English | 简体中文
PromptBox is a Windows Electron application for small teams to organize prompts and their media assets. It provides a polished light interface, nested categories, tags, prompt cards, a focused editor, image copying, drag-and-drop imports, and video previews. Team metadata uses Supabase PostgreSQL as the single source of truth, while original images, videos, and thumbnails are stored in a private Tencent Cloud COS bucket.
This repository does not provide a shared public backend or include the maintainer's production configuration. Every deployment must use its own Supabase project, private Tencent Cloud COS bucket, and dedicated CAM sub-account.
Start with the complete self-hosting guide. Additional references cover Supabase setup, Tencent Cloud COS setup, multi-user synchronization, and the security model.
- Windows 10 or Windows 11, 64-bit
- Node.js 20 or later
- npm 10 or later
npm installInstallation automatically compiles the native better-sqlite3 module for Electron.
The Maple Mono CN fonts are stored in the repository as losslessly compressed chunks. npm run dev and npm run build automatically restore the Regular and Bold font files before starting. Restored .ttf files remain in the local workspace and are never committed to Git.
npm run devCopy .env.example to .env, then set VITE_SUPABASE_URL and VITE_SUPABASE_ANON_KEY before running or packaging the application. These Vite variables are embedded in the client at build time. After changing .env, run npm run dist:win again; restarting an existing installer build is not enough. On first launch, PromptBox shows a minimal sign-in window. After signing in, create a workspace or join a team with an invitation code.
VITE_SUPABASE_ANON_KEY is a client key constrained by Row Level Security and may be included in the application. Never place SUPABASE_SERVICE_ROLE_KEY or permanent Tencent Cloud credentials in the client. They belong exclusively in Supabase Edge Function Secrets.
npm run buildThis command restores the bundled fonts, checks the React and Electron TypeScript projects, runs the Vite production build, compiles the Electron main process, and scans the output for permanent cloud credentials.
npm run dist:winThe installer and portable executable are written to release/:
PromptBox-Setup-1.2.8-x64.exePromptBox-Portable-1.2.8-x64.exe
The NSIS installer supports a custom installation directory and creates Start Menu and desktop shortcuts.
PromptBox uses Electron's app.getPath("userData") by default. On Windows, the directory is normally:
%APPDATA%\PromptBox\
├── database\promptbox.db
├── database\cloud-cache.db
├── cache\
├── media\images\
├── media\videos\
├── media\thumbnails\
├── backups\
└── settings\
promptbox.db is the legacy local database and is retained only for one-time migration and old-backup compatibility. Team data is sourced from Supabase. cloud-cache.db and cache/ may be removed without deleting cloud content. User data is never written to the application installation directory.
Complete .promptbox backups remain available as a safety net before migrating local data. Team workspaces can also export a JSON index containing categories, tags, prompts, media metadata, COS object keys, and version history without packaging every cloud video into a very large ZIP file.
Supabase database backups and COS media backups must be scheduled separately. A free Supabase project may be paused, and the local cache must not be treated as a backup.
- Custom frameless window, in-app dialogs, dropdowns, and context menus.
- Maple Mono CN v7.9 Regular and Bold are bundled with the rendered application, so the target computer does not need the fonts installed.
build/icon.icocontains 16, 20, 24, 32, 40, 48, 64, 128, and 256-pixel layers for the executable, desktop shortcut, Start Menu, taskbar, and backup-file association.
Automatic backups may run daily, weekly, or be disabled, with up to ten retained copies.
- Confirm that the original video still exists in the data directory.
- H.264 video with AAC audio in an MP4 container provides the best Electron compatibility.
- Chromium may be unable to play the codec used by a MOV, AVI, or MKV file even when PromptBox can generate a thumbnail. Convert it to an H.264 MP4 with FFmpeg and import it again.
- The bundled FFmpeg binary only extracts video thumbnails and never modifies the original video.
- Confirm that the original image still exists in the data directory.
- PromptBox first loads the image through Electron
nativeImage. If that fails, Sharp converts it to PNG before writing it to the Windows clipboard. - Some target applications reject transparent or extremely large images. Save the image as PNG or JPEG and import it again.
- PromptBox copies the actual image pixels, not a path or URL.
Run a newer installer and choose the existing installation directory to perform an in-place update. Uninstalling the old version first is unnecessary. The installer uses a stable appId and per-user installation mode, and the uninstaller is explicitly configured not to delete application data.
Program files and user data are completely separated. The program is normally installed under %LOCALAPPDATA%\Programs\PromptBox, while categories, tags, prompts, images, and videos are stored under %APPDATA%\PromptBox. An in-place update replaces program files only.
On first launch after an update, PromptBox creates a complete .promptbox upgrade backup. Before a database schema migration, it also saves a separate database snapshot and applies the migration transactionally. A custom data-directory pointer is stored in the user-data area and survives an in-place update.
Export a manual full backup before important updates and never delete the data directory manually. The portable build also uses the user-data directory rather than storing data beside the executable.
contextIsolation: truenodeIntegration: falsesandbox: true- The renderer can access operating-system capabilities only through an allowlisted IPC bridge.
- Prompt text is rendered as plain text; embedded HTML and scripts are never executed.
- RLS is enabled on all team tables with workspace isolation and owner/editor/viewer roles.
- COS remains private. Edge Functions verify the JWT, membership, role, and object ownership before issuing minimum-scope temporary credentials.
- Images and videos are transferred directly between the Electron main process and COS instead of passing through an Edge Function.
npm run buildscans production output and blocks Supabase service-role keys and permanent Tencent Cloud credential markers.
# Apply database migrations
supabase db push
# Deploy the three authorization functions
supabase functions deploy cos-upload-authorize
supabase functions deploy cos-download-authorize
supabase functions deploy cos-delete-object
# Migration, RLS, role, and optimistic-lock regression tests without Docker
npm run test:sql
# RLS tests with local Supabase and Docker
npm run test:rls
# Tencent Cloud TC3 signature unit test with Deno
npm run test:edgeTencent Cloud STS has an official minimum temporary-credential lifetime of 30 minutes. PromptBox uses that platform minimum while restricting each credential to one randomly generated object key. Signed video playback URLs expire after 10 minutes.
| Shortcut | Action |
|---|---|
| Ctrl+N | Create a prompt |
| Ctrl+S | Save the current editor |
| Ctrl+K | Focus search |
| Ctrl+Shift+C | Copy the current prompt |
| Ctrl+V | Create quickly from pasted text or an image |
| Ctrl+O | Select images or videos |
| Delete | Move the current prompt to the recycle bin |
| Escape | Close the active dialog |
PromptBox source code is licensed under the MIT License. See THIRD_PARTY_NOTICES.md for third-party components and their respective licenses.