p2p-envsync 0.1.0

package/net.js

@@ -0,0 +1,335 @@
+'use strict';
+
+// Phase 2: LAN P2P sync. No new deps -- `dgram` multicast stands in for
+// mDNS discovery, raw `net` sockets + a room-key HMAC handshake stand in
+// for the Noise/libp2p transport. Good enough for one office LAN; swap for
+// libp2p if you ever need real NAT traversal or a relay path (Phase 5).
+
+const net = require('net');
+const dgram = require('dgram');
+const crypto = require('crypto');
+const fs = require('fs');
+const lib = require('./lib');
+const { notify } = require('./notify');
+const backup = require('./backup');
+const mesh = require('./mesh');
+const signal = require('./signal');
+
+const MCAST_ADDR = '239.255.42.99';
+const MCAST_PORT = 41234;
+const ANNOUNCE_INTERVAL_MS = 3000;
+const SIGNAL_INTERVAL_MS = 10000;
+
+function getLocalIp() {
+  const ifaces = require('os').networkInterfaces();
+  for (const list of Object.values(ifaces)) {
+    for (const iface of list) {
+      if (iface.family === 'IPv4' && !iface.internal) return iface.address;
+    }
+  }
+  return '127.0.0.1';
+}
+
+function log(...args) {
+  console.log(`[${new Date().toISOString()}]`, ...args);
+}
+
+function startSync(name) {
+  const config = lib.loadConfig(name);
+  if (!config.peerId) {
+    config.peerId = lib.getDeviceIdentity().publicKey;
+    lib.saveConfig(name, config);
+  }
+  const key = config.key;
+  const roomHash = lib.roomHash(key);
+  lib.recordPeer(name, config.peerId, lib.getDeviceIdentity().label);
+
+  let merged = lib.loadMerged(name);
+  // Reconcile against whatever is on disk right now instead of overwriting
+  // it: any edits made while sync wasn't running are local changes, not
+  // stale data to discard. Vault-only rooms (config.filePath === null) have
+  // no file at all -- skip this entirely, or an absent file would read as
+  // "the user deleted everything" and wipe the vault.
+  let localValues = lib.mergedToValues(merged);
+  if (config.filePath) {
+    const onDisk = fs.existsSync(config.filePath) ? lib.parseEnv(fs.readFileSync(config.filePath, 'utf8')) : {};
+    const startupDiff = lib.diffValues(lib.mergedToValues(merged), onDisk);
+    if (Object.keys(startupDiff).length > 0) {
+      const ts = Date.now();
+      for (const [k, change] of Object.entries(startupDiff)) {
+        if (change.type === 'removed') delete merged[k];
+        else merged[k] = { value: onDisk[k], ts, peer: config.peerId };
+      }
+      lib.saveMerged(name, merged);
+      lib.appendHistory(name, { ts, values: onDisk, diff: startupDiff, source: config.peerId });
+      log('picked up local changes made while sync was stopped:', startupDiff);
+    }
+    localValues = onDisk;
+  }
+
+  const sockets = new Map(); // peerId -> socket
+  const connecting = new Set(); // "host:port" currently being dialed
+
+  function sendEncrypted(socket, payload) {
+    socket.write(JSON.stringify(lib.encrypt(key, payload)) + '\n');
+  }
+
+  function broadcastState() {
+    for (const socket of sockets.values()) sendEncrypted(socket, { type: 'state', merged });
+  }
+
+  // Best-effort GitHub backup push: debounced so a burst of merges (e.g. a
+  // fresh peer's initial full-state exchange) triggers one push, not many.
+  // If there's no repo configured yet, or no internet right now, it just
+  // fails silently and the periodic retry below picks it up once connected.
+  let backupPushTimer = null;
+  function scheduleBackupPush() {
+    if (!backup.isConnected()) return;
+    clearTimeout(backupPushTimer);
+    backupPushTimer = setTimeout(() => {
+      const result = backup.pushBackup(name);
+      if (!result.ok) log(`backup push skipped (${result.reason})`);
+    }, 3000);
+  }
+  setInterval(scheduleBackupPush, 60000);
+
+  // Phase 5: async off-LAN relay. Reuses the GitHub backup as a transport,
+  // not just a backup -- periodically pull the shared repo and merge it
+  // through the exact same last-write-wins logic used for LAN peers
+  // (applyMergedUpdate), so it can never blindly overwrite local state.
