@steadwing/openalerts 0.2.0 → 0.2.2

package/README.md

@@ -37,7 +37,9 @@ openclaw plugins install @steadwing/openalerts
 
 ### 2. Configure
 
-Add to your `openclaw.json`:
+If you already have a channel paired with OpenClaw (e.g. Telegram via `openclaw pair`), **no config is needed** — OpenAlerts auto-detects where to send alerts.
+
+Otherwise, set it explicitly in `openclaw.json`:
 
 ```jsonc
 {
@@ -55,69 +57,128 @@ Add to your `openclaw.json`:
 }
 ```
 
+**Auto-detection priority:** explicit config > static `allowFrom` in channel config > pairing store.
+
 ### 3. Restart & verify
 
 ```bash
 openclaw gateway stop && openclaw gateway run
 ```
 
+
 Send `/health` to your bot. You should get a live status report back — zero LLM tokens consumed.
 
 That's it. OpenAlerts is now watching your agent.
 
+## Dashboard
+
+A real-time web dashboard is embedded in the gateway at:
+
+```
+http://127.0.0.1:18789/openalerts
+```
+
+- **Activity** — Live event timeline with session flows, tool calls, LLM usage
+- **System Logs** — Filtered, structured logs with search
+- **Health** — Rule status, alert history, system stats
+
 ## Alert Rules
 
-Seven rules run against every event in real-time:
+Eight rules run against every event in real-time:
 
 | Rule | Watches for | Severity |
 |---|---|---|
-| **llm-errors** | 3+ LLM failures in 5 minutes | ERROR |
-| **infra-errors** | 3+ infrastructure errors in 5 minutes | ERROR |
-| **gateway-down** | No heartbeat for 90+ seconds | CRITICAL |
+| **llm-errors** | 1+ LLM/agent failure in 1 minute | ERROR |
+| **infra-errors** | 1+ infrastructure error in 1 minute | ERROR |
+| **gateway-down** | No heartbeat for 30+ seconds | CRITICAL |
 | **session-stuck** | Session idle for 120+ seconds | WARN |
 | **high-error-rate** | 50%+ of last 20 messages failed | ERROR |
 | **queue-depth** | 10+ items queued | WARN |
+| **tool-errors** | 1+ tool failure in 1 minute | WARN |
 | **heartbeat-fail** | 3 consecutive heartbeat failures | ERROR |
 
-All thresholds and cooldowns are [configurable per-rule](#configuration).
+All thresholds and cooldowns are [configurable per-rule](#advanced-configuration).
 
-## Configuration
+## LLM-Enriched Alerts
 
-Full config reference under `plugins.entries.openalerts.config`:
+By default, OpenAlerts uses your configured LLM model to enrich alerts with a human-friendly summary and an actionable suggestion. The enrichment is appended below the original alert detail:
+
+```
+1 agent error(s) on unknown in the last minute. Last: 401 Incorrect API key...
+
+Summary: Your OpenAI API key is invalid or expired — the agent cannot make LLM calls.
+Action: Update your API key in ~/.openclaw/.env with a valid key from platform.openai.com/api-keys
+```
+
+- **Model**: reads from `agents.defaults.model.primary` in your `openclaw.json` (e.g. `"openai/gpt-4o-mini"`)
+- **API key**: reads from the corresponding environment variable (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `GROQ_API_KEY`, etc.)
+- **Supported providers**: OpenAI, Anthropic, Groq, Together, DeepSeek (and any OpenAI-compatible API)
+- **Graceful fallback**: if the LLM call fails or times out (10s), the original alert is sent unchanged
+
+To disable LLM enrichment, set `"llmEnriched": false` in your plugin config:
 
 ```jsonc
 {
-  "alertChannel": "telegram",       // telegram | discord | slack | whatsapp | signal
-  "alertTo": "YOUR_CHAT_ID",        // chat/user ID on that channel
-  "cooldownMinutes": 15,            // minutes between repeated alerts (default: 15)
-  "quiet": false,                   // true = log only, no messages sent
-
-  "rules": {
-    "gateway-down": {
-      "threshold": 120000            // override: 2 min instead of 90s
-    },
-    "high-error-rate": {
-      "enabled": false               // disable a rule entirely
-    },
-    "llm-errors": {
-      "threshold": 5,                // require 5 errors instead of 3
-      "cooldownMinutes": 30          // longer cooldown for this rule
+  "plugins": {
+    "entries": {
+      "openalerts": {
+        "config": {
+          "llmEnriched": false
+        }
+      }
     }
   }
 }
 ```
 
-## Dashboard
+## Advanced Configuration
 
-A real-time web dashboard is embedded in the gateway at:
+Each rule can be individually tuned or disabled. You can also set global options like `cooldownMinutes` (default: `15`) and `quiet: true` for log-only mode.
 
+**Step 1.** Add a `rules` object inside `plugins.entries.openalerts.config` in your `~/.openclaw/openclaw.json`:
+
+```jsonc
+{
+  "plugins": {
+    "entries": {
+      "openalerts": {
+        "enabled": true,
+        "config": {
+          "rules": {
+            "llm-errors": { "threshold": 5 },
+            "infra-errors": { "cooldownMinutes": 30 },
+            "high-error-rate": { "enabled": false },
+            "gateway-down": { "threshold": 60000 }
+          }
+        }
+      }
+    }
+  }
+}
 ```
-http://127.0.0.1:18789/openalerts
+
+**Step 2.** Restart the gateway to apply:
+
+```bash
+openclaw gateway stop && openclaw gateway run
 ```
 
-- **Activity** — Live event timeline with session flows, tool calls, LLM usage
-- **System Logs** — Filtered, structured logs with search
-- **Health** — Rule status, alert history, system stats
+### Rule reference
+
+| Rule | `threshold` unit | Default |
+|---|---|---|
+| `llm-errors` | Error count in 1 min window | `1` |
+| `infra-errors` | Error count in 1 min window | `1` |
+| `gateway-down` | Milliseconds without heartbeat | `30000` (30s) |
+| `session-stuck` | Milliseconds idle | `120000` (2 min) |
+| `high-error-rate` | Error percentage (0-100) | `50` |
+| `queue-depth` | Number of queued items | `10` |
+| `tool-errors` | Error count in 1 min window | `1` |
+| `heartbeat-fail` | Consecutive failures | `3` |
+
+Every rule also accepts:
+- **`enabled`** — `false` to disable the rule (default: `true`)
+- **`cooldownMinutes`** — minutes before the same rule can fire again (default: `15`)
 
 ## Commands
 
@@ -129,18 +190,6 @@ Zero-token chat commands available in any connected channel:
 | `/alerts` | Recent alert history with severity and timestamps |
 | `/dashboard` | Returns the dashboard URL |
 
