env: .env file for API keys (gitignored), loaded by scripts and resolve_provider; key removed from bashrc

.gitignore

@@ -0,0 +1 @@
+.env

.playwright-mcp/console-2026-08-08T09-11-01-487Z.log

@@ -7695,3 +7695,12 @@
 [29252812ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
 [29257963ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
 [29260190ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29263568ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29268554ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29273559ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29275794ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29280000ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29284671ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29290218ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29294135ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29296881ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40

scripts/run_bridge.sh

@@ -3,6 +3,14 @@
 # Usage: scripts/run_bridge.sh [port]   (default 8765)
 # Note: the bridge keeps running until interrupted (Ctrl-C).
 set -euo pipefail
+
+# Load API keys from the project .env file (if present)
+if [ -f .env ]; then
+  set -a
+  # shellcheck disable=SC1091
+  . ./.env
+  set +a
+fi
 cd "$(dirname "$0")/.."
 PORT="${1:-8765}"
 

scripts/run_chat.sh

@@ -3,6 +3,14 @@
 # Open http://127.0.0.1:8000 to watch the capsule while you talk to it.
 # Usage: scripts/run_chat.sh [--model gemma4:e2b]
 set -euo pipefail
+
+# Load API keys from the project .env file (if present)
+if [ -f .env ]; then
+  set -a
+  # shellcheck disable=SC1091
+  . ./.env
+  set +a
+fi
 cd "$(dirname "$0")/.."
 BRIDGE_PID=""
 LIVE_PID=""

scripts/run_demo.sh

@@ -5,5 +5,13 @@
 #        scripts/run_demo.sh --agent scripted
 #        scripts/run_demo.sh --agent llm --model gemma4:e2b
 set -euo pipefail
+
+# Load API keys from the project .env file (if present)
+if [ -f .env ]; then
+  set -a
+  # shellcheck disable=SC1091
+  . ./.env
+  set +a
+fi
 cd "$(dirname "$0")/.."
 exec testbed/.venv/bin/python -m testbed.demo "$@"

scripts/run_live.sh

@@ -3,6 +3,14 @@
 # demo while you watch. Open http://127.0.0.1:8000 in a browser.
 # Usage: scripts/run_live.sh [demo args...]   e.g. --agent scripted
 set -euo pipefail
+
+# Load API keys from the project .env file (if present)
+if [ -f .env ]; then
+  set -a
+  # shellcheck disable=SC1091
+  . ./.env
+  set +a
+fi
 cd "$(dirname "$0")/.."
 BRIDGE_PID=""
 LIVE_PID=""

testbed/llm_agent.py

@@ -104,6 +104,31 @@ _MULTIMODAL_HINTS = (
 )
 
 
+def load_dotenv() -> None:
+    """Load KEY=VALUE pairs from a .env file (project root or cwd) into
+    os.environ without overriding already-set variables."""
+    import os
+    from pathlib import Path
+
+    candidates = [
+        Path.cwd() / ".env",
+        Path(__file__).resolve().parent.parent / ".env",
+    ]
+    for path in candidates:
+        if not path.is_file():
+            continue
+        for line in path.read_text().splitlines():
+            line = line.strip()
+            if not line or line.startswith("#") or "=" not in line:
+                continue
+            key, _, value = line.partition("=")
+            key = key.strip()
+            value = value.strip().strip('"').strip("'")
+            if key and key not in os.environ:
+                os.environ[key] = value
+        return
+
+
 def resolve_provider(
     *,
     provider: str | None,
@@ -113,11 +138,12 @@ def resolve_provider(
 ) -> tuple[str, str, str]:
     """Resolve endpoint + key + model from a provider preset (or explicit args).
 
-    Keys come from the environment (POLZA_API_KEY / OPENAI_API_KEY) so nothing
+    Keys come from the environment or the project's .env file, so nothing
     secret lives in the repo or on the command line.
     """
     import os
 
+    load_dotenv()
     if provider:
         preset = PROVIDERS.get(provider)
         if preset is None: