feat(dashboard): allow creating new env keys from Keys tab

[ljluestc]

What does this PR do?

This PR adds support for creating brand-new environment keys from the Dashboard Keys tab.

Before this change, the Keys page could only edit keys already known in OPTIONAL_ENV_VARS. That meant users could not add a new key from the UI, and newly-created custom keys were not surfaced by GET /api/env after reload.

This PR fixes that by:

• Adding a create-key form in the Keys page (key + value) with validation.
• Persisting new keys through the existing PUT /api/env flow.
• Extending GET /api/env so custom .env keys are returned (with safe default metadata), making them visible/editable after refresh.

This approach reuses existing backend persistence (save_env_value) and avoids adding a separate API shape just for custom keys.

Related Issue

Fixes #14641

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• web/src/pages/EnvPage.tsx

  • Added a Create key card/form to add new .env entries from the Dashboard.
  • Added client-side validation for env var key format: ^[A-Za-z_][A-Za-z0-9_]*$.
  • Added guardrail preventing creation for channel-managed keys.
  • Updated local page state immediately after successful create, so new keys appear without full-page refresh.

• hermes_cli/web_server.py

  • Updated GET /api/env to include custom keys found in .env that are not present in OPTIONAL_ENV_VARS.
  • Added safe default metadata for custom keys (description, inferred category, is_password, channel_managed, redacted display value).
  • Kept invalid env names filtered out from the response.

• tests/hermes_cli/test_web_server.py

  • Added test_set_custom_env_var_is_listed_in_env_keys to verify:
    • custom key can be written via PUT /api/env
    • custom key is returned by GET /api/env
    • metadata includes expected defaults (description, channel_managed, etc.)

How to Test

1. Start the dashboard and open Keys.
2. In the new Create key form, create a key like CUSTOM_DASHBOARD_KEY with value custom-value-1234.
3. Verify the key appears in the list immediately.
4. Refresh the page and verify the key is still listed (persisted and reloaded via GET /api/env).
5. Confirm .env contains the new key.
6. Optional API verification:
   • PUT /api/env with a custom key/value.
   • GET /api/env includes that key with description: "Custom key from .env".

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Ubuntu Linux

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A (N/A)
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A (N/A)
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A (N/A)
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A (N/A)
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A (N/A)

Screenshots / Logs

• npm --prefix web run typecheck ✅
• python3 -m py_compile hermes_cli/web_server.py tests/hermes_cli/test_web_server.py ✅
• scripts/run_tests.sh ... could not run in this checkout because no local .venv/venv was present.

[alt-glitch]

Duplicate of #20808 — same feature (create custom env keys from the Dashboard Keys page), same approach: both extend GET /api/env to surface custom .env keys not in OPTIONAL_ENV_VARS, add a create-key form to web/src/pages/EnvPage.tsx, persist via the existing PUT /api/env / save_env_value flow, and touch the same files (hermes_cli/web_server.py, tests/hermes_cli/test_web_server.py, EnvPage.tsx). Both also reference #14641. #20808 is the earlier open PR; tracking there.

[teknium1]

Implemented on main; closing via automated hermes-sweeper review.

• Commit 1c75e7c9d81230b8e1743e2ab626525c2231631f (feat(dashboard): list & add arbitrary custom .env keys on the Keys page) added the Custom Keys add-key flow in web/src/pages/EnvPage.tsx:493 and is included in v2026.7.1.
• hermes_cli/web_server.py:6098 now returns arbitrary non-channel-managed on-disk .env keys as password-masked custom rows, while hermes_cli/web_server.py:6114 persists updates through the existing guarded PUT /api/env route.
• tests/hermes_cli/test_env_custom_keys.py:31 covers custom-key listing and masking behavior.
• The prior duplicate discussion on feat: add custom environment keys in dashboard #20808 and the merged feat(dashboard): list & add arbitrary custom .env keys on the Keys page #54552 implementation cover the same requested behavior.