Is Merlin AI safe?

// React-Query definition for the remote config blob.// staleTime = base_unit * 10  ->  refetched on every startup and again whenever stale.MerlinConfig: {  meta: { persist: true },              // cached to chrome.storage via React-Query persist plugin  placeholderData: BUILTIN_FALLBACK,    // shipped fallback if the network call fails  queryFn: async ({ signal }) => {    try {      let resp = null;      if (REMOTE_CONFIG_ENABLED) {        // Two fetch backends; both end up at the same jsDelivr URL.        resp = isModernBrowser          ? await axiosFetchAdapter({              adapter: 'fetch',              fetchOptions: { cache: 'no-cache' },              method: 'GET',              signal,              url: 'https://cdn.jsdelivr.net/gh/foyer-work/cdn-files@latest/merlin_config.json',            })          : await fallbackFetcher({              adapter: 'fetch',              fetchOptions: { cache: 'no-cache' },              method: 'GET',              url: 'https://cdn.jsdelivr.net/gh/foyer-work/cdn-files@latest/merlin_config.json',            }, signal);      }      return resp.data;    } catch {      console.error('Failed to fetch latest config');      return BUILTIN_FALLBACK;    }  },  queryKey: ['merlinConfig'],  staleTime: BASE_UNIT * 10,}

// In webAccess-e2cdf625.js: at session-init the extension forces an immediate// refetch of both remote configs (staleTime:0 bypasses the persisted cache).await queryClient.fetchQuery({ ...QUERIES.MerlinConfig,    staleTime: 0 });await queryClient.fetchQuery({ ...QUERIES.MerlinConstants, staleTime: 0 });

// The fetched config is then read in many places to drive behavior. Examples:// 1) DOM cleaner selection (webAccess-e2cdf625.js):const u = await _.fetchQuery(C.MerlinConfig);if ((u?.useNewDomClean ?? true)) {  // run the v2 DOM stripper across captured search results}// 2) Telemetry gate (webAccess-e2cdf625.js):const h = _.getQueryData(C.MerlinConfig.queryKey);return h?.misc?.dataCollection?.extension?.isActive ?? false;

var zn = async (e, t) => {  let n = ((e = true) => {      let t = ((e = true) => {          let t = Array.from(globalThis.window.document.querySelectorAll(`#rso > div, #tads > div, #rso .MjjYud`));          return e ? t.filter((e => !An(e))) : t        })(e),        n = [];      return t.forEach((e => {        let t = e.querySelector(kn);        if (t) {          let r = t.href;          if (r && r.includes(`/url?q=`)) try {            let e = new URLSearchParams(new URL(r).search).get(`q`);            e && (r = e)          } catch {}          r && r.startsWith(`http`) && n.push({            url: r,            container: e          })        }      })), n    })(),    r = await Bn(n.map((e => e.url)));  e && X.trackEvent(G.checkoutPopupGoogleSearch, {    url: globalThis.window.location.href,    partnersFound: Object.entries(r).map((([e, t]) => ({      url: e,      partner: t.activeDomain    }))),    isPartnerBoxMuted: t  });  let i = n.find((e => r[e.url]));  if (i) {    let e = (e => {      let t = e.querySelector(`h3`),        n = e.querySelector(`.VuuXrf, span[role="text"]`)?.innerText,        r = e.querySelector(`cite`)?.textContent,        i = e.querySelector(kn)?.querySelector(`img`)?.parentElement?.parentElement?.outerHTML,        a = e.querySelector(`.VwiC3b, .kb069e, div[style*="-webkit-line-clamp"]`);      return {        title: t?.textContent?.trim() ?? null,        siteName: n,        citation: r,        imgContents: i,        description: a?.innerHTML?.trim() ?? null      }    })(i.container);    return {      ...i,      ...e,      domainData: r[i.url]    }  }  return null}, Bn = async e => {  let {    payload: t  } = await dt({    type: St,    payload: {      urls: e    }  });  return t.result}, Vn = e => !!e.partnerSerpBox?.enabled, Hn = async () => !!await Y.get(`gf_partner_serp_muted`), Un = async () => {  await J({    type: Ct,    payload: {}  })}, Wn = R(`<div class=gf-app>`);(async (e, t, n, r) => {  if (Vn(r)) {    let i = await Hn(),      a = !!r.enhancedLogging;    e.debug(`Serp partner box enabled. Looking for partner in search results`);    let o = await zn(a, i);    if (!i && o && r.partnerSerpBox?.learnMoreUrl) return void((e => {      let t = document.querySelector(`div[data-subtree="mfc"], .fG8Fp`),        n = document.getElementById(`atvcap`) ?? document.getElementById(`tads`) ?? document.getElementById(`search`);      return t ? (t.insertAdjacentElement(`afterend`, e), !0) : !!n && (n.prepend(e), !0)    })((e => {      let t = document.createElement(`div`);      return fe((() => F(In, e)), t), t    })({      ...o,      currentLanguage: n,      logger: e,      learnMoreUrl: r.partnerSerpBox?.learnMoreUrl,      charitiesList: t,      serpLoggingEnabled: a    })) ? (e.info(`Partner found and banner injected`), a && X.trackEvent(G.checkoutPopupGooglePartnerAnnCreated, {      url: globalThis.window.location.href,      activeDomain: o.domainData.activeDomain    })) : e.warn(`Partner found but banner couldn't be injected`));    e.info(`Couldn't find partners in search results`)  }})(e.logger, s, u, e.popupConfig)

bo = class {  async handle(e, t) {    let {      urls: n    } = e.payload, {      giveFreelyService: r    } = t, i = r.getLogger();    try {      let e = await r.getActiveDomains();      if (!e || e.length === 0) throw Error(`No active domains`);      let t = {},        i = n.map((async n => {          try {            let {              hostname: i            } = new URL(n), a = e.find((e => i === e.domain || i.endsWith(`.${e.domain}`)));            if (a) {              let {                result: e              } = await r.shouldStandDown(a.domain, n);              t[n] = {                activeDomain: a,                shouldStandDown: e,                currentlyActivated: await r.wasLastStandDownAnActivation(a.domain)              }            }          } catch {}        }));      return await Promise.all(i), {        type: W.GET_ACTIVE_DOMAINS,        payload: {          result: t        }      }    } catch (e) {      return i.error(`Error checking domain`, {        urls: n,        error: e      }), {        type: W.GET_ACTIVE_DOMAINS,        payload: {          result: {}        }      }    }  }}jo = class {  async handle(e, t) {    let {      eventType: n,      eventData: r,      anonymous: i,      skipThrottling: a    } = e.payload, {      giveFreelyService: o    } = t, s = o.getLogger();    s.debug(`Broadcasting event`, {      eventType: n,      eventData: r,      anonymous: i,      skipThrottling: a    });    try {      let e = await o.trackEvent(n, r, i, a);      return {        type: W.TRACK_EVENT,        payload: {          result: e        }      }    } catch (e) {      return s.error(`Error broadcasting event. Returning false`, {        eventType: n,        eventData: r,        error: e      }), {        type: W.TRACK_EVENT,        payload: {          result: !1        }      }    }  }}Y.register(W.IS_ACTIVE_DOMAIN, new Eo), Y.register(W.GET_POPUP_CONFIG, new wo), Y.register(W.HIDE_POPUP, new To), Y.register(W.SHOULD_STAND_DOWN, new Ao), Y.register(W.TRACK_EVENT, new jo), Y.register(W.ACTIVATE_OFFER, new yo), Y.register(W.STORE_SHOPIFY_SHOP_ID, new ko), Y.register(W.GET_DOMAIN_BY_SHOP_ID, new xo), Y.register(W.GET_LANGUAGE_CONTENT, new Co), Y.register(W.LOG_MERCHANTS_IN_SEARCH_RESULTS, new Do), Y.register(W.GET_ACTIVE_DOMAINS, new bo), Y.register(W.MUTE_PARTNER_SERP_BOX, new Oo), Y.register(W.GET_GF_DATA, new So)

// background.js:5923-5968var mo = { urls: ['<all_urls>'], types: ['main_frame'] };chrome.webRequest.onBeforeRequest.addListener(  ({ requestId, url, initiator }) => {    // Skip already-tracked or invalid URLs    if (trackedRequests.has(requestId) || !isValidUrl(url)) return;    const { hostname, search } = new URL(url);    let initiatorHost;    if (initiator && isValidUrl(initiator))      initiatorHost = new URL(initiator).hostname;    // Check if URL or initiator matches an affiliate merchant    if (giveFreelyService.hasAffiliation([hostname, initiatorHost], search)        || giveFreelyService.isCustomStandownMatch([url, initiator])) {      trackedRequests.add(requestId); // mark for redirect tracking    }  },  { urls: ['<all_urls>'], types: ['main_frame'] });