@ouro.bot/cli 0.1.0-alpha.346 → 0.1.0-alpha.348

package/changelog.json

@@ -1,6 +1,19 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.348",
+      "changes": [
+        "Provider attempts now share one bounded retry runner across real runtime turns, provider pings, health inventory, working-provider discovery, and GitHub Copilot model validation, retrying every provider failure class before terminal handling while preserving attempt metadata and nerves events.",
+        "Provider checks can now ping the selected lane model instead of drifting to provider defaults, and readiness/model pings use zero-delay retries so health checks stay fast."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.347",
+      "changes": [
+        "Post-turn session persist functions now return the events array directly, eliminating a redundant `loadSession` file read after every CLI TUI turn. `postTurnPersist` returns `SessionEvent[]` and `deferPostTurnPersist` returns `Promise<SessionEvent[]>`, so the CLI sense uses the returned data instead of re-reading the file it just wrote."
+      ]
+    },
     {
       "version": "0.1.0-alpha.346",
       "changes": [

package/dist/heart/core.js

@@ -10,7 +10,6 @@ exports.isExternalStateQuery = isExternalStateQuery;
 exports.getSettleRetryError = getSettleRetryError;
 exports.stripLastToolCalls = stripLastToolCalls;
 exports.repairOrphanedToolCalls = repairOrphanedToolCalls;
-exports.isRetryBlocked = isRetryBlocked;
 exports.runAgent = runAgent;
 const config_1 = require("./config");
 const identity_1 = require("./identity");
@@ -33,6 +32,7 @@ const tool_loop_1 = require("./tool-loop");
 const packets_1 = require("../arc/packets");
 const tool_friction_1 = require("./tool-friction");
 const provider_models_1 = require("./provider-models");
+const provider_attempt_1 = require("./provider-attempt");
 const _providerRuntimes = {
     human: null,
     agent: null,
@@ -366,38 +366,6 @@ function isContextOverflow(err) {
         return true;
     return false;
 }
-// HTTP statuses that will never become retryable on their own — the request is
-// semantically wrong (malformed, unauthorized, missing route, etc.) and the
-// caller has to do something different before it can succeed.
-const NON_RETRYABLE_HTTP_STATUSES = new Set([
-    400, // Bad Request — malformed payload
-    401, // Unauthorized — credentials invalid/expired
-    403, // Forbidden — credentials lack permission
-    404, // Not Found — model/route doesn't exist
-    422, // Unprocessable Entity — semantic validation failure
-]);
-// Provider-classified error categories that we never retry. usage-limit is
-// distinct from rate-limit: rate limits clear in seconds (retryable), usage
-// limits are billing quotas that take hours/days to reset.
-const NON_RETRYABLE_CLASSIFICATIONS = new Set([
-    "auth-failure",
-    "usage-limit",
-]);
-// Default policy: retry every error from the provider, EXCEPT the small set
-// above. The user explicitly requested this — past behavior was to retry only
-// on a known-transient list, which silently dropped real harness/SDK timeouts
-// (e.g. OpenAI SDK's "Request timed out." has no err.code and no status, so
-// the substring matchers missed it).
-function isRetryBlocked(error, classification) {
-    const status = error.status;
-    if (status !== undefined && NON_RETRYABLE_HTTP_STATUSES.has(status))
-        return true;
-    if (NON_RETRYABLE_CLASSIFICATIONS.has(classification))
-        return true;
-    return false;
-}
-const MAX_RETRIES = 3;
-const RETRY_BASE_MS = 2000;
 const RETRY_LABELS = {
     "auth-failure": "auth error",
     "usage-limit": "usage limit",
@@ -406,6 +374,29 @@ const RETRY_LABELS = {
     "network-error": "network error",
     "unknown": "error",
 };
+function waitForProviderRetry(delayMs, signal) {
+    if (!signal) {
+        return new Promise((resolve) => {
+            setTimeout(resolve, delayMs);
+        });
+    }
+    return new Promise((resolve, reject) => {
+        let timer;
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(new provider_attempt_1.ProviderAttemptAbortError());
+        };
+        timer = setTimeout(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }, delayMs);
+        if (signal.aborted) {
+            onAbort();
+            return;
+        }
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+}
 function buildAuthFailureGuidance(provider, model, agentName, detail) {
     const mismatch = (0, provider_models_1.getProviderModelMismatchMessage)(provider, model);
     const modelLabel = model
@@ -500,7 +491,6 @@ async function runAgent(messages, callbacks, channel, signal, options) {
     let done = false;
     let lastUsage;
     let overflowRetried = false;
-    let retryCount = 0;
     let outcome = "settled";
     let completion;
     let terminalError;
@@ -515,6 +505,35 @@ async function runAgent(messages, callbacks, channel, signal, options) {
     let sawExternalStateQuery = false;
     const toolLoopState = (0, tool_loop_1.createToolLoopState)();
     const toolFrictionLedger = (0, tool_friction_1.createToolFrictionLedger)();
+    const finishTerminalProviderError = (error, classification) => {
+        terminalError = error;
+        terminalErrorClassification = classification;
+        /* v8 ignore start — auth-failure guidance: tested via provider error classification tests @preserve */
+        if (terminalErrorClassification === "auth-failure") {
+            const agentName = (0, identity_2.getAgentName)();
+            const currentProvider = providerRuntime.id;
+            callbacks.onError(new Error(buildAuthFailureGuidance(currentProvider, providerRuntime.model, agentName, terminalError.message)), "terminal");
+        }
+        else {
+            callbacks.onError(terminalError, "terminal");
+        }
+        /* v8 ignore stop */
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            event: "engine.error",
+            trace_id: traceId,
+            component: "engine",
+            message: terminalError.message,
+            meta: {
+                provider: providerRuntime.id,
+                model: providerRuntime.model,
+                errorClassification: terminalErrorClassification,
+            },
+        });
+        stripLastToolCalls(messages);
+        outcome = "errored";
+        done = true;
+    };
     // Prevent MaxListenersExceeded warning — each iteration adds a listener
     try {
         require("events").setMaxListeners(50, signal);
@@ -581,21 +600,71 @@ async function runAgent(messages, callbacks, channel, signal, options) {
             break;
         }
         try {
-            callbacks.onModelStart();
-            const result = await providerRuntime.streamTurn({
-                messages,
-                activeTools,
-                callbacks,
-                signal,
-                traceId,
-                toolChoiceRequired,
-                reasoningEffort: currentReasoningEffort,
-                eagerSettleStreaming: true,
+            const callProviderTurn = async () => {
+                callbacks.onModelStart();
+                try {
+                    return await providerRuntime.streamTurn({
+                        messages,
+                        activeTools,
+                        callbacks,
+                        signal,
+                        traceId,
+                        toolChoiceRequired,
+                        reasoningEffort: currentReasoningEffort,
+                        eagerSettleStreaming: true,
+                    });
+                }
+                catch (error) {
+                    if (signal?.aborted)
+                        throw new provider_attempt_1.ProviderAttemptAbortError();
+                    throw error;
+                }
+            };
+            const callProviderTurnWithOverflowRecovery = async () => {
+                try {
+                    return await callProviderTurn();
+                }
+                catch (error) {
+                    if (error instanceof provider_attempt_1.ProviderAttemptAbortError)
+                        throw error;
+                    if (isContextOverflow(error) && !overflowRetried) {
+                        overflowRetried = true;
+                        stripLastToolCalls(messages);
+                        const { maxTokens, contextMargin } = (0, config_1.getContextConfig)();
+                        const trimmed = (0, context_1.trimMessages)(messages, maxTokens, contextMargin, maxTokens * 2);
+                        messages.splice(0, messages.length, ...trimmed);
+                        providerRuntime.resetTurnState(messages);
+                        callbacks.onError(new Error("context trimmed, retrying..."), "transient");
+                        return callProviderTurn();
+                    }
+                    throw error;
+                }
+            };
+            const attempt = await (0, provider_attempt_1.runProviderAttempt)({
+                operation: "turn",
+                provider: providerRuntime.id,
+                model: providerRuntime.model,
+                run: callProviderTurnWithOverflowRecovery,
+                classifyError: (error) => providerRuntime.classifyError(error),
+                onRetry: (record, maxAttempts) => {
+                    const delayMs = record.delayMs;
+                    const seconds = delayMs / 1000;
+                    const cause = RETRY_LABELS[record.classification];
+                    callbacks.onError(new Error(`${cause}, retrying in ${seconds}s (${record.attempt}/${maxAttempts})...`), "transient");
+                },
+                sleep: async (delayMs) => {
+                    await waitForProviderRetry(delayMs, signal);
+                    providerRuntime.resetTurnState(messages);
+                },
             });
+            if (!attempt.ok) {
+                finishTerminalProviderError(attempt.error, attempt.classification);
+                continue;
+            }
+            const result = attempt.value;
             // Track usage from the latest API call
             if (result.usage)
                 lastUsage = result.usage;
-            retryCount = 0; // reset on success
             // SHARED: build CC-format assistant message from TurnResult
             const msg = {
                 role: "assistant",
@@ -978,26 +1047,11 @@ async function runAgent(messages, callbacks, channel, signal, options) {
         }
         catch (e) {
             // Abort is not an error — just stop cleanly
-            if (signal?.aborted) {
+            if (e instanceof provider_attempt_1.ProviderAttemptAbortError || signal?.aborted) {
                 stripLastToolCalls(messages);
                 outcome = "aborted";
                 break;
             }
-            // Context overflow: trim aggressively and retry once
-            if (isContextOverflow(e) && !overflowRetried) {
-                overflowRetried = true;
-                stripLastToolCalls(messages);
-                const { maxTokens, contextMargin } = (0, config_1.getContextConfig)();
-                const trimmed = (0, context_1.trimMessages)(messages, maxTokens, contextMargin, maxTokens * 2);
-                messages.splice(0, messages.length, ...trimmed);
-                providerRuntime.resetTurnState(messages);
-                callbacks.onError(new Error("context trimmed, retrying..."), "transient");
-                continue;
-            }
-            // Retry policy: retry every error EXCEPT those on the blocklist
-            // (NON_RETRYABLE_HTTP_STATUSES / NON_RETRYABLE_CLASSIFICATIONS).
