From 81d68c1352bc0d5c412fd45cb34293c9728dbbf5 Mon Sep 17 00:00:00 2001
From: Nicolas Brichet <nicolas.brichet@quantstack.net>
Date: Wed, 15 Oct 2025 22:21:23 +0200
Subject: [PATCH 1/3] Copy the API key from settings to secrets manager when
 switching

---
 src/widgets/ai-settings.tsx | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/src/widgets/ai-settings.tsx b/src/widgets/ai-settings.tsx
index c900041..c1857ec 100644
--- a/src/widgets/ai-settings.tsx
+++ b/src/widgets/ai-settings.tsx
@@ -232,6 +232,23 @@ const AISettingsComponent: React.FC<IAISettingsComponentProps> = ({
     return secret?.value;
   };
 
+  const setSecretToManager = async (
+    provider: string,
+    fieldName: string,
+    value: string
+  ): Promise<void> => {
+    await secretsManager?.set(
+      Private.getToken(),
+      SECRETS_NAMESPACE,
+      `${provider}:${fieldName}`,
+      {
+        namespace: SECRETS_NAMESPACE,
+        id: `${provider}:${fieldName}`,
+        value
+      }
+    );
+  };
+
   /**
    * Attach a secrets field to the secrets manager.
    * @param input - the DOm element to attach.
@@ -354,6 +371,15 @@ const AISettingsComponent: React.FC<IAISettingsComponentProps> = ({
     if (updates.useSecretsManager !== undefined) {
       if (updates.useSecretsManager) {
         for (const provider of model.config.providers) {
+          // if the secrets manager doesn't have the current API key, copy the current
+          // one from settings.
+          if (!(await getSecretFromManager(provider.provider, 'apiKey'))) {
+            setSecretToManager(
+              provider.provider,
+              'apiKey',
+              provider.apiKey ?? ''
+            );
+          }
           provider.apiKey = SECRETS_REPLACEMENT;
           await model.updateProvider(provider.id, provider);
         }

From 6866e848b76ecbc75993978632511072bf13af04 Mon Sep 17 00:00:00 2001
From: Nicolas Brichet <nicolas.brichet@quantstack.net>
Date: Wed, 15 Oct 2025 22:24:18 +0200
Subject: [PATCH 2/3] Display the alert when the secrets manager is on

---
 src/widgets/ai-settings.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/widgets/ai-settings.tsx b/src/widgets/ai-settings.tsx
index c1857ec..1350131 100644
--- a/src/widgets/ai-settings.tsx
+++ b/src/widgets/ai-settings.tsx
@@ -745,7 +745,7 @@ const AISettingsComponent: React.FC<IAISettingsComponentProps> = ({
                 label={
                   <div>
                     <span>Use the secrets manager to manage API keys</span>
-                    {!config.useSecretsManager && (
+                    {config.useSecretsManager && (
                       <Alert severity="warning" icon={<Error />} sx={{ mb: 2 }}>
                         The secrets will be stored in plain text in settings
                       </Alert>

From a8569d74f61ce3911b31e3dd1378690937f5e12a Mon Sep 17 00:00:00 2001
From: Nicolas Brichet <nicolas.brichet@quantstack.net>
Date: Wed, 15 Oct 2025 22:33:49 +0200
Subject: [PATCH 3/3] Never populate the API key field with the setting value
 when using the secrets manager

---
 src/widgets/ai-settings.tsx | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/widgets/ai-settings.tsx b/src/widgets/ai-settings.tsx
index 1350131..0b6d689 100644
--- a/src/widgets/ai-settings.tsx
+++ b/src/widgets/ai-settings.tsx
@@ -325,9 +325,7 @@ const AISettingsComponent: React.FC<IAISettingsComponentProps> = ({
     // Retrieve the API key from the secrets manager if necessary.
     if (model.config.useSecretsManager && secretsManager) {
       provider.apiKey =
-        (await getSecretFromManager(provider.provider, 'apiKey')) ??
-        provider.apiKey ??
-        '';
+        (await getSecretFromManager(provider.provider, 'apiKey')) ?? '';
     }
     setEditingProvider(provider);
     setDialogOpen(true);