-## Architecture
-
-```
-src/core/          Framework-agnostic engine, zero dependencies
-                   Rules engine, evaluator, event bus, state store, formatter
-
-src/plugin/        OpenClaw adapter plugin
-                   Event translation, alert routing, dashboard, chat commands
-```
-
-Everything ships as a single `@steadwing/openalerts` package. The core is completely framework-agnostic — adding monitoring for a new framework only requires writing an adapter.
-
 ## Development
 
 ```bash

package/dist/core/engine.d.ts

@@ -13,11 +13,14 @@ export declare class OpenAlertsEngine {
     private stateDir;
     private dispatcher;
     private platform;
+    private enricher;
     private logger;
     private logPrefix;
     private watchdogTimer;
     private pruneTimer;
     private running;
+    private eventRing;
+    private static readonly RING_MAX;
     constructor(options: OpenAlertsInitOptions);
     /** Start the engine: warm from history, start timers. */
     start(): void;
@@ -30,12 +33,16 @@ export declare class OpenAlertsEngine {
         readonly name: string;
         send(alert: AlertEvent, formatted: string): Promise<void> | void;
     }): void;
+    /** Fire a test alert to verify delivery. */
+    sendTestAlert(): void;
     /** Whether the platform sync is connected. */
     get platformConnected(): boolean;
     /** Whether the engine is running. */
     get isRunning(): boolean;
     /** Read recent stored events (for /alerts command). */
     getRecentEvents(limit?: number): StoredEvent[];
+    /** Get recent full events from the in-memory ring buffer (for dashboard history). */
+    getRecentLiveEvents(limit?: number): OpenAlertsEvent[];
     private handleEvent;
     private fireAlert;
 }

package/dist/core/engine.js

@@ -17,14 +17,18 @@ export class OpenAlertsEngine {
     stateDir;
     dispatcher;
     platform = null;
+    enricher;
     logger;
     logPrefix;
     watchdogTimer = null;
     pruneTimer = null;
     running = false;
+    eventRing = [];
+    static RING_MAX = 500;
     constructor(options) {
         this.config = options.config;
         this.stateDir = options.stateDir;
+        this.enricher = options.enricher ?? null;
         this.logger = options.logger ?? console;
         this.logPrefix = options.logPrefix ?? "openalerts";
         this.bus = new OpenAlertsEventBus();
@@ -64,7 +68,9 @@ export class OpenAlertsEngine {
         this.watchdogTimer = setInterval(() => {
             const alerts = processWatchdogTick(this.state, this.config);
             for (const alert of alerts) {
-                this.fireAlert(alert);
+                void this.fireAlert(alert).catch((err) => {
+                    this.logger.error(`${this.logPrefix}: watchdog alert failed: ${String(err)}`);
+                });
             }
         }, DEFAULTS.watchdogIntervalMs);
         // Prune timer (cleans old log entries every 6h)
@@ -82,7 +88,7 @@ export class OpenAlertsEngine {
         const channelNames = this.dispatcher.hasChannels
             ? `${this.dispatcher.channelCount} channel(s)`
             : "log-only (no alert channels)";
-        this.logger.info(`${this.logPrefix}: started, ${channelNames}, 7 rules active`);
+        this.logger.info(`${this.logPrefix}: started, ${channelNames}, 8 rules active`);
     }
     /** Ingest a universal event. Can be called directly or via the event bus. */
     ingest(event) {
@@ -109,6 +115,21 @@ export class OpenAlertsEngine {
     addChannel(channel) {
         this.dispatcher.addChannel(channel);
     }
+    /** Fire a test alert to verify delivery. */
+    sendTestAlert() {
+        void this.fireAlert({
+            type: "alert",
+            id: `test:manual:${Date.now()}`,
+            ruleId: "test",
+            severity: "info",
+            title: "Test alert — delivery verified",
+            detail: "This is a test alert from /test_alert. If you see this, alert delivery is working.",
+            ts: Date.now(),
+            fingerprint: "test:manual",
+        }).catch((err) => {
+            this.logger.error(`${this.logPrefix}: test alert failed: ${String(err)}`);
+        });
+    }
     /** Whether the platform sync is connected. */
     get platformConnected() {
         return this.platform?.isConnected() ?? false;
@@ -121,8 +142,17 @@ export class OpenAlertsEngine {
     getRecentEvents(limit = 100) {
         return readRecentEvents(this.stateDir, limit);
     }
+    /** Get recent full events from the in-memory ring buffer (for dashboard history). */
+    getRecentLiveEvents(limit = 200) {
+        return this.eventRing.slice(-limit);
+    }
     // ─── Internal ──────────────────────────────────────────────────────────────
     handleEvent(event) {
+        // Add to in-memory ring buffer
+        this.eventRing.push(event);
+        if (this.eventRing.length > OpenAlertsEngine.RING_MAX) {
+            this.eventRing = this.eventRing.slice(-OpenAlertsEngine.RING_MAX);
+        }
         // Persist as diagnostic snapshot
         const snapshot = {
             type: "diagnostic",
@@ -141,13 +171,15 @@ export class OpenAlertsEngine {
         // Run through evaluator
         const alerts = processEvent(this.state, this.config, event);
         for (const alert of alerts) {
-            this.fireAlert(alert);
+            void this.fireAlert(alert).catch((err) => {
+                this.logger.error(`${this.logPrefix}: alert fire failed: ${String(err)}`);
+            });
         }
         // Forward to platform
         this.platform?.enqueue(snapshot);
     }
-    fireAlert(alert) {
-        // Persist alert
+    async fireAlert(alert) {
+        // Persist alert (original, before enrichment)
         try {
             appendEvent(this.stateDir, alert);
         }
@@ -156,9 +188,21 @@ export class OpenAlertsEngine {
         }
         // Forward to platform
         this.platform?.enqueue(alert);
+        // Enrich with LLM if enricher is available
+        let enriched = alert;
+        if (this.enricher) {
+            try {
+                const result = await this.enricher(alert);
+                if (result)
+                    enriched = result;
+            }
+            catch (err) {
+                this.logger.warn(`${this.logPrefix}: llm enrichment failed, using original: ${String(err)}`);
+            }
+        }
         // Dispatch to channels (unless quiet mode)
         if (!this.config.quiet) {
-            void this.dispatcher.dispatch(alert).catch((err) => {
+            void this.dispatcher.dispatch(enriched).catch((err) => {
                 this.logger.error(`${this.logPrefix}: alert dispatch failed: ${String(err)}`);
             });
         }

package/dist/core/evaluator.js

@@ -65,7 +65,7 @@ export function processEvent(state, config, event) {
         state.stats.totalCostUsd = 0;
         state.stats.lastResetTs = now;
     }
-    // Track event types in stats
+    // Track event types in stats (independent of rule enabled state)
     if (event.type === "infra.error") {
         state.stats.webhookErrors++;
     }
@@ -83,6 +83,16 @@ export function processEvent(state, config, event) {
     if (event.type === "session.start") {
         state.stats.sessionsStarted++;
     }
+    if (event.type === "session.stuck") {
+        state.stats.stuckSessions++;
+    }
+    if (event.type === "llm.call" || event.type === "llm.error" || event.type === "agent.error") {
+        state.stats.messagesProcessed++;
+        if (event.type === "llm.error" || event.type === "agent.error" ||
+            event.outcome === "error" || event.outcome === "timeout") {
+            state.stats.messageErrors++;
+        }
+    }
     if (event.type === "llm.token_usage") {
         if (typeof event.tokenCount === "number")
             state.stats.totalTokens += event.tokenCount;
@@ -103,7 +113,14 @@ export function processEvent(state, config, event) {
     const ctx = { state, config, now };
     const fired = [];
     for (const rule of ALL_RULES) {
-        const alert = rule.evaluate(event, ctx);
+        let alert;
+        try {
+            alert = rule.evaluate(event, ctx);
+        }
+        catch {
+            // One broken rule must never block the rest
+            continue;
+        }
         if (!alert)
             continue;
         // Check cooldown

package/dist/core/index.d.ts

@@ -1,4 +1,4 @@
-export type { AlertChannel, AlertEvent, AlertRuleDefinition, AlertSeverity, AlertTarget, DiagnosticSnapshot, EvaluatorState, HeartbeatSnapshot, MonitorConfig, RuleContext, RuleOverride, OpenAlertsEvent, OpenAlertsEventType, OpenAlertsInitOptions, OpenAlertsLogger, StoredEvent, WindowEntry, } from "./types.js";
+export type { AlertChannel, AlertEnricher, AlertEvent, AlertRuleDefinition, AlertSeverity, AlertTarget, DiagnosticSnapshot, EvaluatorState, HeartbeatSnapshot, MonitorConfig, RuleContext, RuleOverride, OpenAlertsEvent, OpenAlertsEventType, OpenAlertsInitOptions, OpenAlertsLogger, StoredEvent, WindowEntry, } from "./types.js";
 export { DEFAULTS, LOG_FILENAME, STORE_DIR_NAME } from "./types.js";
 export { OpenAlertsEngine } from "./engine.js";
 export { OpenAlertsEventBus } from "./event-bus.js";
@@ -6,6 +6,7 @@ export { AlertDispatcher } from "./alert-channel.js";
 export { createEvaluatorState, processEvent, processWatchdogTick, warmFromHistory, } from "./evaluator.js";
 export { ALL_RULES } from "./rules.js";
 export { appendEvent, pruneLog, readAllEvents, readRecentEvents, } from "./store.js";
+export { createLlmEnricher, type LlmEnricherOptions } from "./llm-enrichment.js";
 export { formatAlertMessage, formatAlertsOutput, formatHealthOutput, } from "./formatter.js";
 export { createPlatformSync, type PlatformSync } from "./platform.js";
 export { BoundedMap, type BoundedMapOptions, type BoundedMapStats, } from "./bounded-map.js";

package/dist/core/index.js

@@ -13,6 +13,8 @@ export { createEvaluatorState, processEvent, processWatchdogTick, warmFromHistor
 export { ALL_RULES } from "./rules.js";
 // Store
 export { appendEvent, pruneLog, readAllEvents, readRecentEvents, } from "./store.js";
+// LLM Enrichment
+export { createLlmEnricher } from "./llm-enrichment.js";
 // Formatter
 export { formatAlertMessage, formatAlertsOutput, formatHealthOutput, } from "./formatter.js";
 // Platform

package/dist/core/llm-enrichment.d.ts

@@ -0,0 +1,14 @@
+import type { AlertEnricher, OpenAlertsLogger } from "./types.js";
+export type LlmEnricherOptions = {
+    /** Model string from config, e.g. "openai/gpt-5-nano" */
+    modelString: string;
+    /** Logger for debug/warn messages */
+    logger?: OpenAlertsLogger;
+    /** Timeout in ms (default: 10000) */
+    timeoutMs?: number;
+};
+/**
+ * Create an AlertEnricher that calls an LLM to add a summary + action to alerts.
+ * Returns null if provider or API key can't be resolved.
+ */
+export declare function createLlmEnricher(opts: LlmEnricherOptions): AlertEnricher | null;

package/dist/core/llm-enrichment.js

@@ -0,0 +1,174 @@
+const PROVIDER_MAP = {
+    openai: {
+        type: "openai-compatible",
+        baseUrl: "https://api.openai.com/v1",
+        apiKeyEnvVar: "OPENAI_API_KEY",
+    },
+    groq: {
+        type: "openai-compatible",
+        baseUrl: "https://api.groq.com/openai/v1",
+        apiKeyEnvVar: "GROQ_API_KEY",
+    },
+    together: {
+        type: "openai-compatible",
+        baseUrl: "https://api.together.xyz/v1",
+        apiKeyEnvVar: "TOGETHER_API_KEY",
+    },
+    deepseek: {
+        type: "openai-compatible",
+        baseUrl: "https://api.deepseek.com/v1",
+        apiKeyEnvVar: "DEEPSEEK_API_KEY",
+    },
+    anthropic: {
+        type: "anthropic",
+        baseUrl: "https://api.anthropic.com/v1",
+        apiKeyEnvVar: "ANTHROPIC_API_KEY",
+    },
+};
+// ─── Prompt ─────────────────────────────────────────────────────────────────
+function buildPrompt(alert) {
+    return `You are a concise DevOps alert analyst. Given this monitoring alert, provide:
+1. A brief human-friendly summary (1 sentence, plain language)
+2. One actionable suggestion to resolve it
+
+Alert:
+- Rule: ${alert.ruleId}
+- Severity: ${alert.severity}
+- Title: ${alert.title}
+- Detail: ${alert.detail}
+
+Reply in exactly this format (2 lines only):
+Summary: <your summary>
+Action: <your suggestion>`;
+}
+// ─── Response Parsing ───────────────────────────────────────────────────────
+function parseEnrichment(text) {
+    const lines = text.trim().split("\n");
+    let summary = "";
+    let action = "";
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (trimmed.toLowerCase().startsWith("summary:")) {
+            summary = trimmed.slice("summary:".length).trim();
+        }
+        else if (trimmed.toLowerCase().startsWith("action:")) {
+            action = trimmed.slice("action:".length).trim();
+        }
+    }
+    if (!summary && !action)
+        return null;
+    return { summary, action };
+}
+// ─── HTTP Calls ─────────────────────────────────────────────────────────────
+async function callOpenAICompatible(baseUrl, apiKey, model, prompt, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetch(`${baseUrl}/chat/completions`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${apiKey}`,
+            },
+            body: JSON.stringify({
+                model,
+                messages: [{ role: "user", content: prompt }],
+                max_tokens: 200,
+                temperature: 0.3,
+            }),
+            signal: controller.signal,
