chore: linting

src-tauri/src/sync/client.rs

@@ -0,0 +1,281 @@
+use super::types::*;
+use reqwest::Client;
+
+#[derive(Clone)]
+pub struct SyncClient {
+  client: Client,
+  base_url: String,
+  token: String,
+}
+
+impl SyncClient {
+  pub fn new(base_url: String, token: String) -> Self {
+    Self {
+      client: Client::new(),
+      base_url: base_url.trim_end_matches('/').to_string(),
+      token,
+    }
+  }
+
+  fn url(&self, path: &str) -> String {
+    format!("{}/v1/objects/{}", self.base_url, path)
+  }
+
+  pub async fn stat(&self, key: &str) -> SyncResult<StatResponse> {
+    let response = self
+      .client
+      .post(self.url("stat"))
+      .header("Authorization", format!("Bearer {}", self.token))
+      .json(&StatRequest {
+        key: key.to_string(),
+      })
+      .send()
+      .await
+      .map_err(|e| SyncError::NetworkError(e.to_string()))?;
+
+    if response.status().is_client_error() {
+      return Err(SyncError::AuthError("Invalid or missing token".to_string()));
+    }
+
+    response
+      .json()
+      .await
+      .map_err(|e| SyncError::SerializationError(e.to_string()))
+  }
+
+  pub async fn presign_upload(
+    &self,
+    key: &str,
+    content_type: Option<&str>,
+  ) -> SyncResult<PresignUploadResponse> {
+    let response = self
+      .client
+      .post(self.url("presign-upload"))
+      .header("Authorization", format!("Bearer {}", self.token))
+      .json(&PresignUploadRequest {
+        key: key.to_string(),
+        content_type: content_type.map(|s| s.to_string()),
+        expires_in: Some(3600),
+      })
+      .send()
+      .await
+      .map_err(|e| SyncError::NetworkError(e.to_string()))?;
+
+    if response.status().is_client_error() {
+      return Err(SyncError::AuthError("Invalid or missing token".to_string()));
+    }
+
+    response
+      .json()
+      .await
+      .map_err(|e| SyncError::SerializationError(e.to_string()))
+  }
+
+  pub async fn presign_download(&self, key: &str) -> SyncResult<PresignDownloadResponse> {
+    let response = self
+      .client
+      .post(self.url("presign-download"))
+      .header("Authorization", format!("Bearer {}", self.token))
+      .json(&PresignDownloadRequest {
+        key: key.to_string(),
+        expires_in: Some(3600),
+      })
+      .send()
+      .await
+      .map_err(|e| SyncError::NetworkError(e.to_string()))?;
+
+    if response.status().is_client_error() {
+      return Err(SyncError::AuthError("Invalid or missing token".to_string()));
+    }
+
+    response
+      .json()
+      .await
+      .map_err(|e| SyncError::SerializationError(e.to_string()))
+  }
+
+  pub async fn delete(&self, key: &str, tombstone_key: Option<&str>) -> SyncResult<DeleteResponse> {
+    let response = self
+      .client
+      .post(self.url("delete"))
+      .header("Authorization", format!("Bearer {}", self.token))
+      .json(&DeleteRequest {
+        key: key.to_string(),
+        tombstone_key: tombstone_key.map(|s| s.to_string()),
+        deleted_at: Some(chrono::Utc::now().to_rfc3339()),
+      })
+      .send()
+      .await
+      .map_err(|e| SyncError::NetworkError(e.to_string()))?;
+
+    if response.status().is_client_error() {
+      return Err(SyncError::AuthError("Invalid or missing token".to_string()));
+    }
+
+    response
+      .json()
+      .await
+      .map_err(|e| SyncError::SerializationError(e.to_string()))
+  }
+
+  pub async fn list(&self, prefix: &str) -> SyncResult<ListResponse> {
+    let response = self
+      .client
+      .post(self.url("list"))
+      .header("Authorization", format!("Bearer {}", self.token))
+      .json(&ListRequest {
+        prefix: prefix.to_string(),
+        max_keys: Some(1000),
+        continuation_token: None,
+      })
+      .send()
+      .await
+      .map_err(|e| SyncError::NetworkError(e.to_string()))?;
+
+    if response.status().is_client_error() {
+      return Err(SyncError::AuthError("Invalid or missing token".to_string()));
+    }
+
+    response
+      .json()
+      .await
+      .map_err(|e| SyncError::SerializationError(e.to_string()))
+  }
+
+  pub async fn upload_bytes(
+    &self,
+    presigned_url: &str,
+    data: &[u8],
+    content_type: Option<&str>,
+  ) -> SyncResult<()> {
+    let mut req = self.client.put(presigned_url).body(data.to_vec());
+
+    if let Some(ct) = content_type {
+      req = req.header("Content-Type", ct);
+    }
+
+    let response = req
+      .send()
+      .await
+      .map_err(|e| SyncError::NetworkError(e.to_string()))?;
+
+    if !response.status().is_success() {
+      let status = response.status();
+      let body = response.text().await.unwrap_or_default();
+      return Err(SyncError::NetworkError(format!(
+        "Upload failed with status {status}: {body}"
+      )));
+    }
+
+    Ok(())
+  }
+
+  pub async fn download_bytes(&self, presigned_url: &str) -> SyncResult<Vec<u8>> {
+    let response = self
+      .client
+      .get(presigned_url)
+      .send()
+      .await
+      .map_err(|e| SyncError::NetworkError(e.to_string()))?;
+
+    if !response.status().is_success() {
+      return Err(SyncError::NetworkError(format!(
+        "Download failed with status: {}",
+        response.status()
+      )));
+    }
+
+    response
+      .bytes()
+      .await
+      .map(|b| b.to_vec())
+      .map_err(|e| SyncError::NetworkError(e.to_string()))
+  }
+
+  pub async fn presign_upload_batch(
+    &self,
+    items: Vec<(String, Option<String>)>,
+  ) -> SyncResult<PresignUploadBatchResponse> {
+    let request = PresignUploadBatchRequest {
+      items: items
+        .into_iter()
+        .map(|(key, content_type)| PresignUploadBatchItem { key, content_type })
+        .collect(),
+      expires_in: Some(3600),
+    };
+
+    let response = self
+      .client
+      .post(self.url("presign-upload-batch"))
+      .header("Authorization", format!("Bearer {}", self.token))
+      .json(&request)
+      .send()
+      .await
+      .map_err(|e| SyncError::NetworkError(e.to_string()))?;
+
+    if response.status().is_client_error() {
+      return Err(SyncError::AuthError("Invalid or missing token".to_string()));
+    }
+
+    response
+      .json()
+      .await
+      .map_err(|e| SyncError::SerializationError(e.to_string()))
+  }
+
+  pub async fn presign_download_batch(
+    &self,
+    keys: Vec<String>,
+  ) -> SyncResult<PresignDownloadBatchResponse> {
+    let request = PresignDownloadBatchRequest {
+      keys,
+      expires_in: Some(3600),
+    };
+
+    let response = self
+      .client
+      .post(self.url("presign-download-batch"))
+      .header("Authorization", format!("Bearer {}", self.token))
+      .json(&request)
+      .send()
+      .await
+      .map_err(|e| SyncError::NetworkError(e.to_string()))?;
+
+    if response.status().is_client_error() {
+      return Err(SyncError::AuthError("Invalid or missing token".to_string()));
+    }
+
+    response
+      .json()
+      .await
+      .map_err(|e| SyncError::SerializationError(e.to_string()))
+  }
+
+  pub async fn delete_prefix(
+    &self,
+    prefix: &str,
+    tombstone_key: Option<&str>,
+  ) -> SyncResult<DeletePrefixResponse> {
+    let response = self
+      .client
+      .post(self.url("delete-prefix"))
+      .header("Authorization", format!("Bearer {}", self.token))
+      .json(&DeletePrefixRequest {
+        prefix: prefix.to_string(),
+        tombstone_key: tombstone_key.map(|s| s.to_string()),
