Free · Zero Knowledge · Client-Side Encrypted

One Workspace.
Every Device.

Sessyn is a VS Code extension that securely syncs your full developer workspace — including .env, certificates, and configs — between trusted machines with client-side AES-256-GCM encryption. Works on desktop, vscode.dev, and github.dev.

Three steps to sync

Install, authenticate, and your workspace syncs across all your machines.

1

Install & Authenticate

Install the VS Code extension and sign in with GitHub or Microsoft. Your identity is verified, never stored.

2

Set a Passphrase

Create a workspace passphrase. All encryption happens on your machine, the server never sees your keys or files, and there is no forced 30-day passphrase rotation.

3

Sync Everywhere

Your workspace stays in sync across all trusted machines. Add a new machine in seconds.

Built for developers who care about security

Every feature designed with zero-trust principles.

🔐

Client-Side Encryption

AES-256-GCM with Argon2id KDF and HKDF subkeys. Files are encrypted before they leave your machine.

📁

Full Workspace Sync

Syncs everything — .env files, SSH keys, certificates, configs. Use .syncignore to exclude anything.

🖥️

Multi-Machine Trust

Per-machine keypairs sign every sync request. Ed25519 on desktop, ECDSA P-256 on web. Approve or revoke machines anytime.

Real-Time Sync

WebSocket-based sync with automatic conflict detection, mass-delete protection, and quarantine auto-cleanup.

🔄

Conflict Resolution

When the same file changes on two machines, choose per file: Keep Local, Keep Remote, Keep Both, or open a side-by-side diff to decide.

📤

File Transfer

Send encrypted files directly to a specific machine. Right-click any file and choose "Send to Machine" — or copy a remote file locally.

🔍

Review Changes

Preview what will sync before committing. See which files are new, modified, or deleted across machines.

🛡️

Zero Knowledge Server

The server stores only encrypted blobs. No plaintext filenames, no content inspection, no backdoors.

🩹

Auto-Heal Auth

Expired sessions are silently refreshed. If the token can't be renewed, Sessyn re-authenticates via OAuth — no manual steps needed.

📦

Auto Updates

Sessyn checks GitHub for new releases and supports one-click local updates plus remote update, reload, smoke test, and sync orchestration on connected machines, including ARM64.

🔁

Resumable Transfers

Chunked encrypted transfers, journaled recovery, and a cached file index let large syncs resume from the last completed chunk after reloads and reconnects.

🌐

Works Everywhere

Desktop (macOS, Linux, Windows, ARM64), vscode.dev, and github.dev. One extension, every platform.

🔑

AES-256-GCM

Authenticated encryption with associated data

🧬

Argon2id KDF

Memory-hard key derivation from your passphrase

🔗

HKDF Subkeys

Unique encryption key per file, per version

✍️

HMAC-SHA256 Manifests

Authenticated file listings prevent tampering

🔏

Ed25519 / ECDSA P-256 Signing

Per-machine keypairs sign every sync request

🛡️

Post-Quantum Ready

All symmetric crypto quantum-safe; ML-DSA-87 upgrade path built in

Your files never leave your machine unencrypted

Sessyn uses a layered encryption architecture. Your passphrase is never transmitted — it's stretched locally using Argon2id, then HKDF derives unique subkeys for each file. Even if the server is compromised, your data remains unreadable.

  • Passphrase never leaves your machine
  • Server stores only encrypted blobs
  • No plaintext filenames on server
  • Each file encrypted with unique subkey
  • TLS 1.3 in transit + AES-256-GCM at rest
  • Sync requests cryptographically signed per-machine
  • Machine trust can be revoked instantly
  • All symmetric crypto quantum-safe — PQ asymmetric ready
  • Fully auditable — published on VS Code Marketplace

You choose what syncs

Fine-grained control with .gitignore-style patterns.

.syncignore
1# Sessyn Sync Ignore — .gitignore syntax
2
3# Version control
4.git/
5
6# Build artifacts
7node_modules/
8dist/
9*.pyc
10
11# OS files
12.DS_Store
13Thumbs.db
14
15# Everything else syncs — including .env, certs, keys
16# All encrypted client-side before upload ✓

Install the Extension

One click from the VS Code Marketplace. Available on all platforms — including vscode.dev and github.dev.

Install from Marketplace

macOS, Linux, and Windows — including ARM64

Or search in VS Code

ext install aegyrix.sessyn

Manual .vsix downloads available on GitHub Releases

Installation & Usage Guide

Everything you need to get up and running with Sessyn.

1 Installation

Install Sessyn directly from the VS Code Marketplace:

VS Code
1. Open Extensions sidebar (Cmd+Shift+X) 2. Search "Sessyn" 3. Click Install

Or install from the command line:

code --install-extension aegyrix.sessyn

You can also install from the VS Code Marketplace website, or download a .vsix file from GitHub Releases for offline installation.