+  // This is what lets two peers who are never on the same LAN converge --
+  // slower than LAN (bounded by RELAY_PULL_MS), but with no server to run.
+  const RELAY_PEER_ID = 'github-relay';
+  const RELAY_PULL_MS = 45000;
+  lib.recordPeer(name, RELAY_PEER_ID, 'GitHub backup');
+  function relayPull() {
+    if (!backup.isConnected()) return;
+    const result = backup.fetchRemoteMerged(name);
+    if (!result.ok) { log(`relay pull skipped (${result.reason})`); return; }
+    applyMergedUpdate(result.merged, RELAY_PEER_ID);
+  }
+  setInterval(relayPull, RELAY_PULL_MS);
+  relayPull();
+
+  function applyMergedUpdate(remoteMerged, sourcePeer) {
+    let changed = false;
+    const diff = {};
+    for (const [k, remoteEntry] of Object.entries(remoteMerged)) {
+      const localEntry = merged[k];
+      const remoteWins = !localEntry
+        || remoteEntry.ts > localEntry.ts
+        || (remoteEntry.ts === localEntry.ts && remoteEntry.peer > localEntry.peer);
+      if (remoteWins && (!localEntry || localEntry.value !== remoteEntry.value)) {
+        merged[k] = remoteEntry;
+        diff[k] = { type: localEntry ? 'changed' : 'added', from: localEntry?.value, to: remoteEntry.value, peer: remoteEntry.peer };
+        changed = true;
+      }
+    }
+    if (!changed) return;
+    lib.saveMerged(name, merged);
+    localValues = lib.mergedToValues(merged);
+    if (config.filePath) fs.writeFileSync(config.filePath, lib.serializeEnv(localValues));
+    lib.appendHistory(name, { ts: Date.now(), values: localValues, diff, source: sourcePeer });
+    const sourceLabel = lib.peerLabel(name, sourcePeer);
+    log(`merged update from ${sourceLabel}:`, diff);
+    if (sourcePeer !== config.peerId) {
+      notify(`envsync: ${name}`, `${sourceLabel} changed ${Object.keys(diff).join(', ')} -- run "envsync review ${name}"`);
+    }
+    broadcastState();
+    scheduleBackupPush();
+  }
+
+  // --- TCP: mutual auth (prove room-key knowledge both ways) then encrypted state exchange ---
+  function attachSocket(socket, isServer) {
+    let authed = false;
+    let remotePeerId = null;
+    let buf = '';
+    const myNonce = crypto.randomBytes(16).toString('hex');
+
+    function proof(nonce) {
+      return crypto.createHmac('sha256', Buffer.from(key, 'hex')).update(nonce).digest('hex');
+    }
+
+    socket.on('data', (chunk) => {
+      buf += chunk.toString('utf8');
+      let idx;
+      while ((idx = buf.indexOf('\n')) !== -1) {
+        const line = buf.slice(0, idx);
+        buf = buf.slice(idx + 1);
+        if (!line) continue;
+        const msg = JSON.parse(line);
+        if (!authed) {
+          if (msg.type === 'challenge') {
+            socket.write(JSON.stringify({ type: 'response', proof: proof(msg.nonce), nonce: myNonce, peerId: config.peerId, label: lib.getDeviceIdentity().label }) + '\n');
+          } else if (msg.type === 'response') {
+            if (msg.proof !== proof(myNonce)) { socket.destroy(); return; }
+            remotePeerId = msg.peerId;
+            sockets.set(remotePeerId, socket);
+            lib.recordPeer(name, msg.peerId, msg.label);
+            if (isServer) socket.write(JSON.stringify({ type: 'ack', proof: proof(msg.nonce), peerId: config.peerId, label: lib.getDeviceIdentity().label }) + '\n');
+            authed = true;
+            // Always send full state once authed, regardless of side --
+            // a brand-new joiner's empty state would otherwise never
+            // trigger the other side to send its data back.
+            sendEncrypted(socket, { type: 'state', merged });
+          } else if (msg.type === 'ack') {
+            if (msg.proof !== proof(myNonce)) { socket.destroy(); return; }
+            remotePeerId = msg.peerId;
+            sockets.set(remotePeerId, socket);
+            lib.recordPeer(name, msg.peerId, msg.label);
+            authed = true;
+            sendEncrypted(socket, { type: 'state', merged });
+          }
+          continue;
+        }
+        const payload = lib.decrypt(key, msg);
+        if (payload.type === 'state') applyMergedUpdate(payload.merged, remotePeerId);
+      }
+    });
+    socket.on('close', () => {
+      for (const [pid, s] of sockets) if (s === socket) sockets.delete(pid);
+    });
+    socket.on('error', () => socket.destroy());
+    if (isServer) socket.write(JSON.stringify({ type: 'challenge', nonce: myNonce }) + '\n');
+  }
+
+  function dialPeer(host, port) {
+    const addrKey = `${host}:${port}`;
+    if (connecting.has(addrKey)) return;
+    connecting.add(addrKey);
+    const socket = net.createConnection({ host, port }, () => {
+      log(`connected to peer at ${addrKey}`);
+      attachSocket(socket, false);
+    });
+    socket.on('error', () => connecting.delete(addrKey));
+    socket.on('close', () => connecting.delete(addrKey));
+  }
+
+  const server = net.createServer((socket) => attachSocket(socket, true));
+  server.listen(0, () => {
+    log(`TCP listening on port ${server.address().port}`);
+
+    setInterval(() => {
+      try {
+        signal.announcePresence(roomHash, {
+          peerId: config.peerId,
+          label: lib.getDeviceIdentity().label,
+          ip: getLocalIp(),
+          port: server.address().port,
+          meshIps: mesh.getMyMeshIps().map((m) => m.ip),
+          ts: Date.now(),
+        });
+        const peers = signal.discoverPeers(roomHash);
+        for (const peer of peers) {
+          if (peer.peerId === config.peerId) continue;
+          if (sockets.has(peer.peerId)) continue;
+          if (config.peerId > peer.peerId) continue;
+          if (peer.meshIps && peer.meshIps.length) {
+            for (const meshIp of peer.meshIps) dialPeer(meshIp, peer.port);
+          }
+          dialPeer(peer.ip, peer.port);
+        }
+      } catch (err) {
+        log('gist signaling failed:', err.message);
+      }
+    }, SIGNAL_INTERVAL_MS);
+  });
+
+  const udp = dgram.createSocket({ type: 'udp4', reuseAddr: true });
+  udp.on('message', (msg, rinfo) => {
+    let announce;
+    try { announce = JSON.parse(msg.toString('utf8')); } catch { return; }
+    if (announce.roomHash !== roomHash || announce.peerId === config.peerId) return;
+    if (sockets.has(announce.peerId)) return;
+    // avoid both sides dialing each other: lower peerId initiates.
+    if (config.peerId > announce.peerId) return;
+    const addrKey = `${rinfo.address}:${announce.port}`;
+    if (connecting.has(addrKey)) return;
+    connecting.add(addrKey);
+    const socket = net.createConnection({ host: rinfo.address, port: announce.port }, () => {
+      log(`connected to peer at ${addrKey}`);
+      attachSocket(socket, false);
+    });
+    socket.on('error', () => connecting.delete(addrKey));
+    socket.on('close', () => connecting.delete(addrKey));
+  });
+  udp.bind(MCAST_PORT, () => {
+    udp.addMembership(MCAST_ADDR);
+    setInterval(() => {
+      const payload = Buffer.from(JSON.stringify({ roomHash, peerId: config.peerId, port: server.address().port }));
+      udp.send(payload, MCAST_PORT, MCAST_ADDR);
+    }, ANNOUNCE_INTERVAL_MS);
+  });
+
+  // local file watch -> update merged, write history, broadcast
+  // (vault-only rooms have no file, so there's nothing to watch here --
+  // editing happens via `envsync set`/`unset` instead, picked up below)
+  if (config.filePath) {
+    fs.watchFile(config.filePath, { interval: 1000 }, () => {
+      if (!fs.existsSync(config.filePath)) return;
+      const next = lib.parseEnv(fs.readFileSync(config.filePath, 'utf8'));
+      const diff = lib.diffValues(localValues, next);
+      if (Object.keys(diff).length === 0) return;
+      const ts = Date.now();
+      for (const [k, change] of Object.entries(diff)) {
+        if (change.type === 'removed') delete merged[k];
+        else merged[k] = { value: next[k], ts, peer: config.peerId };
+      }
+      lib.saveMerged(name, merged);
+      localValues = next;
+      lib.appendHistory(name, { ts, values: next, diff, source: config.peerId });
+      log('local change:', diff);
+      broadcastState();
+      scheduleBackupPush();
+    });
+  }
+
+  // `envsync set`/`unset` run from another terminal write straight to the
+  // vault (lib.setValue/unsetValue), bypassing this process's in-memory
+  // state entirely. Watch the vault file itself so a running `sync` still
+  // notices, merges, and broadcasts those edits -- this is the only edit
+  // path for vault-only rooms, and works for file-mode rooms too.