+        deleted_at: Some(chrono::Utc::now().to_rfc3339()),
+      })
+      .send()
+      .await
+      .map_err(|e| SyncError::NetworkError(e.to_string()))?;
+
+    if response.status().is_client_error() {
+      return Err(SyncError::AuthError("Invalid or missing token".to_string()));
+    }
+
+    response
+      .json()
+      .await
+      .map_err(|e| SyncError::SerializationError(e.to_string()))
+  }
+}

src-tauri/src/sync/manifest.rs

@@ -0,0 +1,636 @@
+use chrono::{DateTime, Utc};
+use globset::{Glob, GlobSet, GlobSetBuilder};
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::fs::{self, File};
+use std::io::{BufReader, Read};
+use std::path::Path;
+use std::time::SystemTime;
+
+use super::types::{SyncError, SyncResult};
+
+/// Default exclude patterns for volatile Chromium profile files
+pub const DEFAULT_EXCLUDE_PATTERNS: &[&str] = &[
+  "Cache/**",
+  "Code Cache/**",
+  "GPUCache/**",
+  "GrShaderCache/**",
+  "ShaderCache/**",
+  "Service Worker/CacheStorage/**",
+  "Crashpad/**",
+  "Crash Reports/**",
+  "BrowserMetrics/**",
+  "blob_storage/**",
+  "*.log",
+  "*.tmp",
+  "LOG",
+  "LOG.old",
+  "LOCK",
+  ".donut-sync/**",
+];
+
+/// A single file entry in the manifest
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ManifestFileEntry {
+  pub path: String,
+  pub size: u64,
+  pub mtime: i64,
+  pub hash: String,
+}
+
+/// The sync manifest for a profile
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SyncManifest {
+  pub version: u32,
+  #[serde(rename = "profileId")]
+  pub profile_id: String,
+  #[serde(rename = "generatedAt")]
+  pub generated_at: String,
+  #[serde(rename = "updatedAt")]
+  pub updated_at: String,
+  #[serde(rename = "excludeGlobs")]
+  pub exclude_globs: Vec<String>,
+  pub files: Vec<ManifestFileEntry>,
+}
+
+impl SyncManifest {
+  pub fn new(profile_id: String, exclude_globs: Vec<String>) -> Self {
+    let now = Utc::now().to_rfc3339();
+    Self {
+      version: 1,
+      profile_id,
+      generated_at: now.clone(),
+      updated_at: now,
+      exclude_globs,
+      files: Vec::new(),
+    }
+  }
+
+  pub fn updated_at_datetime(&self) -> Option<DateTime<Utc>> {
+    DateTime::parse_from_rfc3339(&self.updated_at)
+      .ok()
+      .map(|dt| dt.with_timezone(&Utc))
+  }
+}
+
+/// Local hash cache to avoid re-hashing unchanged files
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct HashCache {
+  pub entries: HashMap<String, HashCacheEntry>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct HashCacheEntry {
+  pub size: u64,
+  pub mtime: i64,
+  pub hash: String,
+}
+
+impl HashCache {
+  pub fn load(cache_path: &Path) -> Self {
+    if !cache_path.exists() {
+      return Self::default();
+    }
+
+    match fs::read_to_string(cache_path) {
+      Ok(content) => serde_json::from_str(&content).unwrap_or_default(),
+      Err(_) => Self::default(),
+    }
+  }
+
+  pub fn save(&self, cache_path: &Path) -> SyncResult<()> {
+    if let Some(parent) = cache_path.parent() {
+      fs::create_dir_all(parent).map_err(|e| {
+        SyncError::IoError(format!(
+          "Failed to create cache directory {}: {e}",
+          parent.display()
+        ))
+      })?;
+    }
+
+    let json = serde_json::to_string_pretty(self)
+      .map_err(|e| SyncError::SerializationError(format!("Failed to serialize hash cache: {e}")))?;
+
+    fs::write(cache_path, json).map_err(|e| {
+      SyncError::IoError(format!(
+        "Failed to write hash cache {}: {e}",
+        cache_path.display()
+      ))
+    })?;
+
+    Ok(())
+  }
+
+  pub fn get(&self, path: &str, size: u64, mtime: i64) -> Option<&str> {
+    self.entries.get(path).and_then(|entry| {
+      if entry.size == size && entry.mtime == mtime {
+        Some(entry.hash.as_str())
+      } else {
+        None
+      }
+    })
+  }
+
+  pub fn insert(&mut self, path: String, size: u64, mtime: i64, hash: String) {
+    self
+      .entries
+      .insert(path, HashCacheEntry { size, mtime, hash });
+  }
+}
+
+/// Build a GlobSet from exclude patterns
+fn build_exclude_globset(patterns: &[String]) -> SyncResult<GlobSet> {
+  let mut builder = GlobSetBuilder::new();
+  for pattern in patterns {
+    let glob = Glob::new(pattern)
+      .map_err(|e| SyncError::InvalidData(format!("Invalid exclude pattern '{}': {e}", pattern)))?;
+    builder.add(glob);
+  }
+  builder
+    .build()
+    .map_err(|e| SyncError::InvalidData(format!("Failed to build exclude globset: {e}")))
+}
+
+/// Compute blake3 hash of a file
+/// Returns None if the file doesn't exist (was deleted)
+fn hash_file(path: &Path) -> Result<Option<String>, SyncError> {
+  let file = match File::open(path) {
+    Ok(f) => f,
+    Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+    Err(e) => {
+      return Err(SyncError::IoError(format!(
+        "Failed to open {}: {e}",
+        path.display()
+      )));
+    }
+  };
+
+  let mut reader = BufReader::new(file);
+  let mut hasher = blake3::Hasher::new();
+  let mut buffer = [0u8; 65536]; // 64KB buffer
+
+  loop {
+    let bytes_read = reader
+      .read(&mut buffer)
+      .map_err(|e| SyncError::IoError(format!("Failed to read {}: {e}", path.display())))?;
+    if bytes_read == 0 {
+      break;
+    }
+    hasher.update(&buffer[..bytes_read]);
+  }
+
+  Ok(Some(hasher.finalize().to_hex().to_string()))
+}
+
+/// Get mtime as unix timestamp
+/// Returns None if the file doesn't exist (was deleted)
+fn get_mtime(path: &Path) -> Result<Option<i64>, SyncError> {
+  let metadata = match path.metadata() {
+    Ok(m) => m,
+    Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+    Err(e) => {
+      return Err(SyncError::IoError(format!(
+        "Failed to get metadata for {}: {e}",
+        path.display()
+      )));
+    }
+  };
+
+  let mtime = metadata
+    .modified()
+    .map_err(|e| SyncError::IoError(format!("Failed to get mtime for {}: {e}", path.display())))?;
+
+  Ok(Some(
+    mtime
+      .duration_since(SystemTime::UNIX_EPOCH)
+      .map(|d| d.as_secs() as i64)
+      .unwrap_or(0),
+  ))
+}
+
+/// Generate a manifest for a profile directory
+pub fn generate_manifest(
+  profile_id: &str,
+  profile_dir: &Path,
+  cache: &mut HashCache,
+) -> SyncResult<SyncManifest> {
+  let exclude_patterns: Vec<String> = DEFAULT_EXCLUDE_PATTERNS
+    .iter()
+    .map(|s| s.to_string())
+    .collect();
+  let globset = build_exclude_globset(&exclude_patterns)?;
+
+  let mut manifest = SyncManifest::new(profile_id.to_string(), exclude_patterns);
+  let mut max_mtime: i64 = 0;
+
+  if !profile_dir.exists() {
+    log::debug!(
+      "Profile directory doesn't exist: {}, creating empty manifest",
+      profile_dir.display()
+    );
+    return Ok(manifest);
+  }
+
+  fn walk_dir(
+    dir: &Path,
+    base_dir: &Path,
+    globset: &GlobSet,
+    cache: &mut HashCache,
+    files: &mut Vec<ManifestFileEntry>,
+    max_mtime: &mut i64,
+  ) -> SyncResult<()> {
+    let entries = fs::read_dir(dir).map_err(|e| {
+      SyncError::IoError(format!("Failed to read directory {}: {e}", dir.display()))
+    })?;
+
+    for entry in entries {
+      let entry = entry.map_err(|e| {
+        SyncError::IoError(format!("Failed to read entry in {}: {e}", dir.display()))
+      })?;
+
+      let path = entry.path();
+      let relative_path = path
+        .strip_prefix(base_dir)
+        .map_err(|_| SyncError::IoError("Failed to compute relative path".to_string()))?
