docs(plugin): explain credential reset on update

[ct-jaryn]

A changed user-plugin package digest drops saved credential bindings even when the endpoint and credential declaration stay the same. The Baizhi example currently mentions only destination changes, so a documentation-only package update can unexpectedly leave users needing to enter their key again.

Update both English and Chinese lifecycle instructions to describe this behavior, point users to DeepChat's native credential form, and leave the intended core update behavior open for maintainer discussion. This follows the preservation-path explanation in review 5244917446 on #2324; it changes only two README files and targets dev.

Validation on dev 51528f8: format:check, i18n:validate, lint, both typechecks, plugin:validate, and the existing userPluginLifecycle suite (8 tests) passed. README files are excluded by the repository formatter; both texts were manually checked. No live service or Electron GUI run was performed for this documentation change.

Summary by CodeRabbit

• Documentation
  • Updated plugin update instructions to require reviewing package changes and approving new snapshots.
  • Clarified that package updates may remove saved credential bindings, even when endpoint and authentication settings are unchanged.
  • Added guidance to check plugin setup status and re-enter the original key when requested.
  • Added corresponding updates to the Chinese documentation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 91e76e8a-3eb3-438e-9a9e-f6280e2c8eb7

📥 Commits

Reviewing files that changed from the base of the PR and between 51528f8 and 12c57a4.

📒 Files selected for processing (2)

• examples/user-plugins/baizhi-agent-toolkit/README.md
• examples/user-plugins/baizhi-agent-toolkit/README.zh-CN.md

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The plugin README files now document credential binding removal after package digest changes. They instruct users to check plugin configuration and re-enter the original key when credentials are missing.

Changes

Plugin update guidance

Layer / File(s)	Summary
Credential binding update guidance examples/user-plugins/baizhi-agent-toolkit/README.md, examples/user-plugins/baizhi-agent-toolkit/README.zh-CN.md	The update instructions cover credential binding removal after any package digest change, including documentation-only changes. They direct users to check setup status and re-enter the raw key through DeepChat's credential form when required.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main documentation change: explaining credential reset behavior after plugin updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[zerob13]

结论：需要修改

这次改动的方向是对的：英文和中文说明同步更新，也提醒用户更新后检查配置状态。但当前文案把实现行为写反了，会让用户误以为普通的文档更新会丢失 API Key。

必须修复

• examples/user-plugins/baizhi-agent-toolkit/README.md:90-96
• examples/user-plugins/baizhi-agent-toolkit/README.zh-CN.md:68-71

文案声称「只要 package digest 改变，已保存的 credential bindings 就会丢失」。但当前实现并不是这样：src/main/plugin/userPlugins.ts:185-188 会继承已有的 mcpDigests，更新 MCP 配置时 src/main/mcp/settings.ts:1019-1026 会保留已有 serverId；凭据绑定存放在对应 serverId 的 SecretStore 中，并不会因为包内容变化自动删除。现有生命周期测试也验证了更新后凭据仍然保留：test/main/plugin/userPluginLifecycle.test.ts:302-344。

请改成与当前实现一致的说明。若确实存在某个具体路径会清除绑定，请在 DeepChat 代码或可复现测试中明确指出该路径，并补充回归测试后再描述为已知行为；不要把仍在讨论中的假设写成用户操作指南。

其他检查

• 没有发现过度设计或超出范围的改动。
• 中英文文案的更新范围和结构基本一致。
• 没有新增测试；本 PR 是文档改动，但文案依赖的实现行为应以现有生命周期测试为准。

参考分析

本次审查基于 PR 12c57a4f2163ff50cf369065a4b24565539562d5 相对 dev 的两份 README diff，并核对了用户插件更新、MCP server identity 与变量凭据存储路径。当前工作树未修改代码；本地针对性测试未能启动，因为该隔离 worktree 没有可用的 Vitest 命令，且当前 Node 为 22.22.0，而仓库声明需要 Node 24.x。