ADFA-4684 | Fix Gemini API key entry: show/hide, trim, and at-rest encryption

[jatezzz]

Description

Fixes the Gemini API key input in the AI Assistant plugin, reported in appdevforall/CodeOnTheGo#1514 where keys wouldn't save correctly and produced 400 "invalid API key" errors. The field now has a working show/hide (eye) toggle that reveals the actual saved key, trims the value on save (dropping the trailing spaces/newlines Gemini rejects), and stops corrupting the key with a masked placeholder on edit. The key is also encrypted at rest with a hardware-backed Android Keystore secret instead of being stored as plaintext.

Details

Changes:

• Show/hide toggle: new ic_visibility / ic_visibility_off drawables and an ImageButton beside the input; toggle swaps inputType via an explicit visibility flag (the previous bit-check never flipped back, so it always read "hidden").
• Edit loads the real key: Edit now populates the field with the actual saved key (masked) rather than 16 placeholder bullets, so the eye can reveal it and Save can't re-store the placeholder as the key.
• Trim on save: saveButton trims before persisting (read side already trimmed).
• Encryption at rest: SecureApiKeyStore (AES/GCM, Android Keystore) in both ai-assistant (write/read) and ai-core (read for API calls); only ciphertext hits SharedPreferences, and legacy plaintext keys migrate transparently on next save.
• Strings: hint, content descriptions, and trings.xml`.

document_5111703426673150080.mp4

Ticket

ADFA-4684

Fixes:

• AI agent won't accept API key CodeOnTheGo#1514
• AI Agent, 400 BAD_REQUEST error CodeOnTheGo#1095

Observation

• The Gemini model list is intentionally left as t (kept for compatibility); retired models can still be selected but now surface a clearer error.
• SecureApiKeyStore is duplicated in ai-assistay're separate Gradle projects with no shared module; the two copies must stay in sync (same alias cotg_ai_gemini_key_v1 and transform) or ai-core can't decrypt what ai-assistant wrote. They interoperate because both plugins run in the host app's process (shared Keystore).

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[jatezzz]

@claude review

[claude]

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, comment @claude review on this pull request to trigger a review.

[jatezzz]

Build Pass

[hal-eisen-adfa]

Requesting changes. Two blocking items scoped to this PR's diff (the API-key security + FilePicker rewrite). The larger AI-plugin findings from the review belong to the base PR #41 and are posted there, not here.

The rest of the PR is solid: AES/GCM at-rest encryption with legacy-plaintext passthrough, inputType="textPassword" on the key field, save-failure surfaced instead of crashing, and the in-place FilePicker refresh that fixes the second-"Toggle All" crash.

[hal-eisen-adfa]

Code review of the Gemini API-key security work. The crypto core is sound — AES/GCM with a fresh random 12-byte IV per encrypt, GCM tag verification, fail-closed decrypt, and a sensible legacy-plaintext migration. No blockers; 6 non-critical findings inline below, ranked by severity. Note this is a static review — the encryption, on-device migration, and FLAG_SECURE screenshot-blocking still need device verification (install both .cgp, save a key, confirm ciphertext in prefs, revoke the Keystore alias to exercise the 'unreadable' path).