+  fs.watchFile(lib.mergedFile(name), { interval: 1000 }, () => {
+    let fresh;
+    try { fresh = lib.loadMerged(name); } catch { return; }
+    const diff = {};
+    let changed = false;
+    for (const [k, entry] of Object.entries(fresh)) {
+      if (!merged[k] || merged[k].value !== entry.value) {
+        diff[k] = { type: merged[k] ? 'changed' : 'added', from: merged[k]?.value, to: entry.value };
+        changed = true;
+      }
+    }
+    for (const k of Object.keys(merged)) {
+      if (!(k in fresh)) { diff[k] = { type: 'removed' }; changed = true; }
+    }
+    if (!changed) return;
+    merged = fresh;
+    localValues = lib.mergedToValues(merged);
+    if (config.filePath) fs.writeFileSync(config.filePath, lib.serializeEnv(localValues));
+    log('vault edited directly (set/unset):', diff);
+    broadcastState();
+    scheduleBackupPush();
+  });
+
+  log(`syncing room "${name}" (peer ${config.peerId}, room ${roomHash.slice(0, 8)}...)`);
+}
+
+function startAllRooms() {
+  const rooms = lib.listRoomStatuses();
+  if (!rooms.length) {
+    log('no rooms found -- daemon staying alive with nothing to sync yet');
+    setInterval(() => {}, 60000);
+    return;
+  }
+  for (const { name } of rooms) {
+    try {
+      startSync(name);
+      log(`daemon: started sync for room "${name}"`);
+    } catch (err) {
+      log(`daemon: skipping room "${name}" (${err.message})`);
+    }
+  }
+}
+
+module.exports = { startSync, startAllRooms };

package/notify.js

@@ -0,0 +1,48 @@
+'use strict';
+
+// Native OS notifications -- no GUI framework, no new deps. Each platform's
+// own bundled tool does the work: osascript (mac), notify-send (Linux,
+// ships with most desktop distros), PowerShell toast (Windows 10+).
+
+const { execFileSync } = require('child_process');
+
+function escapeAppleScript(str) {
+  return str.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+
+function notifyDarwin(title, message) {
+  execFileSync('osascript', ['-e', `display notification "${escapeAppleScript(message)}" with title "${escapeAppleScript(title)}"`]);
+}
+
+function notifyLinux(title, message) {
+  execFileSync('notify-send', [title, message]);
+}
+
+// ponytail: shells out to powershell for a toast; untested on real Windows,
+// fix on first report if the XML namespace/API surface has drifted.
+function notifyWindows(title, message) {
+  const escape = (s) => s.replace(/'/g, "''");
+  const script = `
+    [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null
+    $template = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent([Windows.UI.Notifications.ToastTemplateType]::ToastText02)
+    $texts = $template.GetElementsByTagName('text')
+    $texts.Item(0).AppendChild($template.CreateTextNode('${escape(title)}')) > $null
+    $texts.Item(1).AppendChild($template.CreateTextNode('${escape(message)}')) > $null
+    $toast = [Windows.UI.Notifications.ToastNotification]::new($template)
+    [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('envsync').Show($toast)
+  `;
+  execFileSync('powershell', ['-NoProfile', '-Command', script]);
+}
+
+function notify(title, message) {
+  try {
+    if (process.platform === 'darwin') return notifyDarwin(title, message);
+    if (process.platform === 'linux') return notifyLinux(title, message);
+    if (process.platform === 'win32') return notifyWindows(title, message);
+  } catch {
+    // fall through to console
+  }
+  console.log(`[notify] ${title}: ${message}`);
+}
+
+module.exports = { notify };

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "p2p-envsync",
+  "version": "0.1.0",
+  "description": "P2P encrypted .env sync for dev teams — LAN-first, offline-first, zero server",
+  "keywords": ["env", "dotenv", "sync", "p2p", "encrypted", "secrets", "team", "developer-tools"],
+  "author": "RismanRJ",
+  "license": "MIT",
+  "type": "commonjs",
+  "bin": {
+    "envsync": "./cli.js"
+  },
+  "main": "tray/main.js",
+  "files": ["lib.js", "cli.js", "net.js", "backup.js", "notify.js", "mesh.js", "signal.js", "tray/", "LICENSE"],
+  "scripts": {
+    "test": "node --test test/",
+    "tray": "electron ."
