Add settings page tabs and show env API keys with last four digits.

System settings now use the same CSS tab layout as env config; sensitive env fields display masked values from .env while keeping save-on-empty behavior.

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/env/env_schema.py

@@ -135,11 +135,11 @@ def _field_type(key: str, value: str) -> str:
 
 def _mask_value(key: str, value: Optional[str]) -> dict[str, Any]:
     if value is None or value == "":
-        return {"value": "", "masked": "", "has_value": False}
+        return {"value": "", "masked": "", "tail": "", "has_value": False}
     if not _is_sensitive(key):
-        return {"value": value, "masked": value, "has_value": True}
+        return {"value": value, "masked": value, "tail": "", "has_value": True}
     tail = value[-4:] if len(value) >= 4 else value
-    return {"value": "", "masked": f"****{tail}", "has_value": True}
+    return {"value": "", "masked": f"****{tail}", "tail": tail, "has_value": True}
 
 
 def parse_env_example_schema(example_path: str) -> list[dict[str, Any]]:
@@ -264,7 +264,7 @@ def validate_env_updates(groups: list[dict], updates: dict[str, str]) -> tuple[d
         if value is None:
             continue
         val = str(value).strip()
-        if allowed[key].get("sensitive") and val == "":
+        if allowed[key].get("sensitive") and (val == "" or (val.startswith("****") and len(val) <= 8)):
             continue
         ftype = allowed[key].get("type")
         if ftype == "bool":

lib/env/env_ui_manifest.py

@@ -170,6 +170,7 @@ def _build_field(
         "hot_reload": meta.get("hot_reload", _hot_reload(key)),
         "current": masked["value"] if not _is_sensitive(key) else "",
         "masked": masked["masked"],
+        "tail": masked.get("tail") or "",
         "has_value": masked["has_value"],
     }