@alfe.ai/gateway 0.3.1 → 0.4.0

package/dist/bin/gateway.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as installService, c as uninstallService, i as checkExistingDaemon, n as queryDaemonHealth, r as startDaemon, s as stopExistingDaemon, t as formatHealthReport, y as SOCKET_PATH } from "../health.js";
+import { S as SOCKET_PATH, a as installService, c as uninstallService, i as checkExistingDaemon, n as queryDaemonHealth, r as startDaemon, s as stopExistingDaemon, t as formatHealthReport } from "../health.js";
 import { t as LOG_FILE } from "../logger.js";
 import { spawn } from "node:child_process";
 //#region bin/gateway.ts

package/dist/health.js

@@ -111,6 +111,7 @@ const ID_PREFIXES = {
 	directGrant: "dgr",
 	revision: "rev",
 	fact: "kfc",
+	changeRequest: "chr",
 	oauthConnection: "con",
 	channel: "chn",
 	oauthConnectionRequest: "crq",
@@ -4757,6 +4758,13 @@ enumValues({
 	InProgress: "in-progress",
 	Done: "done"
 });
+enumValues({
+	Open: "open",
+	Approved: "approved",
+	Rejected: "rejected",
+	Withdrawn: "withdrawn",
+	Superseded: "superseded"
+});
 enumValues({ Flex: "flex" });
 enumValues({
 	Provisioning: "provisioning",
@@ -5358,14 +5366,30 @@ var NoopRuntimeGate = class {
 * both places.
 */
 const AGENT_DAEMON_SENTRY_DSN = "https://a47f010d8d39fb4350f913492189f283@o4511008239452160.ingest.us.sentry.io/4511679448547328";
+const CLI_SENTRY_DSN = "https://82dde4631336561f2fcc89d7531623de@o4511008239452160.ingest.us.sentry.io/4511679411191808";
+/**
+* Dedicated project for errors emitted BY the agent runtime child process
+* (OpenClaw/Hermes) — crashes, spawn failures, and error-looking output. Kept
+* separate from `agent-daemon` so runtime noise never drowns daemon issues.
+* Mirrors `SENTRY_DSNS.agentRuntime` in `config/config.ts`.
+*/
+const AGENT_RUNTIME_SENTRY_DSN = "https://feb7fb2e3b8e723aec518e74715bfa6d@o4511008239452160.ingest.us.sentry.io/4511683667558400";
 /** Surface → Sentry project: `cli` and `agent-daemon` respectively. */
 const SURFACE_DSNS = {
-	cli: "https://82dde4631336561f2fcc89d7531623de@o4511008239452160.ingest.us.sentry.io/4511679411191808",
+	cli: CLI_SENTRY_DSN,
 	daemon: AGENT_DAEMON_SENTRY_DSN
 };
 /** Held after a successful init so the capture helpers can run synchronously. */
 let sentry = null;
 /**
+* Second client for the `agent-runtime` project (daemon surface only). The
+* default client keeps the daemon's own DSN; runtime child-process events are
+* routed here via an explicitly-bound Scope — the documented multi-client
+* pattern. `null` until `initAgentSentry({ surface: "daemon" })` succeeds.
+*/
+let runtimeClient = null;
+let runtimeScope = null;
+/**
 * Map the configured API URL to a coarse environment tag. Best-effort — returns
 * `"unknown"` when no config is present yet (e.g. `alfe login` pre-setup).
