@brutalsystems/muster 0.7.11 → 0.7.14

package/dist/identity/processes.js

@@ -16,8 +16,8 @@
  *    on every transaction, so a process that died while Muster was not running
  *    is reported as dead rather than trusted from what was recorded.
  *
- * Membership is derived from the parent chain and inherits its one real limit:
- * a reparented child is unreachable from the root. See issue #24.
+ * Membership is the union of the parent chain and the process group the root
+ * leads, because a reparented child leaves the chain but keeps its group.
  */
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -41,8 +41,41 @@ export async function processRef(pid) {
 export async function isSame(ref) {
     return (await processRef(ref.pid))?.start === ref.start;
 }
-export async function descendants(root, deadline = Date.now() + 1000) {
-    const rows = (await command("ps", ["-axo", "pid=,ppid="], Math.max(1, Math.min(1000, deadline - Date.now()))))
+/**
+ * The process group a pid leads, or undefined if it leads none.
+ *
+ * Only a leader's group is safe to treat as membership: the group then exists
+ * because this process was started, so everything in it descends from that
+ * start. A process that merely belongs to someone else's group shares it with
+ * whatever else is there — a shell, a tmux pane, the terminal — and sweeping
+ * that would reach far outside the session.
+ *
+ * Both terminal hosts start their root in a new session, so in practice the
+ * launched root does lead its own group.
+ */
+export async function ownedGroup(pid) {
+    try {
+        const pgid = Number((await command("ps", ["-p", String(pid), "-o", "pgid="])).trim());
+        return pgid === pid ? pgid : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Membership by two signals, because neither is sufficient alone.
+ *
+ * The parent chain is exact while it holds, and it stops holding the moment an
+ * intermediate process exits: the children reparent to launchd and are no
+ * longer reachable from the root, though they are still running the session's
+ * work. The process group survives that — reparenting changes no pid's group —
+ * but is only meaningful for a group the root leads, and is escapable by a
+ * process that calls setsid() for itself.
+ *
+ * So: union them. What the chain loses to reparenting, the group usually keeps.
+ */
+export async function descendants(root, deadline = Date.now() + 1000, group) {
+    const rows = (await command("ps", ["-axo", "pid=,ppid=,pgid="], Math.max(1, Math.min(1000, deadline - Date.now()))))
         .split("\n")
         .map((l) => l.trim().split(/\s+/).map(Number));
     const found = new Set([root]);
@@ -54,10 +87,26 @@ export async function descendants(root, deadline = Date.now() + 1000) {
                 changed = true;
             }
     }
+    if (group)
+        for (const [pid, , pgid] of rows)
+            if (pid && pid > 1 && pgid === group)
+                found.add(pid);
     return [...found];
 }
-async function liveTree(root) {
-    return (await Promise.all((await descendants(root)).map(processRef))).filter((r) => !!r);
+/** Whether anything still runs in a group we started. */
+export async function groupAlive(group, deadline = Date.now() + 1000) {
+    try {
+        const rows = (await command("ps", ["-axo", "pid=,pgid="], Math.max(1, Math.min(1000, deadline - Date.now()))))
+            .split("\n")
+            .map((l) => l.trim().split(/\s+/).map(Number));
+        return rows.some(([pid, pgid]) => pid && pid > 1 && pgid === group);
+    }
+    catch {
+        return false;
+    }
+}
+async function liveTree(root, group) {
+    return (await Promise.all((await descendants(root, Date.now() + 1000, group)).map(processRef))).filter((r) => !!r);
 }
 function signal(ref, name) {
     try {
@@ -74,11 +123,10 @@ function signal(ref, name) {
  * every signal, because a pid that exits between discovery and the signal may
  * already belong to something else.
  *
- * Reparented descendants are a separate gap: once an intermediate process dies,
- * its children leave the parent chain entirely and no re-read will find them.
- * That needs a membership signal the chain does not provide (see issue #24).
+ * Reparented descendants are reachable only through the process group, so pass
+ * one when the caller has recorded it; the parent chain alone cannot see them.
  */
-export async function stopTree(ref) {
+export async function stopTree(ref, group) {
     if (!(await isSame(ref)))
         return;
     const known = new Map();
@@ -94,12 +142,12 @@ export async function stopTree(ref) {
         return added;
     };
     const deepestFirst = () => [...known.values()].reverse();
-    remember(await liveTree(ref.pid));
+    remember(await liveTree(ref.pid, group));
     for (const r of deepestFirst())
         if (await isSame(r))
             signal(r, "SIGTERM");
     await delay(150);
-    const late = (await isSame(ref)) ? remember(await liveTree(ref.pid)) : [];
+    const late = remember((await isSame(ref)) || group ? await liveTree(ref.pid, group) : []);
     if (late.length) {
         for (const r of late.reverse())
             if (await isSame(r))