💡 After installation, you'll see the Sessyn icon (shield + lock) appear in your activity bar on the left side of VS Code.

2 First-Time Setup

When you first open VS Code after installing Sessyn, you'll see a welcome notification prompting you to set up workspace sync.

Setup Wizard
Sessyn Setup 1 2 3 Authenticate Workspace Passphrase 🐙 Sign in with GitHub 🔒 Sign in with Microsoft

The setup wizard walks you through three steps:

  • Authenticate — Sign in with your GitHub or Microsoft account. Sessyn uses OAuth to verify your identity; your credentials are never stored on the server.
  • Configure workspace — Enter a name for this machine (e.g., "Work MacBook") and select the workspace path to sync.
  • Set passphrase — Create a passphrase used to derive your encryption keys. This passphrase is never sent to the server. “Remember on this device” stores the derived workspace key securely in VS Code and your OS keychain.
⚠️ Remember your passphrase. It's the only way to decrypt your workspace data. If you choose not to remember it on-device, you can unlock the workspace later with Sessyn: Unlock Workspace Encryption. If you lose the passphrase, there is no recovery — that's the point of zero-knowledge encryption.

3 Syncing Your Workspace

After setup, Sessyn connects to the sync server via WebSocket for real-time updates.

Sync Flow
Your Machine encrypted Sessyn Server (encrypted blobs only) encrypted Other Machine

To sync manually, click the Sync Now button in the Machines sidebar, or run Sessyn: Sync Now from the command palette (Cmd+Shift+P).

Conflict Resolution
Resolve Conflict: .env ⚠ .env modified on both machines ✓ Keep Local Your version ↓ Keep Remote Other machine ⊕ Keep Both Save as .remote ⇔ Diff & Decide Compare first 💡 "Diff & Decide" opens a side-by-side diff editor — review both versions before choosing

What happens during a sync:

  • Sessyn scans your workspace and computes SHA-256 hashes for each file
  • Only metadata (file paths + hashes) is sent to the server — never raw file content
  • The server compares metadata and returns what's changed
  • Changed files are encrypted on your machine with AES-256-GCM, then uploaded
  • New files from other machines are downloaded and decrypted locally

Real-time updates: When another machine pushes changes, you'll get a notification:

🔔 "New files available from another machine" — click Sync Now to pull the latest changes.

Safety features:

  • Mass-delete protection — If a sync would delete >50% of your files, you must explicitly confirm
  • Conflict resolution UI — If the same file changed on two machines, you get a per-file prompt: Keep Local, Keep Remote, Keep Both, or Diff & Decide
  • Side-by-side diff — "Diff & Decide" opens VS Code's native diff editor so you can visually compare remote vs local before choosing
  • Pre-write safety — Before overwriting a local file during sync, Sessyn re-hashes it to make sure you haven't edited it since the compare step
  • Quarantine auto-cleanup — When remote deletes would remove local files, backups are quarantined. Quarantine files older than 30 days are automatically pruned each sync
  • Chunked resume — Interrupted uploads and downloads resume from the last completed encrypted chunk instead of restarting the whole file

4 Conflict Resolution

When the same file is modified on two machines before syncing, Sessyn detects the conflict and gives you full control over how to resolve it.

Resolution options (prompted per file):

OptionWhat It Does
Keep LocalYour version wins — overwrites the remote copy
Keep RemoteThe other machine's version wins — overwrites your local copy
Keep BothSaves the remote version as filename.remote.ext alongside your local file
Diff & DecideOpens VS Code's native side-by-side diff editor so you can visually compare both versions, then choose

Pre-write safety: Before overwriting a local file, Sessyn re-hashes it to verify you haven't made edits since the compare step. If the file changed, it's skipped instead of silently overwritten.

Quarantine: When a remote sync would delete a local file, the file is quarantined (backed up) instead of removed. Quarantine backups older than 30 days are automatically pruned at the start of each sync.

💡 You can always skip a conflict — it will be flagged again on the next sync until resolved.

5 Machine Trust

Every machine that syncs your workspace must be explicitly trusted. Each generates a unique keypair at setup time (Ed25519 on desktop, ECDSA P-256 on web) and signs every sync request. The server verifies signatures against the registered public key.

Machines Sidebar
MACHINES ⟳ Sync Work MacBook Trusted · connected 🖥 Home Desktop Trusted · offline New Laptop Pending approval

Trust states:

StateMeaning
TrustedMachine is approved and can sync this workspace
PendingMachine registered but awaiting approval from a trusted machine
RevokedMachine was removed — can no longer sync
💡 Your first machine is automatically trusted. When you add a second machine, it starts in "Pending" state until approved from the first machine. Machines offline for more than 30 days are automatically purged.