 */
@@ -5396,12 +5420,13 @@ function errorReportingDisabled() {
 	} catch {}
 	return false;
 }
-const KV_SECRET_RE = /\b(authorization|api[_-]?key|apikey|token|secret|password|passwd|bearer)\b(\s*[:=]\s*|\s+)("?)([^\s"']+)\3/gi;
+const KV_SECRET_RE = /(?<![A-Za-z0-9])([A-Za-z0-9_-]*(?:authorization|api[_-]?key|apikey|token|secret|password|passwd|bearer|credential)s?)(\s*[:=]\s*|\s+)("?)([^\s"']+)\3/gi;
+const URL_QUERY_SECRET_RE = /([?&](?:[A-Za-z0-9_-]*(?:token|secret|key|signature|credential|password)|sig|code|x-amz-[a-z-]+)=)[^&\s"']+/gi;
 const MIN_BARE_SECRET_LEN = 16;
 const ALFE_TOKEN_RE = /alfe_(?:dev|test|demo|live)_[A-Za-z0-9._-]+/g;
 const BEARER_RE = /\bbearer\s+[A-Za-z0-9._\-+/=]+/gi;
 function scrubString(value) {
-	return value.replace(BEARER_RE, "Bearer [REDACTED]").replace(KV_SECRET_RE, (match, label, sep, _q, secret) => {
+	return value.replace(BEARER_RE, "Bearer [REDACTED]").replace(URL_QUERY_SECRET_RE, "$1[REDACTED]").replace(KV_SECRET_RE, (match, label, sep, _q, secret) => {
 		if (!/[:=]/.test(sep) && secret.length < MIN_BARE_SECRET_LEN) return match;
 		return `${label}${sep}[REDACTED]`;
 	}).replace(ALFE_TOKEN_RE, "alfe_[REDACTED]");
@@ -5445,6 +5470,33 @@ async function initAgentSentry(options) {
 		const dsn = SURFACE_DSNS[options.surface].trim();
 		if (!dsn) return;
 		const mod = await import("@sentry/node");
+		if (options.surface === "daemon" && !runtimeScope) try {
+			const dsn = AGENT_RUNTIME_SENTRY_DSN.trim();
+			{
+				const client = new mod.NodeClient({
+					dsn,
+					environment: deriveEnvironment(),
+					...options.release ? { release: options.release } : {},
+					sampleRate: 1,
+					tracesSampleRate: 0,
+					sendDefaultPii: false,
+					transport: mod.makeNodeTransport,
+					stackParser: mod.defaultStackParser,
+					integrations: [],
+					beforeSend: (event) => scrubEvent(event)
+				});
+				client.init();
+				const scope = new mod.Scope();
+				scope.setClient(client);
+				const runtime = deriveRuntime();
+				if (runtime) scope.setTag("runtime", runtime);
+				runtimeClient = client;
+				runtimeScope = scope;
+			}
+		} catch {
+			runtimeClient = null;
+			runtimeScope = null;
+		}
 		if (mod.getClient()) {
 			sentry = mod;
 			return;
@@ -5456,6 +5508,7 @@ async function initAgentSentry(options) {
 			sampleRate: 1,
 			tracesSampleRate: 0,
 			sendDefaultPii: false,
+			...options.surface === "daemon" ? { integrations: (defaults) => defaults.filter((i) => i.name !== "OnUncaughtException" && i.name !== "OnUnhandledRejection") } : {},
 			beforeSend: (event) => scrubEvent(event),
 			beforeBreadcrumb: (breadcrumb) => scrubBreadcrumb(breadcrumb)
 		});
@@ -5476,6 +5529,10 @@ function setAgentContext(context) {
 	try {
 		if (context.agentId) sentry.setTag("agentId", context.agentId);
 		if (context.runtime) sentry.setTag("runtime", context.runtime);
+		if (runtimeScope) {
+			if (context.agentId) runtimeScope.setTag("agentId", context.agentId);
+			if (context.runtime) runtimeScope.setTag("runtime", context.runtime);
+		}
 	} catch {}
 }
 /**
@@ -5520,8 +5577,75 @@ function captureCliFailure(context, cause) {
 		});
 	} catch {}
 }
+/**
+* Capture a runtime child-process crash (non-graceful exit) or spawn failure
+* into the dedicated `agent-runtime` project. Recent output travels as
+* breadcrumbs — NEVER `extra`, which `scrubEvent` (the runtime client's
+* `beforeSend`) deletes. Throttling is the caller's job (`CaptureThrottle` in
+* `runtime-output-monitor.ts`). No-op when the runtime client is not
+* initialised. Never throws.
+*/
+function captureRuntimeCrash(opts) {
+	if (!runtimeScope) return;
+	try {
+		const scope = runtimeScope.clone();
+		for (const { stream, line } of opts.recentOutput) scope.addBreadcrumb({
+			category: `runtime.${stream}`,
+			level: stream === "stderr" ? "warning" : "info",
+			message: line
+		});
+		const crashKey = opts.spawnError ? `spawn:${opts.spawnError.code ?? "error"}` : String(opts.code ?? opts.signal ?? "unknown");
+		scope.setFingerprint([
+			"runtime-crash",
+			opts.runtime,
+			crashKey
+		]);
+		scope.setTags({
+			runtime: opts.runtime,
+			exitCode: String(opts.code),
+			signal: String(opts.signal),
+			crashesSuppressed: String(opts.crashesSuppressed ?? 0)
+		});
+		if (opts.spawnError) scope.captureException(opts.spawnError);
+		else scope.captureMessage(`Runtime ${opts.runtime} crashed (code=${String(opts.code)}, signal=${String(opts.signal)})`, "error");
+	} catch {}
+}
+/**
+* Capture an error-looking block of runtime output (stack trace, Python
+* traceback, or ERROR-level log line) detected while the child is running.