package/dist/identity-auth.js

@@ -0,0 +1,66 @@
+import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { identityPath } from "./identity-store.js";
+const run = promisify(execFile);
+/**
+ * Claude Code stores its credential in the macOS keychain under a service name
+ * derived from the configuration directory's PATH, which is why a copied
+ * directory cannot authenticate: it hashes to a name that does not exist.
+ */
+export function claudeKeychainService(configDir) {
+    return ("Claude Code-credentials-" +
+        createHash("sha256").update(configDir).digest("hex").slice(0, 8));
+}
+async function keychainHas(service) {
+    try {
+        await run("security", ["find-generic-password", "-s", service]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function readsAsJson(file) {
+    try {
+        JSON.parse(await readFile(file, "utf8"));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function identityAuthState(home, name, meta, env, probe = keychainHas) {
+    const dir = identityPath(home, name);
+    const no = (detail) => ({ state: "not-configured", detail });
+    const yes = (detail) => ({ state: "configured", detail });
+    if (meta.agent === "claude") {
+        if (meta.token_env)
+            return env[meta.token_env]
+                ? yes(`token variable ${meta.token_env} is set`)
+                : no(`token variable ${meta.token_env} is not set`);
+        // A keychain item for the TEMPLATE's path proves the template is usable
+        // where it sits, and nothing more. A launch never points Claude at the
+        // template: it copies it, and the copy's path hashes to a DIFFERENT service
+        // name with no fallback (see claudeKeychainService above). So the keychain
+        // route cannot produce a launch, and reporting "configured" for it would
+        // promise one that dies at its deadline. `token_env` is the only route a
+        // Claude identity can launch under, so its absence is not-configured
+        // regardless of what the keychain holds.
+        return no((await probe(claudeKeychainService(dir)))
+            ? "a keychain item exists for this identity's template path, but a launch runs from a copy whose path hashes to a different service name — mint a token with `claude setup-token` and name the variable with --token-env"
+            : "no credential for a launch — mint a token with `claude setup-token` and name the variable with --token-env");
+    }
+    // Codex keeps a flat JSON auth file. OpenCode splits config from data: its
+    // auth file lives under a data root the binary itself always suffixes with
+    // "opencode" (join(XDG_DATA_HOME, "opencode", "auth.json") — confirmed
+    // against the installed 1.18.32 binary and the real ~/.local/share/opencode
+    // layout; see identity-copy.ts and task-4-report.md). The identity template
+    // mirrors that shape under data/opencode/auth.json.
+    const file = meta.agent === "opencode" ? join("data", "opencode", "auth.json") : "auth.json";
+    return (await readsAsJson(join(dir, file)))
+        ? yes(`${file} is present`)
+        : no(`${file} is missing or unreadable — log in for this identity`);
+}

