Add Gandr TTS plugin

[AALG123]

Plugin Submission

Plugin information

• Author: Gandr-AI
• Plugin name: gandr
• Version: 0.0.1
• Source repository: https://github.com/Gandr-AI/dify-plugin
• Contact: sam@gandr.ai

Submission type

• New plugin
• Version update

What changed

Gandr TTS model plugin: text-to-speech via Gandr's OpenAI-compatible speech endpoint (POST /v1/audio/speech), with 23 languages, six stock voices, and automatic mapping from the OpenAI voice names. Redirected here from langgenius/dify-official-plugins#3620 (community plugins belong in this repo).

Risk level

• Low risk
• Medium risk
• High risk

The plugin only calls a fixed, documented third-party HTTPS API (https://tts.gandr.ai, or the operator-configured API Base URL). No user-controlled code, commands, SQL, file operations, browser automation, or arbitrary network requests.

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below. Limitation: validated against the live Gandr API contract and the provider test harness, not yet run inside a Dify CE deployment. The plugin code paths (credential check, speech request, audio response mapping) mirror the official fishaudio plugin's structure; happy to run a CE validation if the reviewers want one.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

None. The plugin forwards the synthesis request (text, voice, output format, speed) and the user's own Gandr API key to the configured endpoint over HTTPS. The key is stored by Dify's credential store and is never logged.

Local validation

Package built from the source repo with zip (runtime files only):

• unzip -l gandr.difypkg: 16 files (manifest.yaml, PRIVACY.md, README.md, main.py, provider/, models/, _assets/icon.svg, pyproject.toml, requirements.txt, uv.lock, .env.example)
• no .git, pycache, .DS_Store, or credential files present
• plugin previously reviewed in dify-official-plugins#3620 (redirected here by repo scope, not on substance)

[crazywoola]

Hi @AALG123 — here is the current CI summary for commit 955638c.

❌ Blocking errors

• manifest.yaml is missing the required repo and contact fields.
• Packaging failed because the runner could not find uv while exporting requirements.txt (exec: "uv": executable file not found in $PATH). If this package layout is intentional, this part may require a CI workflow fix.

⚠️ Warnings / review items

• Possible secret-field references need review: README.md:56, models/tts/tts.py:122, and models/tts/tts.py:133 (api_key).
• The recommended meta.minimum_dify_version field is missing.
• dify_plugin>=0.9.0 and requests>=2.32.0 have lower-bound-only constraints.
• The sensitive-capability scan found an arbitrary network request at models/tts/tts.py:163; please make sure this is disclosed in the PR's security/privacy notes.
• Workflow infrastructure warning (not caused by this PR): actions/checkout@v4 and actions/setup-python@v5 still target deprecated Node.js 20 and are being forced onto Node.js 24.

Open the failed pre-check-plugin job