feat: TealTiger governance plugin for Dify - #425

packages/dify-plugin-tealtiger/tools/governance_scan.py:35

• res.security is treated like a dict (.get(...)), but in TealTiger’s Python examples it’s accessed as an attribute (response.security.decision). As written, this will raise at runtime and fall into the exception handler, causing scans to DENY even when they should ALLOW. Also, returning security objects directly may not be JSON-serializable.

            res = client.chat.completions.create(
                model="gpt-4o-mini",
                messages=[{"role": "user", "content": content}]
            )
            

packages/dify-plugin-tealtiger/tools/governance_scan.py:29

• This "governance scan" tool currently calls client.chat.completions.create(...), which invokes an LLM request. The linked Dify integration requirements in this repo describe a deterministic governance node with no LLM in the governance path (scan-only). Consider using TealTiger’s scan/evaluate APIs (e.g., TealGuard/TealEngine) so the tool can scan content without generating completions or incurring model cost/latency.

            if budget > 0:
                client_args["budget"] = budget
                
            client = TealOpenAI(**client_args)
            

packages/dify-plugin-tealtiger/tools/governance_scan.py:12

• The tool currently (1) doesn’t fail fast with an actionable message when api_key is missing and (2) doesn’t wire secret scanning or budget limits into the TealTiger client, even though the tool’s description/requirements mention secrets and budget configuration. Consider validating credentials up front and passing secret_detection + budget into TealOpenAI.

        api_key = self.runtime.credentials.get("api_key")
        content = tool_parameters.get("content", "")
        pii_detection = tool_parameters.get("pii_detection", True)
        prompt_injection = tool_parameters.get("prompt_injection", True)
        content_moderation = tool_parameters.get("content_moderation", True)