always use deepCopy for prefs.values for safety

background/background.js

@@ -59,7 +59,7 @@ window.API_METHODS = Object.assign(window.API_METHODS || {}, {
   parseCss({code}) {
     return backgroundWorker.parseMozFormat({code});
   },
-  getPrefs: () => prefs.values, // will be deepCopy'd by invokeAPI handler
+  getPrefs: () => prefs.values,
   setPref: (key, value) => prefs.set(key, value),
 
   openEditor,

js/prefs.js

@@ -137,7 +137,9 @@ window.INJECTED !== 1 && (() => {
   const prefs = window.prefs = {
     initializing,
     defaults,
-    values,
+    get values() {
+      return deepCopy(values);
+    },
     get(key) {
       return isKnown(key) && values[key];
     },