+        });
+        if (!res.ok)
+            return null;
+        const data = (await res.json());
+        return data.choices?.[0]?.message?.content ?? null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function callAnthropic(baseUrl, apiKey, model, prompt, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetch(`${baseUrl}/messages`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "x-api-key": apiKey,
+                "anthropic-version": "2023-06-01",
+            },
+            body: JSON.stringify({
+                model,
+                max_tokens: 200,
+                messages: [{ role: "user", content: prompt }],
+            }),
+            signal: controller.signal,
+        });
+        if (!res.ok)
+            return null;
+        const data = (await res.json());
+        const textBlock = data.content?.find((b) => b.type === "text");
+        return textBlock?.text ?? null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+// ─── Factory ────────────────────────────────────────────────────────────────
+/**
+ * Create an AlertEnricher that calls an LLM to add a summary + action to alerts.
+ * Returns null if provider or API key can't be resolved.
+ */
+export function createLlmEnricher(opts) {
+    const { modelString, logger, timeoutMs = 10_000 } = opts;
+    // Parse "provider/model-name" format
+    const slashIdx = modelString.indexOf("/");
+    if (slashIdx < 1) {
+        logger?.warn(`openalerts: llm-enrichment skipped — invalid model string "${modelString}"`);
+        return null;
+    }
+    const providerKey = modelString.slice(0, slashIdx).toLowerCase();
+    const model = modelString.slice(slashIdx + 1);
+    const providerConfig = PROVIDER_MAP[providerKey];
+    if (!providerConfig) {
+        logger?.warn(`openalerts: llm-enrichment skipped — unknown provider "${providerKey}"`);
+        return null;
+    }
+    const apiKey = process.env[providerConfig.apiKeyEnvVar];
+    if (!apiKey) {
+        logger?.warn(`openalerts: llm-enrichment skipped — ${providerConfig.apiKeyEnvVar} not set in environment`);
+        return null;
+    }
+    logger?.info(`openalerts: llm-enrichment enabled (${providerKey}/${model})`);
+    return async (alert) => {
+        const prompt = buildPrompt(alert);
+        let responseText = null;
+        if (providerConfig.type === "anthropic") {
+            responseText = await callAnthropic(providerConfig.baseUrl, apiKey, model, prompt, timeoutMs);
+        }
+        else {
+            responseText = await callOpenAICompatible(providerConfig.baseUrl, apiKey, model, prompt, timeoutMs);
+        }
+        if (!responseText)
+            return null;
+        const parsed = parseEnrichment(responseText);
+        if (!parsed)
+            return null;
+        // Append enrichment to the original detail
+        let enrichedDetail = alert.detail;
+        if (parsed.summary) {
+            enrichedDetail += `\n\nSummary: ${parsed.summary}`;
+        }
+        if (parsed.action) {
+            enrichedDetail += `\nAction: ${parsed.action}`;
+        }
+        return { ...alert, detail: enrichedDetail };
+    };
+}

package/dist/core/rules.js

@@ -32,7 +32,7 @@ function isRuleEnabled(ctx, ruleId) {
 const infraErrors = {
     id: "infra-errors",
     defaultCooldownMs: 15 * 60 * 1000,
-    defaultThreshold: 3,
+    defaultThreshold: 1,
     evaluate(event, ctx) {
         if (event.type !== "infra.error")
             return null;
@@ -40,8 +40,8 @@ const infraErrors = {
             return null;
         const channel = event.channel ?? "unknown";
         pushWindow(ctx, "infra-errors", { ts: ctx.now });
-        const threshold = getRuleThreshold(ctx, "infra-errors", 3);
-        const windowMs = 5 * 60 * 1000; // 5 minutes
+        const threshold = getRuleThreshold(ctx, "infra-errors", 1);
+        const windowMs = 60 * 1000; // 1 minute
         const count = countInWindow(ctx, "infra-errors", windowMs);
         if (count < threshold)
             return null;
@@ -52,7 +52,7 @@ const infraErrors = {
             ruleId: "infra-errors",
             severity: "error",
             title: "Infrastructure errors spike",
-            detail: `${count} infra errors on ${channel} in the last 5 minutes.`,
+            detail: `${count} infra error(s) on ${channel} in the last minute.${event.error ? ` Last: ${event.error}` : ""}`,
             ts: ctx.now,
             fingerprint,
         };
@@ -62,32 +62,37 @@ const infraErrors = {
 const llmErrors = {
     id: "llm-errors",
     defaultCooldownMs: 15 * 60 * 1000,
-    defaultThreshold: 3,
+    defaultThreshold: 1,
     evaluate(event, ctx) {
-        if (event.type !== "llm.call")
+        // Trigger on LLM call/error events AND agent errors (agent failing before/during LLM call)
+        if (event.type !== "llm.call" && event.type !== "llm.error" && event.type !== "agent.error")
             return null;
         if (!isRuleEnabled(ctx, "llm-errors"))
             return null;
-        // Track all LLM calls for stats
-        ctx.state.stats.messagesProcessed++;
-        if (event.outcome !== "error")
-            return null;
-        ctx.state.stats.messageErrors++;
+        // Stats are tracked in the evaluator (independent of rule state).
+        // Only proceed for actual errors:
+        if (event.type === "llm.call") {
+            // Only explicit error/timeout outcomes trigger alerting; undefined = OK
+            if (event.outcome !== "error" && event.outcome !== "timeout")
+                return null;
+        }
+        // llm.error and agent.error are always errors — no outcome check needed
         const channel = event.channel ?? "unknown";
         pushWindow(ctx, "llm-errors", { ts: ctx.now });
-        const threshold = getRuleThreshold(ctx, "llm-errors", 3);
-        const windowMs = 5 * 60 * 1000;
+        const threshold = getRuleThreshold(ctx, "llm-errors", 1);
+        const windowMs = 60 * 1000; // 1 minute
         const count = countInWindow(ctx, "llm-errors", windowMs);
         if (count < threshold)
             return null;
         const fingerprint = `llm-errors:${channel}`;
+        const label = event.type === "agent.error" ? "agent error(s)" : "LLM error(s)";
         return {
             type: "alert",
             id: makeAlertId("llm-errors", fingerprint, ctx.now),
             ruleId: "llm-errors",
             severity: "error",
             title: "LLM call errors",
-            detail: `${count} LLM errors on ${channel} in the last 5 minutes.`,
+            detail: `${count} ${label} on ${channel} in the last minute.${event.error ? ` Last: ${event.error}` : ""}`,
             ts: ctx.now,
             fingerprint,
         };
@@ -103,7 +108,7 @@ const sessionStuck = {
