feat: configurable custom env vars in settings panel

[aterrylu]

Summary

• Adds a Custom Environment Variables section to the dashboard settings panel
• Users can define arbitrary key-value pairs (e.g. NO_FLICKER=1, OPENAI_API_KEY=sk-...) that get injected into every newly spawned session
• Integrates with existing settings persistence (~/.autonomos/settings.json) and save flow

Changes

Server

• settings.ts: Added customEnvVars: Record<string, string> to AppSettings interface
• sessions.ts: buildEnv() spreads custom vars into session environment, with a RESERVED_ENV_KEYS blocklist (PATH, CLAUDECODE, PORT, HOME, AUTONOMOS_SERVER, AUTONOMOS_SESSION_ID) to prevent overriding internal vars
• routes/settings.ts: API validation — accepts only valid POSIX env var names (/^[A-Za-z_][A-Za-z0-9_]*$/), string values only

Dashboard

• SettingsStatusBarItem.tsx: New EnvVarSection and EnvVarRow components — key-value pair list with add/remove buttons, integrated into existing batch-save flow. Uses useMemo for stable React keys across re-renders.

Design decisions

• Custom vars applied last in buildEnv() so they can override ANTHROPIC_BASE_URL etc., but reserved internal keys are blocklisted
• POSIX name validation on server side silently drops invalid keys (spaces, =, etc.)
• No secret redaction for custom env var values in GET response — unlike anthropicAuthToken, these values need to be visible for editing. Tradeoff documented.

Test plan

• Add a custom env var (e.g. NO_FLICKER=1) in settings, save
• Spawn a new session, verify env var is present (echo $NO_FLICKER)
• Verify settings persist across server restart
• Verify reserved keys (PATH, CLAUDECODE) are blocked
• Verify invalid key names are rejected (try MY VAR, 123KEY)
• Verify add/remove/edit flow works in the UI
• Verify existing settings (API override, channels, auto-trust) still work

🤖 Generated with Claude Code