ADFA-4684 | Fix Gemini API key entry: show/hide, trim, and at-rest encryption

[jatezzz]

Description

Fixes the Gemini API key input in the AI Assistant plugin, reported in appdevforall/CodeOnTheGo#1514 where keys wouldn't save correctly and produced 400 "invalid API key" errors. The field now has a working show/hide (eye) toggle that reveals the actual saved key, trims the value on save (dropping the trailing spaces/newlines Gemini rejects), and stops corrupting the key with a masked placeholder on edit. The key is also encrypted at rest with a hardware-backed Android Keystore secret instead of being stored as plaintext.

Details

Changes:

• Show/hide toggle: new ic_visibility / ic_visibility_off drawables and an ImageButton beside the input; toggle swaps inputType via an explicit visibility flag (the previous bit-check never flipped back, so it always read "hidden").
• Edit loads the real key: Edit now populates the field with the actual saved key (masked) rather than 16 placeholder bullets, so the eye can reveal it and Save can't re-store the placeholder as the key.
• Trim on save: saveButton trims before persisting (read side already trimmed).
• Encryption at rest: SecureApiKeyStore (AES/GCM, Android Keystore) in both ai-assistant (write/read) and ai-core (read for API calls); only ciphertext hits SharedPreferences, and legacy plaintext keys migrate transparently on next save.
• Strings: hint, content descriptions, and trings.xml`.

document_5111703426673150080.mp4

Ticket

ADFA-4684

Fixes: appdevforall/CodeOnTheGo#1514

Observation

• The Gemini model list is intentionally left as t (kept for compatibility); retired models can still be selected but now surface a clearer error.
• SecureApiKeyStore is duplicated in ai-assistay're separate Gradle projects with no shared module; the two copies must stay in sync (same alias cotg_ai_gemini_key_v1 and transform) or ai-core can't decrypt what ai-assistant wrote. They interoperate because both plugins run in the host app's process (shared Keystore).

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[jatezzz]

@claude review

[claude]

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, comment @claude review on this pull request to trigger a review.

[jatezzz]

Build Pass