Update Live Tennis API plugin to v0.0.6

[bensynapse]

Plugin Submission

Plugin information

• Author: livetennisapi
• Plugin name: livetennisapi
• Version: 0.0.6
• Source repository: https://github.com/livetennisapi/livetennisapi-dify-plugin
• Contact: hello@livetennisapi.com

Submission type

• New plugin
• Version update

What changed

Version update, 0.0.5 → 0.0.6. Additive — the six existing tools are
unchanged, so workflows built on the Marketplace 0.0.5 work unmodified.

• Six new read-only tools over the API's documented public endpoints,
  following the same conventions as the existing six (prose + JSON output,
  no tool ever raises, tier gates named in tool descriptions):
  get_h2h (head-to-head), get_archive_matches / get_archive_players /
  get_archive_career (a 1968–2022 results archive), get_rankings
  (published ranking tables) and get_match_statistics (in-play statistics).
  Endpoints above the free plan answer on lower plans with a normal
  reason: "upgrade_required" result naming the plan — never an exception.
• New juniors value for get_matches' tour parameter (the API's tours
  are ATP, WTA, Challenger, ITF and juniors).
• Richer rate-limit results: the API's daily cap now reports
  limit_per_day and the absolute resets_at instant; its 24-hour abuse
  throttle is its own reason: "abuse_throttled" with retry_at_epoch; an
  ambiguous player-name fragment returns reason: "ambiguous_name" with the
  candidate list.
• Updated Marketplace listing copy (current plan limits, the full tier-gated
  tool table).

Reconciliation note for reviewers. After #2808 (0.0.3) merged, 0.0.4 and
0.0.5 were pushed to this repo directly by a maintainer (dcf71cc, 46c71ea —
thank you): 0.0.4 was a version bump and 0.0.5 additionally dropped the
entertainment manifest tag. Both changes are folded into the source
repository, and this 0.0.6 is built on top of them — the entertainment tag
stays gone.

Every tool is a GET. The plugin has no write path of any kind.

Risk level

• Low risk
• Medium risk
• High risk

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below. — limitation documented in Reviewer notes
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

Vendor disclosure. I am the operator of the Live Tennis API, the service
this plugin wraps, and the publisher of the livetennisapi PyPI package it
depends on. This is a first-party integration, not a third-party wrapper.

Network destinations. One, fixed and documented:
https://api.livetennisapi.com/api/public/v1. It is a module constant in
livetennisapi_client.py, deliberately not exposed as a credential or a
tool parameter, so the destination cannot be redirected by a user, a workflow
or a model. No arbitrary URL fetching, proxying, crawling or webhook
forwarding.

Sensitive capabilities: none. No command or code execution, no shell, no
SQL, no database access, no SSH/SFTP, no filesystem operations, no browser
automation, no bundled binaries. Every tool issues a GET and formats the
response.

Credentials. A single api_key (secret-input), sent in the x-api-key
header to the one host above. It is never logged, never included in an error
message, and never returned in tool output. The plugin writes no files and
keeps no cache or state between invocations.

Input constraints. Unchanged in kind from the reviewed 0.0.2/0.0.3:
numeric parameters are coerced and clamped to the API's own ceilings, select
parameters are case-folded against fixed allow-lists with a safe fallback, and
name parameters are length-checked before any request leaves the plugin.
Requests carry a 30-second timeout.

Data returned is public professional-sport information: player names,
nationalities, rankings, handedness, dates of birth, match results, statistics
and scores. No Dify user identity, conversation content, prompt or workflow
variable is sent anywhere. See PRIVACY.md.

Dependencies: two lines. dify_plugin>=0.9.0 and livetennisapi>=1.3.0,
both from PyPI.

Reviewer notes

• Testing. Verified with the source repo's offline test suite, which
  drives all twelve tools through the plugin's real _invoke entrypoints
  against a local HTTP stub: no key, success, 403 tier wall, 401, 404, 429
  and unusable parameters — nothing raises — plus value checks that the
  daily-cap resets_at, the abuse throttle and ambiguous-name candidates are
  relayed, and a wire assertion that the key travels in x-api-key with no
  Authorization header. Packaged and validated with the dify CLI v0.6.5.
  The source repo now runs all of this in CI:
  https://github.com/livetennisapi/livetennisapi-dify-plugin/actions.
  Not re-verified on Dify Cloud for this release.
• The Marketplace currently returns 404 for
  livetennisapi/livetennisapi/0.0.6, so the pre-check version gate passes.

🤖 Generated with Claude Code

[crazywoola]

✅ LGTM

Decision: Approve

Local Check Results

Check	Status	Detail	Required action
PR content language	✅ Pass	PR title/body CJK ratio=0.0% (zh=0, en=4484, ignored_zh=0, allowed_zh<=0)	None.
Project structure	✅ Pass	All expected files present: manifest.yaml, README.md, PRIVACY.md. _assets/: yes.	None.
Manifest author	✅ Pass	author is valid.	None.
Icon validation	✅ Pass	icon exists: _assets/icon.png	None.
Version check	✅ Pass	version 0.0.6 is available.	None.
README language	✅ Pass	README.md CJK ratio=0.0% (zh=0, en=5534, allowed_zh<=0)	None.
PRIVACY.md	✅ Pass	PRIVACY.md exists and is non-empty.	None.
Dependency install	✅ Pass	requirements installed successfully.	None.
dify_plugin version	✅ Pass	dify_plugin version 0.10.1 satisfies >= 0.9.0.	None.
Install test	✅ Pass	plugin install test passed.	None.
Packaging test	✅ Pass	packaging check passed.	None.