-            // The classification still drives the user-facing label and the
-            // auth-failure guidance message below — it just no longer gates retries.
             const errorForClassification = e instanceof Error ? e : /* v8 ignore next -- defensive @preserve */ new Error(String(e));
             let providerClassification;
             try {
@@ -1007,77 +1061,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                 /* v8 ignore next -- defensive: classifyError should not throw @preserve */
                 providerClassification = "unknown";
             }
-            const blocked = isRetryBlocked(errorForClassification, providerClassification);
-            const shouldRetry = !blocked && retryCount < MAX_RETRIES;
-            (0, runtime_1.emitNervesEvent)({
-                level: shouldRetry ? "info" : "warn",
-                event: shouldRetry ? "engine.provider_retry" : "engine.provider_retry_skip",
-                component: "engine",
-                message: shouldRetry
-                    ? `provider error is retryable (attempt ${retryCount + 1}/${MAX_RETRIES})`
-                    : blocked
-                        ? `provider error is on retry blocklist`
-                        : `provider error retries exhausted`,
-                meta: {
-                    provider: providerRuntime.id,
-                    model: providerRuntime.model,
-                    retryCount,
-                    maxRetries: MAX_RETRIES,
-                    blocked,
-                    providerClassification,
-                    errorMessage: errorForClassification.message.slice(0, 200),
-                    httpStatus: e.status ?? null,
-                },
-            });
-            if (shouldRetry) {
-                retryCount++;
-                const delay = RETRY_BASE_MS * Math.pow(2, retryCount - 1);
-                const cause = RETRY_LABELS[providerClassification];
-                callbacks.onError(new Error(`${cause}, retrying in ${delay / 1000}s (${retryCount}/${MAX_RETRIES})...`), "transient");
-                // Wait with abort support
-                const aborted = await new Promise((resolve) => {
-                    const timer = setTimeout(() => resolve(false), delay);
-                    if (signal) {
-                        const onAbort = () => { clearTimeout(timer); resolve(true); };
-                        if (signal.aborted) {
-                            clearTimeout(timer);
-                            resolve(true);
-                            return;
-                        }
-                        signal.addEventListener("abort", onAbort, { once: true });
-                    }
-                });
-                if (aborted) {
-                    stripLastToolCalls(messages);
-                    outcome = "aborted";
-                    break;
-                }
-                providerRuntime.resetTurnState(messages);
-                continue;
-            }
-            terminalError = errorForClassification;
-            terminalErrorClassification = providerClassification;
-            /* v8 ignore start — auth-failure guidance: tested via provider error classification tests @preserve */
-            if (terminalErrorClassification === "auth-failure") {
-                const agentName = (0, identity_2.getAgentName)();
-                const currentProvider = providerRuntime.id;
-                callbacks.onError(new Error(buildAuthFailureGuidance(currentProvider, providerRuntime.model, agentName, terminalError.message)), "terminal");
-            }
-            else {
-                callbacks.onError(terminalError, "terminal");
-            }
-            /* v8 ignore stop */
-            (0, runtime_1.emitNervesEvent)({
-                level: "error",
-                event: "engine.error",
-                trace_id: traceId,
-                component: "engine",
-                message: terminalError.message,
-                meta: { errorClassification: terminalErrorClassification },
-            });
-            stripLastToolCalls(messages);
-            outcome = "errored";
-            done = true;
+            finishTerminalProviderError(errorForClassification, providerClassification);
         }
     }
     (0, runtime_1.emitNervesEvent)({

package/dist/heart/provider-attempt.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_PROVIDER_ATTEMPT_POLICY = exports.ProviderAttemptAbortError = void 0;
+exports.runProviderAttempt = runProviderAttempt;
+const runtime_1 = require("../nerves/runtime");
+class ProviderAttemptAbortError extends Error {
+    constructor(message = "provider attempt aborted") {
+        super(message);
+        this.name = "ProviderAttemptAbortError";
+    }
+}
+exports.ProviderAttemptAbortError = ProviderAttemptAbortError;
+exports.DEFAULT_PROVIDER_ATTEMPT_POLICY = {
+    maxAttempts: 3,
+    baseDelayMs: 2_000,
+    backoffMultiplier: 2,
+};
+function sleep(delayMs) {
+    return new Promise((resolve) => setTimeout(resolve, delayMs));
+}
+function normalizePolicy(policy) {
+    return {
+        ...exports.DEFAULT_PROVIDER_ATTEMPT_POLICY,
+        ...policy,
+    };
+}
+function toError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}
+function classify(error, classifyError) {
+    if (!(error instanceof Error))
+        return "unknown";
+    try {
+        return classifyError(error);
+    }
+    catch {
+        return "unknown";
+    }
+}
+function httpStatus(error) {
+    const status = error.status;
+    return typeof status === "number" ? status : null;
+}
+function delayForAttempt(policy, attempt) {
+    return policy.baseDelayMs * Math.pow(policy.backoffMultiplier, attempt - 1);
+}
+async function runProviderAttempt(input) {
+    const policy = normalizePolicy(input.policy);
+    const maxAttempts = Math.max(1, Math.floor(policy.maxAttempts));
+    const wait = input.sleep ?? sleep;
+    const attempts = [];
+    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+        try {
+            const value = await input.run();
+            attempts.push({
+                attempt,
+                provider: input.provider,
+                model: input.model,
+                operation: input.operation,
+                ok: true,
+                willRetry: false,
+            });
+            (0, runtime_1.emitNervesEvent)({
+                component: "engine",
+                event: "engine.provider_attempt_succeeded",
+                message: "provider attempt succeeded",
+                meta: { provider: input.provider, model: input.model, operation: input.operation, attempt, maxAttempts },
+            });
+            return { ok: true, value, attempts };
+        }
+        catch (caught) {
+            if (caught instanceof ProviderAttemptAbortError)
+                throw caught;
+            const error = toError(caught);
+            const classification = classify(caught, input.classifyError);
+            const willRetry = attempt < maxAttempts;
+            const delayMs = willRetry ? delayForAttempt(policy, attempt) : undefined;
+            const record = {
+                attempt,
+                provider: input.provider,
+                model: input.model,
+                operation: input.operation,
+                ok: false,
+                classification,
+                errorMessage: error.message,
+                httpStatus: httpStatus(error),
+                willRetry,
+                ...(delayMs !== undefined ? { delayMs } : {}),
+            };
+            attempts.push(record);
+            if (!willRetry) {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "engine",
+                    event: "engine.provider_attempt_failed",
+                    message: "provider attempt failed",
+                    meta: {
+                        provider: input.provider,
+                        model: input.model,
+                        operation: input.operation,
+                        attempt,
+                        maxAttempts,
+                        classification,
+                        errorMessage: error.message.slice(0, 200),
+                        httpStatus: httpStatus(error),
+                    },
+                });
+                return { ok: false, error, classification, attempts };
+            }
+            const retryDelayMs = delayMs;
+            (0, runtime_1.emitNervesEvent)({
+                component: "engine",
+                event: "engine.provider_attempt_retry",
+                message: "provider attempt failed; retrying",
+                meta: {
+                    provider: input.provider,
+                    model: input.model,
+                    operation: input.operation,
+                    attempt,
+                    maxAttempts,
+                    classification,
+                    errorMessage: error.message.slice(0, 200),
+                    httpStatus: httpStatus(error),
+                    delayMs: retryDelayMs,
+                },
+            });
+            await input.onRetry?.(record, maxAttempts);
+            await wait(retryDelayMs);
+        }
+    }
+    /* v8 ignore next 2 -- defensive: loop always returns on success or final failure @preserve */
+    return { ok: false, error: new Error("provider attempt loop ended unexpectedly"), classification: "unknown", attempts };
+}

package/dist/heart/provider-ping.js

@@ -13,6 +13,7 @@ const github_copilot_1 = require("./providers/github-copilot");
 const auth_flow_1 = require("./auth/auth-flow");
 const provider_models_1 = require("./provider-models");
 const runtime_1 = require("../nerves/runtime");
+const provider_attempt_1 = require("./provider-attempt");
 const PING_TIMEOUT_MS = 10_000;
 const PING_PROMPT = "ping";
 const CHAT_PING_MAX_TOKENS = 1;
@@ -67,6 +68,30 @@ function sanitizeErrorMessage(message) {
     // Already clean (e.g., "401 Provided authentication token is expired.")
     return message;
 }
+async function readGithubCopilotModelPingError(response) {
+    let detail = `HTTP ${response.status}`;
+    try {
+        const json = await response.json();
+        /* v8 ignore start -- error format parsing: all branches tested via config-models.test.ts @preserve */
+        if (typeof json.error === "string")
+            detail = json.error;
+        else if (typeof json.error === "object" && json.error !== null) {
+            const errObj = json.error;
+            if (typeof errObj.message === "string")
+                detail = errObj.message;
+        }
+        else if (typeof json.message === "string")
+            detail = json.message;
+        /* v8 ignore stop */
+    }
+    catch {
+        // response body not JSON — keep HTTP status
+    }
+    return detail;
+}
+function createStatusError(message, status) {
+    return Object.assign(new Error(message), { status });
+}
 async function pingGithubCopilotModel(baseUrl, token, model, fetchImpl = fetch) {
     const base = baseUrl.replace(/\/+$/, "");
     const isClaude = model.startsWith("claude");
@@ -74,41 +99,31 @@ async function pingGithubCopilotModel(baseUrl, token, model, fetchImpl = fetch)
     const body = isClaude
         ? JSON.stringify(createChatPingRequest(model))
         : JSON.stringify(createResponsePingRequest(model));
-    try {
-        const response = await fetchImpl(url, {
-            method: "POST",
-            headers: {
-                Authorization: `Bearer ${token}`,
-                "Content-Type": "application/json",
-            },
-            body,
-        });
-        if (response.ok)
-            return { ok: true };
-        let detail = `HTTP ${response.status}`;
-        try {
-            const json = await response.json();
-            /* v8 ignore start -- error format parsing: all branches tested via config-models.test.ts @preserve */
-            if (typeof json.error === "string")
-                detail = json.error;
-            else if (typeof json.error === "object" && json.error !== null) {
-                const errObj = json.error;
-                if (typeof errObj.message === "string")
-                    detail = errObj.message;
+    const attempt = await (0, provider_attempt_1.runProviderAttempt)({
+        operation: "model-ping",
+        provider: "github-copilot",
+        model,
+        classifyError: github_copilot_1.classifyGithubCopilotError,
+        policy: {
+            maxAttempts: 3,
+            baseDelayMs: 0,
+            backoffMultiplier: 2,
+        },
+        run: async () => {
+            const response = await fetchImpl(url, {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    "Content-Type": "application/json",
+                },
+                body,
+            });
+            if (!response.ok) {
+                throw createStatusError(await readGithubCopilotModelPingError(response), response.status);
             }
-            else if (typeof json.message === "string")
-                detail = json.message;
-            /* v8 ignore stop */
-        }
-        catch {
-            // response body not JSON — keep HTTP status
-        }
-        return { ok: false, error: detail };
-    }
-    catch (err) {
-        /* v8 ignore next -- defensive: fetch errors are always Error instances @preserve */
-        return { ok: false, error: err instanceof Error ? err.message : String(err) };
-    }
+        },
+    });
+    return attempt.ok ? { ok: true } : { ok: false, error: attempt.error.message };
 }
 function hasEmptyCredentials(provider, config) {
     const record = config;
@@ -121,37 +136,37 @@ function hasEmptyCredentials(provider, config) {
     }
     return identity_1.PROVIDER_CREDENTIALS[provider].required.some((key) => !record[key]);
 }
-function createRuntimeForPing(provider, config) {
+function createRuntimeForPing(provider, config, model) {
     // Use the same provider defaults as auth switch and hatch so verification
     // cannot drift to stale provider/model pairings, and pass the checked
     // credentials directly so daemon-side pings do not depend on --agent globals.
-    const model = (0, provider_models_1.getDefaultModelForProvider)(provider);
+    const resolvedModel = model ?? (0, provider_models_1.getDefaultModelForProvider)(provider);
     switch (provider) {
         case "anthropic":
-            return (0, anthropic_1.createAnthropicProviderRuntime)(model, config);
+            return (0, anthropic_1.createAnthropicProviderRuntime)(resolvedModel, config);
         case "azure":
-            return (0, azure_1.createAzureProviderRuntime)(model, {
+            return (0, azure_1.createAzureProviderRuntime)(resolvedModel, {
                 ...config,
                 apiVersion: config.apiVersion ?? DEFAULT_AZURE_API_VERSION,
             });
         case "minimax":
-            return (0, minimax_1.createMinimaxProviderRuntime)(model, config);
+            return (0, minimax_1.createMinimaxProviderRuntime)(resolvedModel, config);
         case "openai-codex":
-            return (0, openai_codex_1.createOpenAICodexProviderRuntime)(model, config);
+            return (0, openai_codex_1.createOpenAICodexProviderRuntime)(resolvedModel, config);
         case "github-copilot":
-            return (0, github_copilot_1.createGithubCopilotProviderRuntime)(model, config);
+            return (0, github_copilot_1.createGithubCopilotProviderRuntime)(resolvedModel, config);
         /* v8 ignore next 2 -- exhaustive: all providers handled above @preserve */
         default:
             throw new Error(`unsupported provider for ping: ${provider}`);
     }
 }
-async function pingProvider(provider, config) {
+async function pingProvider(provider, config, options = {}) {
     if (hasEmptyCredentials(provider, config)) {
         return { ok: false, classification: "auth-failure", message: "no credentials configured" };
     }
     let runtime;
     try {
-        runtime = createRuntimeForPing(provider, config);
+        runtime = createRuntimeForPing(provider, config, options.model);
         /* v8 ignore start -- factory creation failure: tested via individual provider init tests @preserve */
     }
     catch (error) {
@@ -162,58 +177,67 @@ async function pingProvider(provider, config) {
         };
     }
     /* v8 ignore stop */
-    try {
-        const controller = new AbortController();
-        /* v8 ignore next -- timeout callback: only fires after 10s, tests resolve faster @preserve */
-        const timeout = setTimeout(() => controller.abort(), PING_TIMEOUT_MS);
-        try {
-            // Minimal API call — no thinking, no reasoning, no tools.
