Notes for add-on reviewers

MagiClip 0.7.0 · magiclip@magiclip.local · distributed unlisted to organisations through Firefox enterprise policy.

What it does

Caseworkers start a case from one or more forms in their organisation’s forms library. They clip values from approved casework pages, review where sources agree and conflict, and fill target forms with the checked values. All application logic runs inside the extension. The optional AI features go only to the organisation’s own gateway, and only after the user has approved a redaction preview of the exact request.

No remotely hosted code

• Every script that runs is in the package. There is no eval, new Function or innerHTML in MagiClip’s own code, and the CSP forbids 'unsafe-eval'.
• The forms library (lib/library-sync.js, lib/library.js) downloads JSON only. It is checked against a manifest with a SHA-256 per file and validated as untrusted input. Profiles are a declarative extraction language, which lib/extract.js interprets with DOM queries. Detection patterns in privacy.json are compiled with new RegExp. Nothing from the library is executed as code.
• Model weights for the on-device privacy model (Transformers.js plus ONNX Runtime WASM, in privacy/worker.js) are data, not code. By default they come from Hugging Face: openai/privacy-filter, pinned to commit 7ffa9a043d54d1be65afb281eddf0ffbe629385b. The SHA-256 of every file is built into the extension (DEFAULT_MODEL in lib/model-fetch.js), and each download is checked as it streams. A request outside the model server, or for a file with no expected hash, is refused. The user can choose another server with the same files (Privacy tab), and policy can lock the address. Either way the pinned revision and hashes still apply unless policy sets others. Files are fetched with CORS, which Hugging Face allows, so no host permission is needed.
• Prompts are packaged Markdown files in prompts/.
• Tesseract runs with workerBlobURL: false, and its worker, core and language data are all loaded from vendor/, never from a CDN.

Content security policy

script-src 'self' 'wasm-unsafe-eval'; object-src 'none'; img-src 'self' data: blob:;
frame-src 'none'; media-src 'none'; style-src 'self' 'unsafe-inline'

• 'wasm-unsafe-eval' is required to instantiate the packaged WebAssembly: ONNX Runtime for the privacy model, and tesseract.js-core for OCR.
• img-src data: blob: displays pictures and PDF pages the user drops into the reader, after they are rendered on the computer.

Permissions

Data collection

MagiClip declares its data categories in data_collection_permissions. Case data is stored locally and deleted when the case ends. The only transmissions are to the organisation-configured forms library and AI gateway, and model-file downloads from the model server (Hugging Face by default), which carry no user data. See the privacy policy. Every AI request passes through previewBeforeSend() in lib/ai/boundary.js, and lib/ai/client.js refuses any payload that has not been approved. There is no analytics or telemetry, and nothing is sent to the publisher.

Third-party libraries

All are unmodified files from official npm releases, copied into vendor/ by tools/vendor.mjs. The same list ships in the package as vendor/SOURCES.tsv. Each checksum can be checked against the linked file:

curl -sL <url> | sha256sum

The linter’s DANGEROUS_EVAL and UNSAFE_VAR_ASSIGNMENT warnings are all inside these library files. None comes from MagiClip’s own code.

Rebuilding from source

The source archive uploaded with each version contains the full repository at the release commit. The build uses open-source tools only:

# Node.js 24.19.0, pnpm 11.3.0, on Linux, macOS or Windows
pnpm install --frozen-lockfile
pnpm build:ext            # runs tools/vendor.mjs, then web-ext build
# output: dist/magiclip-0.7.0.zip, and the packaged tree is extension/

MagiClip’s own code in extension/ is not minified, bundled or transpiled. The build only copies in the vendored libraries listed above.

Trying it

The quickest way is the hosted demo: fictional casework pages and a forms library at https://magiclip.surprisingly.ltd/demo/. Try the demo walks through every feature step by step. In short:

1. Open the sidebar. In Settings, enter the library address https://magiclip.surprisingly.ltd/demo/library/, press Connect and allow access to the site.
2. On the Case tab, tick two forms and start a case.
3. Open /demo/client-1042.html, press Allow on magiclip.surprisingly.ltd, then Clip this page. Clip the rent account (it produces a conflict) and client-2077 (a different person, which shows the identity warning).
4. Open /demo/dhp.html and press Fill this form. The plan is shown before anything is filled, and MagiClip never submits.

Page and library access is asked for at run time, through the optional host permission, so the demo needs no extra permission in the manifest. The demo pages are static HTML and their forms only move between pages on this site. AI features need an organisation gateway, which the public demo doesn’t have. Without one, the preview still works and nothing is sent.

The same demo runs offline from the source archive with pnpm demo (library address http://localhost:8787/demo/library/). pnpm test runs the unit tests.

Contact

privacy@surprisingly.ltd