rbox
Dropbox for devs. Continuous, end-to-end-encrypted, dev-aware sync of your working directories across machines. Source, configs, and uncommitted git state move; node_modules, build output, and secrets stay local. Files are encrypted under keys only you hold; rbox's servers store ciphertext, with no escrow.
Built on Cloudflare (Workers + D1 + R2 + Durable Objects) with a Bun/TypeScript client. rbox treats regenerable build output and secrets as local state.
Agent-developed project. rbox is designed and built almost entirely by
AI coding agents (Claude, Codex, and others) working from design docs under
docs/design/, with a human founder setting direction,
reviewing, and approving releases. Expect agent-oriented artifacts
throughout: AGENTS.md, CLAUDE.md, CONTEXT.md, docs/STATUS.md,
review transcripts, and commit messages written for an agent audience.
The code ships to real users, but read it with that provenance in mind.
Install
curl -fsSL https://rbox.to/install.sh | sh
macOS (Apple Silicon) and Linux (x64/arm64). The installer downloads the prebuilt CLI to ~/.rbox/bin and adds it to your PATH.
Quickstart
rbox setup
rbox setup is the guided wizard: it signs this machine in (or creates an account), sets up encryption on the first machine, creates or joins a workspace, and offers to start background sync. Bare rbox (no args) opens the same menu.
A synced folder can be a single repository or a folder of many repositories, or just a folder — it's whatever directory rbox keeps in sync across your machines. Which folders this machine syncs, and with what options, is listed in ~/.rbox/config.json; run rbox config to see it.
Prefer flags for CI/scripting? rbox init is the headless form of setup (see docs/usage.md).
Add a second machine
On a machine you're already set up on:
rbox pair # prints a short-lived command; press c to copy it
On the new machine, paste the command it gives you:
rbox connect <pairing-token>
That enrolls the new machine for encryption in two steps — no re-typing your recovery phrase. (The classic device-code path, rbox login then approve it from another device, still works too.)
Lost every machine? Re-enroll from your 24-word recovery phrase with rbox recover.
Agent / CI sync (beta)
Create an expiring agent key on a trusted, already-enrolled machine:
rbox key create-ci --expires 7d
Put the printed RBOX_KEY in your CI or agent secret store, then bootstrap an
ephemeral machine without a browser:
export RBOX_KEY='...'
curl -fsSL https://rbox.to/agent.sh | sh -s -- --workspace <workspace> --pull-only
RBOX_KEY carries account decryption authority in this beta, so keep expiries
short and store it only where you would store a root-equivalent CI secret.
What it does
- Continuous sync. A per-workspace daemon (
rbox start) watches for changes, debounces, and prunes ignored trees so an npm ci or a giant clone never pegs your machine. rbox status avoids a network round-trip when the local daemon is live and attributable to the current workspace.
- End-to-end encryption. Full E2EE is the only mode — filenames and contents are encrypted client-side. See
/security.
- Dev-aware ignores. The builtin ignore layer is always enabled, filtering
node_modules, common build caches, and secrets such as .env by default. Interactive wizards also respect .gitignore by default; .rboxignore supplies shared fleet rules, while folder-config ignorePaths supplies machine-local exclusions. A later ! rule in .rboxignore can re-include a specific file (for example !.env), or you can opt into syncing Git-ignored files too — still end-to-end encrypted, though large ignored builds and datasets come along as well.
- Syncs uncommitted git state safely. Index, HEAD, your most recent stash, and rebase state ride along via
git bundle (never a torn copy of a live .git). On by default; --git false opts out per machine.
- Secrets stay put.
.env, *.pem, and keys are ignored by default.
- Version history & restore.
rbox versions / rbox restore <path>@<seq> on paid plans.
- Local trash tier. Destructive pulls move files to a recoverable local trash (
rbox trash list|restore|empty) instead of deleting outright.
- Autostart.
rbox autostart enable resumes background sync after a reboot or re-login.
- Local export.
rbox export decrypts workspaces locally and writes a directory or .tar.gz.
- One readable config file.
~/.rbox/config.json is the authority for which folders this machine syncs and their options — inspect it with rbox config, edit it by hand, or repair it with rbox config add|regenerate|repair.
Run rbox help for the full command list, or docs/usage.md for the narrative guide.
Plans
| Plan | Price | Storage | Workspaces | Version history |
|---|
| Solo | $8/mo or $80/yr | 50 GiB | ∞ | 30 days |
| Pro | $20/mo or $200/yr | 250 GiB | ∞ | 365 days |
| Team* | not yet purchasable | 150 GiB/seat | ∞ | 90 days |
Solo and Pro include a 14-day card-upfront trial; annual billing is two months free.
* Team is listed but not purchasable. Details and per-plan specifics: docs/pricing.md.
Architecture
src/engine/ pure sync core — manifests, reconcile, apply, hashing, ignore,
git-state capture, convergent crypto, project detection
src/cli/ client — daemon, watcher, sync (push/pull/conflict-retry),
auth, setup wizard, remote client
apps/api/ Cloudflare Worker control plane — blobs (R2), manifests + the
WorkspaceSync Durable Object (per-(ws,proj) commit sequencer +
hibernating-WebSocket fanout), D1 (auth/accounts/quota), GC
apps/web/ dashboard (app.rbox.to)
The blob layer is content-addressed: a file's identity is sha256(bytes), so dedup, integrity, and GC fall out for free. Commits are sequenced by the Durable Object with optimistic concurrency — a stale parent gets a 409 and the client pulls, re-scans, and retries.
Deployment
Two independent pipelines — don't conflate them:
- API (
apps/api) → dev on merge to main, prod only on an explicit promotion. A merge to main auto-deploys the dev Worker (rbox-dev-api) through the Cloudflare Workers Builds git integration. Production (rbox-prod-api, serving api.rbox.to) ships only when someone fast-forwards the production branch (git push origin main:production), which runs the test-gated .github/workflows/deploy-api.yml: typecheck + API tests, then D1 migrations, then deploy. The production Workers Builds integration is deliberately disconnected so a promotion cannot race it. Each prod deploy restarts the WorkspaceSync Durable Object, so any DO change (or bug) is live on the next promotion — and a restart mid-commit must be safe. That is exactly what design 91 guarantees: the head is DO-authoritative and fail-closed, so a restart can never regress it (worst case it serves repair_required, never a silent fork). The dev Worker has its own D1/R2 and a separate WorkspaceSync namespace; keep RBOX_API pointed at prod for any real workspace — the two namespaces do not share a head. Canonical detail: docs/DEPLOYMENTS.md.
- CLI binaries → R2 on
v* tag. The rbox binaries are a separate GitHub Actions pipeline (.github/workflows/release.yml) triggered by pushing a v* tag; it signs the version manifest and publishes to the rbox-releases bucket, which rbox upgrade verifies. See docs/cicd-release-setup.md.
Docs
