Feat/dify integration by hittyt · Pull Request #157 · alibaba/OpenSandbox

hittyt · 2026-02-01T11:59:49Z

Summary

This PR introduces a Dify plugin that enables Dify workflows to use OpenSandbox as a code execution environment.
Features

Three sandbox tools for Dify workflows:

sandbox_create - Create a new sandbox with configurable image, timeout, and environment
sandbox_run - Execute commands in a running sandbox
sandbox_kill - Terminate a sandbox

Flexible credential management:

Supports Dify's built-in credential configuration
Falls back to environment variables (OPENSANDBOX_BASE_URL, OPENSANDBOX_API_KEY)

Testing

Not run (explain why)
Unit tests
Integration tests
e2e / manual verification

Breaking Changes

None
Yes (describe impact and migration path)

Checklist

Linked Issue or clearly described motivation Integrated with Dify code execution node #152
Added/updated docs (if needed)
Added/updated tests (if needed)
Security impact considered
Backward compatibility considered

- Add OpenSandbox Dify plugin with sandbox_create, sandbox_run, sandbox_kill tools - Add E2E test framework for Dify plugin integration - Add GitHub Actions workflow for automated E2E testing - Support both local testing and CI testing

main branch references unreleased image versions (1.12.0)

First run will still pull images, but subsequent runs will use cached images. Expected to reduce CI time from ~15min to ~5min after cache is populated.

Dify 1.11.4 requires CSRF token header for authenticated requests

…bugging - Add timeout/retry loop for provider discovery - Match by partial name or plugin_id - Add debug output for provider list

- Use plugin endpoint for plugin-type providers - Add debug output for credentials flow - Fallback to using provider name as credential ID

- Print full provider details for debugging - Use default tool labels when tools list is empty - Fix plugin_unique_identifier fallback

…ial_id

Plugin now reads OPENSANDBOX_BASE_URL and OPENSANDBOX_API_KEY env vars as fallback when credentials are not configured via Dify API

Dify's plugin credential API doesn't support configuring credentials for plugin providers via API. The test now verifies: - Plugin registration success - Provider discovery - Provider structure validation Full workflow execution requires manual credential configuration in Dify UI.

- Unit tests for utility functions (normalize_domain, parse_optional_json, etc) - Integration tests for sandbox lifecycle (create -> run -> kill) - Integration tests require running OpenSandbox server

jwx0925 · 2026-02-01T12:06:27Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 908726f4b9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-02-01T12:10:28Z

integrations/dify-plugin/opensandbox/provider/opensandbox.py

+    def _validate_credentials(self, credentials: dict[str, Any]) -> None:
+        base_url = credentials.get("opensandbox_base_url", "")
+        api_key = credentials.get("opensandbox_api_key", "")
+        if not base_url or not api_key:
+            raise ToolProviderCredentialValidationError("Missing OpenSandbox base URL or API key.")


Allow env fallback during credential validation

The tools support falling back to OPENSANDBOX_BASE_URL/OPENSANDBOX_API_KEY, but the provider validation rejects missing credentials before tools ever run. In Dify, provider validation happens when configuring the plugin, so a deployment that relies on env vars (e.g., secrets injected into the runtime container) will fail to register the provider even though build_connection_config would succeed at invocation time. If env-only configuration is intended, this should read env vars here or mark the credentials optional in the provider definition so the plugin can be used with env-based configuration.

Useful? React with 👍 / 👎.

Add env recognition support for the fallback path

.github/workflows/dify-plugin-e2e.yml

integrations/dify-plugin/opensandbox/tools/sandbox_create.yaml

tests/e2e/dify_plugin/.gitignore

server/.gitignore

tests/e2e/dify_plugin/run_local.sh

Pangjiping · 2026-02-02T02:04:40Z

@ninan-nn please review this about Python sdk usage

- Move .gitignore patterns from server/ and tests/e2e/dify_plugin/ to root - Add .venv/, .dify/, and *.e2e.toml to root .gitignore - Remove push trigger for feat/** branches in dify-plugin-e2e workflow - Support env var fallback (OPENSANDBOX_BASE_URL/OPENSANDBOX_API_KEY) in provider validation for consistency with tool invocation logic

ninan-nn · 2026-02-03T07:24:18Z

integrations/dify-plugin/opensandbox/pyproject.toml

+# uv pip compile pyproject.toml -o ./requirements.txt
+dependencies = [
+    "dify-plugin>=0.5.1",
+    "opensandbox",


Set the dependency version range to opensandbox>=1.0.0,<2.0.0 to avoid unexpected breaking changes from future major releases and ensure compatibility.

ninan-nn · 2026-02-03T07:33:36Z

integrations/dify-plugin/opensandbox/pyproject.toml

+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+[project]


Suggested: use Pyright and Ruff for type checking and linting.

ninan-nn · 2026-02-03T07:37:47Z

integrations/dify-plugin/opensandbox/provider/opensandbox.yaml

+      en_US: API key for OpenSandbox server authentication. Falls back to OPENSANDBOX_API_KEY env var.
+      zh_Hans: 用于 OpenSandbox 服务鉴权的 API Key。如未填写，将使用 OPENSANDBOX_API_KEY 环境变量。
+tools:
+  - tools/sandbox_create.yaml


why filesystem tool not provided, eg. file_read & file_write

hittyt added 21 commits February 1, 2026 15:16

fix(e2e): use stable Dify release tag 1.11.4 instead of main

03a672c

main branch references unreleased image versions (1.12.0)

chore: ignore e2e config files

9fbc589

perf(ci): add Docker image caching to speed up E2E tests

a8b7c7c

First run will still pull images, but subsequent runs will use cached images. Expected to reduce CI time from ~15min to ~5min after cache is populated.

fix(e2e): pass CSRF token to all Dify API requests

63ad72a

Dify 1.11.4 requires CSRF token header for authenticated requests

fix(e2e): improve tool provider discovery with better matching and de…

fb9c5da

…bugging - Add timeout/retry loop for provider discovery - Match by partial name or plugin_id - Add debug output for provider list

fix(e2e): handle None values in provider matching

9d6d84e

fix(e2e): add CSRF token to credentials GET request

cda104e

fix(e2e): support plugin provider credentials API

e4dc710

- Use plugin endpoint for plugin-type providers - Add debug output for credentials flow - Fallback to using provider name as credential ID

fix(e2e): add fallback for tools and improve debugging

a8077bb

- Print full provider details for debugging - Use default tool labels when tools list is empty - Fix plugin_unique_identifier fallback

fix(e2e): try credentials/add endpoint and update with credential_id

4d29aa0

fix(e2e): add type parameter and try multiple credential API formats

1f7ac8d

fix(e2e): try plugin-specific credential endpoints

ed4bb02

fix(e2e): try more credential API patterns and continue on failure

100e3ba

fix(e2e): pass credentials via tool_configurations instead of credent…

63709f1

…ial_id

fix(e2e): pass OpenSandbox config via environment variables to plugin

f75d201

Plugin now reads OPENSANDBOX_BASE_URL and OPENSANDBOX_API_KEY env vars as fallback when credentials are not configured via Dify API

fix(e2e): try more credential type values (plugin, model, tool)

ba15592

test(plugin): add unit tests for tools with integration tests

4723558

- Unit tests for utility functions (normalize_domain, parse_optional_json, etc) - Integration tests for sandbox lifecycle (create -> run -> kill) - Integration tests require running OpenSandbox server

fix(test): use correct SDK API parameters (timeout, ready_timeout)

b621f4c

fix(test): use correct Execution model attributes (logs.stdout, error)

908726f

hittyt requested review from Generalwin, Pangjiping, jwx0925 and ninan-nn as code owners February 1, 2026 11:59

chatgpt-codex-connector bot reviewed Feb 1, 2026

View reviewed changes

hittyt added 2 commits February 1, 2026 20:29

chore: add Apache 2.0 license headers to new files

c278d81

docs(agents): add license header requirement before commit

158189d

hittyt added the feature New feature or request label Feb 1, 2026

Pangjiping reviewed Feb 2, 2026

View reviewed changes

Pangjiping assigned ninan-nn Feb 2, 2026

ninan-nn reviewed Feb 3, 2026

View reviewed changes

chore: replace icon with OpenSandbox own icon

00b6eec

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feat/dify integration#157

Feat/dify integration#157
hittyt wants to merge 25 commits intoalibaba:mainfrom
hittyt:feat/dify-integration

hittyt commented Feb 1, 2026

Uh oh!

jwx0925 commented Feb 1, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Feb 1, 2026

Uh oh!

hittyt Feb 3, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Pangjiping commented Feb 2, 2026

Uh oh!

ninan-nn Feb 3, 2026

Uh oh!

ninan-nn Feb 3, 2026

Uh oh!

ninan-nn Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

hittyt commented Feb 1, 2026

Summary

Testing

Breaking Changes

Checklist

Uh oh!

jwx0925 commented Feb 1, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Feb 1, 2026

Choose a reason for hiding this comment

Uh oh!

hittyt Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Pangjiping commented Feb 2, 2026

Uh oh!

ninan-nn Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

ninan-nn Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

ninan-nn Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants