diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..4c49bd7
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.env
diff --git a/.playwright-mcp/console-2026-08-08T09-11-01-487Z.log b/.playwright-mcp/console-2026-08-08T09-11-01-487Z.log
index eadf4d1..94fa150 100644
--- a/.playwright-mcp/console-2026-08-08T09-11-01-487Z.log
+++ b/.playwright-mcp/console-2026-08-08T09-11-01-487Z.log
@@ -7695,3 +7695,12 @@
 [29252812ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
 [29257963ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
 [29260190ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29263568ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29268554ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29273559ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29275794ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29280000ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29284671ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29290218ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29294135ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
+[29296881ms] [ERROR] WebSocket connection to 'ws://127.0.0.1:8001/' failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED @ http://127.0.0.1:8000/:40
diff --git a/chat_map.png b/chat_map.png
index a3b7a15..159b6b5 100644
Binary files a/chat_map.png and b/chat_map.png differ
diff --git a/scripts/run_bridge.sh b/scripts/run_bridge.sh
index 36692ca..b530633 100755
--- a/scripts/run_bridge.sh
+++ b/scripts/run_bridge.sh
@@ -3,6 +3,14 @@
 # Usage: scripts/run_bridge.sh [port]   (default 8765)
 # Note: the bridge keeps running until interrupted (Ctrl-C).
 set -euo pipefail
+
+# Load API keys from the project .env file (if present)
+if [ -f .env ]; then
+  set -a
+  # shellcheck disable=SC1091
+  . ./.env
+  set +a
+fi
 cd "$(dirname "$0")/.."
 PORT="${1:-8765}"
 
diff --git a/scripts/run_chat.sh b/scripts/run_chat.sh
index e9cf3c8..7c4e280 100755
--- a/scripts/run_chat.sh
+++ b/scripts/run_chat.sh
@@ -3,6 +3,14 @@
 # Open http://127.0.0.1:8000 to watch the capsule while you talk to it.
 # Usage: scripts/run_chat.sh [--model gemma4:e2b]
 set -euo pipefail
+
+# Load API keys from the project .env file (if present)
+if [ -f .env ]; then
+  set -a
+  # shellcheck disable=SC1091
+  . ./.env
+  set +a
+fi
 cd "$(dirname "$0")/.."
 BRIDGE_PID=""
 LIVE_PID=""
diff --git a/scripts/run_demo.sh b/scripts/run_demo.sh
index 925a366..62b2dca 100755
--- a/scripts/run_demo.sh
+++ b/scripts/run_demo.sh
@@ -5,5 +5,13 @@
 #        scripts/run_demo.sh --agent scripted
 #        scripts/run_demo.sh --agent llm --model gemma4:e2b
 set -euo pipefail
+
+# Load API keys from the project .env file (if present)
+if [ -f .env ]; then
+  set -a
+  # shellcheck disable=SC1091
+  . ./.env
+  set +a
+fi
 cd "$(dirname "$0")/.."
 exec testbed/.venv/bin/python -m testbed.demo "$@"
diff --git a/scripts/run_live.sh b/scripts/run_live.sh
index a860c9e..e2c42c5 100755
--- a/scripts/run_live.sh
+++ b/scripts/run_live.sh
@@ -3,6 +3,14 @@
 # demo while you watch. Open http://127.0.0.1:8000 in a browser.
 # Usage: scripts/run_live.sh [demo args...]   e.g. --agent scripted
 set -euo pipefail
+
+# Load API keys from the project .env file (if present)
+if [ -f .env ]; then
+  set -a
+  # shellcheck disable=SC1091
+  . ./.env
+  set +a
+fi
 cd "$(dirname "$0")/.."
 BRIDGE_PID=""
 LIVE_PID=""
diff --git a/testbed/llm_agent.py b/testbed/llm_agent.py
index 69426e0..57740cf 100644
--- a/testbed/llm_agent.py
+++ b/testbed/llm_agent.py
@@ -104,6 +104,31 @@ _MULTIMODAL_HINTS = (
 )
 
 
+def load_dotenv() -> None:
+    """Load KEY=VALUE pairs from a .env file (project root or cwd) into
+    os.environ without overriding already-set variables."""
+    import os
+    from pathlib import Path
+
+    candidates = [
+        Path.cwd() / ".env",
+        Path(__file__).resolve().parent.parent / ".env",
+    ]
+    for path in candidates:
+        if not path.is_file():
+            continue
+        for line in path.read_text().splitlines():
+            line = line.strip()
+            if not line or line.startswith("#") or "=" not in line:
+                continue
+            key, _, value = line.partition("=")
+            key = key.strip()
+            value = value.strip().strip('"').strip("'")
+            if key and key not in os.environ:
+                os.environ[key] = value
+        return
+
+
 def resolve_provider(
     *,
     provider: str | None,
@@ -113,11 +138,12 @@ def resolve_provider(
 ) -> tuple[str, str, str]:
     """Resolve endpoint + key + model from a provider preset (or explicit args).
 
-    Keys come from the environment (POLZA_API_KEY / OPENAI_API_KEY) so nothing
+    Keys come from the environment or the project's .env file, so nothing
     secret lives in the repo or on the command line.
     """
     import os
 
+    load_dotenv()
     if provider:
         preset = PROVIDERS.get(provider)
         if preset is None: