Update linebot plugin to version 0.0.6

[kevintsai1202]

Plugin Submission

Plugin information

• Author: kevintsai
• Plugin name: linebot
• Version: 0.0.6
• Source repository: https://github.com/kevintsai1202/difyplugin
• Contact: kevintsai1202@gmail.com

Submission type

• New plugin
• Version update

What changed

• Security: bumped dify_plugin to >=0.9.0 and Werkzeug to >=3.1.8 to patch the safe_join Windows device-name vulnerability (CVE-2026-27199 / CVE-2026-21860).
• Reliability: refactored the endpoint into a core/ service layer (LINE client, storage, formatting, Dify chat/upload) with 53 unit tests; fixed reply-token expiry (falls back to push), silent exception swallowing, and disabled logging that previously caused "webhook Verify succeeds but real messages get no reply".
• New feature: image messages can now be forwarded to the Dify App without requiring a Dify API key — the plugin serves the image itself via a short-lived signed URL (/img/<token>) so Dify can fetch it directly; a Dify API key remains supported as an alternative upload path.
• New feature: optional Markdown-to-FlexMessage rendering, welcome message on follow, display name passthrough, and a /clearconversationhistory command to reset the Dify conversation.

Risk level

• Low risk
• Medium risk
• High risk

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Cloud (remote debug) for both text and image flows; Dify Community Edition testing was not performed in this session.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

The plugin makes outbound HTTPS requests only to:

• The LINE Messaging API (api.line.me, api-data.line.me) — sending replies/push messages, downloading user-sent images, checking message quota, fetching user profile display name.
• The Dify App the end user configures in the plugin settings (session.app.chat.invoke), and optionally the Dify Files API (/files/upload) when the user supplies a Dify API key.

It handles LINE user IDs, display names, and user-sent images/text, all of which are passed through to the Dify App the operator configures — no data is sent to any third-party service beyond LINE and the user's own Dify instance. Channel secret/access token and Dify API key are user-supplied plugin settings, stored via the Dify plugin SDK's own encrypted settings storage, never logged (main.py sets the SDK's request-reader logger to WARNING to avoid leaking them into logs).

Local validation

python -m venv .venv312   # Python 3.12, required by dify_plugin>=0.9.0
.venv312/Scripts/pip install -r requirements.txt pytest
.venv312/Scripts/python -m pytest tests/ -q
# 53 passed

Also verified live on Dify Cloud via remote debug: text conversation, image upload via the plugin's own /img/<token> serving endpoint, and image upload via the Dify API key path.

Reviewer notes

This PR's base branch history required syncing: the kevintsai1202/dify-plugins fork's main had diverged from langgenius/dify-plugins:main with no common ancestor, so this branch was created directly from upstream's latest main commit via the GitHub API (fork object-network sharing) rather than from the fork's own stale main.

🤖 Generated with Claude Code