Stanford Calendar Injector

A Manifest V3 Chrome extension that screenshots the current page, sends it to an extraction backend you control, opens a prefilled Outlook Web event, and can save it automatically. It defaults to America/Los_Angeles and a 30-minute reminder. No OpenAI key is stored in the extension.

What you need

• Chrome and a Stanford account that uses Outlook Web.
• A Cloudflare account and an OpenAI API key for the private Worker backend.
• Node.js 20+.

1. Deploy the extraction backend

cd worker
npm install
cp wrangler.toml.example wrangler.toml
npx wrangler login
npx wrangler secret put OPENAI_API_KEY
npx wrangler secret put BACKEND_TOKEN
npm run deploy

Copy the deployed URL and append /extract, for example https://stanford-calendar-injector.<your-subdomain>.workers.dev/extract.

2. Install the extension locally

1. Open chrome://extensions.
2. Turn on Developer mode.
3. Click Load unpacked and select this repository folder (the folder containing manifest.json).
4. Copy the extension ID shown by Chrome.
5. In worker/wrangler.toml, uncomment ALLOWED_ORIGIN and set it to chrome-extension://<that ID>. Deploy again with npm run deploy.
6. On the extension card, choose Details → Extension options. Paste the /extract URL and the BACKEND_TOKEN value you just set, choose your default reminder, and enable or disable auto-save.

3. Use it

Open a webpage, flyer, or event image in a normal browser tab and click the extension icon. The extension captures only the visible tab, submits its screenshot plus limited visible page text and the current local date/time to your backend, then opens Outlook Web with the event details. Yearless dates are resolved to the next occurrence, and door/check-in deadlines are not treated as the event end time. With auto-save enabled, its dedicated Outlook content script clicks Save after it verifies the event title.

Sign in to Outlook Web first. Outlook may present an account-picker or security prompt; finish that prompt and click the extension again. If Outlook changes its compose UI, update selectors only in src/outlook-compose.js.

Security and privacy notes

• The OpenAI key is a Cloudflare secret (OPENAI_API_KEY), never extension code or extension storage.
• The Worker accepts only POST /extract, requires a separate BACKEND_TOKEN, applies CORS only to your configured extension origin, limits screenshot size, and does not log request payloads. This token is not an OpenAI key and is stored locally in the extension (not Chrome Sync); rotate it if the local browser profile is compromised.
• Page text and the screenshot are sent to the backend/OpenAI, so do not use the extension on sensitive pages.
• Duplicate protection stores a SHA-256 hash of title, start, end, and location locally for 24 hours. It prevents accidental repeat injections; it cannot detect events created outside the extension.
• The extension asks only for active-tab capture/scripting, storage, notifications, Outlook access, and a user-approved HTTPS backend origin. The https: connection policy is necessary because the user-configured backend URL is not known at build time; use only a backend you control.

Test checklist

1. In chrome://extensions, click Errors after loading; it should show no manifest errors.
2. Enter an invalid backend URL and verify Settings rejects it.
3. Use a sample event page, inspect the generated Outlook event, and verify date/time/location before allowing auto-save for real events.
4. Click the action twice with the same page and verify the second attempt shows the duplicate notification.