+* The block lines travel as breadcrumbs; the head line is the message.
+* Throttling/dedupe is the caller's job. No-op when Sentry is not initialised.
+* Never throws.
+*/
+function captureRuntimeErrorOutput(opts) {
+	if (!runtimeScope) return;
+	try {
+		const scope = runtimeScope.clone();
+		for (const line of opts.lines) scope.addBreadcrumb({
+			category: `runtime.${opts.stream}`,
+			level: "error",
+			message: line
+		});
+		scope.setFingerprint([
+			"runtime-output",
+			opts.runtime,
+			opts.kind,
+			opts.fingerprintKey
+		]);
+		scope.setTags({
+			runtime: opts.runtime,
+			stream: opts.stream,
+			kind: opts.kind,
+			suppressedCount: String(opts.suppressedCount ?? 0)
+		});
+		scope.captureMessage(opts.lines[0].slice(0, 300), "error");
+	} catch {}
+}
 /** Flush queued events (small timeout) so short-lived commands deliver them. */
 async function flushSentry(timeoutMs = 2e3) {
+	try {
+		if (runtimeClient) await runtimeClient.flush(timeoutMs);
+	} catch {}
 	if (!sentry) return;
 	try {
 		await sentry.flush(timeoutMs);
@@ -21972,6 +22096,177 @@ function createLogger(component, additionalData) {
 		component
 	});
 }
+const ANSI_RE = /\x1b\[[0-9;]*[A-Za-z]/g;
+function stripAnsi(line) {
+	return line.replace(ANSI_RE, "");
+}
+/** Rolling window of the child's most recent output lines (both streams). */
+var OutputRingBuffer = class {
+	lines = [];
+	push(line) {
+		this.lines.push({
+			stream: line.stream,
+			line: line.line.length > 500 ? line.line.slice(0, 500) : line.line
+		});
+		if (this.lines.length > 50) this.lines.shift();
+	}
+	/** Oldest → newest copy. */
+	snapshot() {
+		return this.lines.map((l) => ({ ...l }));
+	}
+};
+const PY_TRACEBACK_START = "Traceback (most recent call last):";
+const NODE_ERROR_HEAD = /^\s*(?:Uncaught\s+|Unhandled\w*\s+)?[A-Z][A-Za-z0-9_]*(?:Error|Exception)\b\s*[:(]/;
+const LOG_ERROR_LEVEL = /^.{0,40}(?:\[(?:ERROR|FATAL|CRITICAL)\]|\b(?:ERROR|FATAL|CRITICAL)\b\s*[:|])/;
+const JSON_ERROR_LEVEL = /"level"\s*:\s*(?:"(?:error|fatal)"|(?:50|60)\b)/;
+const NODE_FRAME = /^\s+at\s/;
+const NODE_CAUSE = /^\s*caused by:?/i;
+const NODE_CHAINED = /^\s*[A-Z][A-Za-z0-9_]*(?:Error|Exception)\b\s*:/;
+const PY_FILE = /^\s*File "/;
+const PY_INDENTED = /^\s{2,}\S/;
+const PY_TERMINAL = /^[A-Za-z_][\w.]*(?:Error|Exception|Interrupt)?:/;
+/** Digits/hex-stripped, lowercased head line — stable across timestamps/ids. */
+function toFingerprintKey(head) {
+	return head.toLowerCase().replace(/\b0x[0-9a-f]+\b/g, "<hex>").replace(/\d+/g, "<n>").trim().slice(0, 120);
+}
+function compact(blocks) {
+	return blocks.filter((b) => b !== null);
+}
+/**
+* Stateful multi-line error detector. Feed lines (per stream) as they arrive;
+* returns the blocks completed by that line (usually zero or one — two when a
+* line closes a pending block AND is itself a single-line error-log block).
+* Call `flush()` on quiet periods / process exit to complete a trailing block.
