hippo-memory 1.67.0 → 1.69.0

package/README.md

@@ -844,7 +844,7 @@ For Codex, it adds two hooks to `$CODEX_HOME/hooks.json` (else `~/.codex/hooks.j
 
 **Codex runs a new or changed hook only after you trust it, so open `/hooks` in Codex once and trust both;** `hippo doctor` reminds you. The per-prompt hook was checked against a real Codex request; the compaction hook follows Codex's documented `compact` start source and has not been watched end to end in Codex. Each hook also carries a `commandWindows` form (`hippo.cmd ...`), because Codex runs hooks through PowerShell on Windows, where the execution policy can block npm's `hippo.ps1`. hippo only ever appends these two entries and never rewrites one, since Codex treats a changed command as a new hook to trust. To remove: `hippo hook uninstall codex`, which takes out only hippo's exact commands and leaves every other hook, including one of yours that runs hippo.
 
-For GitHub Copilot, once `$COPILOT_HOME` (else `~/.copilot`) exists, `hippo setup` writes hippo's own `hooks/hippo.json`, adds a `hippo` server to `mcp-config.json` and puts a block in `copilot-instructions.md` that asks the agent to call `hippo_recall` and `hippo_remember`. The Copilot CLI, including its sessions inside VS Code, uses all four hooks, the server and the block. VS Code's Local agent runs only the session-start hook and reads neither of the other files, so it gets no pre-compact snapshot or end-of-session capture yet, and its recall tools need hippo added to VS Code's own `mcp.json`. The hooks, that `mcp.json` recipe and how to remove it all: [integrations/copilot.md](integrations/copilot.md).
+For GitHub Copilot, when `$COPILOT_HOME` (else `~/.copilot`) or a VS Code User folder exists, `hippo setup` writes hippo's own `hooks/hippo.json`. When the Copilot folder was there before setup, it also adds a `hippo` server to `mcp-config.json` and a block to `copilot-instructions.md`. The block asks the agent to call `hippo_recall` and `hippo_remember`. The Copilot CLI, including its sessions inside VS Code, uses the session-start, tool-failure, pre-compact and session-end hooks, the server and the block. VS Code's agent mode (the Local agent, VS Code 1.109.3 or later) reads the same hooks file. It gets session start, the pre-compact snapshot and a capture after every reply. Setup also adds hippo to VS Code's own `mcp.json` and writes `prompts/hippo.instructions.md`, so its recall tools and instructions work too. The hooks, the VS Code files and how to remove them: [integrations/copilot.md](integrations/copilot.md).
 
 ### What the hook adds (Claude Code example)
 

package/dist/agent-memories/copilot.d.ts

@@ -1,3 +1,5 @@
-import type { Adapter } from './types.js';
+import type { Adapter, AdapterContext } from './types.js';
+/** VS Code's user-data resolution: portable install first, then the app-data override, then the platform default. */
+export declare function vscodeDataFolders(ctx: Pick<AdapterContext, 'env' | 'home' | 'platform'>): string[];
 export declare const copilotAdapter: Adapter;
 //# sourceMappingURL=copilot.d.ts.map

package/dist/agent-memories/copilot.js

@@ -7,7 +7,7 @@ import { gitLayout } from './git.js';
 const PRODUCTS = ['Code', 'Code - Insiders'];
 const MEMORY_TOOL = ['github.copilot-chat', 'memory-tool', 'memories'];
 /** VS Code's user-data resolution: portable install first, then the app-data override, then the platform default. */
-function dataFolders(ctx) {
+export function vscodeDataFolders(ctx) {
     const { env, home, platform } = ctx;
     if (env.VSCODE_PORTABLE)
         return [path.join(env.VSCODE_PORTABLE, 'user-data')];
@@ -103,7 +103,7 @@ function projectContainers(data, ctx, matches, warnings) {
 export const copilotAdapter = {
     tool: 'copilot',
     list(ctx, scope) {
-        const data = dataFolders(ctx);
+        const data = vscodeDataFolders(ctx);
         const warnings = [];
         const found = [];
         if (scope === 'user') {

