# ShinrAI for Dify

Protect workflow text, uploaded documents and model calls using your existing Dify model credentials. The three tools are MIT licensed. Install the `.difypkg` directly; the ShinrAI package is not published in Dify's marketplace.

Tested: **Dify 1.17.0**, plugin daemon **0.6.10**, ShinrAI plugin **0.1.1**, Python SDK **0.10.2**, and the official OpenAI API compatible provider **0.0.66**. Actual application and browser tests ran on two independent installations, with Claude Sonnet 4.6 and GPT-5 mini. Release acceptance and external dependencies are recorded separately in the QA handoff.

## Install and verify

1. Sign up for ShinrAI and create an API key within your account's existing key limit.
2. In Dify, open **Plugins → Install plugin → Local package** and select `shinrai-0.1.1.difypkg`. Your administrator must allow local packages. Keep package verification rules appropriate to your own deployment; this direct package does not claim a marketplace signature.
3. Open the ShinrAI tool provider's authorization settings. Enter the service URL, normally `https://api.shinrai.innovius.io`, and your ShinrAI key. Dify validates the connection with a synthetic protection request. For document tools, also enter your Dify installation's **internal file server origin**, for example `http://api:5001`. This must match the signed upload URLs Dify supplies to plugins. The origin is an administrator setting; workflow input cannot change it.
4. Import `workflows/text.yml`. Choose your saved ShinrAI authorization if Dify asks. Select **Test Run**, enter `Kontakt Max Mustermann, E-Mail max.mustermann@example.org.`, and start the run. The result must contain protected values.
5. Import `workflows/document.yml`. Run it with a synthetic TXT, PDF or DOCX. The outputs are protected extracted text and a flattened `protected-document.pdf`. Download the PDF and inspect the visible content. The original upload remains in your Dify installation.
6. Import `workflows/ai-private.yml` and `workflows/ai-restored.yml`. In the **Protected model call** node, select an existing model connection from your Dify workspace and suitable completion limits. The shipped lab selection is an example; your provider resolves its existing credentials inside Dify. Ask it to repeat the synthetic email. Private mode keeps the replacement; restored mode restores recognized replacements inside the ShinrAI plugin.
7. Publish the tested workflow in Dify when you are satisfied with its behavior. Keep the ShinrAI stage required before any export or external model step. Leave “continue on error” and alternative unprotected branches disabled.

The lab's Innovius provider sends streaming events with CRLF separators. Its OpenAI compatible model connection uses `\r\n\r\n` in **Delimiter for streaming results**. Use the separator your own provider emits. An empty, interrupted, tool-bearing or incomplete model response fails the protected stage. GPT-5 mini does not accept a temperature parameter on the tested provider; the templates leave temperature unset. Keep the workflow's maximum tokens within the limit configured on the model connection.

## Protection boundary

- **Protect text** returns protected text; it does not output original-bearing mappings.
- **Protect document** accepts uploads from the configured Dify file origin only, without redirects. It supports TXT, PDF and DOCX, including scans and embedded images processed by ShinrAI. Limits: 10 MB, 100 pages, 125,000 extracted characters, five minutes, 40 MB output. Unsupported or incomplete documents fail before an output is returned. Original filenames and workflow metadata are not sent to ShinrAI or attached to the protected PDF.
- **Protected model call** protects the question, system instructions, retrieved context and supported conversation history consistently within the request. It invokes the model through Dify's reverse invocation API using existing credentials. Restoration mappings stay inside that invocation and never become workflow variables, ordinary model input or outputs. Supported history is JSON containing `user` and `assistant` text messages; raw images, audio, tools and arbitrary message structures are rejected by this stage.
- Each workflow execution is a new paid protection operation. Result downloads and service retries reuse their job. After document retrieval, the plugin requests deletion of service artifacts; ShinrAI's 24-hour expiration is the cleanup backstop. Dify's own original uploads, workflow inputs, protected outputs and execution history follow your Dify retention settings.
- This integration protects the selected workflows. It does not intercept unrelated apps, knowledge indexing, external embeddings, other plugins or a model node that bypasses the required stage. Dify itself receives the original workflow input. For retrieval, pass all selected retrieved context into the protected model node before external inference.

## Troubleshooting and development

On failure, check the key's allowance, configured origin, model connection, completion limits and streaming separator. A document origin mismatch means Dify's internal file URL and the saved administrator setting differ. Fix the configuration instead of adding an arbitrary URL downloader. Never add an unprotected fallback to conceal a protection failure.

`build-plugin.py` assembles only the public connector library and bilingual tool schemas. Package `plugin/` using the official Dify CLI 0.6.10: `dify plugin package plugin -o shinrai-0.1.1.difypkg`. The exact Python dependencies are pinned in `plugin/requirements.txt`. Source and fixtures remain separate from private service/model implementation.

References: [Dify tool plugins](https://docs.dify.ai/en/develop-plugin/dev-guides-and-walkthroughs/tool-plugin), [model reverse invocation](https://docs.dify.ai/en/develop-plugin/features-and-specs/advanced-development/reverse-invocation-model), [Dify 1.17.0](https://github.com/langgenius/dify/tree/1.17.0).

## Validated example

The [screenshots](screenshots/) show the actual installed test application with synthetic data. Replacement values vary between runs. The download includes shared example documents and an executable connection test in `../fixtures/`.