[ForeignKeyCN]

Summary

A new Google Drive tool plugin (tools/google_drive_tool) for working with files in Google Drive and shared drives from workflows and agents. The repository so far only has the Google Drive data source, which imports documents into knowledge bases. The plugin is named google_drive_tool because that data source already uses google_drive; its label is "Google Drive". It is built like the other reworked plugins: Google Calendar (#4173), Gmail (#4180), and the Microsoft and Atlassian plugins (#4163–#4171).

Auth

• OAuth from the Dify console: one Google account for the whole workspace.
• Each user signs in: every chat user signs in with their own Google account.
  • Authorization code + PKCE through a plugin endpoint (GET /google_drive/callback) that only stores the one-time code.
  • Per-user tokens are Fernet-encrypted in plugin storage, keyed by a hash of client_id | Dify user ID. They never appear in tool output.
  • After sign-in the agent reports which account was used.
  • An unticked Drive permission, invalid_grant or a 401 leads to a new sign-in.
  • The callback page warns about forwarded links.
  • google_drive_sign_out forgets the sign-in.
• Scope: https://www.googleapis.com/auth/drive (plus openid email), so the tools can search and manage all of the user's files, not only those the app created.

Tools (prefixed google_drive_: the new Agent rejects duplicate tool names across plugins)

Area	Tool
Find	google_drive_search: • filters: name, full text, type (folder / Doc / Sheet / Slides / PDF), folder, recent • or a raw Drive query (values escaped) • follows pages google_drive_list_folder (folders first, root by default), google_drive_list_shared_drives
Read	google_drive_read_text: a Doc as Markdown (falling back to plain text), a Sheet as CSV, Slides or a text file as text. google_drive_get_file
Download	google_drive_download_file: binary files up to 50 MB. Google Docs/Sheets/Slides are exported to PDF, DOCX, XLSX, PPTX, CSV, MD, TXT, HTML or PNG (default: the Office format)
Write	google_drive_upload_file: • a file, or text written by the agent • multipart upload • optional conversion to a Google Doc / Sheet / Slides google_drive_create_folder, google_drive_copy_file, google_drive_move_file, google_drive_rename_file, google_drive_delete_file (trash, restore or permanent)
Share	google_drive_share_file: • who: a person, a group, a domain or anyone with the link • role: viewer / commenter / editor • optional notification and message google_drive_list_permissions, google_drive_remove_permission (by email, anyone for link sharing, or by ID; the owner is refused)

• Shared drives: every call works across My Drive and shared drives (supportsAllDrives, corpora=allDrives).
• Output variables: every tool returns typed output variables (success / error plus its fields).
• Path safety: IDs are encoded as one path segment each.

Release Notes

• New plugin: Google Drive tools.
  • Search and list files in My Drive and shared drives.
  • Read Docs, Sheets and Slides as text.
  • Download or export files.
  • Upload files or text, optionally as Google Docs/Sheets/Slides.
  • Create folders; copy, move, rename and delete files.
  • Share files with people, groups, domains or by link, and stop sharing.
• Two ways to authorize: OAuth (one shared account), and Each user signs in for chat agents, where each person works on their own Drive.

Change Type

• Documentation / non-plugin change
• Non-LLM plugin (tools, extensions, datasource, etc.)
• LLM plugin

Screenshots / Videos

The README includes two chat screenshots:

• The agent asks the user to sign in, then creates a folder and uploads a file.
• The agent saves CSV text as a Google Sheet, reads it back and shares it by link.

Testing

• Unit tests: 41 passed (pytest tests). They cover:
  • Sign-in flow: PKCE link with the Drive scope, callback, redeem, cache, refresh, invalid_grant / 401 → new link, unticked permission, per-user isolation, secret rotation, cancel/error pages, sign-out.
  • Search: query building and escaping, paging, shared-drive parameters.
  • Read and download: Markdown export with plain-text fallback, binary refused for read, binary download, Office export and an invalid format.
  • Upload: multipart body, conversion, text types.
  • Copy / move / delete: move computes removeParents from the current parents.
  • Sharing: share and unshare by email, by link, and refusing the owner.
  • Path encoding.
  • Every tool's output variables, the manifest and endpoint, and the OAuth URL and provider validation.
• Self-hosted Dify (Community), Each user signs in, real Google account, in an agent chat:
  • Google sign-in.
  • Created a folder and uploaded notes.txt into it.
  • Saved CSV text as a Google Sheet (convert_to=spreadsheet) and read it back as CSV.
  • Shared it with anyone with the link and returned the link.
• Not run against Google: export/download, copy, move, rename, delete, permission listing/removal and shared-drive listing (unit tests only).

Checklist

• I have read the contribution guidelines
• New plugin, version 1.0.0