README
¶
SyncMyEnv — core
Local agent and CLI (syncmyenv / sme) for SyncMyEnv: discovery, encrypted vault,
file watcher, version history, restore and sync.
Local-first, encrypted, automatic, recoverable.
Install
brew install syncmyenv/tap/sme # macOS / Linux
curl -fsSL https://syncmyenv.com/install.sh | sh # verifies sha256 + sigstore signature
go install github.com/syncmyenv/core/cmd/syncmyenv@latest
Releases are signed — see SECURITY.md.
Quick start (from source)
make build # -> bin/syncmyenv (+ bin/sme symlink)
./bin/sme init # create vault, prints your recovery key
./bin/sme protect ~/Projects # scan + choose + seal revision 1
./bin/sme daemon install # start on login: every save becomes a revision
./bin/sme snapshot # or seal changes by hand
./bin/sme history ~/Projects/app/.env
./bin/sme restore ~/Projects/app/.env --version 2
./bin/sme restore --missing # everything deleted / new machine
./bin/sme login # or: sme login env.mycompany.com (self-hosted)
./bin/sme sync # push/pull; the daemon pushes automatically
Status
| Command | Status |
|---|---|
scan |
✅ works — discovers .env, .env.*, env, env.*; skips templates, node_modules, .git, etc. |
init |
✅ post-quantum vault key, wrapped by master password + recovery key |
status |
✅ vault, protected files, missing files |
protect, unprotect, list |
✅ choose files (dir scan asks first), seal contents |
snapshot |
✅ seal a revision for every changed file — no password needed |
history, restore |
✅ revisions; restore by version / --to / --missing, never loses data |
keys verify, keys passwd |
✅ check password/recovery key, change password (or reset via recovery key) |
daemon, daemon install/uninstall |
✅ watches files, seals every change; launchd / systemd --user |
login, logout, sync |
✅ Cloud or self-hosted server; signed, verified, end-to-end encrypted — see docs/sync.md |
| folder / S3 remotes (BYO storage) | paused |
sync |
Phase 2 |
share |
Phase 4 |
Layout
cmd/syncmyenv/ entrypoint
internal/cli/ cobra commands
internal/scanner/ env file discovery
internal/config/ paths (~/.syncmyenv, SYNCMYENV_HOME)
internal/crypto/ key hierarchy (Argon2id + age/X25519)
internal/vault/ SQLite vault
internal/watcher/ fsnotify watcher (parent-dir watches, debounce)
internal/remote/ server connection + syncer (push, verify, pull)
protocol/ PUBLIC: sync wire types + HTTP client (imported by the server)
docs/ architecture notes
See docs/architecture.md.
Releasing
git tag v0.1.0 && git push origin v0.1.0
.github/workflows/release.yml runs GoReleaser: static binaries for macOS/Linux/Windows
(amd64 + arm64), checksums.txt signed with cosign (keyless), GitHub build provenance, and the
Homebrew cask in syncmyenv/homebrew-tap
(needs the HOMEBREW_TAP_TOKEN secret). Dry run: goreleaser release --snapshot --clean --skip=sign.
License
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
syncmyenv
command
|
|
|
internal
|
|
|
cli
Package cli wires the syncmyenv command tree.
|
Package cli wires the syncmyenv command tree. |
|
config
Package config resolves SyncMyEnv's on-disk locations.
|
Package config resolves SyncMyEnv's on-disk locations. |
|
crypto
Package crypto implements the SyncMyEnv key hierarchy on vetted libraries only (age, x/crypto) — no custom primitives.
|
Package crypto implements the SyncMyEnv key hierarchy on vetted libraries only (age, x/crypto) — no custom primitives. |
|
daemon
Package daemon holds the background agent's plumbing: a single-instance lock and OS service integration (launchd on macOS, systemd on Linux).
|
Package daemon holds the background agent's plumbing: a single-instance lock and OS service integration (launchd on macOS, systemd on Linux). |
|
remote
Package remote stores this device's connection to a SyncMyEnv server (cloud or self-hosted) and syncs the vault with it.
|
Package remote stores this device's connection to a SyncMyEnv server (cloud or self-hosted) and syncs the vault with it. |
|
scanner
Package scanner discovers environment files under user-chosen roots.
|
Package scanner discovers environment files under user-chosen roots. |
|
storage
Package storage abstracts where encrypted blobs live remotely (folder, S3/R2, SyncMyEnv server, WebDAV...).
|
Package storage abstracts where encrypted blobs live remotely (folder, S3/R2, SyncMyEnv server, WebDAV...). |
|
vault
Package vault is the local, encrypted store of protected env files and their revision history (~/.syncmyenv/vault.db).
|
Package vault is the local, encrypted store of protected env files and their revision history (~/.syncmyenv/vault.db). |
|
watcher
Package watcher detects changes to protected files.
|
Package watcher detects changes to protected files. |
|
Package protocol is the SyncMyEnv sync protocol: wire types shared by the CLI and the server, plus a small HTTP client.
|
Package protocol is the SyncMyEnv sync protocol: wire types shared by the CLI and the server, plus a small HTTP client. |
Click to show internal directories.
Click to hide internal directories.