I would not suggest we impose this on all plugins some may have a once only use case. For example generated passwords are never known and cannot be reproduced but they may already be applied externally.

Each module can handle their requirements at installation, yours can detect the presence of the files and do a sweep before it re-installs and the example can notice it already has a password file and leave it in tact.

Unfortunately the suggested patch cannot cater for all scenarios and my advise: Mark this "works as intended" and close issue.

I'm not sure I get your point.
This removes old files in /var/lib/dokku/plugins. This directory should contain only code, not data such as passwords.
Moreover it applies only to 'core' plugins which are part of this repository, and thus we are sure they don't keep data in the wrong place.

@plietar you are correct I mistook this for the /home/dokku working directory which could then keep state information instead, am I right?

For interest sake: where does external plugins go when plugins-install did its thing' if not to /var/lib/dokku/plugins ?

Despite its name plugins-install does not copy plugins to /var/lib/dokku/plugins
It allows plugins to run some commands once they are installed, for eg dependencies. (nginx-vhosts installs nginx and setups sudo rights.)

Users must copy/clone the external plugins source into /var/lib/dokku/plugins themselves.