Syncker

Peer-to-peer folder sync between your own devices (Linux + Android), no server. Hyperdrive/Hyperswarm.

A Google-Drive-like folder that stays in sync between your devices (Linux and Android) with no server. Built on the Hypercore protocol stack using the current Holepunch modules: hyperdrive, corestore, hyperswarm, and the bare runtime on Android.

How it works laptop phone desktop ~/Syncker ⇄ scan/merge ⇄ Syncker/ ⇄ scan/merge ⇄ ~/Syncker │ │ │ own Hyperdrive (writer) own Hyperdrive (writer) own Hyperdrive (writer) └──────── Hyperswarm topic = sha256(drive secret) ─────────┘ every device replicates every device's drive One writer per device. Each device has its own Hyperdrive, a signed, append-only log of its changes. No multi-writer coordination is needed.

Drive secret. Creating a shared drive makes a 32-byte secret, shared as the invite (syncker:<z32>?name=<drive name>, also shown as a QR code). Each drive runs its own engine, with its own Corestore, peers and swarm topic, so drives never see each other's files. Devices join the Hyperswarm topic derived from it. On each connection, both sides prove they know the secret with an HMAC over the Noise handshake hash, bound to each side's role. Only then do they exchange drive keys and replicate. Known devices are gossiped.

Merge. Every entry carries { vv, clock, hash, size, mtime, device }. vv is a version vector: a local edit takes the vector of the version it replaced (what was on disk) and bumps its own counter. A version covered by another one is history. Versions that don't cover each other were made concurrently, and they are resolved without losing data:

An edit beats a concurrent delete. Of several concurrent edits, the highest (clock, driveKey) wins (clock is a Lamport clock). The others are kept as name (conflict <device> <hash>).ext, with one name per losing version, so a later conflict on the same file gets its own copy. A device only folds a losing version into what it "knows" once that conflict copy exists on disk, so a later edit can't bury it. Deletes are tombstones.

Materialize. All metadata is replicated. File contents are fetched in the background from any device that has them, verified (SHA-256) and written atomically.

Selective sync. Each device has a list of online-only paths per drive.

Those paths are never downloaded. A copy already on the device is removed once it is safely in the drive, and that removal is never published as a deletion. Unsaved local edits are published first. Opening an online-only file streams it from the drive. Every device publishes, in its own drive, a record of what it wants each device to keep: { device: { excluded, clock } }. Per device, the highest clock wins, so every device agrees, and an offline device applies changes when it comes back. A device that turns off "Allow other devices to choose what this device syncs" follows only its own record. That flag is trusted only from the device's own drive. A drive just joined is "on hold" (everything treated as online only, nothing removed) until its size is known (every connected device's file list fully read) and a choice is made. Where each file is. Devices tell each other (over the authenticated connection) which files they have on disk, as path and hash prefix, so each file can show which devices have the latest version. Big files a device is still adding are announced in /.syncker/activity.

Safety.

The folder holds a .syncker marker. If the folder or marker is missing or unreadable (deleted, renamed, storage not mounted, Android permission revoked), sync pauses. An empty folder is never taken to mean "delete everything", and unreadable subfolders are treated as unknown, not deleted. A file you save while a remote version downloads is kept (checked again right before the swap). Nothing is ever written or deleted through a symlink. A path that can't be written on this device (name too long, invalid characters, a folder in the way) is reported under "Couldn't sync" and never blocks other files. When a file and a folder end up with the same name, the folder keeps it and the file becomes a conflict copy on every device. Robust connections.

Devices keep announcing themselves and look for missing peers again after 5, 10 and 20 s, then every 30 s. Each device advertises its drive length on the authenticated channel. If replication makes no progress towards it for 8 s, the connection is redialed. This is a safety net: the connect-time deadlock it was added for is fixed. The hello handler must not hold a Protomux batch cork while it waits for data from the same connection.

License

GPL-3.0