package/dist/identity-cli.js

@@ -0,0 +1,88 @@
+import { identityAuthState } from "./identity-auth.js";
+import { IdentityError, identityDirExists, identityMetaSchema, identityNameSchema, identityPath, listIdentities, readIdentity, writeIdentity, } from "./identity-store.js";
+/**
+ * The one-time login for each agent. Muster never performs it: each is an
+ * interactive OAuth flow, and a command that appeared to do it for you would be
+ * hiding a credential prompt.
+ */
+function loginCommand(agent, dir) {
+    if (agent === "claude")
+        // setup-token first, and not as an alternative: a launch runs from a COPY of
+        // this directory, and the keychain credential an interactive /login writes is
+        // keyed to THIS path, so it cannot be reached from a copy. Only a token can.
+        return `CLAUDE_CONFIG_DIR=${dir} claude setup-token    # then export the token and pass --token-env`;
+    if (agent === "codex")
+        return `CODEX_HOME=${dir} codex login`;
+    return `OPENCODE_CONFIG_DIR=${dir} opencode auth login`;
+}
+export async function setupIdentity(opts) {
+    const name = identityNameSchema.parse(opts.name);
+    // token_env is consumed ONLY by identityEnv's Claude branch, and
+    // identityAuthState ignores it for the others — while the launch path refuses
+    // when the named variable is unset. So on a codex or opencode identity it has
+    // exactly one effect: a new way to fail. Refused where the operator types it.
+    if (opts.tokenEnv && opts.agent !== "claude")
+        throw new IdentityError(name, `--token-env applies only to a claude identity; ${opts.agent} authenticates from an auth file in the template, and a token variable here would only add a way for the launch to fail`);
+    // Distinguish "no such identity" from "an identity that is there but unusable".
+    // Overwriting the second would silently repurpose a directory that still holds
+    // another agent's credential.
+    const present = await identityDirExists(opts.home, name);
+    let created = true;
+    let existing;
+    if (present) {
+        created = false;
+        existing = await readIdentity(opts.home, name); // throws if unusable
+        if (existing.agent !== opts.agent)
+            throw new IdentityError(name, `already exists for agent ${existing.agent}; refusing to repurpose it for ${opts.agent}`);
+    }
+    // An operator who passes --token-env means it to take effect, even on an
+    // identity that already has one recorded — that's the whole point of this
+    // command's remedy path (see issue #59). Omitting the flag on a re-run must
+    // leave whatever is recorded alone, which is why this only fires when a
+    // value was actually supplied and it differs from what's already there.
+    const tokenEnvChanged = opts.tokenEnv !== undefined && opts.tokenEnv !== existing?.token_env;
+    const meta = identityMetaSchema.parse({
+        agent: opts.agent,
+        // Preserve the original creation timestamp for an existing identity;
+        // only a brand-new directory gets a fresh one.
+        created: existing?.created ?? new Date().toISOString(),
+        ...(opts.tokenEnv !== undefined
+            ? { token_env: opts.tokenEnv }
+            : existing?.token_env
+                ? { token_env: existing.token_env }
+                : {}),
+    });
+    if (created || tokenEnvChanged)
+        await writeIdentity(opts.home, name, meta);
+    const current = await readIdentity(opts.home, name);
+    const dir = identityPath(opts.home, name);
+    return {
+        created,
+        path: dir,
+        login: loginCommand(current.agent, dir),
+        auth: await identityAuthState(opts.home, name, current, opts.env ?? process.env),
+    };
+}
+export async function describeIdentities(home, env, 
+/** Profile grants, so stale ones surface without a launch having to fail. */
+grants = {}) {
+    const found = await listIdentities(home);
+    const identities = [];
+    for (const { name, meta } of found)
+        identities.push({
+            name,
+            agent: meta.agent,
+            auth: await identityAuthState(home, name, meta, env),
+        });
+    // A profile granting an identity that does not exist is a misconfiguration.
+    // It is deliberately NOT checked in loadConfig: Muster reads its config for
+    // every command, so failing there would stop `list` and `stop` working and
+    // turn a stale grant into a total outage.
+    const names = new Set(found.map((i) => i.name));
+    const staleGrants = [];
+    for (const [profile, granted] of Object.entries(grants))
+        for (const identity of granted)
+            if (!names.has(identity))
+                staleGrants.push({ profile, identity });
+    return { identities, staleGrants };
+}