+        .to_string_lossy()
+        .replace('\\', "/");
+
+      // Check if excluded
+      if globset.is_match(&relative_path) {
+        continue;
+      }
+
+      // Get metadata - skip if file was deleted between directory read and metadata access
+      let metadata = match path.metadata() {
+        Ok(m) => m,
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+          log::debug!(
+            "File disappeared during manifest generation, skipping: {}",
+            path.display()
+          );
+          continue;
+        }
+        Err(e) => {
+          return Err(SyncError::IoError(format!(
+            "Failed to get metadata for {}: {e}",
+            path.display()
+          )));
+        }
+      };
+
+      if metadata.is_dir() {
+        walk_dir(&path, base_dir, globset, cache, files, max_mtime)?;
+      } else if metadata.is_file() {
+        let size = metadata.len();
+        let mtime = match get_mtime(&path)? {
+          Some(m) => m,
+          None => {
+            // File was deleted, skip it
+            log::debug!(
+              "File disappeared during manifest generation, skipping: {}",
+              path.display()
+            );
+            continue;
+          }
+        };
+
+        *max_mtime = (*max_mtime).max(mtime);
+
+        // Check cache for existing hash
+        let hash = if let Some(cached_hash) = cache.get(&relative_path, size, mtime) {
+          cached_hash.to_string()
+        } else {
+          match hash_file(&path)? {
+            Some(computed_hash) => {
+              cache.insert(relative_path.clone(), size, mtime, computed_hash.clone());
+              computed_hash
+            }
+            None => {
+              // File was deleted, skip it
+              log::debug!(
+                "File disappeared during manifest generation, skipping: {}",
+                path.display()
+              );
+              continue;
+            }
+          }
+        };
+
+        files.push(ManifestFileEntry {
+          path: relative_path,
+          size,
+          mtime,
+          hash,
+        });
+      }
+    }
+
+    Ok(())
+  }
+
+  walk_dir(
+    profile_dir,
+    profile_dir,
+    &globset,
+    cache,
+    &mut manifest.files,
+    &mut max_mtime,
+  )?;
+
+  // Sort files for deterministic manifest
+  manifest.files.sort_by(|a, b| a.path.cmp(&b.path));
+
+  // Update the updatedAt timestamp to max mtime
+  if max_mtime > 0 {
+    if let Some(dt) = DateTime::from_timestamp(max_mtime, 0) {
+      manifest.updated_at = dt.to_rfc3339();
+    }
+  }
+
+  Ok(manifest)
+}
+
+/// Compute the diff between local and remote manifests
+#[derive(Debug, Default)]
+pub struct ManifestDiff {
+  pub files_to_upload: Vec<ManifestFileEntry>,
+  pub files_to_download: Vec<ManifestFileEntry>,
+  pub files_to_delete_local: Vec<String>,
+  pub files_to_delete_remote: Vec<String>,
+}
+
+impl ManifestDiff {
+  pub fn is_empty(&self) -> bool {
+    self.files_to_upload.is_empty()
+      && self.files_to_download.is_empty()
+      && self.files_to_delete_local.is_empty()
+      && self.files_to_delete_remote.is_empty()
+  }
+}
+
+/// Compute what needs to be synced between local and remote
+pub fn compute_diff(local: &SyncManifest, remote: Option<&SyncManifest>) -> ManifestDiff {
+  let mut diff = ManifestDiff::default();
+
+  let Some(remote) = remote else {
+    // No remote manifest - upload everything
+    diff.files_to_upload = local.files.clone();
+    return diff;
+  };
+
+  // Build hash maps for quick lookup
+  let local_files: HashMap<&str, &ManifestFileEntry> =
+    local.files.iter().map(|f| (f.path.as_str(), f)).collect();
+  let remote_files: HashMap<&str, &ManifestFileEntry> =
+    remote.files.iter().map(|f| (f.path.as_str(), f)).collect();
+
+  // Compare timestamps to determine direction
+  let local_updated = local.updated_at_datetime();
+  let remote_updated = remote.updated_at_datetime();
+
+  let local_is_newer = match (local_updated, remote_updated) {
+    (Some(l), Some(r)) => l > r,
+    (Some(_), None) => true,
+    (None, Some(_)) => false,
+    (None, None) => true, // Default to uploading
+  };
+
+  if local_is_newer {
+    // Upload changed/new files, delete remote files that don't exist locally
+    for (path, local_entry) in &local_files {
+      match remote_files.get(path) {
+        Some(remote_entry) if remote_entry.hash != local_entry.hash => {
+          diff.files_to_upload.push((*local_entry).clone());
+        }
+        None => {
+          diff.files_to_upload.push((*local_entry).clone());
+        }
+        _ => {}
+      }
+    }
+
+    for path in remote_files.keys() {
+      if !local_files.contains_key(path) {
+        diff.files_to_delete_remote.push(path.to_string());
+      }
+    }
+  } else {
+    // Download changed/new files, delete local files that don't exist remotely
+    for (path, remote_entry) in &remote_files {
+      match local_files.get(path) {
+        Some(local_entry) if local_entry.hash != remote_entry.hash => {
+          diff.files_to_download.push((*remote_entry).clone());
+        }
+        None => {
+          diff.files_to_download.push((*remote_entry).clone());
+        }
+        _ => {}
+      }
+    }
+
+    for path in local_files.keys() {
+      if !remote_files.contains_key(path) {
+        diff.files_to_delete_local.push(path.to_string());
+      }
+    }
+  }
+
+  diff
+}
+
+/// Get the path to the hash cache file for a profile
+pub fn get_cache_path(profile_dir: &Path) -> std::path::PathBuf {
+  profile_dir.join(".donut-sync").join("cache.json")
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+  use tempfile::TempDir;
+
+  #[test]
+  fn test_hash_cache_operations() {
+    let cache_dir = TempDir::new().unwrap();
+    let cache_path = cache_dir.path().join("cache.json");
+
+    let mut cache = HashCache::default();
+    cache.insert(
+      "test.txt".to_string(),
+      100,
+      1234567890,
+      "abc123".to_string(),
+    );
+
+    assert_eq!(cache.get("test.txt", 100, 1234567890), Some("abc123"));
+    assert_eq!(cache.get("test.txt", 100, 999), None); // Different mtime
+    assert_eq!(cache.get("test.txt", 50, 1234567890), None); // Different size
+
+    cache.save(&cache_path).unwrap();
+
+    let loaded = HashCache::load(&cache_path);
+    assert_eq!(loaded.get("test.txt", 100, 1234567890), Some("abc123"));
+  }
+
+  #[test]
+  fn test_generate_manifest_empty_dir() {
+    let temp_dir = TempDir::new().unwrap();
+    let profile_dir = temp_dir.path().join("profile");
+    fs::create_dir_all(&profile_dir).unwrap();
+
+    let mut cache = HashCache::default();
+    let manifest = generate_manifest("test-profile", &profile_dir, &mut cache).unwrap();
+
+    assert_eq!(manifest.profile_id, "test-profile");
+    assert_eq!(manifest.version, 1);
+    assert!(manifest.files.is_empty());
+  }
+
+  #[test]
+  fn test_generate_manifest_with_files() {
+    let temp_dir = TempDir::new().unwrap();
+    let profile_dir = temp_dir.path().join("profile");
+    fs::create_dir_all(&profile_dir).unwrap();
+
+    fs::write(profile_dir.join("file1.txt"), "hello").unwrap();
+    fs::write(profile_dir.join("file2.txt"), "world").unwrap();
+    fs::create_dir_all(profile_dir.join("subdir")).unwrap();
+    fs::write(profile_dir.join("subdir/file3.txt"), "nested").unwrap();
+
+    let mut cache = HashCache::default();
+    let manifest = generate_manifest("test-profile", &profile_dir, &mut cache).unwrap();
+
+    assert_eq!(manifest.files.len(), 3);
+    assert!(manifest.files.iter().any(|f| f.path == "file1.txt"));
+    assert!(manifest.files.iter().any(|f| f.path == "file2.txt"));
+    assert!(manifest.files.iter().any(|f| f.path == "subdir/file3.txt"));
