Repository navigation
feat: github sync - #58
Merged
Merged
Conversation
️✅ There are no secrets present in this pull request anymore.If these secrets were true positive and are still valid, we highly recommend you to revoke them. 🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request. |
The engine for syncing accounts, layouts, drawings and other user data between computers through a remote such as a private GitHub repository. Not wired into the app yet: no GitHub client, store adapters or UI. - Everything is encrypted on the device (AES-256-GCM, per-record keys from HKDF), padded, and stored under content-hash paths, so the remote sees no names, symbols or sizes worth reading. Each object is bound to its repository, key epoch, record and generation. - The root key unlocks with a recovery code (with check digits), an optional scrypt passphrase, or a per-computer X25519 key. - Records merge three ways by shape (fields, map, set, list, text, value) with hybrid logical clock stamps; edits are stamped when they happen, so an offline edit does not beat a newer one. Text edited on both sides keeps both versions. - A signed manifest with a rising sequence refuses tampered, missing, foreign or rolled-back data before anything is applied. - Applying is journalled and rolls back if a store refuses; a sync that would delete most of a store waits for the user; pushes are compare-and-swap and retry after a lost race. - Copier leases fence their holder before anyone else may take over, and presence records which accounts each computer has open.
File > Sync Across Computers (beta) connects computers to the encrypted sync core. No app data syncs yet; this registers each computer and checks the repository. - GitHub App sign-in by the device flow with only the public client id; refresh tokens are single use, so refreshes run one at a time and the new pair is saved before use. Requests go only to api.github.com, refuse redirects and run on their own in-memory session. - A GitHub remote over the Git Data API: conditional head reads that cost no rate limit, Contents API seeding of an empty repository, and fast-forward-only ref updates as the compare-and-swap. Public repositories and ones with other files are refused, and an hourly check stops sync if the repository goes missing or public. - Without GitHub, the same engine runs over one .ot5sync file on a drive or share; a missing file reads as offline, never as empty. - Setup creates the sync key and a recovery code that must be typed back before sync starts; other computers unlock with the code, a passphrase, or approval from a linked computer after both show the same six words. - The sync key, device key and tokens live only in the OS keychain; the engine state on disk is encrypted. - A scheduler stamps edits a second after they settle, pushes within a budget, polls faster while focused, syncs on focus, lock and wake, and backs off when offline. Quitting waits up to 5 s for unsynced edits. - Readers refuse data written by, or restoring, a computer that was removed from sync.
Security review fixes for sync pairing and the sync file. - A computer waiting to pair no longer trusts a key wrapped to it. The key must open the existing synced data, and the user must type three words the approving computer shows, derived from the real sync key; three misses discard the key. Someone holding the GitHub token could otherwise wrap a key of their own to it and later read its data. - Approval names the public key whose words were shown, so a request swapped in afterwards is refused instead of approved. - Sync file writes use a random temporary name created exclusively, so a link planted in a shared folder cannot redirect the write. - The removed-computer check is documented as best effort: the writer field is self-reported, and removal must replace the key.
cyenite
force-pushed
the
feat/github-sync
branch
from
November 4, 2026 12:47
e5b6e6f to
2b15743
Compare
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Syncs saved accounts (and, behind an opt-in, their passwords, API keys and the CID), layouts, drawings, templates, watchlists, Pine scripts and preferences between a user's computers through a private GitHub repository, end-to-end encrypted so GitHub only ever holds ciphertext.
How was this tested?
Checklist
npm run checkpasses (typecheck, tests and build).docs/is updated where needed.CHANGELOG.md.