package/dist/identity-copy.js

@@ -0,0 +1,124 @@
+import { copyFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { identityPath } from "./identity-store.js";
+/**
+ * What a copy must contain: enough to start authenticated, onboarded, and
+ * trusting the launch directory. Deliberately not the template's cache, plugins
+ * or history — copying only this is what keeps retained copies proportional to
+ * the transcripts written into them rather than to the template's size.
+ *
+ * OpenCode entries are settled against the installed 1.18.32 binary, not
+ * guessed (see task-4-report.md for the full evidence trail):
+ *   - CONFIG resolves as `OPENCODE_CONFIG_DIR ?? XDG_CONFIG_HOME/opencode`,
+ *     used as-is with no suffix appended. The real file the binary reads on
+ *     this machine is `opencode.jsonc` (confirmed at ~/.config/opencode —
+ *     `config.json` and `opencode.json` are also checked, in that order, but
+ *     neither exists here; `opencode.jsonc` is the one actually in use).
+ *   - DATA always resolves as `XDG_DATA_HOME/opencode` — the "opencode"
+ *     suffix is hardcoded in the binary and cannot be overridden
+ *     independently (there is no OPENCODE_DATA_DIR). Its auth file is
+ *     `<data>/auth.json`, confirmed against the string join(e.Path.data,
+ *     "auth.json") in the binary and against the real file at
+ *     ~/.local/share/opencode/auth.json on this machine.
+ * So the copy reproduces that shape under a `data/` subdirectory, and
+ * `identityEnv` points XDG_DATA_HOME at it (see below). This was NOT
+ * verified end to end against an authenticated OpenCode identity — no one
+ * has run the one-time login for one on this machine, so there is no
+ * template to copy from and launch. The config/data path resolution above is
+ * verified from the binary's own logic and the real on-disk layout; whether a
+ * copy built this way actually leaves OpenCode believing itself logged in on
+ * first launch is unverified.
+ */
+export const IDENTITY_FILES = {
+    claude: [".claude.json", "settings.json"],
+    codex: ["auth.json", "config.toml"],
+    opencode: ["opencode.jsonc", join("data", "opencode", "auth.json")],
+};
+export const identityLiveDir = (home, launchId) => join(home, "identities-live", launchId);
+export async function copyIdentity(home, name, meta, launchId) {
+    const from = identityPath(home, name);
+    const to = identityLiveDir(home, launchId);
+    await mkdir(to, { recursive: true, mode: 0o700 });
+    for (const file of IDENTITY_FILES[meta.agent]) {
+        const dest = join(to, file);
+        // A declared file may nest inside a subdirectory (opencode's data/opencode/
+        // auth.json) — the destination directory needs to exist before copyFile can
+        // write into it. Not swallowed: if the parent cannot be created, that must
+        // surface rather than leave the file silently absent from the copy.
+        await mkdir(dirname(dest), { recursive: true });
+        try {
+            await copyFile(join(from, file), dest);
+        }
+        catch (e) {
+            // A template legitimately lacks a file until the agent writes one — a new
+            // identity has no settings.json yet. Anything else is a real failure, and
+            // hiding it would launch an agent that cannot authenticate with no signal.
+            if (e.code !== "ENOENT")
+                throw e;
+        }
+    }
+    return to;
+}
+/**
+ * The variables the AGENT receives. Muster's own subprocesses never get these:
+ * a version probe pointed at a per-launch copy answers the wrong question.
+ */
+export function identityEnv(meta, copyPath, sourceEnv) {
+    if (meta.agent === "codex")
+        return { CODEX_HOME: copyPath };
+    if (meta.agent === "opencode")
+        // OPENCODE_CONFIG_DIR replaces the config root outright, so it is set to
+        // copyPath directly. XDG_DATA_HOME is different: the binary hardcodes an
+        // "opencode" suffix onto whatever XDG_DATA_HOME is, so XDG_DATA_HOME must be
+        // set one level ABOVE where the files actually land (copyPath/data, not
+        // copyPath/data/opencode) for that suffix to land back on the copy.
+        return {
+            OPENCODE_CONFIG_DIR: copyPath,
+            XDG_DATA_HOME: join(copyPath, "data"),
+        };
+    const env = { CLAUDE_CONFIG_DIR: copyPath };
+    if (meta.token_env) {
+        const token = sourceEnv[meta.token_env];
+        // Absence is the caller's problem to report before spawning; see run.ts.
+        if (typeof token === "string" && token.length)
+            env.CLAUDE_CODE_OAUTH_TOKEN = token;
+    }
+    return env;
+}
+/**
+ * Set Claude Code's workspace-trust flag for one directory, inside a copy Muster
+ * just created. The live `~/.claude.json` is never touched — that file is written
+ * continuously by every running session, and Muster cannot coordinate with it.
+ */
+export async function setWorkspaceTrust(copyPath, cwd) {
+    const file = join(copyPath, ".claude.json");
+    let data = {};
+    let raw;
+    try {
+        raw = await readFile(file, "utf8");
+    }
+    catch (e) {
+        // The same rule identity-store.ts and copyIdentity settled on: a template
+        // that has never been logged into legitimately has no .claude.json, and a
+        // file containing only `projects` is valid. Anything else — EACCES, EISDIR —
+        // is a real failure, and swallowing it here discarded every onboarding flag
+        // the template's own login produced and wrote a file that had lost them.
+        if (e.code !== "ENOENT")
+            throw e;
+    }
+    if (raw !== undefined)
+        try {
+            data = JSON.parse(raw);
+        }
+        catch (e) {
+            // A file that EXISTS and does not parse is not "no file yet". Overwriting
+            // it would silently drop the copied template's onboarding state and leave
+            // an agent that re-onboards, or does not start at all, with no signal.
+            throw new Error(`${file} exists but is not valid JSON: ${String(e)}`);
+        }
+    const projects = (data.projects ?? {});
+    const existing = (projects[cwd] ?? {});
+    projects[cwd] = { ...existing, hasTrustDialogAccepted: true };
+    data.projects = projects;
+    await writeFile(file, JSON.stringify(data), { mode: 0o600 });
+}

