "page_url_match": "https:\/\/chat(gpt)?.com.*",
  "request_url_match": "https:\/\/files\\d{0,2}\\.oaiusercontent\\.com\/file-.*|https:\/\/sdmntpr\\w+\\.oaiusercontent\\.com\/files\/",
  "fork_to_host": "fs.userstylesapi.com"
}