+  }
+
+  #[test]
+  fn test_generate_manifest_excludes_cache() {
+    let temp_dir = TempDir::new().unwrap();
+    let profile_dir = temp_dir.path().join("profile");
+    fs::create_dir_all(&profile_dir).unwrap();
+
+    fs::write(profile_dir.join("file1.txt"), "keep").unwrap();
+    fs::create_dir_all(profile_dir.join("Cache")).unwrap();
+    fs::write(profile_dir.join("Cache/data"), "exclude").unwrap();
+    fs::create_dir_all(profile_dir.join("Code Cache")).unwrap();
+    fs::write(profile_dir.join("Code Cache/wasm"), "exclude").unwrap();
+
+    let mut cache = HashCache::default();
+    let manifest = generate_manifest("test-profile", &profile_dir, &mut cache).unwrap();
+
+    assert_eq!(manifest.files.len(), 1);
+    assert_eq!(manifest.files[0].path, "file1.txt");
+  }
+
+  #[test]
+  fn test_compute_diff_upload_all_when_no_remote() {
+    let local = SyncManifest {
+      version: 1,
+      profile_id: "test".to_string(),
+      generated_at: Utc::now().to_rfc3339(),
+      updated_at: Utc::now().to_rfc3339(),
+      exclude_globs: vec![],
+      files: vec![
+        ManifestFileEntry {
+          path: "file1.txt".to_string(),
+          size: 10,
+          mtime: 1000,
+          hash: "abc".to_string(),
+        },
+        ManifestFileEntry {
+          path: "file2.txt".to_string(),
+          size: 20,
+          mtime: 2000,
+          hash: "def".to_string(),
+        },
+      ],
+    };
+
+    let diff = compute_diff(&local, None);
+
+    assert_eq!(diff.files_to_upload.len(), 2);
+    assert!(diff.files_to_download.is_empty());
+    assert!(diff.files_to_delete_local.is_empty());
+    assert!(diff.files_to_delete_remote.is_empty());
+  }
+
+  #[test]
+  fn test_compute_diff_detect_changes() {
+    let old_time = "2024-01-01T00:00:00Z";
+    let new_time = "2024-01-02T00:00:00Z";
+
+    let local = SyncManifest {
+      version: 1,
+      profile_id: "test".to_string(),
+      generated_at: new_time.to_string(),
+      updated_at: new_time.to_string(),
+      exclude_globs: vec![],
+      files: vec![
+        ManifestFileEntry {
+          path: "unchanged.txt".to_string(),
+          size: 10,
+          mtime: 1000,
+          hash: "same".to_string(),
+        },
+        ManifestFileEntry {
+          path: "changed.txt".to_string(),
+          size: 10,
+          mtime: 2000,
+          hash: "new_hash".to_string(),
+        },
+        ManifestFileEntry {
+          path: "new_file.txt".to_string(),
+          size: 5,
+          mtime: 3000,
+          hash: "new".to_string(),
+        },
+      ],
+    };
+
+    let remote = SyncManifest {
+      version: 1,
+      profile_id: "test".to_string(),
+      generated_at: old_time.to_string(),
+      updated_at: old_time.to_string(),
+      exclude_globs: vec![],
+      files: vec![
+        ManifestFileEntry {
+          path: "unchanged.txt".to_string(),
+          size: 10,
+          mtime: 1000,
+          hash: "same".to_string(),
+        },
+        ManifestFileEntry {
+          path: "changed.txt".to_string(),
+          size: 10,
+          mtime: 1000,
+          hash: "old_hash".to_string(),
+        },
+        ManifestFileEntry {
+          path: "deleted.txt".to_string(),
+          size: 8,
+          mtime: 500,
+          hash: "gone".to_string(),
+        },
+      ],
+    };
+
+    let diff = compute_diff(&local, Some(&remote));
+
+    // Local is newer, so we upload changed/new and delete remote-only
+    assert_eq!(diff.files_to_upload.len(), 2); // changed + new
+    assert!(diff.files_to_upload.iter().any(|f| f.path == "changed.txt"));
+    assert!(diff
+      .files_to_upload
+      .iter()
+      .any(|f| f.path == "new_file.txt"));
+    assert!(diff.files_to_download.is_empty());
+    assert!(diff.files_to_delete_local.is_empty());
+    assert_eq!(diff.files_to_delete_remote.len(), 1);
+    assert!(diff
+      .files_to_delete_remote
+      .contains(&"deleted.txt".to_string()));
+  }
+}

src-tauri/src/sync/mod.rs

@@ -0,0 +1,19 @@
+mod client;
+mod engine;
+pub mod manifest;
+pub mod scheduler;
+pub mod subscription;
+pub mod types;
+
+pub use client::SyncClient;
+pub use engine::{
+  enable_group_sync_if_needed, enable_proxy_sync_if_needed, is_group_in_use_by_synced_profile,
+  is_group_used_by_synced_profile, is_proxy_in_use_by_synced_profile,
+  is_proxy_used_by_synced_profile, request_profile_sync, set_group_sync_enabled,
+  set_profile_sync_enabled, set_proxy_sync_enabled, sync_profile, trigger_sync_for_profile,
+  SyncEngine,
+};
+pub use manifest::{compute_diff, generate_manifest, HashCache, ManifestDiff, SyncManifest};
+pub use scheduler::{get_global_scheduler, set_global_scheduler, SyncScheduler};
+pub use subscription::{SubscriptionManager, SyncWorkItem};
+pub use types::{SyncError, SyncResult};

src-tauri/src/sync/scheduler.rs

@@ -0,0 +1,613 @@
+use super::engine::SyncEngine;
+use super::subscription::SyncWorkItem;
+use crate::profile::ProfileManager;
+use once_cell::sync::OnceCell;
+use std::collections::{HashMap, HashSet};
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+use tauri::Emitter;
+use tokio::sync::mpsc;
+use tokio::sync::Mutex;
+use tokio::time::sleep;
+
+static GLOBAL_SCHEDULER: OnceCell<Arc<SyncScheduler>> = OnceCell::new();
+
+pub fn get_global_scheduler() -> Option<Arc<SyncScheduler>> {
+  GLOBAL_SCHEDULER.get().cloned()
+}
+
+pub fn set_global_scheduler(scheduler: Arc<SyncScheduler>) {
+  let _ = GLOBAL_SCHEDULER.set(scheduler);
+}
+
+#[derive(Debug, Clone)]
+struct ProfileStopTime {
+  #[allow(dead_code)]
+  stopped_at: Instant,
+  queued: bool,
+}
+
+pub struct SyncScheduler {
+  running: Arc<AtomicBool>,
+  pending_profiles: Arc<Mutex<HashMap<String, ProfileStopTime>>>,
+  pending_proxies: Arc<Mutex<HashSet<String>>>,
+  pending_groups: Arc<Mutex<HashSet<String>>>,
+  pending_tombstones: Arc<Mutex<Vec<(String, String)>>>,
+  running_profiles: Arc<Mutex<HashSet<String>>>,
+  in_flight_profiles: Arc<Mutex<HashSet<String>>>,
+}
+
+impl Default for SyncScheduler {
+  fn default() -> Self {
+    Self::new()
+  }
+}
+
+impl SyncScheduler {
+  pub fn new() -> Self {
+    Self {
+      running: Arc::new(AtomicBool::new(false)),
+      pending_profiles: Arc::new(Mutex::new(HashMap::new())),
+      pending_proxies: Arc::new(Mutex::new(HashSet::new())),
+      pending_groups: Arc::new(Mutex::new(HashSet::new())),
+      pending_tombstones: Arc::new(Mutex::new(Vec::new())),
+      running_profiles: Arc::new(Mutex::new(HashSet::new())),
+      in_flight_profiles: Arc::new(Mutex::new(HashSet::new())),
+    }
+  }
+
+  pub fn is_running(&self) -> bool {
+    self.running.load(Ordering::SeqCst)
+  }
+
+  pub fn stop(&self) {
+    self.running.store(false, Ordering::SeqCst);
+  }
+
+  /// Check if any sync operation is currently in progress
+  pub async fn is_sync_in_progress(&self) -> bool {
+    let in_flight = self.in_flight_profiles.lock().await;
+    if !in_flight.is_empty() {
+      return true;
+    }
+    drop(in_flight);
+
+    let pending_profiles = self.pending_profiles.lock().await;
+    if !pending_profiles.is_empty() {
+      return true;
+    }
+    drop(pending_profiles);
+
+    let pending_proxies = self.pending_proxies.lock().await;
+    if !pending_proxies.is_empty() {
+      return true;
+    }
+    drop(pending_proxies);
+
+    let pending_groups = self.pending_groups.lock().await;
+    if !pending_groups.is_empty() {
+      return true;
+    }
+    drop(pending_groups);
+
+    let pending_tombstones = self.pending_tombstones.lock().await;
+    if !pending_tombstones.is_empty() {
+      return true;
+    }
+
+    false
+  }
+
+  pub async fn mark_profile_running(&self, profile_id: &str) {
+    let mut running = self.running_profiles.lock().await;