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/RismanRJ/envsync.git"
+  },
+  "homepage": "https://github.com/RismanRJ/envsync#readme",
+  "bugs": "https://github.com/RismanRJ/envsync/issues",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "qrcode-terminal": "^0.12.0"
+  },
+  "devDependencies": {
+    "electron": "^41.7.1"
+  }
+}

package/signal.js

@@ -0,0 +1,83 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const backup = require('./backup.js');
+
+const STALE_MS = 60 * 1000;
+const gistIdCache = {};
+
+function descFor(roomHash) {
+  return `envsync-signal-${roomHash.slice(0, 16)}`;
+}
+
+function tmpFile(contents) {
+  const file = path.join(os.tmpdir(), `envsync-peers-${process.pid}-${Date.now()}.json`);
+  fs.writeFileSync(file, contents);
+  return file;
+}
+
+function findSignalGist(roomHash) {
+  if (gistIdCache[roomHash]) return gistIdCache[roomHash];
+  const desc = descFor(roomHash);
+  try {
+    const gists = JSON.parse(execFileSync('gh', ['api', '/gists?per_page=100']).toString());
+    const match = gists.find(g => g.description === desc);
+    if (!match) return null;
+    gistIdCache[roomHash] = match.id;
+    return match.id;
+  } catch {
+    return null;
+  }
+}
+
+function readGistPeers(gistId) {
+  try {
+    const data = JSON.parse(execFileSync('gh', ['api', `/gists/${gistId}`]).toString());
+    const content = data.files && data.files['peers.json'] && data.files['peers.json'].content;
+    return content ? JSON.parse(content) : {};
+  } catch {
+    return {};
+  }
+}
+
+function announcePresence(roomHash, announcement) {
+  if (!backup.isGhAuthenticated()) return;
+  const desc = descFor(roomHash);
+  let file;
+  try {
+    let gistId = findSignalGist(roomHash);
+    if (!gistId) {
+      file = tmpFile(JSON.stringify({ [announcement.peerId]: announcement }));
+      const out = execFileSync('gh', ['gist', 'create', '--filename', 'peers.json', '--desc', desc, '--public=false', file]).toString();
+      const match = out.trim().match(/([a-f0-9]{20,})/);
+      if (match) gistIdCache[roomHash] = match[1];
+      return;
+    }
+    const peers = readGistPeers(gistId);
+    peers[announcement.peerId] = announcement;
+    file = tmpFile(JSON.stringify(peers));
+    execFileSync('gh', ['gist', 'edit', gistId, '-f', 'peers.json', file]);
+  } catch {
+    // no internet, not authed, rate limited -- signaling is best-effort
+  } finally {
+    if (file) { try { fs.unlinkSync(file); } catch {} }
+  }
+}
+
+function discoverPeers(roomHash) {
+  if (!backup.isGhAuthenticated()) return [];
+  try {
+    const gistId = findSignalGist(roomHash);
+    if (!gistId) return [];
+    const peers = readGistPeers(gistId);
+    const now = Date.now();
+    return Object.values(peers).filter(p => now - p.ts < STALE_MS);
+  } catch {
+    return [];
+  }
+}
+
+module.exports = { announcePresence, discoverPeers, findSignalGist };

package/tray/icons.js

@@ -0,0 +1,136 @@
+'use strict';
+
+// Renders a "sync" glyph (two circular arrows, the universal refresh/sync
+// symbol) as a solid-color PNG -- pure pixel math + Node's built-in zlib,
+// no image/canvas library. Supersampled 4x then box-downsampled for
+// anti-aliased edges at tray-icon size.