package/dist/identity-store.js

@@ -0,0 +1,101 @@
+import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { z } from "zod";
+/**
+ * A named, pre-authenticated template configuration for one agent.
+ *
+ * The directory is 0700 because a Codex or OpenCode template contains that
+ * account's own auth file — written there by that agent's login, not by Muster,
+ * but on disk under `~/.muster` all the same. Deleting an identity deletes a
+ * credential.
+ */
+export const identityNameSchema = z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[a-zA-Z0-9_-]+$/, "must be letters, digits, dash or underscore");
+export const identityMetaSchema = z
+    .object({
+    agent: z.enum(["codex", "claude", "opencode"]),
+    created: z.string().min(1),
+    /** Name of the variable holding this identity's token. Never the token. */
+    token_env: z.string().min(1).optional(),
+})
+    .strict();
+/** A local problem with an identity: unknown, malformed, or unusable. */
+export class IdentityError extends Error {
+    identity;
+    constructor(identity, message) {
+        super(`identity ${identity}: ${message}`);
+        this.identity = identity;
+        this.name = "IdentityError";
+    }
+}
+export const identitiesDir = (home) => join(home, "identities");
+export const identityPath = (home, name) => {
+    // Wrapped so every identity problem is an IdentityError, as the error model
+    // promises — a raw schema error here would escape that contract and reach a
+    // caller as an unrecognisable shape.
+    const parsed = identityNameSchema.safeParse(name);
+    if (!parsed.success)
+        throw new IdentityError(name, "name must be letters, digits, dash or underscore");
+    return join(identitiesDir(home), parsed.data);
+};
+/** Whether the directory exists, regardless of whether its metadata is usable. */
+export async function identityDirExists(home, name) {
+    const dir = identityPath(home, name); // throws IdentityError for a bad name
+    try {
+        return (await stat(dir)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+export async function writeIdentity(home, name, meta) {
+    const dir = identityPath(home, name);
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    await writeFile(join(dir, "identity.json"), JSON.stringify(identityMetaSchema.parse(meta), null, 2) + "\n", { mode: 0o600 });
+}
+export async function readIdentity(home, name) {
+    const file = join(identityPath(home, name), "identity.json");
+    let raw;
+    try {
+        raw = await readFile(file, "utf8");
+    }
+    catch (e) {
+        const code = e.code;
+        if (code === "ENOENT")
+            throw new IdentityError(name, "not found — create it with setup-identity");
+        throw new IdentityError(name, `metadata could not be read (${code ?? String(e)})`);
+    }
+    try {
+        return identityMetaSchema.parse(JSON.parse(raw));
+    }
+    catch (e) {
+        throw new IdentityError(name, `metadata is unusable (${String(e)})`);
+    }
+}
+export async function listIdentities(home) {
+    let names;
+    try {
+        names = (await readdir(identitiesDir(home), { withFileTypes: true }))
+            .filter((e) => e.isDirectory())
+            .map((e) => e.name)
+            .sort();
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return [];
+        throw e;
+    }
+    const out = [];
+    for (const name of names)
+        try {
+            out.push({ name, meta: await readIdentity(home, name) });
+        }
+        catch {
+            // A directory without usable metadata is not an identity. `identities`
+            // reports store contents, and a half-made directory is not one.
+        }
+    return out;
+}

