env: .env file for API keys (gitignored), loaded by scripts and resolve_provider; key removed from bashrc

testbed/llm_agent.py

@@ -104,6 +104,31 @@ _MULTIMODAL_HINTS = (
 )
 
 
+def load_dotenv() -> None:
+    """Load KEY=VALUE pairs from a .env file (project root or cwd) into
+    os.environ without overriding already-set variables."""
+    import os
+    from pathlib import Path
+
+    candidates = [
+        Path.cwd() / ".env",
+        Path(__file__).resolve().parent.parent / ".env",
+    ]
+    for path in candidates:
+        if not path.is_file():
+            continue
+        for line in path.read_text().splitlines():
+            line = line.strip()
+            if not line or line.startswith("#") or "=" not in line:
+                continue
+            key, _, value = line.partition("=")
+            key = key.strip()
+            value = value.strip().strip('"').strip("'")
+            if key and key not in os.environ:
+                os.environ[key] = value
+        return
+
+
 def resolve_provider(
     *,
     provider: str | None,
@@ -113,11 +138,12 @@ def resolve_provider(
 ) -> tuple[str, str, str]:
     """Resolve endpoint + key + model from a provider preset (or explicit args).
 
-    Keys come from the environment (POLZA_API_KEY / OPENAI_API_KEY) so nothing
+    Keys come from the environment or the project's .env file, so nothing
     secret lives in the repo or on the command line.
     """
     import os
 
+    load_dotenv()
     if provider:
         preset = PROVIDERS.get(provider)
         if preset is None: