manifest 5.17.0 → 5.19.0

package/README.md

@@ -1,171 +1,152 @@
-# Manifest
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/mnfst/manifest/HEAD/.github/assets/logo-white.svg" />
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/mnfst/manifest/HEAD/.github/assets/logo-dark.svg" />
+    <img src="https://raw.githubusercontent.com/mnfst/manifest/HEAD/.github/assets/logo-dark.svg" alt="Manifest" height="53" title="Manifest"/>
+  </picture>
+</p>
+<p align="center">
+    🦞 Take control of your
+OpenClaw costs
+</p>
 
-Cut your AI agent costs by up to 70%. Manifest is an open-source [OpenClaw](https://github.com/open-claw/open-claw) plugin that combines **intelligent LLM routing** with **real-time cost observability**.
+![manifest-gh](https://github.com/user-attachments/assets/7dd74fc2-f7d6-4558-a95a-014ed754a125)
 
-Instead of sending every request to the most expensive model, Manifest scores each query in under 2ms and routes it to the most cost-effective model that can handle it. Simple lookups go to fast, cheap models. Complex reasoning goes to frontier models. You see exactly where every dollar goes in a local dashboard.
+<p align="center">
+  <a href="https://github.com/mnfst/manifest/stargazers"><img src="https://img.shields.io/github/stars/mnfst/manifest?style=flat" alt="GitHub stars" /></a>
+  &nbsp;
+  <a href="https://www.npmjs.com/package/manifest"><img src="https://img.shields.io/npm/v/manifest?color=cb3837&label=npm" alt="npm version" /></a>
+  &nbsp;
+  <a href="https://www.npmjs.com/package/manifest"><img src="https://img.shields.io/npm/dw/manifest?color=cb3837" alt="npm downloads" /></a>
+  &nbsp;
+  <a href="https://github.com/mnfst/manifest/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/mnfst/manifest/ci.yml?branch=main&label=CI" alt="CI status" /></a>
+  &nbsp;
+  <a href="https://app.codecov.io/gh/mnfst/manifest"><img src="https://img.shields.io/codecov/c/github/mnfst/manifest?label=coverage" alt="Codecov" /></a>
+  &nbsp;
+  <a href="LICENSE"><img src="https://img.shields.io/github/license/mnfst/manifest?color=blue" alt="license" /></a>
+  &nbsp;
+  <a href="https://discord.gg/FepAked3W7"><img src="https://img.shields.io/badge/Discord-Join-5865F2?logo=discord&logoColor=white" alt="Discord" /></a>
+</p>
 
-## Quick start
+## What do you get?
 
-### Cloud (default)
+- 🔀 **Routes every request to the right model** — and cuts costs up to 70%
+- 📊 **Track your expenses** — real-time dashboard that shows tokens and costs per model
+- 🔔 **Set limits** — set up alerts (soft or hard) if your consumption exceeds a certain volume
 
-```bash
-openclaw plugins install manifest
-openclaw config set plugins.entries.manifest.config.apiKey "mnfst_YOUR_KEY"
-openclaw gateway restart
-```
+## Why Manifest
 
-Sign up at [app.manifest.build](https://app.manifest.build) to get your API key.
+OpenClaw sends all your requests to the same model, which is not cost-effective since you summon big models for tiny tasks. Manifest solves it by redirecting queries to the most cost-effective model.
 
-### Local (zero config)
+Manifest is an OpenClaw plugin that intercepts your query, passes it through a 23-dimension scoring algorithm in <2ms and sends it to the most suitable model.
 
-```bash
-openclaw plugins install manifest
-openclaw config set plugins.entries.manifest.config.mode local
-openclaw gateway restart
-```
+Unlike almost all alternatives, everything stays on your machine. No suspicious installer, no black box, no third party, no crypto.
 
-Open `http://127.0.0.1:2099` — your dashboard is live with sql.js storage, no accounts or external services needed.
+## Quick Start
 
-## How the LLM router works
+### Cloud vs Local
 
-Manifest registers as an OpenAI-compatible provider in OpenClaw under the model name `auto`. When a request comes in:
+Manifest is available in cloud and local versions. While both versions install the same OpenClaw Plugin, the local version stores the telemetry data on your computer and the cloud version uses our secure platform.
 