+*/
+var ErrorLineDetector = class {
+	pending = null;
+	get isCollecting() {
+		return this.pending !== null;
+	}
+	feed(stream, rawLine) {
+		const line = stripAnsi(rawLine);
+		if (this.pending) {
+			if (stream === this.pending.stream && this.isContinuation(line)) {
+				this.pending.lines.push(line);
+				if (NODE_FRAME.test(line)) this.pending.sawFrame = true;
+				if (this.pending.kind === "python-traceback" && PY_TERMINAL.test(line) && !PY_FILE.test(line) || this.pending.lines.length >= 40) return compact([this.finish()]);
+				return [];
+			}
+			return compact([this.finish(), this.startOrDetect(stream, line)]);
+		}
+		return compact([this.startOrDetect(stream, line)]);
+	}
+	/** Force-complete a pending block (debounce timeout / process exit). */
+	flush() {
+		return this.finish();
+	}
+	startOrDetect(stream, line) {
+		if (line.trim() === "") return null;
+		if (line.startsWith(PY_TRACEBACK_START)) {
+			this.pending = {
+				kind: "python-traceback",
+				stream,
+				lines: [line],
+				sawFrame: true
+			};
+			return null;
+		}
+		if (LOG_ERROR_LEVEL.test(line) || JSON_ERROR_LEVEL.test(line)) return {
+			kind: "error-log",
+			stream,
+			lines: [line.slice(0, 500)],
+			fingerprintKey: toFingerprintKey(line)
+		};
+		if (NODE_ERROR_HEAD.test(line)) {
+			this.pending = {
+				kind: "node-stack",
+				stream,
+				lines: [line],
+				sawFrame: false
+			};
+			return null;
+		}
+		return null;
+	}
+	isContinuation(line) {
+		if (!this.pending) return false;
+		if (this.pending.kind === "python-traceback") return PY_FILE.test(line) || PY_INDENTED.test(line) || PY_TERMINAL.test(line);
+		return NODE_FRAME.test(line) || NODE_CAUSE.test(line) || NODE_CHAINED.test(line);
+	}
+	finish() {
+		const pending = this.pending;
+		this.pending = null;
+		if (!pending) return null;
+		if (pending.kind === "node-stack" && !pending.sawFrame) return null;
+		return {
+			kind: pending.kind,
+			stream: pending.stream,
+			lines: pending.lines.map((l) => l.slice(0, 500)),
+			fingerprintKey: toFingerprintKey(pending.lines[0])
+		};
+	}
+};
+/**
+* Bounds Sentry quota per RuntimeProcess. Worst case per agent:
+* ≤ `ERROR_CAPTURES_MAX` output events + ≤ 1 crash event per 10-minute window.
+*/
+var CaptureThrottle = class {
+	windowStart = 0;
+	windowCount = 0;
+	errorsSuppressed = 0;
+	lastSentByKey = /* @__PURE__ */ new Map();
+	lastCrashCaptureAt = 0;
+	hasCapturedCrash = false;
+	crashesSuppressed = 0;
+	constructor(stableUptimeMs) {
+		this.stableUptimeMs = stableUptimeMs;
+	}
+	allowErrorCapture(fingerprintKey, now = Date.now()) {
+		if (now - this.windowStart >= 6e5) {
+			this.windowStart = now;
+			this.windowCount = 0;
+		}
+		const lastSent = this.lastSentByKey.get(fingerprintKey);
+		if (lastSent !== void 0 && now - lastSent < 6e5 || this.windowCount >= 5) {
+			this.errorsSuppressed++;
+			return {
+				allow: false,
+				suppressedCount: this.errorsSuppressed
+			};
+		}
+		this.windowCount++;
+		this.lastSentByKey.set(fingerprintKey, now);
+		if (this.lastSentByKey.size > 50) {
+			const oldest = this.lastSentByKey.keys().next().value;
+			if (oldest !== void 0) this.lastSentByKey.delete(oldest);
+		}
+		const suppressed = this.errorsSuppressed;
+		this.errorsSuppressed = 0;
+		return {
+			allow: true,
+			suppressedCount: suppressed
+		};
+	}
+	allowCrashCapture(uptimeMs, now = Date.now()) {
+		const stable = uptimeMs >= this.stableUptimeMs;
+		const throttled = this.hasCapturedCrash && now - this.lastCrashCaptureAt < 6e5;
+		if (!stable && throttled) {
+			this.crashesSuppressed++;
+			return {
+				allow: false,
+				suppressedCount: this.crashesSuppressed
+			};
+		}
+		this.hasCapturedCrash = true;
+		this.lastCrashCaptureAt = now;
+		const suppressed = this.crashesSuppressed;
+		this.crashesSuppressed = 0;
+		return {
+			allow: true,
+			suppressedCount: suppressed
+		};
+	}
+};
 //#endregion
 //#region src/runtime-process.ts
 /**
@@ -21981,14 +22276,22 @@ function createLogger(component, additionalData) {
 * and restarts on crash with exponential backoff.