package/dist/log.js

@@ -1,15 +1,93 @@
-import { mkdir, open } from "node:fs/promises";
+import { mkdir, open, rename, stat } from "node:fs/promises";
 import { join } from "node:path";
+/**
+ * Fields a metadata-only record must not carry: the instruction itself, any
+ * captured screen or output, and anything environment-derived. Enough remains
+ * to diagnose a failed launch without holding what was asked.
+ *
+ * `args` is deliberately NOT dropped: `runtimeArgs` admits only `--model`,
+ * `-m`, `--effort`, `--agent` and `--variant`, so argv cannot carry instruction
+ * text or a credential, and keeping it is worth more for diagnosis than the
+ * nothing it exposes.
+ */
+export const METADATA_DROP = ["prompt", "diagnostic", "output", "env"];
+/**
+ * A nested launch record — a ready session's `peer`, a started task's `run` —
+ * is REBUILT from this allowlist in metadata mode rather than filtered by a
+ * drop list.
+ *
+ * `peer.name` and `peer.canonical_id` are slugs of the runtime's own session
+ * title, which every runtime derives from the prompt, so `{"name":
+ * "secret-instruction"}` reached a log the README calls promptless. A drop
+ * list would have fixed those two and let the next field someone adds to a
+ * peer through; an allowlist admits only what is named here, which is the set
+ * the spec enumerates for a metadata record.
+ */
+export const METADATA_RECORD_KEEP = [
+    "kind",
+    "id",
+    "runtime",
+    "state",
+    "cwd",
+    "host",
+    "pid",
+    "permissions",
+    "sandbox",
+    "enforcement",
+    "mcp",
+    "mcp_warnings",
+    "plugins",
+];
+/**
+ * `requester` is the one nested object passed through whole: the spec keeps the
+ * tuple and its label, and a label is supplied by the receiver's own config,
+ * never derived from the request.
+ */
+const PASS_THROUGH = ["requester"];
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+ * One generation, 8 MiB. The file had no bound at all before this.
+ *
+ * Rotation is not locked. Two processes crossing the ceiling together cannot
+ * lose a line — each write opens the file fresh, and a rename only clobbers
+ * the destination — but three or more crossing at once can, because a second
+ * clobber may take out an intermediate file that has already been closed.
+ * Accepted: the registry's lock exists for launch reservations, and coupling
+ * a best-effort history to it would cost more than the history is worth. If
+ * that trade ever stops holding, this is the place it changes.
+ */
+const MAX_BYTES = 8 * 1024 * 1024;
 export class LaunchLog {
     home;
     constructor(home) {
         this.home = home;
     }
-    async write(data) {
+    /**
+     * The caller chooses the mode; this method only obeys it. The policy that a
+     * non-local requester always gets `metadata`, and that a profile may not
+     * relax it, lives with the requester policy resolution, not here.
+     */
+    async write(data, mode = "full") {
         await mkdir(this.home, { recursive: true, mode: 0o700 });
-        const file = await open(join(this.home, "launches.jsonl"), "a", 0o600);
+        const path = join(this.home, "launches.jsonl");
+        const size = await stat(path)
+            .then((s) => s.size)
+            .catch(() => 0);
+        if (size >= MAX_BYTES)
+            await rename(path, path + ".1").catch(() => undefined);
+        const body = mode === "full"
+            ? data
+            : Object.fromEntries(Object.entries(data)
+                .filter(([k]) => !METADATA_DROP.includes(k))
+                .map(([k, v]) => isRecord(v) && !PASS_THROUGH.includes(k)
+                ? [
+                    k,
+                    Object.fromEntries(Object.entries(v).filter(([field]) => METADATA_RECORD_KEEP.includes(field))),
+                ]
+                : [k, v]));
+        const file = await open(path, "a", 0o600);
         try {
-            await file.writeFile(JSON.stringify({ at: new Date().toISOString(), ...data }) + "\n");
+            await file.writeFile(JSON.stringify({ at: new Date().toISOString(), ...body }) + "\n");
             await file.sync();
         }
         finally {