Onlook edits a running Next.js page and writes back to code
Onlook loads a project into a web container, serves it, displays the result in an iframe, and indexes the source. Instrumentation maps browser elements to their code locations. A designer can select an element, adjust Tailwind styles, move it within a parent, or open the relevant source. AI chat uses the same code access and tools. This is closer to editing a live application than exporting a static mockup from a design canvas.
The current boundary is narrow and useful. Onlook targets Next.js with Tailwind, while support for other frameworks and styling systems remains unchecked in the README. It can create projects from text, images, or templates, manage pages and assets, edit code, save checkpoints, branch experiments, and generate shareable deployments. Comments, a component drag-and-drop panel, MCP use, and some image-reference behavior are still listed as unfinished.
The public repository and hosted early access are different bets
The README says this repository contains the open-source visual editor that started Onlook. It separately describes the next hosted product as early access and points readers to a waitlist. That distinction matters when evaluating roadmap, support, and deployment. A polished hosted experience may include operations or services that are harder to reproduce from the repository, while a source checkout gives teams control at the price of integration work.
GitHub's latest tagged release was v0.2.32 from July 17, 2025, yet the repository was pushed on August 25, 2026. The stale release tag alone does not imply abandonment. Recent pull requests covered agent cost controls, Docker environment setup, Supabase migrations, provider initialization, authentication queries, path handling, and security. The project is active, but packaged release history no longer describes the whole pace of development.
What happened when we ran it
Our sandbox cloned commit 423e2e9 into an unprivileged container with 3 CPUs and 8 GB of RAM. The checkout had 1,695 files, about 151,847 lines of source, and occupied 26.7 MB. Bun installed 2,522 packages in 86 seconds. Dependencies then occupied 2,547 MB, which is a heavy contributor footprint before any local database or project sandbox starts.
The build failed with exit code 1 after 41 seconds. The web client rejected an undefined NEXT_PUBLIC_SUPABASE_ANON_KEY, failed to load next.config.ts, and ended with Error: Invalid environment variables. The log establishes a required configuration value. It does not show whether the build would pass after valid Supabase settings are supplied.
The overall test command also exited 1 after 60 seconds. The visible tail showed the @onlook/scripts workspace running 43 tests across 3 files, with all 43 passing and 0 failing. The supplied log did not name the workspace or check that caused the root command to fail, so assigning a cause would be guesswork. The repository had 3 CI workflow files, Docker and Compose files, workspace configuration, and no tests directory.
Supabase and provider services make local setup a system job
Onlook names Supabase for authentication, Postgres data, and storage. Drizzle supplies the application ORM. AI calls flow through the AI SDK and providers including OpenRouter, Morph, and Relace, while CodeSandbox SDK and Freestyle cover project sandboxes and hosting. A serious self-hosted evaluation must decide which of those outside services remain external, how credentials are stored, and what behavior is available without them.
Current issue 3133 reports a fresh self-host failing during Supabase migration 0008 because newer Supabase storage tables reject direct deletion. The reporter reproduced it with a current CLI and proposed an upsert. Pull request 3134 addresses the same failure, but it was open when checked. Pinning a known compatible toolchain may get farther; a production operator should still test clean installation and restoration against the versions it will support.
Multi-user authorization needs an independent review
Open pull request 3127 reports missing membership checks across project, chat, branch, settings, frame, invitation, and other tRPC procedures. The author says the database client uses a Postgres superuser role exempt from Supabase row-level security, leaving authorization to application procedures. The proposed patch was open and its author had not run the complete suite against a local Supabase stack. This is a report and proposed fix, not our lab finding.
A private single-user trial has a different risk profile from a shared hosted deployment. Before admitting multiple users, verify every project identifier path, sandbox operation, invitation flow, and storage object against an account that should not have access. Also confirm whether the deployed commit contains the proposed checks. Apache-2.0 licensing permits modification, but operators become responsible for carrying any local security patches.
Onlook is promising for one frontend stack, not yet a casual self-host
The product idea is concrete: designers manipulate a real rendered application while code remains editable and traceable. For a Next.js and Tailwind team, that is more useful than a canvas whose output must later be rebuilt. The 2,547 MB install and configuration-dependent failures show that the repository is not a small desktop design tool.
Start with the hosted early access if the goal is to evaluate the editing experience. Choose the repository when source control, private deployment, or contribution justifies owning Supabase, migrations, credentials, containers, and authorization testing. The visual workflow may earn that effort, but our failed build and root test make a clean local proof the first gate.