             return null;
         if (!isRuleEnabled(ctx, "session-stuck"))
             return null;
-        ctx.state.stats.stuckSessions++;
+        // Stats tracked in evaluator (independent of rule state)
         const ageMs = event.ageMs ?? 0;
         const threshold = getRuleThreshold(ctx, "session-stuck", 120_000);
         if (ageMs < threshold)
@@ -153,10 +158,8 @@ const heartbeatFail = {
                 fingerprint,
             };
         }
-        // Reset on success
-        if (event.outcome === "success") {
-            ctx.state.consecutives.set(counterKey, 0);
-        }
+        // Reset on any non-error (success, undefined, etc.)
+        ctx.state.consecutives.set(counterKey, 0);
         return null;
     },
 };
@@ -169,12 +172,12 @@ const queueDepth = {
         // Fire on heartbeat (which carries queue depth) and dedicated queue_depth events
         if (event.type !== "infra.heartbeat" && event.type !== "infra.queue_depth")
             return null;
-        if (!isRuleEnabled(ctx, "queue-depth"))
-            return null;
-        // Update last heartbeat timestamp (used by gateway-down rule)
+        // Always update heartbeat timestamp regardless of rule state (gateway-down depends on it)
         if (event.type === "infra.heartbeat") {
             ctx.state.lastHeartbeatTs = ctx.now;
         }
+        if (!isRuleEnabled(ctx, "queue-depth"))
+            return null;
         const queued = event.queueDepth ?? 0;
         const threshold = getRuleThreshold(ctx, "queue-depth", 10);
         if (queued < threshold)
@@ -198,11 +201,15 @@ const highErrorRate = {
     defaultCooldownMs: 30 * 60 * 1000,
     defaultThreshold: 50, // percent
     evaluate(event, ctx) {
-        if (event.type !== "llm.call")
+        if (event.type !== "llm.call" && event.type !== "llm.error" && event.type !== "agent.error")
             return null;
         if (!isRuleEnabled(ctx, "high-error-rate"))
             return null;
-        const isError = event.outcome === "error";
+        // agent.error and llm.error are always errors; llm.call checks outcome (timeout counts as error)
+        const isError = event.type === "agent.error" ||
+            event.type === "llm.error" ||
+            event.outcome === "error" ||
+            event.outcome === "timeout";
         pushWindow(ctx, "msg-outcomes", { ts: ctx.now, value: isError ? 1 : 0 });
         const window = ctx.state.windows.get("msg-outcomes");
         if (!window || window.length < 20)
@@ -227,11 +234,41 @@ const highErrorRate = {
         };
     },
 };
+// ─── Rule: tool-errors ───────────────────────────────────────────────────
+const toolErrors = {
+    id: "tool-errors",
+    defaultCooldownMs: 15 * 60 * 1000,
+    defaultThreshold: 1, // 1 tool error in 1 minute
+    evaluate(event, ctx) {
+        if (event.type !== "tool.error")
+            return null;
+        if (!isRuleEnabled(ctx, "tool-errors"))
+            return null;
+        pushWindow(ctx, "tool-errors", { ts: ctx.now });
+        const threshold = getRuleThreshold(ctx, "tool-errors", 1);
+        const windowMs = 60 * 1000; // 1 minute
+        const count = countInWindow(ctx, "tool-errors", windowMs);
+        if (count < threshold)
+            return null;
+        const toolName = event.meta?.toolName ?? "unknown";
+        const fingerprint = `tool-errors:${toolName}`;
+        return {
+            type: "alert",
+            id: makeAlertId("tool-errors", fingerprint, ctx.now),
+            ruleId: "tool-errors",
+            severity: "warn",
+            title: "Tool errors spike",
+            detail: `${count} tool error(s) in the last minute.${event.error ? ` Last: ${event.error}` : ""}`,
+            ts: ctx.now,
+            fingerprint,
+        };
+    },
+};
 // ─── Rule: gateway-down ──────────────────────────────────────────────────────
 const gatewayDown = {
     id: "gateway-down",
     defaultCooldownMs: 60 * 60 * 1000,
-    defaultThreshold: 90_000, // 90 seconds
+    defaultThreshold: 30_000, // 30 seconds
     evaluate(event, ctx) {
         // This rule is called by the watchdog timer, not by events directly.
         if (event.type !== "watchdog.tick")
@@ -270,5 +307,6 @@ export const ALL_RULES = [
     heartbeatFail,
     queueDepth,
     highErrorRate,
+    toolErrors,
     gatewayDown,
 ];

package/dist/core/types.d.ts

@@ -51,6 +51,8 @@ export type AlertTarget = {
     to: string;
     accountId?: string;
 };
+/** Enriches an alert with LLM-generated summary/action. Returns enriched alert or null to skip. */
+export type AlertEnricher = (alert: AlertEvent) => Promise<AlertEvent | null>;
 export type RuleOverride = {
     enabled?: boolean;
     threshold?: number;
@@ -65,6 +67,7 @@ export type MonitorConfig = {
     maxLogSizeKb?: number;
     maxLogAgeDays?: number;
     quiet?: boolean;
+    llmEnriched?: boolean;
     rules?: Record<string, RuleOverride>;
 };
 export type OpenAlertsInitOptions = {
@@ -80,6 +83,8 @@ export type OpenAlertsInitOptions = {
     logPrefix?: string;
     /** Diagnosis hint shown in critical alerts (e.g., 'Run "openclaw doctor"') */
     diagnosisHint?: string;
+    /** Optional LLM enricher — adds smart summaries to alerts before dispatch */
+    enricher?: AlertEnricher;
 };
 export type OpenAlertsLogger = {
     info: (msg: string) => void;
@@ -148,5 +153,5 @@ export declare const DEFAULTS: {
     readonly pruneIntervalMs: number;
     readonly platformFlushIntervalMs: number;
     readonly platformBatchSize: 100;
-    readonly gatewayDownThresholdMs: 90000;
+    readonly gatewayDownThresholdMs: 30000;
 };

package/dist/core/types.js

@@ -13,5 +13,5 @@ export const DEFAULTS = {
     pruneIntervalMs: 6 * 60 * 60 * 1000, // 6 hours
     platformFlushIntervalMs: 5 * 60 * 1000, // 5 minutes
     platformBatchSize: 100,
-    gatewayDownThresholdMs: 90_000, // 90 seconds
+    gatewayDownThresholdMs: 30_000, // 30 seconds
 };

package/dist/index.js

@@ -1,7 +1,7 @@
 import { OpenAlertsEngine } from "./core/index.js";
 import { onDiagnosticEvent, registerLogTransport } from "openclaw/plugin-sdk";
 import { createLogBridge } from "./plugin/log-bridge.js";
-import { OpenClawAlertChannel, parseConfig, resolveAlertTarget, translateOpenClawEvent, translateToolCallHook, translateAgentStartHook, translateAgentEndHook, translateSessionStartHook, translateSessionEndHook, translateMessageSentHook, translateMessageReceivedHook, translateBeforeToolCallHook, translateBeforeCompactionHook, translateAfterCompactionHook, translateMessageSendingHook, translateToolResultPersistHook, translateGatewayStartHook, translateGatewayStopHook, } from "./plugin/adapter.js";
