feat(plugin): prepare SERP for marketplace review

[acedatacloud-dev]

Why

The SERP Dify plugin has a working fixed-endpoint client, manifest, icon, README, and privacy file, but it is not ready for an external Marketplace review:

• the README does not link the source repository or explain end-to-end setup;
• the privacy text is generic and claims optional telemetry even though the plugin has no telemetry code;
• it does not enumerate the query/credential/response data sent to Ace Data Cloud;
• the package includes tests/ and .env.example, which current Marketplace requirements classify as development/environment state rather than runtime files;
• the client accepts the bare string Bearer as a non-empty credential;
• there are no Serp-specific regression tests.

This PR makes the canonical source reviewable before a separate .difypkg submission is published externally.

What changed

• document the single tool, exact inputs/outputs, token setup, fixed API endpoint, source repository, and attributed acquisition link;
• replace generic privacy boilerplate with the actual data flow:
  • bearer token in the Authorization header;
  • query and optional search parameters;
  • structured result/error/trace response;
  • fixed https://api.acedata.cloud/serp/google destination;
  • no plugin telemetry, advertising transfer, local files, or plugin database;
  • Dify and Ace Data Cloud retention boundaries;
• reject a bare Bearer credential as empty;
• exclude tests and all .env.* files from the package while retaining them in source control;
• add seven standard-library tests for headers, payload minimization, structured errors, trace IDs, network error token safety, empty-token rejection, docs/privacy, and package exclusions.

Marketplace risk classification

Low risk: the plugin calls one fixed documented HTTPS endpoint. It does not execute code/commands/SQL, access files, automate a browser, accept arbitrary destination URLs, or process uploaded files. Search queries can still contain personal/confidential content, which the privacy policy now states explicitly.

Validation

• Serp tests — 7/7 passed
• Ruff — all checks passed
• repository plugin contract checks — passed
• all Serp YAML files parsed successfully
• official Dify plugin CLI 0.6.10 packaged the plugin successfully
• packaged artifact — 13 runtime/docs files; no tests, .env*, caches, .git, binaries, or local credentials
• git diff --check — clean

Scope boundaries

This PR does not publish to the Dify Marketplace, add a .difypkg binary, change plugin versioning, or modify the other 18 plugins. The repository release workflow remains responsible for version stamping and release packaging after merge. A Marketplace package submission is a separate outward-facing PR.

Rollback

Revert this commit to restore the prior docs, normalization, and package ignore rules. No Dify application migration or API deployment is involved.

🤖 Generated with Claude Code