-            if (provider === "anthropic") {
-                // Use haiku for the ping — setup tokens may not have access to newer
-                // models, but if haiku works, the credentials are valid.
-                // Override the beta header to exclude thinking (which requires a
-                // thinking param in the request body).
-                const client = runtime.client;
-                await client.messages.create(createChatPingRequest(ANTHROPIC_SETUP_PING_MODEL), { signal: controller.signal, headers: { "anthropic-beta": "claude-code-20250219,oauth-2025-04-20" } });
+    const attempt = await (0, provider_attempt_1.runProviderAttempt)({
+        operation: "ping",
+        provider,
+        model: runtime.model,
+        classifyError: (error) => runtime.classifyError(error),
+        policy: {
+            maxAttempts: 3,
+            baseDelayMs: 0,
+            backoffMultiplier: 2,
+            ...options.attemptPolicy,
+        },
+        sleep: options.sleep,
+        run: async () => {
+            const controller = new AbortController();
+            /* v8 ignore next -- timeout callback: only fires after 10s, tests resolve faster @preserve */
+            const timeout = setTimeout(() => controller.abort(), PING_TIMEOUT_MS);
+            try {
+                // Minimal API call — no thinking, no reasoning, no tools.
+                if (provider === "anthropic") {
+                    // Use haiku for the ping — setup tokens may not have access to newer
+                    // models, but if haiku works, the credentials are valid.
+                    // Override the beta header to exclude thinking (which requires a
+                    // thinking param in the request body).
+                    const client = runtime.client;
+                    await client.messages.create(createChatPingRequest(ANTHROPIC_SETUP_PING_MODEL), { signal: controller.signal, headers: { "anthropic-beta": "claude-code-20250219,oauth-2025-04-20" } });
+                }
+                else if (provider === "openai-codex") {
+                    await runtime.streamTurn({
+                        messages: createPingMessages(),
+                        activeTools: [],
+                        callbacks: PING_CALLBACKS,
+                        signal: controller.signal,
+                        toolChoiceRequired: false,
+                    });
+                }
+                else {
+                    // OpenAI-compatible providers (azure, minimax, github-copilot)
+                    const client = runtime.client;
+                    await client.chat.completions.create(createChatPingRequest(runtime.model), { signal: controller.signal });
+                }
             }
-            else if (provider === "openai-codex") {
-                await runtime.streamTurn({
-                    messages: createPingMessages(),
-                    activeTools: [],
-                    callbacks: PING_CALLBACKS,
-                    signal: controller.signal,
-                    toolChoiceRequired: false,
-                });
+            finally {
+                clearTimeout(timeout);
             }
-            else {
-                // OpenAI-compatible providers (azure, minimax, github-copilot)
-                const client = runtime.client;
-                await client.chat.completions.create(createChatPingRequest(runtime.model), { signal: controller.signal });
-            }
-            return { ok: true };
-        }
-        finally {
-            clearTimeout(timeout);
-        }
-    }
-    catch (error) {
-        const err = error instanceof Error ? error : /* v8 ignore next -- defensive @preserve */ new Error(String(error));
-        let classification;
-        try {
-            classification = runtime.classifyError(err);
-        }
-        catch {
-            /* v8 ignore next -- defensive: classifyError should not throw @preserve */
-            classification = "unknown";
-        }
-        (0, runtime_1.emitNervesEvent)({
-            component: "engine",
-            event: "engine.provider_ping_fail",
-            message: `provider ping failed: ${provider}`,
-            meta: { provider, classification, error: err.message },
-        });
-        return { ok: false, classification, message: sanitizeErrorMessage(err.message) };
+        },
+    });
+    if (attempt.ok) {
+        return { ok: true, attempts: attempt.attempts };
     }
+    (0, runtime_1.emitNervesEvent)({
+        component: "engine",
+        event: "engine.provider_ping_fail",
+        message: `provider ping failed: ${provider}`,
+        meta: { provider, classification: attempt.classification, error: attempt.error.message },
+    });
+    return {
+        ok: false,
+        classification: attempt.classification,
+        message: sanitizeErrorMessage(attempt.error.message),
+        attempts: attempt.attempts,
+    };
 }
 const PINGABLE_PROVIDERS = ["anthropic", "openai-codex", "azure", "minimax", "github-copilot"];
 async function runHealthInventory(agentName, currentProvider, deps = {}) {

package/dist/heart/session-events.js

@@ -676,11 +676,11 @@ function selectProjectedEventIds(currentMessages, currentEventIds, trimmedMessag
 }
 function buildCanonicalSessionEnvelope(options) {
     const existing = options.existing;
-    // Capture ingress timestamps before sanitization strips extra properties
-    const currentIngressTimes = options.currentMessages.map(getIngressTime);
-    const previousMessages = sanitizeProviderMessages(options.previousMessages);
-    const currentMessages = sanitizeProviderMessages(options.currentMessages);
-    const trimmedMessages = sanitizeProviderMessages(options.trimmedMessages);
+    // Callers pass pre-sanitized messages + pre-captured ingress times.