+
+const zlib = require('zlib');
+
+const CRC_TABLE = (() => {
+  const table = new Uint32Array(256);
+  for (let n = 0; n < 256; n++) {
+    let c = n;
+    for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+    table[n] = c;
+  }
+  return table;
+})();
+
+function crc32(buf) {
+  let crc = 0xffffffff;
+  for (const byte of buf) crc = CRC_TABLE[(crc ^ byte) & 0xff] ^ (crc >>> 8);
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+function chunk(type, data) {
+  const typeBuf = Buffer.from(type, 'ascii');
+  const len = Buffer.alloc(4);
+  len.writeUInt32BE(data.length);
+  const crc = Buffer.alloc(4);
+  crc.writeUInt32BE(crc32(Buffer.concat([typeBuf, data])));
+  return Buffer.concat([len, typeBuf, data, crc]);
+}
+
+function encodePng(pixels, size) {
+  const raw = Buffer.alloc(size * (1 + size * 4));
+  for (let y = 0; y < size; y++) {
+    const rowStart = y * (1 + size * 4);
+    raw[rowStart] = 0; // filter: none
+    for (let x = 0; x < size; x++) {
+      const [r, g, b, a] = pixels[y * size + x];
+      const o = rowStart + 1 + x * 4;
+      raw[o] = r; raw[o + 1] = g; raw[o + 2] = b; raw[o + 3] = a;
+    }
+  }
+  const ihdr = Buffer.alloc(13);
+  ihdr.writeUInt32BE(size, 0);
+  ihdr.writeUInt32BE(size, 4);
+  ihdr[8] = 8; ihdr[9] = 6; // 8-bit depth, RGBA color type
+  const signature = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
+  return Buffer.concat([
+    signature,
+    chunk('IHDR', ihdr),
+    chunk('IDAT', zlib.deflateSync(raw)),
+    chunk('IEND', Buffer.alloc(0)),
+  ]);
+}
+
+function angleDelta(a, b) {
+  let d = Math.abs(a - b) % 360;
+  return d > 180 ? 360 - d : d;
+}
+
+// One arc of the sync glyph: a ring segment from `start` to `end` degrees,
+// with a triangular arrowhead at the `end`.
+function arcCoverage(px, py, cx, cy, radius, thickness, start, end, arrowSize) {
+  const dx = px - cx;
+  const dy = py - cy;
+  const dist = Math.sqrt(dx * dx + dy * dy);
+  let angle = (Math.atan2(dy, dx) * 180) / Math.PI;
+  if (angle < 0) angle += 360;
+
+  const within = (a, s, e) => {
+    const span = ((e - s) % 360 + 360) % 360;
+    const rel = ((a - s) % 360 + 360) % 360;
+    return rel <= span;
+  };
+
+  if (within(angle, start, end) && Math.abs(dist - radius) <= thickness / 2) return true;
+
+  // arrowhead: a triangle centered on `end`, widening as it nears the tip radius
+  const tipDelta = angleDelta(angle, end);
+  const arrowAngularWidth = (arrowSize / radius) * (180 / Math.PI) * 1.8;
+  if (tipDelta <= arrowAngularWidth) {
+    const taper = 1 - tipDelta / arrowAngularWidth;
+    const halfBand = (thickness / 2) + arrowSize * taper;
+    if (Math.abs(dist - radius) <= halfBand) return true;
+  }
+  return false;
+}
+
+function renderSyncGlyph(rgb, size) {
+  const SS = 4; // supersampling factor
+  const big = size * SS;
+  const cx = big / 2;
+  const cy = big / 2;
+  const radius = big * 0.32;
+  const thickness = big * 0.11;
+  const arrowSize = big * 0.09;
+
+  const bigPixels = new Array(big * big);
+  for (let y = 0; y < big; y++) {
+    for (let x = 0; x < big; x++) {
+      const hit = arcCoverage(x, y, cx, cy, radius, thickness, 15, 165, arrowSize)
+        || arcCoverage(x, y, cx, cy, radius, thickness, 195, 345, arrowSize);
+      bigPixels[y * big + x] = hit ? [...rgb, 255] : [0, 0, 0, 0];
+    }
+  }
+
+  // box downsample for anti-aliasing
+  const pixels = new Array(size * size);
+  for (let y = 0; y < size; y++) {
+    for (let x = 0; x < size; x++) {
+      let r = 0, g = 0, b = 0, a = 0;
+      for (let sy = 0; sy < SS; sy++) {
+        for (let sx = 0; sx < SS; sx++) {
+          const p = bigPixels[(y * SS + sy) * big + (x * SS + sx)];
+          r += p[0]; g += p[1]; b += p[2]; a += p[3];
+        }
+      }
+      const n = SS * SS;
+      pixels[y * size + x] = [Math.round(r / n), Math.round(g / n), Math.round(b / n), Math.round(a / n)];
+    }
+  }
+  return encodePng(pixels, size);
+}
+
+function dataUrl(rgb) {
+  return `data:image/png;base64,${renderSyncGlyph(rgb, 32).toString('base64')}`;
+}
+
+module.exports = {
+  green: dataUrl([48, 209, 88]),
+  yellow: dataUrl([255, 190, 10]),
+  gray: dataUrl([142, 142, 147]),
+};