Is Merlin AI safe?

// React-Query definition for the remote config blob.
// staleTime = base_unit * 10  ->  refetched on every startup and again whenever stale.
MerlinConfig: {
  meta: { persist: true },              // cached to chrome.storage via React-Query persist plugin
  placeholderData: BUILTIN_FALLBACK,    // shipped fallback if the network call fails
  queryFn: async ({ signal }) => {
    try {
      let resp = null;
      if (REMOTE_CONFIG_ENABLED) {
        // Two fetch backends; both end up at the same jsDelivr URL.
        resp = isModernBrowser
          ? await axiosFetchAdapter({
              adapter: 'fetch',
              fetchOptions: { cache: 'no-cache' },
              method: 'GET',
              signal,
              url: 'https://cdn.jsdelivr.net/gh/foyer-work/cdn-files@latest/merlin_config.json',
            })
          : await fallbackFetcher({
              adapter: 'fetch',
              fetchOptions: { cache: 'no-cache' },
              method: 'GET',
              url: 'https://cdn.jsdelivr.net/gh/foyer-work/cdn-files@latest/merlin_config.json',
            }, signal);
      }
      return resp.data;
    } catch {
      console.error('Failed to fetch latest config');
      return BUILTIN_FALLBACK;
    }
  },
  queryKey: ['merlinConfig'],
  staleTime: BASE_UNIT * 10,
}

// In webAccess-e2cdf625.js: at session-init the extension forces an immediate
// refetch of both remote configs (staleTime:0 bypasses the persisted cache).
await queryClient.fetchQuery({ ...QUERIES.MerlinConfig,    staleTime: 0 });
await queryClient.fetchQuery({ ...QUERIES.MerlinConstants, staleTime: 0 });

// The fetched config is then read in many places to drive behavior. Examples:

// 1) DOM cleaner selection (webAccess-e2cdf625.js):
const u = await _.fetchQuery(C.MerlinConfig);
if ((u?.useNewDomClean ?? true)) {
  // run the v2 DOM stripper across captured search results
}

// 2) Telemetry gate (webAccess-e2cdf625.js):
const h = _.getQueryData(C.MerlinConfig.queryKey);
return h?.misc?.dataCollection?.extension?.isActive ?? false;

var zn = async (e, t) => {
  let n = ((e = true) => {
      let t = ((e = true) => {
          let t = Array.from(globalThis.window.document.querySelectorAll(`#rso > div, #tads > div, #rso .MjjYud`));
          return e ? t.filter((e => !An(e))) : t
        })(e),
        n = [];
      return t.forEach((e => {
        let t = e.querySelector(kn);
        if (t) {
          let r = t.href;
          if (r && r.includes(`/url?q=`)) try {
            let e = new URLSearchParams(new URL(r).search).get(`q`);
            e && (r = e)
          } catch {}
          r && r.startsWith(`http`) && n.push({
            url: r,
            container: e
          })
        }
      })), n
    })(),
    r = await Bn(n.map((e => e.url)));
  e && X.trackEvent(G.checkoutPopupGoogleSearch, {
    url: globalThis.window.location.href,
    partnersFound: Object.entries(r).map((([e, t]) => ({
      url: e,
      partner: t.activeDomain
    }))),
    isPartnerBoxMuted: t
  });
  let i = n.find((e => r[e.url]));
  if (i) {
    let e = (e => {
      let t = e.querySelector(`h3`),
        n = e.querySelector(`.VuuXrf, span[role="text"]`)?.innerText,
        r = e.querySelector(`cite`)?.textContent,
        i = e.querySelector(kn)?.querySelector(`img`)?.parentElement?.parentElement?.outerHTML,
        a = e.querySelector(`.VwiC3b, .kb069e, div[style*="-webkit-line-clamp"]`);
      return {
        title: t?.textContent?.trim() ?? null,
        siteName: n,
        citation: r,
        imgContents: i,
        description: a?.innerHTML?.trim() ?? null
      }
    })(i.container);
    return {
      ...i,
      ...e,
      domainData: r[i.url]
    }
  }
  return null
}, Bn = async e => {
  let {
    payload: t
  } = await dt({
    type: St,
    payload: {
      urls: e
    }
  });
  return t.result
}, Vn = e => !!e.partnerSerpBox?.enabled, Hn = async () => !!await Y.get(`gf_partner_serp_muted`), Un = async () => {
  await J({
    type: Ct,
    payload: {}
  })
}, Wn = R(`<div class=gf-app>`);

(async (e, t, n, r) => {
  if (Vn(r)) {
    let i = await Hn(),
      a = !!r.enhancedLogging;
    e.debug(`Serp partner box enabled. Looking for partner in search results`);
    let o = await zn(a, i);
    if (!i && o && r.partnerSerpBox?.learnMoreUrl) return void((e => {
      let t = document.querySelector(`div[data-subtree="mfc"], .fG8Fp`),
        n = document.getElementById(`atvcap`) ?? document.getElementById(`tads`) ?? document.getElementById(`search`);
      return t ? (t.insertAdjacentElement(`afterend`, e), !0) : !!n && (n.prepend(e), !0)
    })((e => {
      let t = document.createElement(`div`);
      return fe((() => F(In, e)), t), t
    })({
      ...o,
      currentLanguage: n,
      logger: e,
      learnMoreUrl: r.partnerSerpBox?.learnMoreUrl,
      charitiesList: t,
      serpLoggingEnabled: a
    })) ? (e.info(`Partner found and banner injected`), a && X.trackEvent(G.checkoutPopupGooglePartnerAnnCreated, {
      url: globalThis.window.location.href,
      activeDomain: o.domainData.activeDomain
    })) : e.warn(`Partner found but banner couldn't be injected`));
    e.info(`Couldn't find partners in search results`)
  }
})(e.logger, s, u, e.popupConfig)

bo = class {
  async handle(e, t) {
    let {
      urls: n
    } = e.payload, {
      giveFreelyService: r
    } = t, i = r.getLogger();
    try {
      let e = await r.getActiveDomains();
      if (!e || e.length === 0) throw Error(`No active domains`);
      let t = {},
        i = n.map((async n => {
          try {
            let {
              hostname: i
            } = new URL(n), a = e.find((e => i === e.domain || i.endsWith(`.${e.domain}`)));
            if (a) {
              let {
                result: e
              } = await r.shouldStandDown(a.domain, n);
              t[n] = {
                activeDomain: a,
                shouldStandDown: e,
                currentlyActivated: await r.wasLastStandDownAnActivation(a.domain)
              }
            }
          } catch {}
        }));
      return await Promise.all(i), {
        type: W.GET_ACTIVE_DOMAINS,
        payload: {
          result: t
        }
      }
    } catch (e) {
      return i.error(`Error checking domain`, {
        urls: n,
        error: e
      }), {
        type: W.GET_ACTIVE_DOMAINS,
        payload: {
          result: {}
        }
      }
    }
  }
}

jo = class {
  async handle(e, t) {
    let {
      eventType: n,
      eventData: r,
      anonymous: i,
      skipThrottling: a
    } = e.payload, {
      giveFreelyService: o
    } = t, s = o.getLogger();
    s.debug(`Broadcasting event`, {
      eventType: n,
      eventData: r,
      anonymous: i,
      skipThrottling: a
    });
    try {
      let e = await o.trackEvent(n, r, i, a);
      return {
        type: W.TRACK_EVENT,
        payload: {
          result: e
        }
      }
    } catch (e) {
      return s.error(`Error broadcasting event. Returning false`, {
        eventType: n,
        eventData: r,
        error: e
      }), {
        type: W.TRACK_EVENT,
        payload: {
          result: !1
        }
      }
    }
  }
}

Y.register(W.IS_ACTIVE_DOMAIN, new Eo), Y.register(W.GET_POPUP_CONFIG, new wo), Y.register(W.HIDE_POPUP, new To), Y.register(W.SHOULD_STAND_DOWN, new Ao), Y.register(W.TRACK_EVENT, new jo), Y.register(W.ACTIVATE_OFFER, new yo), Y.register(W.STORE_SHOPIFY_SHOP_ID, new ko), Y.register(W.GET_DOMAIN_BY_SHOP_ID, new xo), Y.register(W.GET_LANGUAGE_CONTENT, new Co), Y.register(W.LOG_MERCHANTS_IN_SEARCH_RESULTS, new Do), Y.register(W.GET_ACTIVE_DOMAINS, new bo), Y.register(W.MUTE_PARTNER_SERP_BOX, new Oo), Y.register(W.GET_GF_DATA, new So)

// background.js:5923-5968
var mo = { urls: ['<all_urls>'], types: ['main_frame'] };

chrome.webRequest.onBeforeRequest.addListener(
  ({ requestId, url, initiator }) => {
    // Skip already-tracked or invalid URLs
    if (trackedRequests.has(requestId) || !isValidUrl(url)) return;
    const { hostname, search } = new URL(url);
    let initiatorHost;
    if (initiator && isValidUrl(initiator))
      initiatorHost = new URL(initiator).hostname;
    // Check if URL or initiator matches an affiliate merchant
    if (giveFreelyService.hasAffiliation([hostname, initiatorHost], search)
        || giveFreelyService.isCustomStandownMatch([url, initiator])) {
      trackedRequests.add(requestId); // mark for redirect tracking
    }
  },
  { urls: ['<all_urls>'], types: ['main_frame'] }
);