+    const currentIngressTimes = options.currentIngressTimes ?? options.currentMessages.map(getIngressTime);
+    const previousMessages = options.previousMessages;
+    const currentMessages = options.currentMessages;
+    const trimmedMessages = options.trimmedMessages;
     const previousProjectionIds = existing?.projection.eventIds.length
         ? [...existing.projection.eventIds]
         : existing?.events.map((event) => event.id) ?? [];

package/dist/mind/context.js

@@ -39,6 +39,9 @@ exports.saveSession = saveSession;
 exports.appendSyntheticAssistantMessage = appendSyntheticAssistantMessage;
 exports.loadSession = loadSession;
 exports.postTurn = postTurn;
+exports.postTurnTrim = postTurnTrim;
+exports.postTurnPersist = postTurnPersist;
+exports.deferPostTurnPersist = deferPostTurnPersist;
 exports.deleteSession = deleteSession;
 const config_1 = require("../heart/config");
 const session_events_1 = require("../heart/session-events");
@@ -193,12 +196,14 @@ function writeSessionEnvelope(filePath, envelope) {
 function saveSession(filePath, messages, lastUsage, state) {
     const existing = (0, session_events_1.loadSessionEnvelopeFile)(filePath);
     const previousMessages = existing ? (0, session_events_1.projectProviderMessages)(existing) : [];
+    const currentIngressTimes = messages.map(session_events_1.getIngressTime);
     const sanitized = (0, session_events_1.sanitizeProviderMessages)(messages);
     const envelope = (0, session_events_1.buildCanonicalSessionEnvelope)({
         existing,
         previousMessages,
         currentMessages: sanitized,
         trimmedMessages: sanitized,
+        currentIngressTimes,
         recordedAt: new Date().toISOString(),
         lastUsage: lastUsage ?? null,
         state,
@@ -247,7 +252,19 @@ function loadSession(filePath) {
         return null;
     }
 }
+/**
+ * Synchronous post-turn: sanitize, trim (mutates messages in place), and persist to disk.
+ * For non-blocking persist, use postTurnTrim() + deferPostTurnPersist() instead.
+ */
 function postTurn(messages, sessPath, usage, hooks, state) {
+    const prepared = postTurnTrim(messages, usage, hooks);
+    postTurnPersist(sessPath, prepared, usage, state);
+}
+/**
+ * Synchronous phase: run hooks, sanitize, trim, and mutate the messages array in place.
+ * Returns the data needed by postTurnPersist / deferPostTurnPersist.
+ */
+function postTurnTrim(messages, usage, hooks) {
     const preTrimMessages = [...messages];
     if (hooks?.beforeTrim) {
         try {
@@ -266,26 +283,59 @@ function postTurn(messages, sessPath, usage, hooks, state) {
         }
     }
     const { maxTokens, contextMargin } = (0, config_1.getContextConfig)();
+    const currentIngressTimes = messages.map(session_events_1.getIngressTime);
     const currentMessages = (0, session_events_1.sanitizeProviderMessages)(messages);
-    const trimmed = trimMessages(currentMessages, maxTokens, contextMargin, usage?.input_tokens);
-    messages.splice(0, messages.length, ...trimmed);
+    const trimmedMessages = trimMessages(currentMessages, maxTokens, contextMargin, usage?.input_tokens);
+    messages.splice(0, messages.length, ...trimmedMessages);
+    return { currentMessages, trimmedMessages, currentIngressTimes, maxTokens, contextMargin };
+}
+/**
+ * Synchronous persist: load existing envelope, build canonical envelope, write to disk.
