Release Minecraft Workbench v0.4.3 · lopleec/VSCode-minecraft-workbench

External sign-in

Show a native, localized risk confirmation before asking for a third-party username or password. Display the complete authentication API address after discovery, including any change of host.
Explain that credentials are sent to that provider, recommend a separate password, and warn against entering a Microsoft password. Clarify that HTTPS does not establish provider trust, tokens are stored in SecretStorage, passwords are not saved, and removing a local account does not revoke access at the provider.
Require the same manual confirmation when sign-in is opened through MCP. Passing confirmation flags in tool arguments cannot bypass the dialog. Routine token validation/refresh does not prompt again.
Show the actual authentication host and API address in the account/password inputs instead of relying on the provider's self-reported name.
Leave the provider field empty so users choose their own service. Add a short account-page warning and update both README languages.

Cancelling the provider warning, address entry or credential input stops sign-in cleanly. The shared launcher/MCP action now returns false on cancellation instead of reporting success.
Validate that the account field is nonempty before proceeding to password entry.
Retrying external sign-in opens a fresh confirmation and credential entry instead of reusing the previous password. Authentication discovery and metadata now bypass download mirrors, matching credential requests.
Expand the third-party notices with service terms/privacy links and separately downloaded software licenses. Add an About-page link and BMCLAPI attribution in source settings, without new routine-operation dialogs.

Add regression coverage for declined confirmation, MCP-style bypass arguments, resolved-host display, credential-entry order, Chinese localization and cancelled inputs.
82 automated tests passed, including the existing launcher, server, storage, download and MCP regression tests.

输入第三方账户或密码前，先显示原生风险确认框。提示跟随插件语言，并展示识别、跳转后的完整认证 API 地址。
明确用户名和密码将发送给该服务商，建议使用独立密码，勿填写 Microsoft 密码；说明 HTTPS 不代表服务商可信、令牌保存在 SecretStorage、不保存密码，以及移除本地账户不等于撤销服务商访问权限。
通过 MCP 打开登录也必须由用户确认，传入确认标记不能跳过弹窗。正常令牌校验、刷新不会反复弹窗。
账户、密码输入框显示实际认证域名和完整地址，避免被服务商自报名称误导。
服务商地址默认留空，由用户选择；账户页增加简短提示，中英文 README 同步说明。