feat: 将插件 stdin 协议定为 v1，并按声明注入凭据

进程外插件改为只读环境变量和自身配置，避免读宿主 appsettings；宿主按 plugin.json 声明注入 LLM / OpenWeather 等凭据。

MAF1.Web/wwwroot/js/app.js

@@ -7,7 +7,7 @@
  * 3. runGraph POST /api/run；若 status=needsDecision 弹出确认框
  * 4. 确认走 /api/run/{id}/decide；超时则 pollRun 等服务端自动采用默认方案
  *
- * selected / pending 只用于点击交互。发给后端的 JSON 不含 API Key，只有 credentialId。
+ * selected / pending 只用于点击交互。发给后端的 JSON 不含 API Key，只有 credentialId / credential:名称。
  */
 const state = {
     catalog: [],
@@ -51,6 +51,50 @@ function typeInfo(type) {
         || state.plugins.find((item) => item.type === type);
 }
 
+function isLlmCredentialType(type) {
+    const t = (type || "").toLowerCase();
+    return t === "openai-compatible" || t === "llm";
+}
+
+function credentialConfigKey(need) {
+    if (isLlmCredentialType(need.type) || (need.name || "").toLowerCase() === "llm") {
+        return "credentialId";
+    }
+    return "credential:" + need.name;
+}
+
+function credentialsMatching(type) {
+    return (state.credentials || []).filter((c) => {
+        if (isLlmCredentialType(type) && isLlmCredentialType(c.type)) {
+            return true;
+        }
+        return (c.type || "").toLowerCase() === (type || "").toLowerCase();
+    });
+}
+
+function renderCredentialFields(node, info) {
+    const needs = info.credentials || [];
+    if (needs.length === 0) {
+        return `<p class="hint">此节点未声明凭据，宿主不会注入 API Key。</p>`;
+    }
+    return needs.map((need) => {
+        const cfgKey = credentialConfigKey(need);
+        const options = credentialsMatching(need.type);
+        const current = node.config[cfgKey] || (options[0] ? options[0].id : "");
+        if (current && !node.config[cfgKey]) {
+            node.config[cfgKey] = current;
+        }
+        const label = need.name + (need.required ? " *" : "（可选）");
+        if (options.length === 0) {
+            return `<label>凭据 ${label}</label><p class="hint">宿主没有类型 ${need.type} 的凭据。</p>`;
+        }
+        const opts = options.map((c) =>
+            `<option value="${c.id}" ${current === c.id ? "selected" : ""}>${c.name}（${c.hasApiKey ? "已配置 Key" : "缺少 Key"}）</option>`
+        ).join("");
+        return `<label>凭据 ${label}</label><select data-credential-config="${cfgKey}">${opts}</select>`;
+    }).join("") + `<p class="hint">Key 由宿主注入子进程，不会出现在端口或导出的流程图里。</p>`;
+}
+
 function pickNode(list, inputName) {
     return (list || []).find((item) => item.inputs?.some((p) => p.name === inputName));
 }
@@ -252,9 +296,7 @@ function renderInspector() {
       <p class="hint">${info.description}</p>
       <label>显示名</label>
       <input id="title" value="${node.title}" />
-      <label>LLM 凭据</label>
-      <select id="credentialId">${(state.credentials || []).map((c) => `<option value="${c.id}" ${ (node.config.credentialId || "llm-default") === c.id ? "selected" : ""}>${c.name}（${c.hasApiKey ? "已配置 Key" : "缺少 Key"}）</option>`).join("")}</select>
-      <p class="hint">endpoint / API Key 由宿主注入进程，不会出现在输入端口或导出的流程图里。</p>
+      ${renderCredentialFields(node, info)}
       ${info.inputs.map((p) => `
         <label>固定输入 ${p.name}（${p.type}）${p.required ? " *" : ""}</label>
         <input data-config="${p.name}" value="${node.config[p.name] ?? ""}" placeholder="${p.description}" />
@@ -262,7 +304,9 @@ function renderInspector() {
       <p class="hint">若该输入已从上一节点连线，运行时以连线为准。</p>
       <button type="button" id="delNode">删除节点</button>`;
         inspector.querySelector("#title").oninput = (e) => { node.title = e.target.value; };
-        inspector.querySelector("#credentialId")?.addEventListener("change", (e) => { node.config.credentialId = e.target.value; });
+        inspector.querySelectorAll("[data-credential-config]").forEach((select) => {
+            select.addEventListener("change", () => { node.config[select.dataset.credentialConfig] = select.value; });
+        });
         inspector.querySelectorAll("[data-config]").forEach((input) => {
             input.oninput = () => { node.config[input.dataset.config] = input.value; };
         });