EXT-03: Secure AI Integration Service Layer

Objective

Establish a secure connection service layer to handle communication with the Gemini API (using a user settings-defined API key) and gracefully fallback to Chrome's built-in window.ai Prompt API if available.

Description

Develop a shared class/wrapper that reads the API configuration from storage. Create a simple settings panel to input and validate the user's Gemini API key. Implement robust response parsing, connection checks, and error boundaries.

Acceptance Criteria (Subtasks)

• Settings page allows saving an API key into chrome.storage.local with visual masking (password field type)
• The service layer detects native Chrome window.ai Prompt API parameters first, falling back to Gemini API via HTTP fetch if unavailable
• Standardized function signature for prompts: async generateResponse(systemPrompt, userPrompt, options)
• Rate limiting, empty key, or network disconnection scenarios show clean inline notifications instead of breaking the UI

Files to Create

• src/common/api.js
• src/settings/settings.html
• src/settings/settings.js

Start with the planned entry points in src/common/api.js, src/settings/settings.html, and src/settings/settings.js. Define the shared generateResponse(systemPrompt, userPrompt, options) flow around the Chrome window.ai fallback and Gemini HTTP path, then verify the listed storage, masking, validation, parsing, rate-limit, empty-key, and disconnection behaviors are handled with inline notifications.