+    running.insert(profile_id.to_string());
+    log::debug!("Marked profile {} as running", profile_id);
+  }
+
+  pub async fn mark_profile_stopped(&self, profile_id: &str) {
+    let mut running = self.running_profiles.lock().await;
+    running.remove(profile_id);
+    log::debug!("Marked profile {} as stopped", profile_id);
+
+    let mut pending = self.pending_profiles.lock().await;
+    if pending.contains_key(profile_id) {
+      // Set stopped_at to past so it syncs immediately
+      pending.insert(
+        profile_id.to_string(),
+        ProfileStopTime {
+          stopped_at: Instant::now() - Duration::from_secs(3),
+          queued: true,
+        },
+      );
+      log::debug!(
+        "Profile {} has pending sync, will execute immediately",
+        profile_id
+      );
+    }
+  }
+
+  pub async fn is_profile_running(&self, profile_id: &str) -> bool {
+    // First check our internal tracking
+    let running = self.running_profiles.lock().await;
+    if running.contains(profile_id) {
+      return true;
+    }
+    drop(running);
+
+    // Also check the actual profile state from ProfileManager
+    let profile_manager = ProfileManager::instance();
+    if let Ok(profiles) = profile_manager.list_profiles() {
+      if let Some(profile) = profiles.iter().find(|p| p.id.to_string() == profile_id) {
+        return profile.process_id.is_some();
+      }
+    }
+
+    false
+  }
+
+  pub async fn queue_profile_sync(&self, profile_id: String) {
+    self.queue_profile_sync_internal(profile_id).await;
+  }
+
+  pub async fn queue_profile_sync_immediate(&self, profile_id: String) {
+    self.queue_profile_sync_internal(profile_id).await;
+  }
+
+  async fn queue_profile_sync_internal(&self, profile_id: String) {
+    let is_running = self.is_profile_running(&profile_id).await;
+    let mut pending = self.pending_profiles.lock().await;
+
+    if is_running {
+      // Profile is running - queue for after it stops
+      pending.insert(
+        profile_id.clone(),
+        ProfileStopTime {
+          stopped_at: Instant::now(),
+          queued: true,
+        },
+      );
+      log::debug!(
+        "Profile {} is running, queued sync for after stop",
+        profile_id
+      );
+    } else {
+      // Profile is not running - sync immediately (set stopped_at to past)
+      pending.insert(
+        profile_id.clone(),
+        ProfileStopTime {
+          stopped_at: Instant::now() - Duration::from_secs(3),
+          queued: true,
+        },
+      );
+      log::debug!("Profile {} queued for immediate sync", profile_id);
+    }
+  }
+
+  pub async fn queue_proxy_sync(&self, proxy_id: String) {
+    let mut pending = self.pending_proxies.lock().await;
+    pending.insert(proxy_id);
+  }
+
+  pub async fn queue_group_sync(&self, group_id: String) {
+    let mut pending = self.pending_groups.lock().await;
+    pending.insert(group_id);
+  }
+
+  pub async fn queue_tombstone(&self, entity_type: String, entity_id: String) {
+    let mut pending = self.pending_tombstones.lock().await;
+    if !pending
+      .iter()
+      .any(|(t, i)| t == &entity_type && i == &entity_id)
+    {
+      pending.push((entity_type, entity_id));
+    }
+  }
+
+  pub async fn sync_all_enabled_profiles(&self, app_handle: &tauri::AppHandle) {
+    log::info!("Starting initial sync for all enabled profiles...");
+
+    let profiles = {
+      let profile_manager = ProfileManager::instance();
+      match profile_manager.list_profiles() {
+        Ok(p) => p,
+        Err(e) => {
+          log::error!("Failed to list profiles for initial sync: {e}");
+          return;
+        }
+      }
+    };
+
+    let sync_enabled_profiles: Vec<_> = profiles.into_iter().filter(|p| p.sync_enabled).collect();
+
+    if sync_enabled_profiles.is_empty() {
+      log::debug!("No sync-enabled profiles found");
+      return;
+    }
+
+    log::info!(
+      "Found {} sync-enabled profiles, queueing for sync",
+      sync_enabled_profiles.len()
+    );
+
+    for profile in sync_enabled_profiles {
+      let profile_id = profile.id.to_string();
+      let is_running = profile.process_id.is_some();
+
+      // Emit initial status
+      let _ = app_handle.emit(
+        "profile-sync-status",
+        serde_json::json!({
+          "profile_id": profile_id,
+          "status": if is_running { "waiting" } else { "syncing" }
+        }),
+      );
+
+      // Queue for immediate sync (or wait if running)
+      self.queue_profile_sync_immediate(profile_id).await;
+    }
+  }
+
+  pub async fn start(
+    self: Arc<Self>,
+    app_handle: tauri::AppHandle,
+    mut work_rx: mpsc::UnboundedReceiver<SyncWorkItem>,
+  ) {
+    if self.running.swap(true, Ordering::SeqCst) {
+      return;
+    }
+
+    let scheduler = self.clone();
+    let app_handle_clone = app_handle.clone();
+
+    tokio::spawn(async move {
+      while scheduler.running.load(Ordering::SeqCst) {
+        tokio::select! {
+          Some(work_item) = work_rx.recv() => {
+            match work_item {
+              SyncWorkItem::Profile(id) => scheduler.queue_profile_sync(id).await,
+              SyncWorkItem::Proxy(id) => scheduler.queue_proxy_sync(id).await,
+              SyncWorkItem::Group(id) => scheduler.queue_group_sync(id).await,
+              SyncWorkItem::Tombstone(entity_type, entity_id) => {
+                scheduler.queue_tombstone(entity_type, entity_id).await
+              }
+            }
+          }
+          _ = sleep(Duration::from_millis(500)) => {
+            scheduler.process_pending(&app_handle_clone).await;
+          }
+        }
+      }
+
+      log::info!("Sync scheduler stopped");
+    });
+  }
+
+  async fn process_pending(&self, app_handle: &tauri::AppHandle) {
+    self.process_pending_profiles(app_handle).await;
+    self.process_pending_proxies(app_handle).await;
+    self.process_pending_groups(app_handle).await;
+    self.process_pending_tombstones(app_handle).await;
+  }
+
+  async fn process_pending_profiles(&self, app_handle: &tauri::AppHandle) {
+    let profiles_to_sync: Vec<String> = {
+      let mut pending = self.pending_profiles.lock().await;
+      let running = self.running_profiles.lock().await;
+      let in_flight = self.in_flight_profiles.lock().await;
+
+      // Sync immediately if not running and not in-flight (no delay check)
+      let ready: Vec<String> = pending
+        .iter()
+        .filter(|(id, stop_time)| {
+          !running.contains(*id) && !in_flight.contains(*id) && stop_time.queued
+        })
+        .map(|(id, _)| id.clone())
+        .collect();
+
+      for id in &ready {
+        pending.remove(id);
+      }
+
+      ready
+    };
+
+    for profile_id in profiles_to_sync {
+      // Mark as in-flight to prevent duplicate syncs
+      {
+        let mut in_flight = self.in_flight_profiles.lock().await;
+        if in_flight.contains(&profile_id) {
+          log::debug!("Profile {} already in-flight, skipping", profile_id);
+          continue;
+        }
+        in_flight.insert(profile_id.clone());
+      }
+
+      log::info!("Executing queued sync for profile {}", profile_id);
+      let _ = app_handle.emit(
+        "profile-sync-status",
+        serde_json::json!({
+          "profile_id": profile_id,
+          "status": "syncing"
+        }),
+      );
+
+      let profile_to_sync = {
+        let profile_manager = ProfileManager::instance();
+        profile_manager.list_profiles().ok().and_then(|profiles| {
+          profiles
+            .into_iter()
+            .find(|p| p.id.to_string() == profile_id && p.sync_enabled)
+        })
+      };
+
+      let Some(profile) = profile_to_sync else {
+        // Remove from in-flight