6 Configuring .syncignore

Sessyn creates a .syncignore file in your workspace root. It uses standard .gitignore syntax to control which files are synced.

.syncignore
# Always excluded automatically: .git/ .DS_Store Thumbs.db # Your custom rules: node_modules/ dist/ *.log __pycache__/ # Everything else syncs encrypted ✓

To edit your ignore list, run Sessyn: Manage Ignore List from the command palette, or just open .syncignore directly.

🔐 Unlike .gitignore, Sessyn intentionally syncs sensitive files like .env, .pem, and .key — because they're encrypted client-side before upload. Only add files to .syncignore if you don't need them on other machines (build artifacts, caches, etc.).

Commands Reference

All commands are accessible via the VS Code command palette (Cmd+Shift+P / Ctrl+Shift+P):

CommandDescription
Sessyn: Setup WizardOpen the first-time setup wizard
Sessyn: Sync NowManually trigger a workspace sync
Sessyn: Sync Untracked FilesInclude untracked files in the next sync
Sessyn: Review ChangesPreview pending changes before syncing
Sessyn: Send to Machine...Send the current file to a specific machine (encrypted)
Sessyn: Copy LocalDownload a remote file from the sidebar to your machine
Sessyn: View MachinesOpen the Machines sidebar
Sessyn: Approve MachineTrust a pending machine
Sessyn: Revoke MachineRevoke trust from a machine
Sessyn: Delete MachineRemove a machine entirely
Sessyn: Open SettingsOpen the Sessyn settings panel
Sessyn: Manage Ignore ListOpen .syncignore for editing
Sessyn: Unlock Workspace EncryptionUnlock a workspace after restart without permanently remembering the derived key
Sessyn: Apply Sync ProfileApply a managed sync profile to .syncignore
Sessyn: Show StatusOpen the recovery dashboard with journal, smoke test, and last sync details
Sessyn: Run Smoke TestCheck auth, encryption, workspace access, and API reachability
Sessyn: Repair Sync StateClear cached resumable sync state and rebuild from a clean local baseline
Sessyn: ReconnectManually reconnect to the sync server
Sessyn: Sign In AgainRe-authenticate if your session expired
Sessyn: Check for UpdatesCheck GitHub releases for a newer version
Update Extension RemotelyAsk a connected machine to install the newest Sessyn release and reload automatically
Update, Reload & Sync RemotelyUpdate a connected machine, reload it, run a smoke test, and start syncing automatically
Run Smoke Test RemotelyAsk a connected machine to run its own smoke test and report back
Sessyn: Refresh File ListRefresh the file tree in the sidebar
Sessyn: Export DiagnosticsGenerate a redacted JSON report for troubleshooting
Sessyn: Forget SecretsClear all stored credentials and disconnect

Status Bar

Sessyn shows its current state in the bottom-left of VS Code's status bar. Click it to open the Machines sidebar.

VS Code Status Bar
Sessyn: Connected Normal state Sessyn: Syncing... Sync in progress Sessyn: Conflicts File conflicts detected Sessyn: Offline Not connected
StatusIndicatorMeaning
ConnectedGreen dotWebSocket active, ready to sync
SyncingSpinnerFile transfer in progress
ConflictsYellow backgroundSame file changed on multiple machines
OfflineGray dotNo server connection
ErrorRed backgroundAuth expired, machine revoked, or server error

Troubleshooting

"Sessyn: Offline" and won't connect

  • Run Sessyn: Reconnect from the command palette
  • Check your internet connection
  • Run Sessyn: Show Status for detailed diagnostics

"Auth Expired" in status bar

  • Sessyn auto-heals expired sessions — it will silently refresh your token or re-authenticate via OAuth
  • If auto-heal fails, run Sessyn: Reconnect to manually trigger re-authentication
  • If rate-limited (429), the extension auto-retries with progressive backoff — no action needed
  • As a last resort, use Fresh Start in Settings to clear all local data and re-run setup

Machine stuck in "Pending"

  • A new machine needs to be approved from an already-trusted machine
  • Your first machine is auto-trusted — additional machines need approval
  • Open the Machines sidebar on your trusted machine and approve the pending device

File conflicts

  • When the same file is modified on two machines before syncing, Sessyn detects the conflict automatically
  • You'll be prompted per file: Keep Local, Keep Remote, Keep Both, or Diff & Decide
  • "Diff & Decide" opens a side-by-side diff editor so you can compare versions before choosing
  • "Keep Both" saves the remote version alongside your local file as filename.remote.ext

Generate a diagnostic report

Sessyn: Export Diagnostics

This generates a JSON file with connection state, auth info, and sync history. All secrets are automatically redacted.

Changelog

Release history pulled directly from GitHub Releases.

Loading changelog...

Ready to sync securely?

Stop emailing yourself .env files. Stop losing configs when you switch machines. Start syncing with confidence.

Install Sessyn