syncward
Carries your whole Claude Code setup between machines as config-as-code in a git repo you own, guarded by a secret scanner that blocks the push instead of warning you.
- TypeScript
- Bun
- Git
- Shell
- bun:test
01 / Context
An AI coding setup accumulates real value: settings, memory, skills, hooks, keybindings, an installed-plugin list. Carrying ~/.claude between machines by hand is tedious, and the folder sits next to API keys and tokens, so naive syncing is exactly how credentials end up in a git repo. syncward syncs the whole setup as config-as-code in a repository you own, with a scanner standing between your files and every push.
02 / My role
I designed the safety model first and let it constrain everything else: the scanner, the backup and restore path, the locking, and the shape of the CLI all follow from one rule, that a bad push has to be stopped by the tool rather than by me remembering to check.
03 / Problem
One push with a token in it cannot be taken back: the token sits in the git history and the only fix left is rotating it. Divergence is the quieter risk: two machines drift, and a careless apply flattens one of them. A plugin manifest also executes, because a Claude Code plugin runs code at launch. Each of those needed a default that fails safe.
04 / Approach
Every push runs through a fail-closed secret scanner that reads exactly the bytes being committed. Anything that looks like a credential blocks the push; you opt out per finding with a reviewed fingerprint allowlist. An apply backs up first, takes a lock, refuses to silently clobber a machine that has diverged, and can be rolled back. syncward holds new plugins back until you approve them, and the installer is built to verify a published checksum before it touches your PATH. TypeScript on Bun, backed by about 1,500 tests.
05 / Result
The build is complete: scanner, sync, backup and restore, doctor, and init. What remains before it goes public is release engineering, so the repo is private for now.