+        let mut in_flight = self.in_flight_profiles.lock().await;
+        in_flight.remove(&profile_id);
+        continue;
+      };
+
+      let result = match SyncEngine::create_from_settings(app_handle).await {
+        Ok(engine) => engine.sync_profile(app_handle, &profile).await,
+        Err(e) => {
+          log::error!("Failed to create sync engine: {}", e);
+          Err(super::types::SyncError::NotConfigured)
+        }
+      };
+
+      // Remove from in-flight and check if sync just completed
+      let sync_just_completed = {
+        let mut in_flight = self.in_flight_profiles.lock().await;
+        in_flight.remove(&profile_id);
+        // If this was the last in-flight profile and there are no pending profiles, sync just completed
+        in_flight.is_empty()
+          && self.pending_profiles.lock().await.is_empty()
+          && self.pending_proxies.lock().await.is_empty()
+          && self.pending_groups.lock().await.is_empty()
+      };
+
+      match result {
+        Ok(()) => {
+          log::info!("Profile {} synced successfully", profile_id);
+          let _ = app_handle.emit(
+            "profile-sync-status",
+            serde_json::json!({
+              "profile_id": profile_id,
+              "status": "synced"
+            }),
+          );
+        }
+        Err(e) => {
+          log::error!("Failed to sync profile {}: {}", profile_id, e);
+          let _ = app_handle.emit(
+            "profile-sync-status",
+            serde_json::json!({
+              "profile_id": profile_id,
+              "status": "error",
+              "error": e.to_string()
+            }),
+          );
+        }
+      }
+
+      // Trigger cleanup after sync completes if this was the last profile
+      if sync_just_completed {
+        log::debug!("All profile syncs completed, triggering cleanup");
+        let registry = crate::downloaded_browsers_registry::DownloadedBrowsersRegistry::instance();
+        if let Err(e) = registry.cleanup_unused_binaries() {
+          log::warn!("Cleanup after sync failed: {e}");
+        } else {
+          log::debug!("Cleanup after sync completed successfully");
+        }
+      }
+    }
+  }
+
+  async fn process_pending_proxies(&self, app_handle: &tauri::AppHandle) {
+    let proxies_to_sync: Vec<String> = {
+      let mut pending = self.pending_proxies.lock().await;
+      let list: Vec<String> = pending.drain().collect();
+      list
+    };
+
+    if proxies_to_sync.is_empty() {
+      return;
+    }
+
+    match SyncEngine::create_from_settings(app_handle).await {
+      Ok(engine) => {
+        for proxy_id in proxies_to_sync {
+          log::info!("Syncing proxy {}", proxy_id);
+          let _ = app_handle.emit(
+            "proxy-sync-status",
+            serde_json::json!({
+              "id": proxy_id,
+              "status": "syncing"
+            }),
+          );
+          match engine
+            .sync_proxy_by_id_with_handle(&proxy_id, app_handle)
+            .await
+          {
+            Ok(()) => {
+              let _ = app_handle.emit(
+                "proxy-sync-status",
+                serde_json::json!({
+                  "id": proxy_id,
+                  "status": "synced"
+                }),
+              );
+            }
+            Err(e) => {
+              log::error!("Failed to sync proxy {}: {}", proxy_id, e);
+              let _ = app_handle.emit(
+                "proxy-sync-status",
+                serde_json::json!({
+                  "id": proxy_id,
+                  "status": "error"
+                }),
+              );
+            }
+          }
+        }
+
+        // Check if all sync work is complete after proxies finish
+        if !self.is_sync_in_progress().await {
+          log::debug!("All syncs completed after proxy sync, triggering cleanup");
+          let registry =
+            crate::downloaded_browsers_registry::DownloadedBrowsersRegistry::instance();
+          if let Err(e) = registry.cleanup_unused_binaries() {
+            log::warn!("Cleanup after sync failed: {e}");
+          } else {
+            log::debug!("Cleanup after sync completed successfully");
+          }
+        }
+      }
+      Err(e) => {
+        log::error!("Failed to create sync engine: {}", e);
+      }
+    }
+  }
+
+  async fn process_pending_groups(&self, app_handle: &tauri::AppHandle) {
+    let groups_to_sync: Vec<String> = {
+      let mut pending = self.pending_groups.lock().await;
+      let list: Vec<String> = pending.drain().collect();
+      list
+    };
+
+    if groups_to_sync.is_empty() {
+      return;
+    }
+
+    match SyncEngine::create_from_settings(app_handle).await {
+      Ok(engine) => {
+        for group_id in groups_to_sync {
+          log::info!("Syncing group {}", group_id);
+          let _ = app_handle.emit(
+            "group-sync-status",
+            serde_json::json!({
+              "id": group_id,
+              "status": "syncing"
+            }),
+          );
+          match engine
+            .sync_group_by_id_with_handle(&group_id, app_handle)
+            .await
+          {
+            Ok(()) => {
+              let _ = app_handle.emit(
+                "group-sync-status",
+                serde_json::json!({
+                  "id": group_id,
+                  "status": "synced"
+                }),
+              );
+            }
+            Err(e) => {
+              log::error!("Failed to sync group {}: {}", group_id, e);
+              let _ = app_handle.emit(
+                "group-sync-status",
+                serde_json::json!({
+                  "id": group_id,
+                  "status": "error"
+                }),
+              );
+            }
+          }
+        }
+
+        // Check if all sync work is complete after groups finish
+        if !self.is_sync_in_progress().await {
+          log::debug!("All syncs completed after group sync, triggering cleanup");
+          let registry =
+            crate::downloaded_browsers_registry::DownloadedBrowsersRegistry::instance();
+          if let Err(e) = registry.cleanup_unused_binaries() {
+            log::warn!("Cleanup after sync failed: {e}");
+          } else {
+            log::debug!("Cleanup after sync completed successfully");
+          }
+        }
+      }
+      Err(e) => {
+        log::error!("Failed to create sync engine: {}", e);
+      }
+    }
+  }
+
+  async fn process_pending_tombstones(&self, app_handle: &tauri::AppHandle) {
+    let tombstones: Vec<(String, String)> = {
+      let mut pending = self.pending_tombstones.lock().await;
+      std::mem::take(&mut *pending)
+    };
+
+    if tombstones.is_empty() {
+      return;
+    }
+
+    for (entity_type, entity_id) in tombstones {
+      log::info!("Processing tombstone for {} {}", entity_type, entity_id);
+      match entity_type.as_str() {
+        "profile" => {
+          let exists_locally = {
+            let profile_manager = ProfileManager::instance();
+            if let Ok(profiles) = profile_manager.list_profiles() {
+              let profile_uuid = uuid::Uuid::parse_str(&entity_id).ok();
+              profile_uuid
+                .as_ref()
+                .map(|uuid| profiles.iter().any(|p| p.id == *uuid))
+                .unwrap_or(false)
+            } else {
+              false
+            }
+          };
+
+          if exists_locally {
+            // Profile exists locally but was deleted remotely - delete locally
+            log::info!(
+              "Profile {} exists locally, deleting due to remote tombstone",
+              entity_id
+            );
+            // Note: We don't actually delete here to avoid data loss.