package/dist/api/auth.d.ts

@@ -1,7 +1,6 @@
 import { type ApiKeyListItem, type ApiKeyListRow } from '../auth.js';
 import type { KeysetPosition } from '../keyset.js';
-import { type HippoStore } from '../store-port.js';
-import type { Context } from './types.js';
+import type { Context, StoreReply } from './types.js';
 export interface AuthCreateOpts {
     label?: string;
     /**
@@ -30,7 +29,7 @@ export interface AuthCreateResult {
  * Only an admin actor can mint (ForbiddenError otherwise), and a key never
  * outranks its minter: a resolver admin is tenant-only, so it mints members.
  */
-export declare function authCreate(ctx: Context, opts: AuthCreateOpts): AuthCreateResult;
+export declare function authCreate<C extends Context>(ctx: C, opts: AuthCreateOpts): StoreReply<C, AuthCreateResult>;
 export interface AuthCreateSelfOpts {
     label?: string;
     /** Days until the new key expires. */
@@ -42,8 +41,9 @@ export interface AuthCreateSelfResult extends AuthCreateResult {
     /** ISO time the key stops working. */
     expiresAt: string;
 }
-/** Mint a member key for the caller an auth resolver vouched for, whatever its role; the binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
-export declare function authCreateSelf(ctx: Context, opts: AuthCreateSelfOpts): AuthCreateSelfResult;
+/** Mint a member key for the caller an auth resolver vouched for, whatever its role; the binary floor, the cap's revokes, the mint and its audit rows commit or fail together.
+ *  With `ctx.store`, its keyWrites group runs that transaction; hippo.db is opened only when there is no store. */
+export declare function authCreateSelf<C extends Context>(ctx: C, opts: AuthCreateSelfOpts): StoreReply<C, AuthCreateSelfResult>;
 /**
  * List API keys visible to the calling tenant.
  *
@@ -52,27 +52,22 @@ export declare function authCreateSelf(ctx: Context, opts: AuthCreateSelfOpts):
  * scoped because future multi-tenant deployments will share a hippoRoot, and
  * tenant A must not see tenant B's keys. Read-only, so no audit emit.
  */
-export declare function authList(ctx: Context, opts: {
+export declare function authList<C extends Context>(ctx: C, opts: {
     active: boolean;
-}): ApiKeyListItem[];
-/** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from. */
-export declare function authListRows(ctx: Context, opts: {
+}): StoreReply<C, ApiKeyListItem[]>;
+type KeyListOpts = {
     active: boolean;
     limit?: number;
     after?: KeysetPosition;
-}): ApiKeyListRow[];
+};
+/** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from.
+ *  With `ctx.store`, its keyWrites group reads them; hippo.db is opened only when there is no store. */
+export declare function authListRows<C extends Context>(ctx: C, opts: KeyListOpts): StoreReply<C, ApiKeyListRow[]>;
 export interface AuthRevokeResult {
     ok: true;
     revokedAt: string;
 }
-/** A promise when `ctx` carries a store, since every store method is async; today's plain result when it carries none.
- *  hippoRoot keeps the second test off TypeScript's weak-type rule, which would fail a ctx that has no store key at all. */
-export type AuthRevokeReply<C extends Context> = C extends {
-    readonly store: HippoStore;
-} ? Promise<AuthRevokeResult> : C extends {
-    readonly hippoRoot: string;
-    readonly store?: undefined;
-} ? AuthRevokeResult : AuthRevokeResult | Promise<AuthRevokeResult>;
+export type AuthRevokeReply<C extends Context> = StoreReply<C, AuthRevokeResult>;
 /** Revoke a key in the caller's tenant: a member API key may revoke only itself, a resolver member only the keys it minted.
  *  With `ctx.store`, its keyAudit group revokes and writes the auth_revoke row; hippo.db is opened only when there is no store. */
 export declare function authRevoke<C extends Context>(ctx: C, keyId: string): AuthRevokeReply<C>;
@@ -89,4 +84,5 @@ export interface AuthGrantResult {
 export declare function authGrant(ctx: Context, keyId: string, scope: string): AuthGrantResult;
 /** Revoke `keyId`'s grant on `scope`. Same authorization and lookup rules as authGrant. */
 export declare function authUngrant(ctx: Context, keyId: string, scope: string): AuthGrantResult;
+export {};
 //# sourceMappingURL=auth.d.ts.map

package/dist/api/auth.js

@@ -2,31 +2,17 @@
 import { openHippoDb, closeHippoDb } from '../db.js';
 import { BadRequestError, ConflictError, ForbiddenError, NotFoundError } from '../api-errors.js';
 import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
-import { createApiKey, forgetVerifiedKey, listApiKeyRows, listLiveOwnedKeyIds, revokeApiKey, grantScope, ungrantScope, } from '../auth.js';
+import { forgetVerifiedKey, insertApiKey, listApiKeyRows, mintApiKey, revokeApiKey, grantScope, ungrantScope, } from '../auth.js';
 import { DAY_MS } from '../dashboard-snapshot.js';
 import { isRestrictedScope } from '../recall-scope.js';
 import { requireGroup } from '../store-port.js';
+import { createAuditOf, createKeyAt, createSelfKeyAt } from '../store/key-writes.js';
 import { selectApiKeyOwner } from '../store/tenant-lookup.js';
 const API_KEY_SUBJECT = 'api_key:';
 /** The key id an API-key actor's subject names, or null for any other actor. */
 function keyIdOfSubject(subject) {
     return subject.startsWith(API_KEY_SUBJECT) ? subject.slice(API_KEY_SUBJECT.length) : null;
 }
-function inTransaction(db, fn) {
-    db.exec('BEGIN IMMEDIATE');
-    try {
-        const out = fn();
-        db.exec('COMMIT');
-        return out;
-    }
-    catch (err) {
-        try {
-            db.exec('ROLLBACK');
-        }
-        catch { /* keep the original error */ }
-        throw err;
-    }
-}
 /**
  * Mint a new API key. The new key is ALWAYS bound to `ctx.tenantId`. Callers
  * cannot override the tenant via the opts bag — a previous `tenantId` field
@@ -39,38 +25,56 @@ function inTransaction(db, fn) {
  * outranks its minter: a resolver admin is tenant-only, so it mints members.
  */
 export function authCreate(ctx, opts) {
+    // With a store, its keyWrites group stores the key and its auth_create row together, and hippo.db is never opened.
+    const reply = ctx.store ? createThroughStore(ctx, ctx.store, opts) : createOnHippoDb(ctx, opts);
+    // SAFETY: as in authRevoke, a C typed with a store gets the promise its path returns and a C that hides one gets the union.
+    return reply;
+}
+/** A key row in the caller's tenant, made here so only its hash ever reaches a store. */
+function newKey(ctx, fields) {
+    const { keyId, plaintext, keyHash } = mintApiKey();
+    return { plaintext, key: { ...fields, keyId, keyHash, tenantId: ctx.tenantId, createdAt: new Date().toISOString() } };
+}
+function adminKeyMint(ctx, opts) {
     if (ctx.actor.role !== 'admin') {
         throw new ForbiddenError('Only an admin key can create API keys');
     }
     if (ctx.actor.viaAuthResolver && opts.role === 'admin') {
         throw new ForbiddenError('A key minted through the auth resolver can only be a member key');
     }
+    const role = opts.role ?? (ctx.actor.viaAuthResolver ? 'member' : 'admin');
+    const label = opts.label ?? null;
+    const { plaintext, key } = newKey(ctx, { label, role, ownerSubject: null, expiresAt: null });
+    // The plaintext is NEVER logged; metadata carries label + role, keyId is non-secret.
+    return { plaintext, mint: { key, actor: ctx.actor.subject, metadata: { label, role } } };
+}
+function createResult({ key }, plaintext) {
+    return { keyId: key.keyId, plaintext, tenantId: key.tenantId, role: key.role };
+}
+async function createThroughStore(ctx, store, opts) {
+    const keyWrites = requireGroup(store, 'keyWrites');
+    const { plaintext, mint } = adminKeyMint(ctx, opts);
+    await keyWrites.createApiKey(mint);
+    return createResult(mint, plaintext);
+}
+function createOnHippoDb(ctx, opts) {
+    const { plaintext, mint } = adminKeyMint(ctx, opts);
     const db = openHippoDb(ctx.hippoRoot);
     try {
-        const role = opts.role ?? (ctx.actor.viaAuthResolver ? 'member' : 'admin');
-        const mint = () => createApiKey(db, { tenantId: ctx.tenantId, label: opts.label, role });
-        // The plaintext is NEVER logged; metadata carries label + role, keyId is non-secret.
-        const audit = (keyId) => appendAuditEvent(db, {
-            tenantId: ctx.tenantId, actor: ctx.actor.subject, op: 'auth_create', targetId: keyId, metadata: { label: opts.label ?? null, role },