 */
 const log$1 = createLogger("RuntimeProcess");
+/** Quiet-period flush for a pending multi-line error block (e.g. a traceback
+* followed by silence — no closing line ever arrives to complete it). */
+const DETECTOR_FLUSH_DEBOUNCE_MS = 1500;
 const BACKOFF_INITIAL_MS = 1e3;
 const BACKOFF_MAX_MS = 3e4;
+const STABLE_UPTIME_MS = 6e4;
 var RuntimeProcess = class {
 	child = null;
 	stopped = false;
 	backoffMs = BACKOFF_INITIAL_MS;
 	lastStartTime = 0;
 	restartTimer = null;
+	ringBuffer = new OutputRingBuffer();
+	detector = new ErrorLineDetector();
+	throttle = new CaptureThrottle(STABLE_UPTIME_MS);
+	detectorFlushTimer = null;
 	constructor(options) {
 		this.options = options;
 	}
@@ -22039,17 +22342,23 @@ var RuntimeProcess = class {
 		});
 		this.child.stdout?.on("data", (data) => {
 			const lines = data.toString().trim().split("\n");
-			for (const line of lines) log$1.info({
-				runtime: this.options.runtime,
-				stream: "stdout"
-			}, line);
+			for (const line of lines) {
+				log$1.info({
+					runtime: this.options.runtime,
+					stream: "stdout"
+				}, line);
+				this.observeLine("stdout", line);
+			}
 		});
 		this.child.stderr?.on("data", (data) => {
 			const lines = data.toString().trim().split("\n");
-			for (const line of lines) log$1.warn({
-				runtime: this.options.runtime,
-				stream: "stderr"
-			}, line);
+			for (const line of lines) {
+				log$1.warn({
+					runtime: this.options.runtime,
+					stream: "stderr"
+				}, line);
+				this.observeLine("stderr", line);
+			}
 		});
 		this.child.on("exit", (code, signal) => {
 			this.child = null;
@@ -22078,7 +22387,26 @@ var RuntimeProcess = class {
 				signal,
 				backoffMs: this.backoffMs
 			}, "Runtime crashed — scheduling restart with backoff");
-			if (Date.now() - this.lastStartTime >= 6e4) this.backoffMs = BACKOFF_INITIAL_MS;
+			const uptime = Date.now() - this.lastStartTime;
+			if (this.detectorFlushTimer) {
+				clearTimeout(this.detectorFlushTimer);
+				this.detectorFlushTimer = null;
+			}
+			this.emitErrorBlock(this.detector.flush());
+			const crash = this.throttle.allowCrashCapture(uptime);
+			if (crash.allow) captureRuntimeCrash({
+				runtime: this.options.runtime,
+				code,
+				signal,
+				uptimeMs: uptime,
+				recentOutput: this.ringBuffer.snapshot(),
+				crashesSuppressed: crash.suppressedCount
+			});
+			else log$1.debug({
+				runtime: this.options.runtime,
+				suppressed: crash.suppressedCount
+			}, "Crash capture suppressed by throttle");
+			if (uptime >= 6e4) this.backoffMs = BACKOFF_INITIAL_MS;
 			this.restartTimer = setTimeout(() => {
 				this.restartTimer = null;
 				this.start();
@@ -22090,6 +22418,66 @@ var RuntimeProcess = class {
 				runtime: this.options.runtime,
 				err: err.message
 			}, "Runtime process error");
+			if (this.stopped) return;
+			const crash = this.throttle.allowCrashCapture(Date.now() - this.lastStartTime);
+			if (crash.allow) captureRuntimeCrash({
+				runtime: this.options.runtime,
+				code: null,
+				signal: null,
+				uptimeMs: Date.now() - this.lastStartTime,
+				recentOutput: this.ringBuffer.snapshot(),
+				crashesSuppressed: crash.suppressedCount,
+				spawnError: err
+			});
+		});
+	}
+	/**
+	* Track a child output line for error capture: ring-buffer it (crash
+	* context) and run it through the error-block detector. A pending
+	* multi-line block is flushed after a quiet period so a trailing traceback
+	* isn't held forever.
+	*/
+	observeLine(stream, line) {
+		try {
+			this.ringBuffer.push({
+				stream,
+				line
+			});
+			for (const block of this.detector.feed(stream, line)) this.emitErrorBlock(block);
+			if (this.detectorFlushTimer) {
+				clearTimeout(this.detectorFlushTimer);
+				this.detectorFlushTimer = null;
+			}
+			if (this.detector.isCollecting) this.detectorFlushTimer = setTimeout(() => {
+				this.detectorFlushTimer = null;
+				this.emitErrorBlock(this.detector.flush());
+			}, DETECTOR_FLUSH_DEBOUNCE_MS);
+		} catch (err) {
+			log$1.debug({
+				runtime: this.options.runtime,
+				err: err instanceof Error ? err.message : String(err)
+			}, "Runtime output observation failed");
+		}
+	}
+	/** Report a completed error block to Sentry, throttle permitting. */
+	emitErrorBlock(block) {
+		if (!block) return;
+		const { allow, suppressedCount } = this.throttle.allowErrorCapture(block.fingerprintKey);
+		if (!allow) {
+			log$1.debug({
+				runtime: this.options.runtime,
+				kind: block.kind,
+				suppressed: suppressedCount
+			}, "Runtime error-output capture suppressed by throttle");
+			return;
+		}
+		captureRuntimeErrorOutput({
+			runtime: this.options.runtime,
+			stream: block.stream,
+			kind: block.kind,
+			lines: block.lines,
+			fingerprintKey: block.fingerprintKey,
+			suppressedCount
 		});
 	}
 	/**
@@ -22101,6 +22489,11 @@ var RuntimeProcess = class {
 			clearTimeout(this.restartTimer);
 			this.restartTimer = null;
 		}
+		if (this.detectorFlushTimer) {
+			clearTimeout(this.detectorFlushTimer);
+			this.detectorFlushTimer = null;
+		}
+		this.emitErrorBlock(this.detector.flush());
 		const child = this.child;
 		if (!child) return;
 		return new Promise((resolve) => {
@@ -22812,6 +23205,21 @@ async function startDaemon() {
 		surface: "daemon",
 		release: await getCliVersion()
 	});
+	let fatalExiting = false;
+	process.on("uncaughtException", (err) => {
+		if (fatalExiting) process.exit(1);
+		fatalExiting = true;
+		logger$1.error({
+			err: err.message,
+			stack: err.stack
+		}, "Uncaught exception — daemon exiting");
+		captureFatal(err);
+		flushAndExit(1);
+	});
+	process.on("unhandledRejection", (reason) => {
+		logger$1.error({ reason: reason instanceof Error ? reason.message : String(reason) }, "Unhandled promise rejection");
+		captureFatal(reason instanceof Error ? reason : /* @__PURE__ */ new Error(`Unhandled rejection: ${String(reason)}`));
+	});
 	if (!managed) {
 		await mkdir(join(homedir(), ".alfe"), { recursive: true });
 		const existingPid = await checkExistingDaemon();
@@ -23799,4 +24207,4 @@ function formatDuration(ms) {
 	return `${String(Math.round(seconds / 3600))}h`;
 }
 //#endregion
-export { PINNED_OPENCLAW_VERSION as C, resolveAgentIdentity as S, ALFE_DIR as _, installService as a, fetchAgentConfig as b, uninstallService as c, captureFatal as d, captureIntegrationFailure as f, PROTOCOL_VERSION as g, setAgentContext as h, checkExistingDaemon as i, AGENT_DAEMON_SENTRY_DSN as l, initAgentSentry as m, queryDaemonHealth as n, startService as o, flushSentry as p, startDaemon as r, stopExistingDaemon as s, formatHealthReport as t, captureCliFailure as u, PID_PATH as v, loadDaemonConfig as x, SOCKET_PATH as y };
+export { fetchAgentConfig as C, PINNED_OPENCLAW_VERSION as E, SOCKET_PATH as S, resolveAgentIdentity as T, initAgentSentry as _, installService as a, ALFE_DIR as b, uninstallService as c, captureCliFailure as d, captureFatal as f, flushSentry as g, captureRuntimeErrorOutput as h, checkExistingDaemon as i, AGENT_DAEMON_SENTRY_DSN as l, captureRuntimeCrash as m, queryDaemonHealth as n, startService as o, captureIntegrationFailure as p, startDaemon as r, stopExistingDaemon as s, formatHealthReport as t, AGENT_RUNTIME_SENTRY_DSN as u, setAgentContext as v, loadDaemonConfig as w, PID_PATH as x, PROTOCOL_VERSION as y };

package/dist/src/index.d.ts

@@ -74,6 +74,13 @@ declare const PINNED_OPENCLAW_VERSION = "2026.6.8";
  * both places.
  */
 declare const AGENT_DAEMON_SENTRY_DSN = "https://a47f010d8d39fb4350f913492189f283@o4511008239452160.ingest.us.sentry.io/4511679448547328";
+/**
+ * Dedicated project for errors emitted BY the agent runtime child process
+ * (OpenClaw/Hermes) — crashes, spawn failures, and error-looking output. Kept
+ * separate from `agent-daemon` so runtime noise never drowns daemon issues.
+ * Mirrors `SENTRY_DSNS.agentRuntime` in `config/config.ts`.
+ */
+declare const AGENT_RUNTIME_SENTRY_DSN = "https://feb7fb2e3b8e723aec518e74715bfa6d@o4511008239452160.ingest.us.sentry.io/4511683667558400";
 /** Which surface initialised Sentry — tagged on every event. */
 type SentrySurface = "cli" | "daemon";
 interface InitAgentSentryOptions {
@@ -112,6 +119,44 @@ declare function captureIntegrationFailure(integration: string, phase: string, c
  * Sentry is not initialised. Never throws.
  */
 declare function captureCliFailure(context: string, cause?: unknown): void;
+/** A line of runtime child-process output attached to a crash event. */
+interface RuntimeOutputLine {
+  stream: "stdout" | "stderr";
+  line: string;
+}
+/**
+ * Capture a runtime child-process crash (non-graceful exit) or spawn failure
+ * into the dedicated `agent-runtime` project. Recent output travels as
+ * breadcrumbs — NEVER `extra`, which `scrubEvent` (the runtime client's
+ * `beforeSend`) deletes. Throttling is the caller's job (`CaptureThrottle` in
+ * `runtime-output-monitor.ts`). No-op when the runtime client is not
+ * initialised. Never throws.
+ */
+declare function captureRuntimeCrash(opts: {
+  runtime: string;
+  code: number | null;
+  signal: string | null;
+  uptimeMs: number;
+  recentOutput: readonly RuntimeOutputLine[];
+  crashesSuppressed?: number;
+  /** Set for the child `error` event path (e.g. ENOENT — binary missing). */
+  spawnError?: Error;
+}): void;
+/**
+ * Capture an error-looking block of runtime output (stack trace, Python
+ * traceback, or ERROR-level log line) detected while the child is running.
+ * The block lines travel as breadcrumbs; the head line is the message.
+ * Throttling/dedupe is the caller's job. No-op when Sentry is not initialised.
+ * Never throws.
+ */
+declare function captureRuntimeErrorOutput(opts: {
+  runtime: string;
+  stream: "stdout" | "stderr";
+  kind: "node-stack" | "python-traceback" | "error-log";
+  lines: readonly string[];
+  fingerprintKey: string;
+  suppressedCount?: number;
+}): void;
 /** Flush queued events (small timeout) so short-lived commands deliver them. */
 declare function flushSentry(timeoutMs?: number): Promise<void>;
 /**
@@ -293,4 +338,4 @@ declare function checkExistingDaemon(): Promise<number | null>;
  */
 declare function stopExistingDaemon(): Promise<boolean>;
 //#endregion
-export { AGENT_DAEMON_SENTRY_DSN, ALFE_DIR, type AgentIdentity, type AgentWorkspaceConfig, type DaemonConfig, type DaemonHealth, type IPCEvent, type IPCRequest, type IPCResponse, type InitAgentSentryOptions, PID_PATH, PINNED_OPENCLAW_VERSION, PROTOCOL_VERSION, SOCKET_PATH, type SentrySurface, captureCliFailure, captureFatal, captureIntegrationFailure, checkExistingDaemon, fetchAgentConfig, flushSentry, formatHealthReport, initAgentSentry, installService, loadDaemonConfig, logger, queryDaemonHealth, resolveAgentIdentity, setAgentContext, startDaemon, startService, stopExistingDaemon, uninstallService };
