elastik-extension

A Chrome extension that brings Lucy to every webpage.

---

What it does

Injects an elastik panel into any webpage. AI sees what you see. You stay in control.

• iframe panel — bottom-right corner, draggable, resizable
• auto world switching — URL maps to elastik world (github.com → /github, gmail.com → /gmail)
• DOM sync — page content flows to /{world}/result so your AI knows what you're looking at
• toggle — Ctrl+Shift+L to show/hide

---

Install

1. Clone this repo
2. Open chrome://extensions
3. Enable Developer mode (top right)
4. Click Load unpacked → select this folder
5. Done. Visit any webpage. Lucy is there.

---

Configure

Click the extension icon → set your elastik URL (default: http://localhost:3004)

Add custom URL → world mappings. Built-in defaults:

docs.google.com  → /gdocs
github.com       → /github
gmail.com        → /gmail
figma.com        → /figma
notion.so        → /notion
*                → /default

---

How it works

You browse a webpage
  → extension reads DOM text
  → POST to /{world}/result
  → your AI reads it via MCP or HTTP
  → AI writes analysis to /{world}/stage
  → extension panel renders stage
  → you see AI's response next to the webpage

All data stays on your machine. localhost:3004. Your universe.db. Your disk.

---

Requirements

• Chrome (or any Chromium browser)
• A running elastik instance

---

Security

Consent gate — First install opens an opt-in page. Nothing syncs until you explicitly accept. Non-localhost URLs trigger a second confirmation: "Page content will leave your device."

Two filter modes:

Mode	Default behavior	You configure
Blacklist (default)	Syncs all sites	Domains to exclude
Whitelist	Syncs nothing	Domains to include

Default blacklist (ships with extension):

*bank*  *paypal*  *stripe*  *.gov.*
*login*  *signin*  *checkout*  *payment*  *billing*

How it works at runtime:

1. content.js loads → reads syncMode, blacklist/whitelist from chrome.storage
2. Checks current domain against the active list
3. Domain blocked → no panel injection, no DOM read, no POST. Complete silence.

Other safeguards:

• iframe loads via bridge.html (extension page) — bypasses Private Network Access restrictions
• DOM content defaults to localhost — never leaves your machine unless you configure a remote URL and confirm
• No telemetry. No analytics. No cloud calls.
• Panel runs in sandboxed iframe with allow-scripts allow-same-origin allow-forms allow-popups

---

Part of the elastik ecosystem

elastik            → protocol + server (~200 lines)
elastik-extension  → browser client (this repo)

Lucy is water. She flows into every crack.

---

MIT License. © 2026 Ranger Chen.