-        });
         // A resolver admin's keys are found again only through their audit rows, so the key and its row commit together.
         if (ctx.actor.viaAuthResolver) {
-            const result = inTransaction(db, () => {
-                const minted = mint();
-                audit(minted.keyId);
-                return minted;
-            });
-            return { keyId: result.keyId, plaintext: result.plaintext, tenantId: ctx.tenantId, role };
+            createKeyAt(db, mint);
+            return createResult(mint, plaintext);
         }
-        const result = mint();
+        insertApiKey(db, mint.key);
         try {
-            audit(result.keyId);
+            appendAuditEvent(db, createAuditOf(mint));
         }
         catch (error) {
             // Audit must not crash a successful mint.
-            reportAuditWriteFailure('auth_create', String(error), result.keyId);
+            reportAuditWriteFailure('auth_create', String(error), mint.key.keyId);
         }
-        return { keyId: result.keyId, plaintext: result.plaintext, tenantId: ctx.tenantId, role };
+        return createResult(mint, plaintext);
     }
     finally {
         closeHippoDb(db);
@@ -86,34 +90,43 @@ function assertSelfMintOpts({ ttlDays, perSubject }) {
         throw new RangeError(`authCreateSelf: perSubject must be a whole number of at least 1, got ${String(perSubject)}`);
     }
 }
-/** Mint a member key for the caller an auth resolver vouched for, whatever its role; the binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
+/** Mint a member key for the caller an auth resolver vouched for, whatever its role; the binary floor, the cap's revokes, the mint and its audit rows commit or fail together.
+ *  With `ctx.store`, its keyWrites group runs that transaction; hippo.db is opened only when there is no store. */
 export function authCreateSelf(ctx, opts) {
+    const reply = ctx.store ? createSelfThroughStore(ctx, ctx.store, opts) : createSelfOnHippoDb(ctx, opts);
+    // SAFETY: as in authRevoke, a C typed with a store gets the promise its path returns and a C that hides one gets the union.
+    return reply;
+}
+function selfKeyMint(ctx, opts) {
     if (!ctx.actor.viaAuthResolver) {
         throw new ForbiddenError('Only a caller signed in through the auth resolver can mint its own key');
     }
     assertSelfMintOpts(opts);
-    const { tenantId, actor: { subject } } = ctx;
-    const now = Date.now();
-    const expiresAt = new Date(now + opts.ttlDays * DAY_MS).toISOString();
+    const { subject } = ctx.actor;
+    const label = opts.label ?? null;
+    const expiresAt = new Date(Date.now() + opts.ttlDays * DAY_MS).toISOString();
+    // Not destructured: a binding pattern makes TypeScript infer F as KeyFields and lose ownerSubject's string type.
+    const made = newKey(ctx, { label, role: 'member', ownerSubject: subject, expiresAt });
+    // Same op and actor as an admin mint, so a lookup by audit row finds this key too.
+    return { plaintext: made.plaintext, mint: { key: made.key, actor: subject, metadata: { label, role: 'member', self: true, expiresAt }, perSubject: opts.perSubject } };
+}
+function selfResult({ key }, plaintext) {
+    return { keyId: key.keyId, plaintext, tenantId: key.tenantId, role: 'member', expiresAt: key.expiresAt };
+}
+/** The store revokes the replaced keys without this process's verified-key cache, so they leave it here once the mint commits. */
+async function createSelfThroughStore(ctx, store, opts) {
+    const keyWrites = requireGroup(store, 'keyWrites');
+    const { plaintext, mint } = selfKeyMint(ctx, opts);
+    for (const keyId of await keyWrites.createSelfApiKey(mint))
+        forgetVerifiedKey(keyId);
+    return selfResult(mint, plaintext);
+}
+function createSelfOnHippoDb(ctx, opts) {
+    const { plaintext, mint } = selfKeyMint(ctx, opts);
     const db = openHippoDb(ctx.hippoRoot);
     try {
-        // IMMEDIATE takes the write lock before the count, so two mints for one subject cannot both see room under the cap.