+ */
+function postTurnPersist(sessPath, prepared, usage, state) {
     const existing = (0, session_events_1.loadSessionEnvelopeFile)(sessPath);
     const previousMessages = existing ? (0, session_events_1.projectProviderMessages)(existing) : [];
     const envelope = (0, session_events_1.buildCanonicalSessionEnvelope)({
         existing,
         previousMessages,
-        currentMessages,
-        trimmedMessages: trimmed,
+        currentMessages: prepared.currentMessages,
+        trimmedMessages: prepared.trimmedMessages,
+        currentIngressTimes: prepared.currentIngressTimes,
         recordedAt: new Date().toISOString(),
         lastUsage: usage ?? null,
         state,
         projectionBasis: {
-            maxTokens,
-            contextMargin,
+            maxTokens: prepared.maxTokens,
+            contextMargin: prepared.contextMargin,
             inputTokens: usage?.input_tokens ?? null,
         },
     });
     writeSessionEnvelope(sessPath, envelope);
+    return envelope.events;
+}
+/**
+ * Deferred persist: same as postTurnPersist but runs on the next event loop tick.
+ * Returns a promise that resolves when the persist completes.
+ */
+function deferPostTurnPersist(sessPath, prepared, usage, state) {
+    return new Promise((resolve) => {
+        setImmediate(() => {
+            try {
+                const events = postTurnPersist(sessPath, prepared, usage, state);
+                resolve(events);
+            }
+            catch (err) {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "mind",
+                    event: "mind.deferred_persist_error",
+                    message: "deferred session persist failed",
+                    meta: { error: err instanceof Error ? err.message : String(err) },
+                });
+                resolve([]);
+            }
+        });
+    });
 }
 function deleteSession(filePath) {
     try {

package/dist/senses/cli.js

@@ -1009,8 +1009,10 @@ async function main(agentName, options) {
             lastActivityAt: sessionState?.lastFriendActivityAt,
             _testInputSource: options?._testInputSource,
             onAsyncAssistantMessage: async (messages, _assistantMessage) => {
-                (0, context_1.postTurn)(messages, sessPath, undefined, undefined, sessionState);
-                sessionEvents = (0, context_1.loadSession)(sessPath)?.events ?? sessionEvents;
+                const prepared = (0, context_1.postTurnTrim)(messages);
+                const events = (0, context_1.postTurnPersist)(sessPath, prepared, undefined, sessionState);
+                /* v8 ignore next -- defensive: postTurnPersist always returns events in practice @preserve */
+                sessionEvents = events.length > 0 ? events : sessionEvents;
             },
             runTurn: async (messages, userInput, callbacks, signal, toolContext, userContent) => {
                 // Run the full per-turn pipeline: resolve -> gate -> session -> drain -> runAgent -> postTurn -> tokens
@@ -1022,9 +1024,10 @@ async function main(agentName, options) {
                 /* v8 ignore start -- failover-aware callback wrapper: tested via pipeline integration @preserve */
                 const failoverAwareCallbacks = {
                     ...callbacks,
-                    // Save session after each tool result for crash recovery
+                    // Save session after each tool result for crash recovery (deferred to avoid blocking)
                     onToolResult: (turnMessages) => {
-                        (0, context_1.postTurn)(turnMessages, sessPath, undefined, undefined, sessionState);
+                        const prepared = (0, context_1.postTurnTrim)(turnMessages);
+                        (0, context_1.deferPostTurnPersist)(sessPath, prepared, undefined, sessionState);
                     },
                     onError: (error, severity) => {
                         if (severity === "terminal" && failoverState) {
@@ -1069,9 +1072,14 @@ async function main(agentName, options) {
                         },
                     }),
                     postTurn: (turnMessages, sessionPathArg, usage, hooks, state) => {
-                        (0, context_1.postTurn)(turnMessages, sessionPathArg, usage, hooks, state);
+                        // Trim synchronously (mutates turnMessages for next turn),
+                        // then defer envelope build + disk I/O to avoid blocking the TUI.
+                        const prepared = (0, context_1.postTurnTrim)(turnMessages, usage, hooks);
                         sessionState = state;
-                        sessionEvents = (0, context_1.loadSession)(sessionPathArg)?.events ?? sessionEvents;
+                        (0, context_1.deferPostTurnPersist)(sessionPathArg, prepared, usage, state).then((events) => {
+                            /* v8 ignore next -- defensive: deferPostTurnPersist always resolves events in practice @preserve */
+                            sessionEvents = events.length > 0 ? events : sessionEvents;
+                        });
                     },
                     accumulateFriendTokens: tokens_1.accumulateFriendTokens,
                     signal,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.346",
+  "version": "0.1.0-alpha.348",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",