-1. **Score** — The plugin analyzes the conversation locally (last 10 user/assistant messages, excluding system prompts) and assigns a complexity tier.
-2. **Route** — The tier maps to the cheapest model that meets the quality bar: simple tasks go to small models, complex tasks go to frontier models.
-3. **Momentum** — Recent tier history (last 5 turns, 30-min window) is factored in so mid-conversation complexity shifts are handled smoothly.
-4. **Observe** — Every routed request is traced with the resolved model, provider, tier, token counts, and cost — visible in your dashboard.
+#### Use cloud if
+- You want a quick install
+- You want to access the dashboard from different devices
+- You want to connect multiple agents
 
-The entire scoring step adds < 2ms of latency. If the resolve call fails, the request falls through to the default model with no interruption.
+#### Use local if
+- You don't want the telemetry data to move from your computer
+- You don’t need multi-device access
+- You don't want to subscribe to a cloud service
 
-### Enable routing
+If you don't know which version to choose, start with the **cloud version**.
 
-Routing activates automatically when the plugin is enabled. Point your OpenClaw config to use the `manifest` provider with model `auto`:
+### Cloud (default)
 
-```yaml
-# openclaw.config.yaml
-models:
-  - provider: manifest
-    model: auto
+```bash
+openclaw plugins install manifest
+openclaw config set plugins.entries.manifest.config.apiKey "mnfst_YOUR_KEY"
+openclaw gateway restart
 ```
 
-## Cost observability
-
-The dashboard tracks every LLM call in real time:
-
-- **Token usage** — input, output, and cache-read tokens broken down by model and provider
-- **Cost breakdown** — per-model spend in USD with trend indicators
-- **Message log** — paginated history with latency, tokens, and tool calls per request
-- **Agent overview** — aggregated metrics across all your agents
-
-### Agent self-query tools
-
-The plugin registers three tools your agent can call to query its own telemetry:
+Sign up at [app.manifest.build](https://app.manifest.build) to get your API key.
 
-| Tool | Returns |
-|------|---------|
-| `manifest_usage` | Token consumption (input, output, cache, trend %) |
-| `manifest_costs` | Cost breakdown by model in USD |
-| `manifest_health` | Connectivity check |
+### Local
 
-```
-User: "How much have I spent today?"
-  → manifest_costs({ period: "today" })
-  → { total_usd: 0.42, by_model: { "gpt-4o": 0.38, "gpt-4o-mini": 0.04 } }
+```bash
+openclaw plugins install manifest
+openclaw config set plugins.entries.manifest.config.mode local
+openclaw gateway restart
 ```
 
-## Data privacy
+Dashboard opens at **http://127.0.0.1:2099**. Telemetry from your agents flows in automatically.
 
-- **Local mode**: Everything stays on your machine. sql.js database, no network calls.
-- **Cloud mode**: Only OpenTelemetry metadata (model, tokens, latency) is sent. Message content is never collected.
+## Features
 
-## Configuration
+- **LLM Router** — scores each query and calls the most suitable model
+- **Real-time dashboard** — tokens, costs, messages, and model usage at a glance
+- **No coding required** — Simple install as OpenClaw plugin
+- **OTLP-native** — standard OpenTelemetry ingestion (traces, metrics, logs)
 
-Cloud mode is the default. For local mode (zero config), set `mode` to `local`.
+## Privacy by architecture
 
-| Setting | Type | Default | Description |
-|---------|------|---------|-------------|
-| `mode` | string | `cloud` | `cloud` sends telemetry to app.manifest.build (default). `local` runs an embedded server on your machine. `dev` connects to a local backend without API key management. |
-| `apiKey` | string | env `MANIFEST_API_KEY` | Agent API key (must start with `mnfst_`). Required for cloud mode, auto-generated in local mode. |
-| `endpoint` | string | `https://app.manifest.build/otlp` | OTLP endpoint URL. Only relevant for cloud and dev modes. |
-| `port` | number | `2099` | Port for the embedded dashboard server (local mode only). |
-| `host` | string | `127.0.0.1` | Bind address for the embedded server (local mode only). |
+**In local mode, your data stays on your machine.** All agent messages, token counts, costs, and telemetry are stored locally. In cloud mode, only OpenTelemetry metadata (model, tokens, latency) is sent — message content is never collected.
 
-### Local mode
+**In cloud mode, the blind proxy physically cannot read your prompts** This is fundamentally different from services saying "trust us."
 
-```bash
-openclaw config set plugins.entries.manifest.config.mode local
-openclaw gateway restart
-```
-
-### Self-hosted
+The only thing Manifest collects is anonymous product analytics (hashed machine ID, OS platform, package version, event names) to help improve the project. No personally identifiable information or agent data is included.
 
-Point to your own Manifest instance:
+**Opting out:**
 
 ```bash
-openclaw config set plugins.entries.manifest.config.endpoint "http://localhost:3001/otlp/v1"
+MANIFEST_TELEMETRY_OPTOUT=1
 ```
 
-## OpenTelemetry trace structure
-
-The plugin hooks into four OpenClaw lifecycle events and produces standard OpenTelemetry traces:
-
-| Event | What happens |
-|-------|-------------|
-| `message_received` | Root span created, message counter incremented |
-| `before_agent_start` | Child span for the agent turn |
-| `tool_result_persist` | Tool span with duration, success/error tracking |
-| `agent_end` | Spans closed, token/cost metrics recorded, routing resolved |
+Or add `"telemetryOptOut": true` to `~/.openclaw/manifest/config.json`.
 
-```
-openclaw.request (SERVER)
-  └── openclaw.agent.turn (INTERNAL)     model=gpt-4o-mini, tier=simple
-        ├── tool.web_search               duration=320ms
-        └── tool.summarize                duration=45ms
-```
 
-## Architecture
+## Manifest vs OpenRouter
 
-The plugin bundles all OpenTelemetry dependencies into a single file via esbuild. This avoids the dual-registry problem when OpenClaw's own `@opentelemetry/api` and the plugin's copy coexist. Zero runtime dependencies.
+|              | Manifest                                                   | OpenRouter                                                    |
+| ------------ | ---------------------------------------------------------- | ------------------------------------------------------------- |
+| Architecture | Runs locally — data stays on your machine                  | Cloud proxy — all traffic routes through their servers        |
+| Cost         | Free                                                       | 5% fee on every API call                                      |
+| Source code  | MIT licensed, fully open                                   | Proprietary                                                   |
+| Data privacy | 100% local routing and logging                    | Your prompts and responses pass through a third party         |
+| Transparency | Open scoring algorithm — see exactly why a model is chosen | Black box routing, no visibility into how models are selected |
 
-```
-Published package:
-  dist/index.js          Single-file bundle (~1.4 MB)
-  dist/server.js         Embedded NestJS server (local mode)
-  dist/backend/          Backend compiled output
-  public/                Frontend dashboard assets
-  openclaw.plugin.json   Plugin manifest + config schema
-  skills/                Bundled agent skills
-```
+## Supported Providers
 
-## Development
+Manifest supports **300+ models** across all major LLM providers. Every provider supports smart routing, real-time cost tracking, and OTLP telemetry.
 
-```bash
-npm run build     # Build the bundle
-npm run dev       # Watch mode
-npm test          # Run tests
-npm run typecheck # Type-check
-```
+| Provider | Models |
+|----------|--------|
+| [OpenAI](https://platform.openai.com/) | `gpt-5.3`, `gpt-4.1`, `o3`, `o4-mini` + 54 more |
+| [Anthropic](https://www.anthropic.com/) | `claude-opus-4-6`, `claude-sonnet-4.5`, `claude-haiku-4.5` + 14 more |
+| [Google Gemini](https://ai.google.dev/) | `gemini-2.5-pro`, `gemini-2.5-flash`, `gemini-3-pro` + 19 more |
+| [DeepSeek](https://www.deepseek.com/) | `deepseek-v3`, `deepseek-r1` + 11 more |
+| [xAI](https://x.ai/) | `grok-4`, `grok-3`, `grok-3-mini` + 8 more |
+| [Mistral AI](https://mistral.ai/) | `mistral-large`, `codestral`, `devstral` + 26 more |
+| [Qwen (Alibaba)](https://www.alibabacloud.com/en/solutions/generative-ai/qwen) | `qwen3-235b`, `qwen3-coder`, `qwq-32b` + 42 more |
+| [MiniMax](https://www.minimax.io/) | `minimax-m2.5`, `minimax-m1`, `minimax-m2` + 5 more |
+| [Kimi (Moonshot)](https://kimi.ai/) | `kimi-k2`, `kimi-k2.5` + 3 more |
+| [Amazon Nova](https://aws.amazon.com/ai/nova/) | `nova-pro`, `nova-lite`, `nova-micro` + 5 more |
+| [Z.ai (Zhipu)](https://z.ai/) | `glm-5`, `glm-4.7`, `glm-4.5` + 5 more |
+| [OpenRouter](https://openrouter.ai/) | 300+ models from all providers |
+| [Ollama](https://ollama.com/) | Run any model locally (Llama, Gemma, Mistral, …) |
 
-Local testing against OpenClaw:
+## Contributing
 
-```bash
-openclaw plugins install -l ./packages/openclaw-plugin
-openclaw gateway restart
-# Dashboard at http://127.0.0.1:2099
-```
+Manifest is open source under the [MIT license](LICENSE). See [CONTRIBUTING.md](CONTRIBUTING.md) for the development setup, architecture notes, and workflow. Join the conversation on [Discord](https://discord.gg/FepAked3W7).
 
-## Troubleshooting
+> **Want a hosted version instead?** Check out [app.manifest.build](https://app.manifest.build)
 
-**No spans appearing?**
-- In cloud mode, check your API key starts with `mnfst_`
-- Verify the endpoint is reachable: `curl -I http://your-endpoint/v1/traces`
-- Disable `diagnostics-otel` if enabled: `openclaw plugins disable diagnostics-otel`
+## Quick Links
 
-**Stale code after update?**
-```bash
-rm -rf /tmp/jiti && openclaw gateway restart
-```
+- [GitHub](https://github.com/mnfst/manifest)
+- [Docs](https://manifest.build/docs)
+- [Discord](https://discord.com/invite/FepAked3W7)
+- [Discussions](https://github.com/mnfst/manifest/discussions)
 
 ## License
 
-[MIT](LICENSE.md)
+[MIT](LICENSE)

package/dist/backend/analytics/services/aggregation.service.js

@@ -223,7 +223,11 @@ let AggregationService = class AggregationService {
             .addSelect('at.input_tokens + at.output_tokens', 'total_tokens')
             .addSelect(costExpr, 'cost')
             .addSelect('at.routing_tier', 'routing_tier')
-            .addSelect('at.routing_reason', 'routing_reason');
+            .addSelect('at.routing_reason', 'routing_reason')
+            .addSelect('at.cache_read_tokens', 'cache_read_tokens')
+            .addSelect('at.cache_creation_tokens', 'cache_creation_tokens')
+            .addSelect('at.duration_ms', 'duration_ms')
+            .addSelect('at.error_message', 'error_message');
         if (params.cursor) {
             const sepIdx = params.cursor.indexOf('|');
             if (sepIdx !== -1) {

package/dist/backend/analytics/services/timeseries-queries.service.js

@@ -170,6 +170,7 @@ let TimeseriesQueriesService = class TimeseriesQueriesService {
             .addSelect(costExpr, 'cost')
             .addSelect('at.routing_tier', 'routing_tier')
             .addSelect('at.routing_reason', 'routing_reason')
+            .addSelect('at.error_message', 'error_message')
             .where('at.timestamp >= :cutoff', { cutoff });
         (0, query_helpers_1.addTenantFilter)(qb, userId, agentName);
         return qb.orderBy('at.timestamp', 'DESC').limit(limit).getRawMany();

package/dist/backend/auth/auth.instance.js

@@ -24,6 +24,7 @@ const nodeEnv = process.env['NODE_ENV'] ?? '';
 if (!isLocalMode && nodeEnv !== 'test' && (!betterAuthSecret || betterAuthSecret.length < 32)) {
     throw new Error('BETTER_AUTH_SECRET must be set to a value of at least 32 characters');
 }
+const local_mode_constants_1 = require("../common/constants/local-mode.constants");
 function buildTrustedOrigins() {
     const origins = [];
     if (process.env['BETTER_AUTH_URL']) {
@@ -32,7 +33,9 @@ function buildTrustedOrigins() {
     if (process.env['CORS_ORIGIN']) {
         origins.push(process.env['CORS_ORIGIN']);
     }
-    origins.push(`http://localhost:3000`, `http://localhost:${port}`);
+    if (isDev || isLocalMode) {
+        origins.push(`http://localhost:3000`, `http://localhost:${port}`);
+    }
     if (isLocalMode) {
         origins.push(`http://127.0.0.1:${port}`, `http://127.0.0.1:3000`);
     }
@@ -47,7 +50,7 @@ exports.auth = isLocalMode
         database: database,
         baseURL: process.env['BETTER_AUTH_URL'] ?? `http://localhost:${port}`,
         basePath: '/api/auth',
-        secret: betterAuthSecret || 'test-only-fallback-secret-not-for-production',
+        secret: betterAuthSecret || (0, local_mode_constants_1.getLocalAuthSecret)(),
         logger: { level: 'debug' },
         telemetry: { enabled: false },
         account: {

package/dist/backend/common/guards/api-key.guard.js

@@ -48,11 +48,12 @@ let ApiKeyGuard = ApiKeyGuard_1 = class ApiKeyGuard {
             this.logger.warn(`Rejected request without API key from ${request.ip}`);
             throw new common_1.UnauthorizedException('X-API-Key header required');
         }
-        const hash = (0, hash_util_1.sha256)(apiKey);
+        const hash = (0, hash_util_1.hashKey)(apiKey);
         const found = await this.apiKeyRepo.findOne({ where: { key_hash: hash } });
         if (found) {
             request.apiKeyUserId = String(found.user_id);
-            this.apiKeyRepo.update({ key_hash: hash }, { last_used_at: () => 'CURRENT_TIMESTAMP' })
+            this.apiKeyRepo
+                .update({ key_hash: hash }, { last_used_at: () => 'CURRENT_TIMESTAMP' })
                 .catch(() => { });
             return true;
         }

package/dist/backend/common/utils/crypto.util.js

@@ -13,8 +13,7 @@ function deriveKey(secret, salt) {
     return (0, crypto_1.scryptSync)(secret, salt, KEY_LENGTH);
 }
 function getEncryptionSecret() {
-    const key = process.env['MANIFEST_ENCRYPTION_KEY'] ||
-        process.env['BETTER_AUTH_SECRET'];
+    const key = process.env['MANIFEST_ENCRYPTION_KEY'] || process.env['BETTER_AUTH_SECRET'];
     if (key && key.length >= 32) {
         return key;
     }
@@ -29,10 +28,7 @@ function encrypt(plaintext, secret) {
     const key = deriveKey(secret, salt);
     const iv = (0, crypto_1.randomBytes)(IV_LENGTH);
     const cipher = (0, crypto_1.createCipheriv)(ALGORITHM, key, iv);
-    const encrypted = Buffer.concat([
-        cipher.update(plaintext, 'utf8'),
-        cipher.final(),
-    ]);
+    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
     const tag = cipher.getAuthTag();
     return [
         salt.toString('base64'),
@@ -54,10 +50,7 @@ function decrypt(ciphertext, secret) {
     const key = deriveKey(secret, salt);
     const decipher = (0, crypto_1.createDecipheriv)(ALGORITHM, key, iv);
     decipher.setAuthTag(tag);
-    const decrypted = Buffer.concat([
-        decipher.update(encrypted),
-        decipher.final(),
-    ]);
+    const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
     return decrypted.toString('utf8');
 }
 function isEncrypted(value) {

package/dist/backend/common/utils/hash.util.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sha256 = sha256;
+exports.hashKey = hashKey;
 exports.keyPrefix = keyPrefix;
 const crypto_1 = require("crypto");
 const HASH_SALT = 'manifest-api-key-salt';
 const KEY_LENGTH = 32;
-function sha256(input) {
+function hashKey(input) {
     return (0, crypto_1.scryptSync)(input, HASH_SALT, KEY_LENGTH).toString('hex');
 }
 function keyPrefix(key) {

package/dist/backend/common/utils/sql-dialect.js

@@ -12,7 +12,7 @@ exports.sqlSanitizeCost = sqlSanitizeCost;
 exports.portableSql = portableSql;
 exports.sqlCastInterval = sqlCastInterval;
 function detectDialect(dsType) {
-    return (dsType === 'better-sqlite3' || dsType === 'sqljs') ? 'sqlite' : 'postgres';
+    return dsType === 'sqljs' ? 'sqlite' : 'postgres';
 }
 function timestampType() {
     return process.env['MANIFEST_MODE'] === 'local' ? 'datetime' : 'timestamp';

package/dist/backend/config/app.config.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.appConfig = void 0;
 const config_1 = require("@nestjs/config");
 const path_1 = require("path");
-function sanitizeSqlitePath(raw) {
+function sanitizeDbPath(raw) {
     if (!raw)
         return '';
     return (0, path_1.resolve)(raw);
@@ -13,7 +13,7 @@ exports.appConfig = (0, config_1.registerAs)('app', () => ({
     nodeEnv: process.env['NODE_ENV'] ?? 'development',
     databaseUrl: process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase',
     manifestMode: process.env['MANIFEST_MODE'] ?? 'cloud',
-    sqlitePath: sanitizeSqlitePath(process.env['MANIFEST_DB_PATH'] ?? ''),
+    dbPath: sanitizeDbPath(process.env['MANIFEST_DB_PATH'] ?? ''),
     corsOrigin: process.env['CORS_ORIGIN'] ?? 'http://localhost:3000',
     throttleTtl: Number(process.env['THROTTLE_TTL'] ?? 60000),
     throttleLimit: Number(process.env['THROTTLE_LIMIT'] ?? 100),