Is HARPA AI: Web Automation with ChatGPT, Claude, Gemini, Grok safe?

(() => {  const {    $chat: t,    $utils: n,    $s: a  } = e;  t.paramUserinfo = async () => {    if (a.global.userinfo) return a.global.userinfo;    return (await Promise.all([o(), r()])).filter(Boolean).join(" ")  };  const o = () => {      if (!a.billing.loggedIn) return;      const e = [a.billing.account.firstName, a.billing.account.lastName].filter(Boolean).join(" ");      return e ? `User name is ${e}.` : void 0    },    r = async () => {      if (Date.now() - (a.billing.locationCollectedOn || 0) < n.time.DAY) return a.billing.location ? `Current location ${a.billing.location}.` : null;      try {        const e = await fetch("https://whatismyipaddress.com/"),          t = await e.text(),          n = /<p class="information">(.+?)<\/p>/g,          o = [];        let r;        for (; null !== (r = n.exec(t));) o.push(r[1]);        const i = o.at(-1).split("<span>").at(-1).split("</span>")[0];        return a.billing.location = i, a.billing.locationCollectedOn = Date.now(), `User location is ${a.billing.location}.`      } catch (e) {        return t.warn("failed fetching location", e), a.billing.location = null, a.billing.locationCollectedOn = Date.now(), null      }    }})()

(() => {  const {    $chat: t,    $browser: n,    $utils: a  } = e;  t.params = [{    key: "proPlan",    value: t.paramProPlan  }, {    key: "connection",    value: t.paramConnection,    isObject: !0  }, {    key: "userinfo",    value: t.paramUserinfo  }, {    key: "date",    value: t.paramDate  }, {    key: "time",    value: t.paramTime  }, {    key: "language",    value: t.paramLanguage  }, {    key: "title",    value: t.paramPageTitle  }, {    key: "url",    value: t.paramPageUrl  }, {    key: "domain",    value: t.paramPageDomain  }, {    key: "desc",    value: t.paramPageDesc  }, {    key: "input",    value: t.paramPageInput  }, {    key: "selection",    value: t.paramPageSelection  }, {    key: "email",    value: t.paramPageEmail,    isObject: !0  }, {    key: "thread",    value: t.paramPageThread,    isObject: !0  }, {    key: "transcript",    value: t.paramYouTubeTranscript,    plain: !1  }, {    key: "transcriptPlain",    value: t.paramYouTubeTranscript,    plain: !0  }, {    key: "serp",    value: t.paramSerp  }, {    key: "message",    value: t.paramMessage  }, {    key: "cost",    value: t.paramCost  }, {    key: "gpt",    value: t.paramGpt  }, {    key: "grab",    value: t.paramGrab  }, {    key: "page",    value: t.paramPage,    preprocess: t.paramPagePreprocess  }, {    key: "view",    value: t.paramView  }, {    key: "assert",    value: t.paramAssert  }];  t.params.forEach(((e, t) => {    let n = `{{(?<key>${a.string.escapeRegExp(e.key)})`;    e.isObject && (n += "(?<field>\\.[^{} ]+)?"), n += "( (?<args>[^{}]+))?}}", e.regex = new RegExp(n, "g"), e.order = t  }))})()

// nj-engine.js: fetches the full Google Sheet as CSV using the authenticated sessionasync fetchExportCsv(spreadsheetId, gid) {  const url = `https://docs.google.com/spreadsheets/d/${spreadsheetId}/export?format=csv&gid=${gid || this.getActiveGid()}`;  const response = await fetch(url, { credentials: 'same-origin' }); // uses Google session cookies  if (!response.ok) throw new Error(`GSheets export failed: ${response.status} ${response.statusText}`);  return response.text(); // returns full CSV including collapsed from view rows and columns}

// Alternative CSV export using the Google Visualization API endpointasync fetchCsv(spreadsheetId, options = {}) {  let url = `https://docs.google.com/spreadsheets/d/${spreadsheetId}/gviz/tq?tqx=out:csv`;  if (options.sheet) {    url += `&sheet=${encodeURIComponent(options.sheet)}`;  } else {    url += `&gid=${options.gid || this.getActiveGid()}`; // defaults to active tab  }  if (options.range) url += `&range=${encodeURIComponent(options.range)}`;  const response = await fetch(url, { credentials: 'include' }); // includes all cookies  // ... parses and returns CSV}

// bg.js GrokSessionApi: reads every grok.com cookie the browser holdsasync _getAllCookies() {  const seen = new Map;  const merge = cookies => cookies.forEach(c => { if (!seen.has(c.name)) seen.set(c.name, c); });  // Standard domain cookies  merge(await chrome.cookies.getAll({ domain: '.grok.com' }));  merge(await chrome.cookies.getAll({ url: 'https://grok.com' }));  // Partitioned (CHIPS) cookies  try {    merge(await chrome.cookies.getAll({      domain: '.grok.com',      partitionKey: { topLevelSite: 'https://grok.com' }    }));  } catch {}  // Cloudflare bot-clearance token specifically (also partitioned)  try {    const cfCookie = await chrome.cookies.get({      url: 'https://grok.com',      name: 'cf_clearance',      partitionKey: { topLevelSite: 'https://grok.com' }    });    if (cfCookie) seen.set(cfCookie.name, cfCookie);  } catch {}  return [...seen.values()];}

// Registers a declarativeNetRequest session rule that rewrites headers on grok.com API trafficasync _injectHeaders() {  const headers = [];  // Attach all harvested grok.com cookies to every matching request  const cookies = await this._getAllCookies();  if (cookies.length) {    headers.push({      header: 'cookie',      operation: 'set',      value: cookies.map(c => `${c.name}=${c.value}`).join('; ')    });  }  // Spoof browser security headers to make requests appear same-origin  headers.push(    { header: 'origin',         operation: 'set', value: 'https://grok.com' },    { header: 'referer',        operation: 'set', value: 'https://grok.com/' },    { header: 'sec-fetch-dest', operation: 'set', value: 'empty' },    { header: 'sec-fetch-mode', operation: 'set', value: 'cors' },    { header: 'sec-fetch-site', operation: 'set', value: 'same-origin' }  );  // Apply rule to all XHR traffic matching grok.com/rest/app-chat/*  await declarativeNetRequest.register({    key: this._ruleKey, // 'grok-headers'    condition: {      urlFilter: 'https://grok.com/rest/app-chat/*',      resourceTypes: ['xmlhttprequest']    },    action: {      type: 'modifyHeaders',      requestHeaders: headers    }  });}