+import { OpenClawAlertChannel, createOpenClawEnricher, parseConfig, resolveAlertTarget, translateOpenClawEvent, translateToolCallHook, translateAgentStartHook, translateAgentEndHook, translateSessionStartHook, translateSessionEndHook, translateMessageSentHook, translateMessageReceivedHook, translateBeforeToolCallHook, translateBeforeCompactionHook, translateAfterCompactionHook, translateMessageSendingHook, translateToolResultPersistHook, translateGatewayStartHook, translateGatewayStopHook, } from "./plugin/adapter.js";
 import { bindEngine, createMonitorCommands } from "./plugin/commands.js";
 import { createDashboardHandler, closeDashboardConnections, } from "./plugin/dashboard-routes.js";
 const PLUGIN_ID = "openalerts";
@@ -13,12 +13,16 @@ let logBridgeCleanup = null;
 function createMonitorService(api) {
     return {
         id: PLUGIN_ID,
-        start(ctx) {
+        async start(ctx) {
             const logger = ctx.logger;
             const config = parseConfig(api.pluginConfig);
             // Resolve alert target + create OpenClaw alert channel
-            const target = resolveAlertTarget(api, config);
+            const target = await resolveAlertTarget(api, config);
             const channels = target ? [new OpenClawAlertChannel(api, target)] : [];
+            // Create LLM enricher if enabled (default: true)
+            const enricher = config.llmEnriched !== false
+                ? createOpenClawEnricher(api, logger)
+                : null;
             // Create and start the universal engine
             engine = new OpenAlertsEngine({
                 stateDir: ctx.stateDir,
@@ -27,6 +31,7 @@ function createMonitorService(api) {
                 logger,
                 logPrefix: LOG_PREFIX,
                 diagnosisHint: 'Run "openclaw doctor" to diagnose.',
+                enricher: enricher ?? undefined,
             });
             engine.start();
             // Wire commands to engine
@@ -169,7 +174,7 @@ function createMonitorService(api) {
             const targetDesc = target
                 ? `alerting to ${target.channel}:${target.to}`
                 : "log-only (no alert channel detected)";
-            logger.info(`${LOG_PREFIX}: started, ${targetDesc}, log-bridge active, 7 rules active`);
+            logger.info(`${LOG_PREFIX}: started, ${targetDesc}, log-bridge active, 8 rules active`);
         },
         stop() {
             closeDashboardConnections();

package/dist/plugin/adapter.d.ts

@@ -1,4 +1,4 @@
-import type { AlertChannel, AlertEvent, AlertTarget, MonitorConfig, OpenAlertsEvent } from "../core/index.js";
+import type { AlertChannel, AlertEnricher, AlertEvent, AlertTarget, MonitorConfig, OpenAlertsEvent } from "../core/index.js";
 import type { OpenClawPluginApi } from "openclaw/plugin-sdk";
 /**
  * Translate an OpenClaw diagnostic event into a universal OpenAlertsEvent.
@@ -128,11 +128,23 @@ export declare class OpenClawAlertChannel implements AlertChannel {
     readonly name: string;
     private api;
     private target;
+    private warnedMissing;
     constructor(api: OpenClawPluginApi, target: AlertTarget);
     send(alert: AlertEvent, formatted: string): Promise<void>;
 }
 /**
  * Resolve the alert target from plugin config or by auto-detecting from OpenClaw config.
  */
-export declare function resolveAlertTarget(api: OpenClawPluginApi, pluginConfig: MonitorConfig): AlertTarget | null;
+export declare function resolveAlertTarget(api: OpenClawPluginApi, pluginConfig: MonitorConfig): Promise<AlertTarget | null>;
 export declare function parseConfig(raw: Record<string, unknown> | undefined): MonitorConfig;
+/**
+ * Create an AlertEnricher from the OpenClaw plugin API.
+ * Reads the model from api.config.agents.defaults.model.primary (e.g. "openai/gpt-5-nano")
+ * and resolves the API key from process.env.
+ * Returns null if no model is configured or enricher can't be created.
+ */
+export declare function createOpenClawEnricher(api: OpenClawPluginApi, logger?: {
+    info: (msg: string) => void;
+    warn: (msg: string) => void;
+    error: (msg: string) => void;
+}): AlertEnricher | null;

package/dist/plugin/adapter.js

@@ -1,3 +1,7 @@
+import { createLlmEnricher } from "../core/llm-enrichment.js";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { homedir } from "node:os";
 // ─── Diagnostic Event Translation ───────────────────────────────────────────
 //
 // OpenClaw emits 12 diagnostic event types through onDiagnosticEvent():
@@ -230,7 +234,7 @@ export function translateMessageSentHook(data, context) {
         sessionKey: context.sessionId,
         outcome: data.success ? "success" : "error",
         error: data.error,
-        meta: { to: data.to, source: "hook:message_sent" },
+        meta: { to: data.to, content: data.content, source: "hook:message_sent" },
     };
 }
 /** Translate gateway_start hook data into OpenAlertsEvent. */
@@ -261,6 +265,7 @@ export function translateMessageReceivedHook(data, context) {
         outcome: "success",
         meta: {
             from: data.from,
+            content: data.content,
             accountId: context.accountId,
             openclawHook: "message_received",
             source: "hook:message_received",
@@ -310,6 +315,7 @@ export function translateAfterCompactionHook(data, context) {
             messageCount: data.messageCount,
             tokenCount: data.tokenCount,
             compactedCount: data.compactedCount,
+            compaction: true,
             openclawHook: "after_compaction",
             source: "hook:after_compaction",
         },
@@ -324,6 +330,7 @@ export function translateMessageSendingHook(data, context) {
         outcome: "success",
         meta: {
             to: data.to,
+            content: data.content,
             accountId: context.accountId,
             openclawHook: "message_sending",
             source: "hook:message_sending",
@@ -356,6 +363,7 @@ export class OpenClawAlertChannel {
     name;
     api;
     target;
+    warnedMissing = false;
     constructor(api, target) {
         this.api = api;
         this.target = target;
@@ -364,8 +372,13 @@ export class OpenClawAlertChannel {
     async send(alert, formatted) {
         const runtime = this.api.runtime;
         const channel = runtime.channel;
-        if (!channel)
+        if (!channel) {
+            if (!this.warnedMissing) {
+                this.warnedMissing = true;
+                throw new Error(`runtime.channel not available — alert dropped`);
+            }
             return;
+        }
         const opts = this.target.accountId
             ? { accountId: this.target.accountId }
             : {};
@@ -377,20 +390,22 @@ export class OpenClawAlertChannel {
             signal: "sendMessageSignal",
         };
         const methodName = channelMethods[this.target.channel];
-        if (!methodName)
-            return;
+        if (!methodName) {
+            throw new Error(`unsupported channel "${this.target.channel}" — no send method mapped`);
+        }
         const channelMod = channel[this.target.channel];
         const sendFn = channelMod?.[methodName];
-        if (sendFn) {
-            await sendFn(this.target.to, formatted, opts);
+        if (!sendFn) {
+            throw new Error(`${this.target.channel}.${methodName} not found on runtime — alert dropped`);
         }
+        await sendFn(this.target.to, formatted, opts);
     }
 }
 // ─── Alert Target Resolution ────────────────────────────────────────────────
 /**
  * Resolve the alert target from plugin config or by auto-detecting from OpenClaw config.
  */
-export function resolveAlertTarget(api, pluginConfig) {
+export async function resolveAlertTarget(api, pluginConfig) {
     // 1. Explicit config
     if (pluginConfig.alertChannel && pluginConfig.alertTo) {
         return {
@@ -400,7 +415,8 @@ export function resolveAlertTarget(api, pluginConfig) {
         };
     }
     const cfg = api.config;
-    // 2. Auto-detect from configured channels
+    const channelsCfg = cfg.channels ??
+        {};
     const channelKeys = [
         "telegram",
         "discord",
@@ -408,14 +424,33 @@ export function resolveAlertTarget(api, pluginConfig) {
         "whatsapp",
         "signal",
     ];
+    // 2. Auto-detect from static allowFrom in channel config
     for (const channelKey of channelKeys) {
-        const channelConfig = cfg[channelKey];
+        const channelConfig = channelsCfg[channelKey];
         if (!channelConfig || typeof channelConfig !== "object")
             continue;
         const target = extractFirstAllowFrom(channelKey, channelConfig);
         if (target)
             return target;
     }
+    // 3. Auto-detect from pairing store (runtime-paired users)
+    // The store lives at ~/.openclaw/credentials/<channel>-allowFrom.json
+    const credDir = join(process.env.OPENCLAW_HOME ?? join(homedir(), ".openclaw"), "credentials");
+    for (const channelKey of channelKeys) {
+        const channelConfig = channelsCfg[channelKey];
+        if (!channelConfig || typeof channelConfig !== "object")
+            continue;
+        try {
+            const raw = await readFile(join(credDir, `${channelKey}-allowFrom.json`), "utf-8");
+            const data = JSON.parse(raw);
+            if (Array.isArray(data.allowFrom) && data.allowFrom.length > 0) {
+                return { channel: channelKey, to: String(data.allowFrom[0]) };
+            }
+        }
+        catch {
+            // File doesn't exist or isn't valid — skip this channel
+        }
+    }
     return null;
 }
 function extractFirstAllowFrom(channel, channelConfig) {
@@ -451,8 +486,34 @@ export function parseConfig(raw) {
         maxLogSizeKb: typeof raw.maxLogSizeKb === "number" ? raw.maxLogSizeKb : undefined,
         maxLogAgeDays: typeof raw.maxLogAgeDays === "number" ? raw.maxLogAgeDays : undefined,
         quiet: typeof raw.quiet === "boolean" ? raw.quiet : undefined,
+        llmEnriched: typeof raw.llmEnriched === "boolean" ? raw.llmEnriched : undefined,
         rules: raw.rules && typeof raw.rules === "object"
             ? raw.rules
             : undefined,
     };
 }
+// ─── LLM Enricher Factory ───────────────────────────────────────────────────
+/**
+ * Create an AlertEnricher from the OpenClaw plugin API.
+ * Reads the model from api.config.agents.defaults.model.primary (e.g. "openai/gpt-5-nano")
+ * and resolves the API key from process.env.
+ * Returns null if no model is configured or enricher can't be created.
+ */
+export function createOpenClawEnricher(api, logger) {
+    try {
+        const cfg = api.config;
+        const agents = cfg.agents;
+        const defaults = agents?.defaults;
+        const model = defaults?.model;
+        const primary = model?.primary;
+        if (typeof primary !== "string" || !primary.includes("/")) {
+            logger?.warn("openalerts: llm-enrichment skipped — no model configured at agents.defaults.model.primary");
+            return null;
+        }
+        return createLlmEnricher({ modelString: primary, logger });
+    }
+    catch (err) {
+        logger?.warn(`openalerts: llm-enrichment setup failed: ${String(err)}`);
+        return null;
+    }
+}

package/dist/plugin/commands.js

@@ -29,7 +29,7 @@ export function createMonitorCommands(api) {
             handler: () => handleDashboard(),
         },
         {
-            name: "test-alert",
+            name: "test_alert",
             description: "Send a test alert to verify alert delivery",
             acceptsArgs: false,
             handler: () => handleTestAlert(),
@@ -72,26 +72,7 @@ function handleTestAlert() {
     if (!_engine) {
         return { text: "OpenAlerts not initialized yet. Wait for gateway startup." };
     }
-    // Ingest a synthetic infra.error to trigger the infra-errors rule evaluation.
-    // This won't fire an actual alert unless the threshold (3 errors) is reached,
-    // so we fire a one-off test alert directly through the engine.
-    const testEvent = {
-        type: "alert",
-        id: `test:manual:${Date.now()}`,
-        ruleId: "test",
-        severity: "info",
-        title: "Test alert — delivery verified",
-        detail: "This is a test alert from /test-alert. If you see this, alert delivery is working.",
-        ts: Date.now(),
-        fingerprint: `test:manual`,
-    };
-    // Ingest as a custom event so it appears in the dashboard
-    _engine.ingest({
-        type: "custom",
-        ts: Date.now(),
-        outcome: "success",
-        meta: { openclawLog: "test_alert", source: "command:test-alert" },
-    });
+    _engine.sendTestAlert();
     return {
         text: "Test alert sent. Check your alert channel (Telegram/Discord/etc) for delivery confirmation.\n\nIf you don't receive it, check /health for channel status.",
     };

package/dist/plugin/dashboard-html.js

@@ -423,6 +423,8 @@ export function getDashboardHtml() {
     var ft=ev.type||'?';
     if(ft==='custom'&&m.openclawEventType==='session.state')ft='session.'+(m.sessionState||'state');
     if(ft==='custom'&&m.openclawEventType==='message_sent')ft='msg.delivered';
+    if(ft==='custom'&&m.openclawHook==='message_received')ft='msg.in';
+    if(ft==='custom'&&m.openclawHook==='message_sending')ft='msg.out';
 
     var h='<div class="r-main">';
     h+='<span class="r-time">'+fT(ev.ts)+'</span>';
@@ -439,6 +441,7 @@ export function getDashboardHtml() {
     if(m.model)h+='<span class="p m">'+esc(String(m.model))+'</span>';
     if(ev.channel)h+='<span class="p ch">'+esc(ev.channel)+'</span>';