+export { AGENT_DAEMON_SENTRY_DSN, AGENT_RUNTIME_SENTRY_DSN, ALFE_DIR, type AgentIdentity, type AgentWorkspaceConfig, type DaemonConfig, type DaemonHealth, type IPCEvent, type IPCRequest, type IPCResponse, type InitAgentSentryOptions, PID_PATH, PINNED_OPENCLAW_VERSION, PROTOCOL_VERSION, type RuntimeOutputLine, SOCKET_PATH, type SentrySurface, captureCliFailure, captureFatal, captureIntegrationFailure, captureRuntimeCrash, captureRuntimeErrorOutput, checkExistingDaemon, fetchAgentConfig, flushSentry, formatHealthReport, initAgentSentry, installService, loadDaemonConfig, logger, queryDaemonHealth, resolveAgentIdentity, setAgentContext, startDaemon, startService, stopExistingDaemon, uninstallService };

package/dist/src/index.js

@@ -1,3 +1,3 @@
-import { C as PINNED_OPENCLAW_VERSION, S as resolveAgentIdentity, _ as ALFE_DIR, a as installService, b as fetchAgentConfig, c as uninstallService, d as captureFatal, f as captureIntegrationFailure, g as PROTOCOL_VERSION, h as setAgentContext, i as checkExistingDaemon, l as AGENT_DAEMON_SENTRY_DSN, m as initAgentSentry, n as queryDaemonHealth, o as startService, p as flushSentry, r as startDaemon, s as stopExistingDaemon, t as formatHealthReport, u as captureCliFailure, v as PID_PATH, x as loadDaemonConfig, y as SOCKET_PATH } from "../health.js";
+import { C as fetchAgentConfig, E as PINNED_OPENCLAW_VERSION, S as SOCKET_PATH, T as resolveAgentIdentity, _ as initAgentSentry, a as installService, b as ALFE_DIR, c as uninstallService, d as captureCliFailure, f as captureFatal, g as flushSentry, h as captureRuntimeErrorOutput, i as checkExistingDaemon, l as AGENT_DAEMON_SENTRY_DSN, m as captureRuntimeCrash, n as queryDaemonHealth, o as startService, p as captureIntegrationFailure, r as startDaemon, s as stopExistingDaemon, t as formatHealthReport, u as AGENT_RUNTIME_SENTRY_DSN, v as setAgentContext, w as loadDaemonConfig, x as PID_PATH, y as PROTOCOL_VERSION } from "../health.js";
 import { n as logger } from "../logger.js";
-export { AGENT_DAEMON_SENTRY_DSN, ALFE_DIR, PID_PATH, PINNED_OPENCLAW_VERSION, PROTOCOL_VERSION, SOCKET_PATH, captureCliFailure, captureFatal, captureIntegrationFailure, checkExistingDaemon, fetchAgentConfig, flushSentry, formatHealthReport, initAgentSentry, installService, loadDaemonConfig, logger, queryDaemonHealth, resolveAgentIdentity, setAgentContext, startDaemon, startService, stopExistingDaemon, uninstallService };
+export { AGENT_DAEMON_SENTRY_DSN, AGENT_RUNTIME_SENTRY_DSN, ALFE_DIR, PID_PATH, PINNED_OPENCLAW_VERSION, PROTOCOL_VERSION, SOCKET_PATH, captureCliFailure, captureFatal, captureIntegrationFailure, captureRuntimeCrash, captureRuntimeErrorOutput, checkExistingDaemon, fetchAgentConfig, flushSentry, formatHealthReport, initAgentSentry, installService, loadDaemonConfig, logger, queryDaemonHealth, resolveAgentIdentity, setAgentContext, startDaemon, startService, stopExistingDaemon, uninstallService };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/gateway",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Alfe local gateway daemon — persistent control plane for agent integrations",
   "type": "module",
   "bin": {
@@ -23,11 +23,11 @@
     "pino-roll": "^1.2.0",
     "smol-toml": ">=1.6.1",
     "ws": "^8.18.0",
-    "@alfe.ai/agent-api-client": "^0.5.0",
+    "@alfe.ai/agent-api-client": "^0.7.0",
     "@alfe.ai/ai-proxy-local": "^0.0.13",
     "@alfe.ai/config": "^0.3.0",
     "@alfe.ai/integration-manifest": "^0.3.1",
-    "@alfe.ai/integrations": "^0.2.7",
+    "@alfe.ai/integrations": "^0.2.8",
     "@alfe.ai/mcp-bundler": "^0.2.2"
   },
   "license": "UNLICENSED",