bump nalv plugin to version 0.1.5

[Calpath-Duke]

Plugin Submission

Plugin information

• Author: nalv-ai
• Plugin name: NALV
• Version: 0.1.5
• Source repository: https://github.com/nalv-ai/nalv-dify-plugin
• Contact: support@nalv.ai

Submission type

• New plugin
• Version update

What changed

Version update from 0.1.4 to 0.1.5.

Adds the Run Release Check Tool and Tool-first onboarding.

Users can select a conversational Dify app and run one of three frozen release checks:

• Refund Boundary
• Restricted Action
• Human Handoff

On first use, the Tool returns Connect NALV. The user follows the link, authorizes NALV with Google, returns to Dify, and runs the check again.

Normal setup does not require an API key or API Endpoint.

The existing Connect NALV Endpoint remains available as a manual/fallback path.

Supported targets are conversational Dify apps, primarily Chatflow. Workflow targets are not supported.

This update does not remove the existing 0.1.4 Endpoint workflow.

Risk level

• Low risk
• Medium risk
• High risk

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Primary live certification for 0.1.5 was performed on Dify Cloud. Community Edition was not separately retested for this release. No Community Edition-specific behavior is intentionally relied upon.

Security and privacy notes

Connect NALV uses Google OpenID Connect on the NALV web app. Google tokens do not enter or get stored by the Dify plugin. The plugin stores a scoped NALV surface token in Dify plugin storage. Test conversation content and observed replies are sent to the fixed https://app.nalv.ai service for verification. Destination is fixed, not user-configurable. See packaged PRIVACY.md.

High risk: authentication data (scoped NALV surface token and short-lived Connect exchange secret) and outbound check transcripts.

Refund Boundary is a support-behavior verification check. It tests whether the bot stays within a configured refund eligibility boundary. The plugin does NOT process payments, issue refunds, transfer money, or transfer assets. This clarification is included because the Marketplace keyword scanner may flag the word "refund".

Local validation

Official dify-marketplace-toolkit: 0 blocking errors.

dify-plugin 0.10.2: PASS

dify-plugin 0.9.0: PASS

Package SHA-256: a605025e9b443660d070201dec33277d6bad0d47074011eaf99addbcaf038df4

Reviewer notes

Single-file version update. nalv-0.1.4.difypkg is unchanged. Source: https://github.com/nalv-ai/nalv-dify-plugin at 425b796.

Made with Cursor

[Calpath-Duke]

@crazywoola Hi — thank you again for reviewing and merging the NALV 0.1.5 update.

It looks like the post-merge Marketplace publication failed after the PR was successfully merged.

The Upload Merged Plugin workflow for merge commit 1754dfe63479065c4b4b9afb6873dc33d61b6fe4 failed specifically at:

Upload Plugin (production)

The preceding validation steps — Validate Plugin Path, Unpack Plugin for Final Validation, and Final Package Validation — all passed, but the production uploader returned:

{'code': -1, 'data': None, 'msg': 'package decode failed'}

Failed workflow:
https://github.com/langgenius/dify-plugins/actions/runs/34583541111

For reference, the package had already passed the submission-side validation:

• Official dify-marketplace-toolkit: 0 blocking errors
• dify-plugin 0.10.2: PASS
• dify-plugin 0.9.0: PASS
• Package SHA-256: a605025e9b443660d070201dec33277d6bad0d47074011eaf99addbcaf038df4

One potentially relevant detail: the reviewer note on this PR says nalv-0.1.4.difypkg was unchanged while the Marketplace version was bumped to 0.1.5. If the production uploader requires the package artifact itself to be rebuilt or version-matched, please let me know.

NALV 0.1.5 therefore still does not appear to have been published to the Marketplace.

Could you please check whether the production upload can be rerun, or let me know if the .difypkg needs to be rebuilt/repacked differently?

I haven't bumped the version or changed the package since the merged submission, so the investigation can stay scoped to the failed post-merge publication.

Thanks!

[crazywoola]

Please submit a new pull request and bump the version in the manifest.