Is 壹伴 · 小插件 safe?

async checkNeedUpgrade() {
  if (!this.enabled || ve.browser !== "chrome") return;
  let {
    newestVersion: e
  } = await ne.asyncGet(["newestVersion"]), t = ve.extensionVersion;
  if (!d.checkIfNeedUpdate(t, e)) return Pe.debug("already have latest version , clear proxy config"), this.clearProxyConfigs();
  let n;
  n = `${ke.hosts.web}/extension/proxy.pac`, fetch(n).then(s => {
    if (s.status === 200) return s.text();
    throw new Error("fetch pac script failed")
  }).then(s => {
    s && this.pacScript !== s && (Pe.debug("fetched new pac script"), this.pacScript = s), this.initProxy()
  }).catch(() => {})
}

async initProxy() {
  if (this.pacScript) try {
    Pe.debug("need update, try to reach google api"), this.checkGoogleConnectability(e => {
      if (e) Pe.debug("reached google api, skip proxy setting");
      else {
        if (Pe.debug("can't reach google api, try use proxy"), !this.enabled) return;
        chrome.proxy.settings.get({}, ({
          value: t,
          levelOfControl: n
        }) => {
          if (n === "controlled_by_this_extension") return this.addProxyConfigs();
          if (n === "controllable_by_this_extension") return this.addProxyConfigs()
        })
      }
    })
  } catch (e) {
    Pe.debug("can't get latest extension version, wait until next pac auto-update loop"), console.error(e)
  }
}

addProxyConfigs() {
  let e;
  e = {
    mode: "pac_script",
    pacScript: {
      data: this.pacScript
    }
  }, chrome.proxy.settings.set({
    value: e,
    scope: "regular"
  }, () => {
    Pe.debug("proxy config initialized!", {
      pac: this.pacScript
    }), this.checkPacScriptIsValid()
  })
}

{
  "permissions": [
    "sidePanel",
    "tabs",
    "storage",
    "unlimitedStorage",
    "cookies",
    "notifications",
    "contextMenus",
    "webRequest",
    "proxy",
    "alarms",
    "declarativeNetRequestWithHostAccess",
    "declarativeNetRequestFeedback"
  ],
  "host_permissions": [
    "<all_urls>"
  ]
}

// Global tracker used across the extension for all UI telemetry.
class Gn {
  // Called for standard feature-use events.
  // Fires to /user/use_func after a 3-second delay.
  track(action, data = {}, isAdEvent = false) {
    try {
      if (isBackground) {
        if (isAdEvent) {
          setTimeout(() => {
            api.trackAdEvent(action, data, extensionVersion);
          }, 4000);
        } else {
          setTimeout(() => {
            // POST {action, extensionVersion, data} to /user/use_func
            api.trackUserAction(action, data, extensionVersion);
          }, 3000);
        }
      } else {
        // Content-script path: relay via message bridge to background
        messageProxy.trackUserAction({ action, data, isAdEvent });
      }
    } catch (err) {
      console.error(err);
    }
  }

  // Called for richer behavior events.
  // Fires to /user/behavior/add, enriching with mpId + mpNickname.
  async trackUserEventNew(payload) {
    try {
      if (isBackground) {
        const { mpId, mpNickname } = await this.getCurrentMpIdForBg();
        const enriched = {
          ...payload,
          remark: {
            ...payload.remark,
            version: extensionVersion,
            vip_version: userVipVersion,
            mpId,
            mpNickname,
          },
        };
        storage.get(['authed'], ({ authed }) => {
          // POST enriched payload to /user/behavior/add (via saveUserAction)
          api.saveUserAction(enriched).preventDefault();
        });
      } else {
        messageProxy.trackUserEventNew({ data: payload });
      }
    } catch (err) {
      console.error(err);
    }
  }
}

// POST {action, extensionVersion, data} to /user/use_func
function trackUserAction(action, data, extensionVersion) {
  return post('/user/use_func', null, { action, extensionVersion, data }).markSilent();
}

// POST behavior object to /user/behavior/add
function trackUserEvent(payload) {
  return post('/user/behavior/add', null, payload);
}

// Runs 5 seconds after the content-script loads on every page (all_frames: true).
setTimeout(() => { this.recordUserScreenSize(); }, 5 * 1000);

recordUserScreenSize() {
  try {
    const { width, height } = window.screen;
    // Writes to chrome.storage so the background can read it later
    Ce.set({ userScreenSize: { width, height } });
  } catch {}
}

// Called 30 seconds after the extension first installs.
this.execFirstInstallCall(() => {
  this.startAlarms();
  this.registerHeaderModifier();
  this.recordLatestUserId();
  setTimeout(() => {
    this.reportUserScreenSize();
  }, 30 * 1000);
});

async reportUserScreenSize() {
  const { userScreenSize, reportUserScreenSizeDate } = await ne.asyncGet(
    ['userScreenSize', 'reportUserScreenSizeDate']
  );
  const today = d.parseTime(Date.now(), 'y-m-d'); // e.g. '2026-04-14'
  if (!reportUserScreenSizeDate || reportUserScreenSizeDate !== today) {
    // POST to api.yiban.io/user/report/screen_size
    oe.reportUserScreenSize(userScreenSize).preventDefault();
    // Mark today so it doesn't fire again until tomorrow
    ne.set({ reportUserScreenSizeDate: today });
  }
}

// Wraps the actual fetch POST call
function reportUserScreenSize(payload) {
  return post('/user/report/screen_size', {}, payload);
}