src/vs/workbench/api/browser/mainThreadSecretState.ts/MainThreadSecretState/$getPassword
class MainThreadSecretState:	async $getPassword(extensionId: string, key: string): Promise<string | undefined> {
		const fullKey = await this.getFullKey(extensionId);
		const password = await this.credentialsService.getPassword(fullKey, key);
		if (!password) {
			return undefined;
		}

		let decrypted: string | null;
		try {
			decrypted = await this.encryptionService.decrypt(password);
		} catch (e) {
			this.logService.error(e);

			// If we are on a platform that newly started encrypting secrets before storing them,
			// then passwords previously stored were stored un-encrypted (NOTE: but still being stored in a secure keyring).
			// When we try to decrypt a password that wasn't encrypted previously, the encryption service will throw.
			// To recover gracefully, we first try to encrypt & store the password (essentially migrating the secret to the new format)
			// and then we try to read it and decrypt again.
			const encryptedForSet = await this.encryptionService.encrypt(password);
			await this.credentialsService.setPassword(fullKey, key, encryptedForSet);
			const passwordEncrypted = await this.credentialsService.getPassword(fullKey, key);
			decrypted = passwordEncrypted && await this.encryptionService.decrypt(passwordEncrypted);
		}

		if (decrypted) {
			try {
				const value = JSON.parse(decrypted);
				if (value.extensionId === extensionId) {
					return value.content;
				}
			} catch (e) {
				this.logService.error(e);
				throw new Error('Cannot get password');
			}
		}

		return undefined;
	}