AI: store secrets on remote for VS Code Web
Index: code-server/lib/vscode/src/vs/platform/secrets/common/secrets.ts
===================================================================
--- code-server.orig/lib/vscode/src/vs/platform/secrets/common/secrets.ts
+++ code-server/lib/vscode/src/vs/platform/secrets/common/secrets.ts
@@ -139,8 +139,13 @@ export class BaseSecretStorageService ex
 				return await readEncryptedSecret(
 					key,
					(fullKey) => this.getValueFromStorage(key, fullKey, storageService),
-					// If the storage service is in-memory, we don't need to decrypt
-					this._type === 'in-memory' ? (v) => Promise.resolve(v) : (v) => this._encryptionService.decrypt(v),
+					// Don't decrypt if storage is in-memory or if encryption service is not available
+					async (v) => {
+						if (this._type === 'in-memory' || !await this._encryptionService.isEncryptionAvailable()) {
+							return v;
+						}
+						return this._encryptionService.decrypt(v);
+					},
 					this._logService,
 				);
 			} catch (e) {
@@ -160,8 +165,13 @@ export class BaseSecretStorageService ex
 					key,
 					value,
					(fullKey, encrypted) => this.setValueInStorage(key, fullKey, encrypted, storageService),
-					// If the storage service is in-memory, we don't need to encrypt
-					this._type === 'in-memory' ? (v) => Promise.resolve(v) : (v) => this._encryptionService.encrypt(v),
+					// Don't encrypt if storage is in-memory or if encryption service is not available
+					async (v) => {
+						if (this._type === 'in-memory' || !await this._encryptionService.isEncryptionAvailable()) {
+							return v;
+						}
+						return this._encryptionService.encrypt(v);
+					},
 					this._logService,
 				);
 			} catch (e) {
@@ -194,8 +204,9 @@ export class BaseSecretStorageService ex
 
 	private async initialize(): Promise<IStorageService> {
 		let storageService;
-		if (!this._useInMemoryStorage && await this._encryptionService.isEncryptionAvailable()) {
-			this._logService.trace(`[SecretStorageService] Encryption is available, using persisted storage`);
+		if (!this._useInMemoryStorage) {
+			// Use persisted storage when not forced to use in-memory
+			this._logService.trace(`[SecretStorageService] Using persisted storage`);
 			this._type = 'persisted';
 			storageService = this._storageService;
 		} else {
@@ -203,7 +214,7 @@ export class BaseSecretStorageService ex
 			if (this._type === 'in-memory') {
 				return this._storageService;
 			}
-			this._logService.trace('[SecretStorageService] Encryption is not available, falling back to in-memory storage');
+			this._logService.trace('[SecretStorageService] Falling back to in-memory storage');
 			this._type = 'in-memory';
 			storageService = this._register(new InMemoryStorageService());
 		}
Index: code-server/lib/vscode/src/vs/workbench/services/secrets/browser/secretStorageService.ts
===================================================================
--- code-server.orig/lib/vscode/src/vs/workbench/services/secrets/browser/secretStorageService.ts
+++ code-server/lib/vscode/src/vs/workbench/services/secrets/browser/secretStorageService.ts
@@ -22,9 +22,9 @@ export class BrowserSecretStorageService
 		@IBrowserWorkbenchEnvironmentService environmentService: IBrowserWorkbenchEnvironmentService,
 		@ILogService logService: ILogService
 	) {
-		// We don't have encryption in the browser so instead we use the
-		// in-memory base class implementation instead.
-		super(true, storageService, encryptionService, logService);
+		// Use remote storage if enabled, otherwise use in-memory storage
+		const useRemoteStorage = environmentService.options?.remoteStorageEnabled ?? false;
+		super(!useRemoteStorage, storageService, encryptionService, logService);
 
 		if (environmentService.options?.secretStorageProvider) {
 			this._secretStorageProvider = environmentService.options.secretStorageProvider;
Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
===================================================================
--- code-server.orig/lib/vscode/src/vs/code/browser/workbench/workbench.ts
+++ code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
@@ -625,2 +625,2 @@
-		secretStorageProvider: config.remoteAuthority && !secretStorageKeyPath
-			? undefined /* with a remote without embedder-preferred storage, store on the remote */
+		secretStorageProvider: config.remoteStorageEnabled || (config.remoteAuthority && !secretStorageKeyPath)
+			? undefined /* with remote storage enabled, or without embedder-prefered storage, store on the remote */
 	});
 })();