     if(m.messageCount!=null)h+='<span class="p">'+m.messageCount+' msgs</span>';
+    if(m.content){var preview=String(m.content);if(preview.length>60)preview=preview.slice(0,57)+'...';h+='<span class="p">'+esc(preview)+'</span>'}
     if(m.source&&String(m.source)!=='simulate')h+='<span class="p s">'+esc(String(m.source))+'</span>';
     h+='</span></div>';
 
@@ -596,17 +599,21 @@ export function getDashboardHtml() {
   // ─── SSE (OpenAlerts events + OpenClaw log tailing) ──────────────────────
   function connectSSE(){
     if(evSrc)evSrc.close();
-    evSrc=new EventSource('/openalerts/events');
-    evSrc.addEventListener('openalerts',function(e){try{addEvent(JSON.parse(e.data))}catch(_){}});
-    evSrc.addEventListener('oclog',function(e){try{addLogEntry(JSON.parse(e.data))}catch(_){}});
-    evSrc.onopen=function(){$('sDot').className='dot live';$('sConn').textContent='live'};
-    evSrc.onerror=function(){$('sDot').className='dot dead';$('sConn').textContent='reconnecting...'};
+    try{
+      evSrc=new EventSource('/openalerts/events');
+      evSrc.addEventListener('openalerts',function(e){try{addEvent(JSON.parse(e.data))}catch(_){}});
+      evSrc.addEventListener('history',function(e){try{var evs=JSON.parse(e.data);for(var i=0;i<evs.length;i++)addEvent(evs[i])}catch(_){}});
+      evSrc.addEventListener('oclog',function(e){try{addLogEntry(JSON.parse(e.data))}catch(_){}});
+      evSrc.onopen=function(){$('sDot').className='dot live';$('sConn').textContent='live'};
+      evSrc.onerror=function(e){$('sDot').className='dot dead';$('sConn').textContent='err:'+evSrc.readyState};
+    }catch(e){$('sConn').textContent='SSE fail:'+e.message}
   }
 
   // ─── State polling ──────────────────────
   var prevAl={};
   function pollState(){
-    fetch('/openalerts/state').then(function(r){return r.json()}).then(function(s){
+    fetch('/openalerts/state').then(function(r){if(!r.ok)throw new Error('HTTP '+r.status);return r.json()}).catch(function(e){$('sUp').textContent='fetch err: '+e.message;return null}).then(function(s){
+      if(!s)return;
       if(s.stats){
         $('sMsgs').textContent=s.stats.messagesProcessed||0;
         $('sErr').textContent=(s.stats.messageErrors||0)+(s.stats.webhookErrors||0)+(s.stats.toolErrors||0);
@@ -736,7 +743,7 @@ export function getDashboardHtml() {
       var btn=row.querySelector('.log-copy');
       if(btn)lines.push(btn.getAttribute('data-raw'));
     });
-    var blob=new Blob([lines.join('\n')],{type:'text/plain'});
+    var blob=new Blob([lines.join('\\n')],{type:'text/plain'});
     var url=URL.createObjectURL(blob);
     var a=document.createElement('a');
     a.href=url;a.download='openalerts-logs-'+Date.now()+'.txt';

package/dist/plugin/dashboard-routes.js

@@ -26,14 +26,25 @@ const RULE_IDS = [
     "heartbeat-fail",
     "queue-depth",
     "high-error-rate",
+    "tool-errors",
     "gateway-down",
 ];
 function getRuleStatuses(engine) {
     const state = engine.state;
     const now = Date.now();
+    const cooldownWindow = 15 * 60 * 1000;
     return RULE_IDS.map((id) => {
-        const cooldownTs = state.cooldowns.get(id);
-        const fired = cooldownTs != null && cooldownTs > now - 15 * 60 * 1000;
+        // Cooldown keys are fingerprints like "llm-errors:unknown", not bare rule IDs.
+        // Check if ANY cooldown key starting with this rule ID has fired recently.
+        let fired = false;
+        for (const [key, ts] of state.cooldowns) {
+            if (key === id || key.startsWith(id + ":")) {
+                if (ts > now - cooldownWindow) {
+                    fired = true;
+                    break;
+                }
+            }
+        }
         return { id, status: fired ? "fired" : "ok" };
     });
 }
@@ -208,6 +219,20 @@ export function createDashboardHandler(getEngine) {
                 "Access-Control-Allow-Origin": "*",
             });
             res.flushHeaders();
+            // Send initial connection event so the browser knows the stream is live
+            res.write(`:ok\n\n`);
+            // Send current state snapshot as initial event
+            const state = engine.state;
+            res.write(`event: state\ndata: ${JSON.stringify({
+                uptimeMs: Date.now() - state.startedAt,
+                stats: state.stats,
+                rules: getRuleStatuses(engine),
+            })}\n\n`);
+            // Send event history so dashboard survives refreshes
+            const history = engine.getRecentLiveEvents(200);
+            if (history.length > 0) {
+                res.write(`event: history\ndata: ${JSON.stringify(history)}\n\n`);
+            }
             // Subscribe to engine events
             const unsub = engine.bus.on((event) => {
                 try {

package/dist/plugin/log-bridge.js

@@ -272,6 +272,30 @@ export function createLogBridge(engine) {
             },
         });
     }
+    // ── Lane task error (diagnostic) ────────────────────────────────────────────
+    // Safety net: catches lane-level errors from diagnostic logs.
+    // The agent_end hook already covers agent errors → llm-errors rule.
+    // This emits as infra.error to avoid double-counting in the llm-errors window
+    // while still ensuring infra-errors fires if the hook path fails.
+    // Format: "lane task error: lane=main durationMs=1 error="Error: ...""
+    function handleLaneTaskError(rec) {
+        const { lane, error: errorMsg } = rec.kvs;
+        const dedupeKey = `lane-error:${lane}:${rec.ts}`;
+        if (dedupeSet.has(dedupeKey))
+            return;
+        dedupeSet.add(dedupeKey);
+        ingest({
+            type: "infra.error",
+            ts: rec.ts,
+            outcome: "error",
+            error: errorMsg,
+            meta: {
+                lane,
+                source: "log-bridge",
+                openclawLog: "lane_task_error",
+            },
+        });
+    }
     // ── Exec command (exec) ────────────────────────────────────────────────────
     function handleExecCommand(rec) {
         pendingCommand = rec.message;
@@ -312,6 +336,9 @@ export function createLogBridge(engine) {
             if (msg.startsWith("session state:")) {
                 handleSessionState(rec);
             }
+            else if (msg.startsWith("lane task error:")) {
+                handleLaneTaskError(rec);
+            }
         }
         else if (rec.subsystem === "exec") {
             if (msg.startsWith("elevated command")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steadwing/openalerts",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "type": "module",
   "description": "OpenAlerts — An alerting layer for agentic frameworks",
   "author": "Steadwing",