SubMiner/backlog/tasks/task-125 - Add-native-AI-API-key-secret-storage.md

id, title, status, assignee, created_date, updated_date, labels, dependencies, references, priority, ordinal

id	title	status	assignee	created_date	updated_date	labels	dependencies	references	priority	ordinal
TASK-125	Add native AI API key secret storage	To Do		2026-03-08 07:25	2026-03-18 05:27	ai config security		/Users/sudacode/projects/japanese/SubMiner/src/ai/client.ts /Users/sudacode/projects/japanese/SubMiner/src/core/services/anilist/anilist-token-store.ts /Users/sudacode/projects/japanese/SubMiner/src/core/services/jellyfin-token-store.ts /Users/sudacode/projects/japanese/SubMiner/src/main.ts	medium	2000

Description

Store the shared AI provider API key using the app's native secret-storage pattern so users do not need to keep the OpenRouter key in config files or shell commands.

Acceptance Criteria

• #1 Users can configure the shared AI provider without storing the API key in config.jsonc.
• #2 The app persists and reloads the shared AI API key using encrypted native secret storage when available.
• #3 Behavior is defined for existing ai.apiKey and ai.apiKeyCommand configs, including compatibility during migration.
• #4 The feature has regression tests covering key resolution and storage behavior.
• #5 User-facing configuration/docs are updated to describe the supported setup.