+            // The user should be notified or we could add a confirmation step.
+            // For now, just log it.
+          } else {
+            // Profile doesn't exist locally - check if it still exists remotely
+            // (tombstone might have been created but profile files still exist)
+            // Try to download it
+            match SyncEngine::create_from_settings(app_handle).await {
+              Ok(engine) => {
+                if let Ok(true) = engine
+                  .download_profile_if_missing(app_handle, &entity_id)
+                  .await
+                {
+                  log::info!(
+                    "Downloaded missing profile {} from remote storage",
+                    entity_id
+                  );
+                }
+              }
+              Err(e) => {
+                log::debug!("Sync not configured, skipping profile download: {}", e);
+              }
+            }
+          }
+        }
+        "proxy" => {
+          log::debug!(
+            "Proxy tombstone for {} - local deletion not implemented",
+            entity_id
+          );
+        }
+        "group" => {
+          log::debug!(
+            "Group tombstone for {} - local deletion not implemented",
+            entity_id
+          );
+        }
+        _ => {}
+      }
+    }
+  }
+}

src-tauri/src/sync/subscription.rs

@@ -0,0 +1,310 @@
+use crate::settings_manager::SettingsManager;
+use reqwest::Client;
+use serde::Deserialize;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Arc;
+use std::time::Duration;
+use tauri::Emitter;
+use tokio::sync::mpsc;
+use tokio::time::sleep;
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct SubscribeEvent {
+  #[serde(rename = "type")]
+  pub event_type: String,
+  pub key: Option<String>,
+  #[serde(rename = "lastModified")]
+  pub last_modified: Option<String>,
+  pub size: Option<u64>,
+}
+
+#[derive(Debug, Clone)]
+pub enum SyncWorkItem {
+  Profile(String),
+  Proxy(String),
+  Group(String),
+  Tombstone(String, String),
+}
+
+pub struct SyncSubscription {
+  client: Client,
+  base_url: String,
+  token: String,
+  running: Arc<AtomicBool>,
+  work_tx: mpsc::UnboundedSender<SyncWorkItem>,
+}
+
+impl SyncSubscription {
+  pub fn new(
+    base_url: String,
+    token: String,
+    work_tx: mpsc::UnboundedSender<SyncWorkItem>,
+  ) -> Self {
+    Self {
+      client: Client::new(),
+      base_url: base_url.trim_end_matches('/').to_string(),
+      token,
+      running: Arc::new(AtomicBool::new(false)),
+      work_tx,
+    }
+  }
+
+  pub async fn create_from_settings(
+    app_handle: &tauri::AppHandle,
+    work_tx: mpsc::UnboundedSender<SyncWorkItem>,
+  ) -> Result<Option<Self>, String> {
+    let manager = SettingsManager::instance();
+    let settings = manager
+      .load_settings()
+      .map_err(|e| format!("Failed to load settings: {e}"))?;
+
+    let Some(server_url) = settings.sync_server_url else {
+      return Ok(None);
+    };
+
+    let token = manager
+      .get_sync_token(app_handle)
+      .await
+      .map_err(|e| format!("Failed to get sync token: {e}"))?;
+
+    let Some(token) = token else {
+      return Ok(None);
+    };
+
+    Ok(Some(Self::new(server_url, token, work_tx)))
+  }
+
+  pub fn is_running(&self) -> bool {
+    self.running.load(Ordering::SeqCst)
+  }
+
+  pub fn stop(&self) {
+    self.running.store(false, Ordering::SeqCst);
+  }
+
+  pub async fn start(&self, app_handle: tauri::AppHandle) {
+    if self.running.swap(true, Ordering::SeqCst) {
+      return;
+    }
+
+    let running = self.running.clone();
+    let base_url = self.base_url.clone();
+    let token = self.token.clone();
+    let work_tx = self.work_tx.clone();
+    let client = self.client.clone();
+
+    tokio::spawn(async move {
+      while running.load(Ordering::SeqCst) {
+        match Self::connect_and_listen(&client, &base_url, &token, &work_tx, &running, &app_handle)
+          .await
+        {
+          Ok(()) => {
+            log::info!("SSE connection closed gracefully");
+          }
+          Err(e) => {
+            log::warn!("SSE connection error: {e}, reconnecting in 5s");
+            sleep(Duration::from_secs(5)).await;
+          }
+        }
+
+        if running.load(Ordering::SeqCst) {
+          sleep(Duration::from_secs(1)).await;
+        }
+      }
+
+      log::info!("Sync subscription stopped");
+    });
+  }
+
+  async fn connect_and_listen(
+    client: &Client,
+    base_url: &str,
+    token: &str,
+    work_tx: &mpsc::UnboundedSender<SyncWorkItem>,
+    running: &Arc<AtomicBool>,
+    app_handle: &tauri::AppHandle,
+  ) -> Result<(), String> {
+    let url = format!("{base_url}/v1/objects/subscribe");
+
+    let response = client
+      .get(&url)
+      .header("Authorization", format!("Bearer {token}"))
+      .header("Accept", "text/event-stream")
+      .send()
+      .await
+      .map_err(|e| format!("Failed to connect to SSE: {e}"))?;
+
+    if !response.status().is_success() {
+      return Err(format!(
+        "SSE connection failed with status: {}",
+        response.status()
+      ));
+    }
+
+    log::info!("Connected to sync subscription at {url}");
+    let _ = app_handle.emit("sync-subscription-status", "connected");
+
+    let mut buffer = String::new();
+    let mut bytes_stream = response.bytes_stream();
+
+    use futures_util::StreamExt;
+
+    while running.load(Ordering::SeqCst) {
+      match tokio::time::timeout(Duration::from_secs(60), bytes_stream.next()).await {
+        Ok(Some(Ok(bytes))) => {
+          let chunk = String::from_utf8_lossy(&bytes);
+          buffer.push_str(&chunk);
+
+          while let Some(event_end) = buffer.find("\n\n") {
+            let event_str = buffer[..event_end].to_string();
+            buffer = buffer[event_end + 2..].to_string();
+
+            if let Some(event) = Self::parse_sse_event(&event_str) {
+              Self::handle_event(&event, work_tx);
+            }
+          }
+        }
+        Ok(Some(Err(e))) => {
+          return Err(format!("SSE stream error: {e}"));
+        }
+        Ok(None) => {
+          return Ok(());
+        }
+        Err(_) => {
+          log::debug!("SSE timeout, continuing...");
+        }
+      }
+    }
+
+    Ok(())
+  }
+
+  fn parse_sse_event(event_str: &str) -> Option<SubscribeEvent> {
+    let mut data_line = None;
+
+    for line in event_str.lines() {
+      if let Some(data) = line.strip_prefix("data:") {
+        data_line = Some(data.trim());
+      }
+    }
+
+    data_line.and_then(|data| serde_json::from_str(data).ok())
+  }
+
+  fn handle_event(event: &SubscribeEvent, work_tx: &mpsc::UnboundedSender<SyncWorkItem>) {
+    let Some(key) = &event.key else {
+      return;
+    };
+
+    if event.event_type == "ping" {
+      return;
+    }
+
+    let work_item = if key.starts_with("profiles/") {
+      key
+        .strip_prefix("profiles/")
+        .and_then(|s| s.strip_suffix(".tar.gz"))
+        .map(|s| SyncWorkItem::Profile(s.to_string()))
+    } else if key.starts_with("proxies/") {
+      key
+        .strip_prefix("proxies/")
+        .and_then(|s| s.strip_suffix(".json"))
+        .map(|s| SyncWorkItem::Proxy(s.to_string()))
+    } else if key.starts_with("groups/") {
+      key
+        .strip_prefix("groups/")
+        .and_then(|s| s.strip_suffix(".json"))
+        .map(|s| SyncWorkItem::Group(s.to_string()))
