Are transactions sending ether from contract addresses to normal addresses listed in block.transactions or are they not trivial to detect?
If not in block.transactions than how to detect?
All transactions are listed in blocks and can be recovered using the transaction hash. You can poll for changes on your node by filtering to what you're looking for. Also, if you fire an event from your contract, you can filter to only get updates when you see that event; so, if you want your contract to alert you every time it sends out ether, you could create an event that gets emitted any time a payable function is called.
Strictly speaking, there is no such thing as a transaction sent from smart contract. Every valid transaction has to be signed by some private key, and address, derived from this private key, becomes
from address of the transaction. As long as smart contract addresses are not derived from private keys, there could not be any transactions originating from smart contract addresses.
In when transaction destination address has some byte code belonging to it, i.e. when transaction is sent to smart contract address, this byte code is executed. Among other thing, byte code may send ether from its own address to another addresses, and also invoke or even deploy other smart contract. At this point byte code of such invoked or deployed smart contracts is executed, and may in turn invoke or deploy more smart contracts, and so forth.
When byte code on one contract invokes another contracts, for contract being invoked this looks much like a transaction being sent to it, but such invocation is actually not a transaction. It does not have transaction hash or digital signature, does not have receipt and it is not included into block.
So such invocations are actually hard to detect. One way to find such invocation is to analyze execution trance of the transaction this invocation was executed within, i.e. original transaction that triggered chain of contracts invoking each other that finally led to the invocation in scope.
Another, and preferred way, is to use events. Byte code being called may log some event and it will be included into receipt of original transaction. Events are indexed and may bear complex payloads, which makes them easy to find and analyze.
We've solved this exact issue with TrueBlocks which watches every block and extracts from it a list of every involved address. With this ongoing list, it creates an easily searchable index which can be continually monitored to extract exactly these type of 'internal transactions' or 'message calls.' You have to be running your own --tracing node for it to fully work, and it's not easy to install, but it works and we're happy to help if you have questions. http://github.com/Great-Hill-Corporation/trueblocks-core. It's open source.
(Sorry for the plug, but this does answer the question directly.)