-        const result = inTransaction(db, () => {
-            const live = listLiveOwnedKeyIds(db, tenantId, subject, now);
-            const replaced = live.slice(0, Math.max(0, live.length - opts.perSubject + 1));
-            const minted = createApiKey(db, { tenantId, label: opts.label, role: 'member', ownerSubject: subject, expiresAt });
-            for (const keyId of replaced) {
-                revokeApiKey(db, keyId);
-                appendAuditEvent(db, { tenantId, actor: subject, op: 'auth_revoke', targetId: keyId, metadata: { replacedBy: minted.keyId } });
-            }
-            // Same op and actor as an admin mint, so a lookup by audit row finds this key too.
-            appendAuditEvent(db, {
-                tenantId, actor: subject, op: 'auth_create', targetId: minted.keyId,
-                metadata: { label: opts.label ?? null, role: 'member', self: true, expiresAt },
-            });
-            return minted;
-        });
-        return { keyId: result.keyId, plaintext: result.plaintext, tenantId, role: 'member', expiresAt };
+        createSelfKeyAt(db, mint);
+        return selfResult(mint, plaintext);
     }
     finally {
         closeHippoDb(db);
@@ -128,30 +141,50 @@ export function authCreateSelf(ctx, opts) {
  * tenant A must not see tenant B's keys. Read-only, so no audit emit.
  */
 export function authList(ctx, opts) {
-    return authListRows(ctx, opts).map((r) => r.key);
+    const keysOf = (rows) => rows.map((r) => r.key);
+    const rows = listRows(ctx, opts);
+    // SAFETY: the promise comes back exactly when ctx has a store, as StoreReply says.
+    return (rows instanceof Promise ? rows.then(keysOf) : keysOf(rows));
 }
-/** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from. */
+/** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from.
+ *  With `ctx.store`, its keyWrites group reads them; hippo.db is opened only when there is no store. */
 export function authListRows(ctx, opts) {
+    // SAFETY: the promise comes back exactly when ctx has a store, as StoreReply says.
+    return listRows(ctx, opts);
+}
+function listRows(ctx, opts) {
+    return ctx.store ? listThroughStore(ctx, ctx.store, opts) : listOnHippoDb(ctx, opts);
+}
+async function listThroughStore(ctx, store, opts) {
+    const keyWrites = requireGroup(store, 'keyWrites');
+    const keyId = memberKeyIdOf(ctx.actor);
+    const filter = memberListFilter(ctx.actor, keyId === null ? undefined : (await store.findApiKey(keyId))?.ownerSubject);
+    return filter === null ? [] : keyWrites.listApiKeys({ ...opts, tenantId: ctx.tenantId, ...filter });
+}
+function listOnHippoDb(ctx, opts) {
     const db = openHippoDb(ctx.hippoRoot);
     try {
-        const filter = memberListFilter(db, ctx);
+        const keyId = memberKeyIdOf(ctx.actor);
+        const filter = memberListFilter(ctx.actor, keyId === null ? undefined : selectApiKeyOwner(db, keyId)?.ownerSubject);
         return filter === null ? [] : listApiKeyRows(db, { ...opts, tenantId: ctx.tenantId, ...filter });
     }
     finally {
         closeHippoDb(db);
     }
 }
+/** The key id of a member API key caller, whose owner decides what it lists; null for any other caller. */
+function memberKeyIdOf(actor) {
+    return actor.role === 'admin' || actor.viaAuthResolver ? null : keyIdOfSubject(actor.subject);
+}
 /** A member sees only the keys its person minted, or just its own key when that has no owner; an admin sees the whole tenant; null means no keys. */
-function memberListFilter(db, ctx) {
-    const { actor } = ctx;
+function memberListFilter(actor, owner) {
     if (actor.role === 'admin')
         return {};
     if (actor.viaAuthResolver)
         return { ownerSubject: actor.subject };
-    const keyId = keyIdOfSubject(actor.subject);
+    const keyId = memberKeyIdOf(actor);
     if (keyId === null)
         return null;
-    const owner = selectApiKeyOwner(db, keyId)?.ownerSubject;
     return owner ? { ownerSubject: owner } : { keyId };
 }
 /** Throws unless `ctx` may revoke `keyId`; a member gets one answer for a missing, foreign or unowned key, so it cannot probe key ids. */