+    } else if key.starts_with("tombstones/") {
+      key.strip_prefix("tombstones/").and_then(|rest| {
+        if rest.starts_with("profiles/") {
+          rest
+            .strip_prefix("profiles/")
+            .and_then(|s| s.strip_suffix(".json"))
+            .map(|id| SyncWorkItem::Tombstone("profile".to_string(), id.to_string()))
+        } else if rest.starts_with("proxies/") {
+          rest
+            .strip_prefix("proxies/")
+            .and_then(|s| s.strip_suffix(".json"))
+            .map(|id| SyncWorkItem::Tombstone("proxy".to_string(), id.to_string()))
+        } else if rest.starts_with("groups/") {
+          rest
+            .strip_prefix("groups/")
+            .and_then(|s| s.strip_suffix(".json"))
+            .map(|id| SyncWorkItem::Tombstone("group".to_string(), id.to_string()))
+        } else {
+          None
+        }
+      })
+    } else {
+      None
+    };
+
+    if let Some(item) = work_item {
+      log::debug!("Queueing sync work: {:?}", item);
+      let _ = work_tx.send(item);
+    }
+  }
+}
+
+pub struct SubscriptionManager {
+  subscription: Option<SyncSubscription>,
+  work_tx: mpsc::UnboundedSender<SyncWorkItem>,
+  work_rx: Option<mpsc::UnboundedReceiver<SyncWorkItem>>,
+}
+
+impl Default for SubscriptionManager {
+  fn default() -> Self {
+    Self::new()
+  }
+}
+
+impl SubscriptionManager {
+  pub fn new() -> Self {
+    let (work_tx, work_rx) = mpsc::unbounded_channel();
+    Self {
+      subscription: None,
+      work_tx,
+      work_rx: Some(work_rx),
+    }
+  }
+
+  pub fn get_work_sender(&self) -> mpsc::UnboundedSender<SyncWorkItem> {
+    self.work_tx.clone()
+  }
+
+  pub fn take_work_receiver(&mut self) -> Option<mpsc::UnboundedReceiver<SyncWorkItem>> {
+    self.work_rx.take()
+  }
+
+  pub async fn start(&mut self, app_handle: tauri::AppHandle) -> Result<(), String> {
+    if self.subscription.is_some() {
+      return Ok(());
+    }
+
+    let subscription =
+      SyncSubscription::create_from_settings(&app_handle, self.work_tx.clone()).await?;
+
+    if let Some(sub) = subscription {
+      sub.start(app_handle).await;
+      self.subscription = Some(sub);
+      log::info!("Sync subscription manager started");
+    } else {
+      log::debug!("Sync not configured, subscription not started");
+    }
+
+    Ok(())
+  }
+
+  pub fn stop(&mut self) {
+    if let Some(sub) = &self.subscription {
+      sub.stop();
+    }
+    self.subscription = None;
+    log::info!("Sync subscription manager stopped");
+  }
+
+  pub fn is_running(&self) -> bool {
+    self.subscription.as_ref().is_some_and(|s| s.is_running())
+  }
+}

src-tauri/src/sync/types.rs

@@ -0,0 +1,187 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct StatRequest {
+  pub key: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct StatResponse {
+  pub exists: bool,
+  #[serde(rename = "lastModified")]
+  pub last_modified: Option<String>,
+  pub size: Option<u64>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PresignUploadRequest {
+  pub key: String,
+  #[serde(rename = "contentType")]
+  pub content_type: Option<String>,
+  #[serde(rename = "expiresIn")]
+  pub expires_in: Option<u64>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PresignUploadResponse {
+  pub url: String,
+  #[serde(rename = "expiresAt")]
+  pub expires_at: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PresignDownloadRequest {
+  pub key: String,
+  #[serde(rename = "expiresIn")]
+  pub expires_in: Option<u64>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PresignDownloadResponse {
+  pub url: String,
+  #[serde(rename = "expiresAt")]
+  pub expires_at: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DeleteRequest {
+  pub key: String,
+  #[serde(rename = "tombstoneKey")]
+  pub tombstone_key: Option<String>,
+  #[serde(rename = "deletedAt")]
+  pub deleted_at: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DeleteResponse {
+  pub deleted: bool,
+  #[serde(rename = "tombstoneCreated")]
+  pub tombstone_created: bool,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ListRequest {
+  pub prefix: String,
+  #[serde(rename = "maxKeys")]
+  pub max_keys: Option<u32>,
+  #[serde(rename = "continuationToken")]
+  pub continuation_token: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ListObject {
+  pub key: String,
+  #[serde(rename = "lastModified")]
+  pub last_modified: String,
+  pub size: u64,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ListResponse {
+  pub objects: Vec<ListObject>,
+  #[serde(rename = "isTruncated")]
+  pub is_truncated: bool,
+  #[serde(rename = "nextContinuationToken")]
+  pub next_continuation_token: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Tombstone {
+  pub id: String,
+  pub deleted_at: String,
+}
+
+// Batch presign types
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PresignUploadBatchItem {
+  pub key: String,
+  #[serde(rename = "contentType")]
+  pub content_type: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PresignUploadBatchRequest {
+  pub items: Vec<PresignUploadBatchItem>,
+  #[serde(rename = "expiresIn")]
+  pub expires_in: Option<u64>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PresignUploadBatchItemResponse {
+  pub key: String,
+  pub url: String,
+  #[serde(rename = "expiresAt")]
+  pub expires_at: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PresignUploadBatchResponse {
+  pub items: Vec<PresignUploadBatchItemResponse>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PresignDownloadBatchRequest {
+  pub keys: Vec<String>,
+  #[serde(rename = "expiresIn")]
+  pub expires_in: Option<u64>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PresignDownloadBatchItemResponse {
+  pub key: String,
+  pub url: String,
+  #[serde(rename = "expiresAt")]
+  pub expires_at: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PresignDownloadBatchResponse {
+  pub items: Vec<PresignDownloadBatchItemResponse>,
+}
+
+// Delete prefix types
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DeletePrefixRequest {
+  pub prefix: String,
+  #[serde(rename = "tombstoneKey")]
+  pub tombstone_key: Option<String>,
+  #[serde(rename = "deletedAt")]
+  pub deleted_at: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DeletePrefixResponse {
+  #[serde(rename = "deletedCount")]
+  pub deleted_count: u32,
+  #[serde(rename = "tombstoneCreated")]
+  pub tombstone_created: bool,
+}
+
+#[derive(Debug)]
+pub enum SyncError {
+  NotConfigured,
+  NetworkError(String),
+  AuthError(String),
+  IoError(String),
+  SerializationError(String),
+  ConflictError(String),
+  InvalidData(String),
+}
+
+impl std::fmt::Display for SyncError {
+  fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+    match self {
+      SyncError::NotConfigured => write!(f, "Sync not configured"),
+      SyncError::NetworkError(msg) => write!(f, "Network error: {msg}"),
+      SyncError::AuthError(msg) => write!(f, "Authentication error: {msg}"),
+      SyncError::IoError(msg) => write!(f, "IO error: {msg}"),
+      SyncError::SerializationError(msg) => write!(f, "Serialization error: {msg}"),
+      SyncError::ConflictError(msg) => write!(f, "Conflict error: {msg}"),
+      SyncError::InvalidData(msg) => write!(f, "Invalid data: {msg}"),
+    }
+  }
+}
+
+impl std::error::Error for SyncError {}
+
+pub type SyncResult<T> = Result<T, SyncError>;