PromptOS

Requirements

• Node.js 22+ and npm.
• A Supabase project with its URL and public key.
• Credentials for the configured AI provider.
• Stripe test-mode configuration only if testing payments locally.

Getting Started

Install

git clone https://github.com/staypossesed/PromptOS.git
cd PromptOS
npm ci

Create the local environment file only if it does not already exist:

if (-not (Test-Path .env.local)) {
    Copy-Item .env.example .env.local
}

On macOS or Linux, use cp -n .env.example .env.local. Populate the required values described below. Never commit local environment files or secret keys.

Database Setup

For a new Supabase project, run the SQL files in the Supabase SQL editor in this order:

1. supabase/schema.sql: profiles, prompts, generation records, triggers, and access policies.
2. supabase/feedback.sql: user feedback.
3. supabase/prompt-packs.sql: saved prompt packs and context.
4. supabase/model-comparisons.sql: model comparison results.
5. supabase/billing.sql: customers, subscriptions, promo redemptions, and usage tracking.
6. supabase/generation-runs.sql: generation diagnostics.
7. supabase/admin-audit-logs.sql: audit records for administrative actions.
8. supabase/workspace.sql: private context profiles and reusable playbooks.

Review migrations before applying them to an existing database. Keep row-level security enabled. The service-role key is server-only and is required for administrative and billing synchronization operations.

Authentication Setup

Enable the desired Google, GitHub, and email providers in Supabase. Configure Google and GitHub provider credentials in the Supabase dashboard.

Under Authentication > URL Configuration, add these app callback URLs:

Keep the production Site URL pointed at the production app. Add local and preview origins to the redirect allowlist rather than replacing the production Site URL. OAuth provider dashboards use the Supabase provider callback; the URLs above are the final app destinations.

The app uses the bare /auth/callback URL for OAuth and email links. A short-lived cookie stores the validated destination inside the app. External destinations are rejected.

Use port 3000 locally. A different port needs its own callback allowlist entry. An unapproved callback can send users to the production Site URL instead.

Deployment

The application is deployed with Vercel. The existing linked project is named prompt-os; its public product name is Umprompt.

vercel login
vercel env ls
vercel deploy --yes

The last command creates a preview, not a production deployment. Check environment scopes, callback allowlists, return URLs, and payment mode before testing integrations.

After reviewing the preview, production can be deployed explicitly:

vercel deploy --prod

Run that command only when a production release is intended. If the Git integration is enabled, pushing to Vercel's configured production branch can also trigger a production deployment. Use a feature branch for preview-only review.

Vercel-protected previews may require a Vercel account to view. Do not disable deployment protection or expose secrets simply to share a preview.

Environment Configuration

Local .env.local values and Vercel environment variables are independent. A working production checkout does not configure payments on localhost.

Optional Integrations

The analytics wrapper tracks named events without adding prompt, profile, or answer text to event properties. Autocapture and session recording are disabled in the client configuration; review privacy implications before enabling either. Account identification includes the signed-in user's ID and email.

Configure both Upstash variables for shared limits across serverless instances. The in-memory fallback is suitable for local development, not reliable enforcement across production instances.

Checkout Is Not Configured

The checkout route returns MISSING_CONFIG when the selected plan's price ID is absent. Check the corresponding STRIPE_PRICE_* variable, the Stripe key, payment mode, and the environment scope. Production values are not loaded into local development automatically.

Chrome Extension

The browser companion opens Umprompt in a side panel with request optimization, read-only results, optional Edit/Done, Simplify, Copy, previous versions, explicit Save, and the same private account history. English, Spanish, and Russian are supported. It never automatically reads pages or clipboard content.

Recovery release 0.1.2 checks backend availability and the active Chrome connection policy at startup and gives distinct connection, session, response, and saving errors without replacing the draft. The live extension backend is deployed. npm run extension:build -- --live-in-place connects the existing unpacked installation to the live website without changing its folder, ID, callback, or stored drafts; it no longer requires a local dev server. A Chrome Reload is required to activate the build. If Chrome still holds the previous localhost policy, the panel offers Reload extension before making blocked requests. The in-place update test covers reload, unchanged ID/callback, draft preservation, and the real live health endpoint; it does not certify account sign-in.

Run npm run extension:build -- --local to build the local installable package, or npm run extension:build for the production-targeted package. The extension needs its own exact Supabase auth callback; website cookies are not reused. New bearer-authenticated backend routes reuse the website's AI handlers and entitlements, with no additional SQL migration.

See installation and release checks and the store submission draft. Production publishing and real-account acceptance checks are separate from fixture-based browser tests.

Chrome Web Store version 0.1.2 was submitted on October 11, 2026 and is Pending review. Automatic publication after approval is selected; it is not publicly available yet. The scoped security review records the release checks, deployed mitigations, and remaining dependency findings without claiming a clean audit.

Troubleshooting