package/dist/api/context-select.d.ts

@@ -1,12 +1,22 @@
 import type { AmbientLoadResult } from '../store/candidates.js';
 import { type MemoryEntry } from '../memory.js';
+import type { ContextReads, HippoStore } from '../store-port.js';
 import { type HippoConfig } from '../config.js';
 import type { ProjectRef } from '../project-identity.js';
 import type { DeliveryObserver } from '../delivery-recorder.js';
 import type { ContextCost, ContextOpts, ContextResultEntry } from './context-types.js';
 import type { Context } from './types.js';
+/** One store getContext reads rows from: its base search and its context reads. */
+export interface ContextSource {
+    readonly store: HippoStore;
+    readonly reads: ContextReads;
+}
 /** What getContext resolved from opts and config before it read a row. */
 export interface ContextPlan {
+    /** The served store, else hippo.db under the root. */
+    local: ContextSource;
+    /** The served store when it is not hippo.db; then every read and write goes through it and no hippo.db opens. */
+    other: HippoStore | undefined;
     pinnedOnly: boolean;
     limit: number;
     includeRecent: number;

package/dist/api/context-select.js

@@ -241,7 +241,7 @@ export async function selectBySearch(ctx, plan, left, pools, admission) {
     const results = plan.hasGlobal && !plan.primaryIsGlobal
         ? await searchBothStores(ctx, plan, left, minResults, pools, admission.bothStoresAdmit)
         : await searchLocalRows(ctx, plan, left, minResults, pools.local.entries, admission.admit);
-    auditContextRecall(ctx, plan, results.length);
+    await auditContextRecall(ctx, plan, results.length);
     return results;
 }
 // The pools were admitted at load, before ranking, dedupe and budget: a post-filter would let an excluded row fill the
@@ -273,6 +273,7 @@ async function searchLocalRows(ctx, plan, left, minResults, localEntries, admit)
     const usePhysicsCtx = ctxConfig.physics?.enabled !== false;
     const localCost = cost && ((r) => price(r.entry, primaryIsGlobal));
     const vectorCandidates = contextVectorSpec(ctx, plan, admit);
+    const store = plan.local.store;
     const ctxResults = usePhysicsCtx
         ? await physicsSearch(query, localEntries, {
             budget: left,
@@ -282,6 +283,7 @@ async function searchLocalRows(ctx, plan, left, minResults, localEntries, admit)
             physicsConfig: ctxConfig.physics,
             scope: plan.activeScope,
             vectorCandidates,
+            store,
         })
         : await hybridSearch(query, localEntries, {
             budget: left,
@@ -290,6 +292,7 @@ async function searchLocalRows(ctx, plan, left, minResults, localEntries, admit)
             hippoRoot: ctx.hippoRoot,
             scope: plan.activeScope,
             vectorCandidates,
+            store,
         });
     return ctxResults.map((r) => ({
         entry: r.entry,
@@ -299,21 +302,21 @@ async function searchLocalRows(ctx, plan, left, minResults, localEntries, admit)
     }));
 }
 // Same 'recall' op api.recall emits; the pinned-only and no-query branches never search, so they never emit.
-function auditContextRecall(ctx, plan, resultCount) {
-    const ctxRecallMetadata = {
-        ...auditQueryFields(plan.query),
-        results: resultCount,
-        mode: 'context',
+async function auditContextRecall(ctx, plan, resultCount) {
+    const row = {
+        tenantId: ctx.tenantId,
+        actor: ctx.actor.subject,
+        op: 'recall',
+        metadata: { ...auditQueryFields(plan.query), results: resultCount, mode: 'context' },
     };
+    if (plan.other) {
+        await plan.other.appendAuditEvents([row]);
+        return;
+    }
     if (plan.hasLocal) {
         const localDb = openHippoDb(ctx.hippoRoot);
         try {
-            appendAuditEvent(localDb, {
-                tenantId: ctx.tenantId,
-                actor: ctx.actor.subject,
-                op: 'recall',
-                metadata: ctxRecallMetadata,
-            });
+            appendAuditEvent(localDb, row);
         }
         finally {
             closeHippoDb(localDb);
@@ -322,12 +325,7 @@ function auditContextRecall(ctx, plan, resultCount) {
     if (plan.hasGlobal && !plan.primaryIsGlobal) {
         const globalDb = openHippoDb(plan.globalRoot);
         try {
-            appendAuditEvent(globalDb, {
-                tenantId: ctx.tenantId,
-                actor: ctx.actor.subject,
-                op: 'recall',
-                metadata: ctxRecallMetadata,
-            });
+            appendAuditEvent(globalDb, row);
         }
         finally {
             closeHippoDb(globalDb);