@@ -16,6 +16,8 @@
 import java.io.IOException;
 import java.net.URI;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.io.PrintStream;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -57,8 +59,12 @@ public static void main(String[] args) throws Exception {
         System.exit(run(args, System.out, System.err));
     }
 
-    /** Parses {@code args} and, on success, builds the real client and evaluates. */
     static int run(String[] args, PrintStream out, PrintStream err) throws Exception {
+        return run(args, Path.of(System.getProperty("user.home"), ".typesafe.apikey"), out, err);
+    }
+
+    /** Parses {@code args} and, on success, builds the real client and evaluates. */
+    static int run(String[] args, Path apiKeyFile, PrintStream out, PrintStream err) throws Exception {
         if (args.length == 1 && "--version".equals(args[0])) {
             out.println(Main.class.getPackage().getImplementationVersion());
             return 0;
@@ -79,7 +85,7 @@ static int run(String[] args, PrintStream out, PrintStream err) throws Exception
         DefaultTypeSafeClient.Builder builder = DefaultTypeSafeClient.builder()
                 .codec(codec)
                 .httpTransport(new JdkHttpTransport());
-        ApiKey apiKey = loadApiKey(parsed.endpoint());
+        ApiKey apiKey = loadApiKey(parsed.endpoint(), apiKeyFile);
         if (apiKey != null) {
             builder.apiKey(apiKey);
         }
@@ -94,15 +100,11 @@ static int run(String[] args, PrintStream out, PrintStream err) throws Exception
     /** The key file is required against the default endpoint (the real API needs auth), but
      *  optional against any {@code --endpoint} override (a local/self-hosted server may need
      *  none). */
-    private static ApiKey loadApiKey(URI endpoint) throws IOException {
-        if (endpoint == null) {
-            return ApiKey.fromDefaultFile();
-        }
-        try {
-            return ApiKey.fromDefaultFile();
-        } catch (IOException e) {
-            return null;
+    private static ApiKey loadApiKey(URI endpoint, Path apiKeyFile) throws IOException {
+        if (endpoint == null || Files.exists(apiKeyFile)) {
+            return ApiKey.fromFile(apiKeyFile);
         }
+        return null;
     }
 
     /** The evaluate-and-print flow, taking an already-built client so it's testable without a
 
@@ -7,19 +7,29 @@
 import io.github.dfa1.typesafe.client.TypeSafeClient;
 import io.github.dfa1.typesafe.core.Usage;
 import io.github.dfa1.typesafe.codec.jackson3.Jackson3Codec;
+import com.sun.net.httpserver.HttpServer;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.api.io.TempDir;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 
 import java.io.ByteArrayOutputStream;
 import java.io.PrintStream;
+import java.net.InetSocketAddress;
 import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.NoSuchFileException;
+import java.nio.file.Path;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.BDDMockito.given;
 
@@ -35,6 +45,15 @@ class MainTest {
     private final PrintStream out = new PrintStream(outBuffer);
     private final PrintStream err = new PrintStream(errBuffer);
 
+    @TempDir
+    private Path tempDir;
+
+    private Path apiKeyFile;
+
+    private HttpServer server;
+
+    private final List<String> authorizations = new ArrayList<>();
+
     @Test
     void parseReadsStateModelAndAllFlagTypes() {
         // When
@@ -424,6 +443,76 @@ void runFromArgsReturns1AndPrintsUsageWhenArgsAreInvalid() throws Exception {
         assertThat(errBuffer.toString()).contains("Unknown flag: --bogus").contains("Usage: typesafe");
     }
 
+    @Test
+    void runFromArgsRequiresTheKeyFileAgainstTheDefaultEndpoint() {
+        // Given
+        apiKeyFile = tempDir.resolve("missing.apikey");
+
+        // When / Then
+        assertThatThrownBy(() -> Main.run(new String[] {"--state", "hi", "--noul", "Is this urgent?"},
+                apiKeyFile, out, err))
+                .isInstanceOf(NoSuchFileException.class);
+    }
+
+    @Test
+    void runFromArgsCallsTheEndpointWithoutAuthorizationWhenThereIsNoKeyFile() throws Exception {
+        // Given
+        URI endpoint = startServer();
+        apiKeyFile = tempDir.resolve("missing.apikey");
+
+        // When
+        int result = Main.run(new String[] {
+                "--state", "hi", "--endpoint", endpoint.toString(), "--noul", "urgent=Is this urgent?",
+                "--print", "urgent"
+        }, apiKeyFile, out, err);
+
+        // Then
+        assertThat(result).isZero();
+        assertThat(outBuffer.toString()).isEqualToIgnoringNewLines("0.92");
+        assertThat(authorizations).containsExactly((String) null);
+    }
+
+    @Test
+    void runFromArgsCallsTheEndpointWithTheKeyFromTheKeyFile() throws Exception {
+        // Given
+        URI endpoint = startServer();
+        apiKeyFile = Files.writeString(tempDir.resolve("typesafe.apikey"), "secret\n");
+
+        // When
+        int result = Main.run(new String[] {
+                "--state", "hi", "--endpoint", endpoint.toString(), "--noul", "urgent=Is this urgent?"
+        }, apiKeyFile, out, err);
+
+        // Then
+        assertThat(result).isZero();
+        assertThat(authorizations).containsExactly("Bearer secret");
+    }
+
+    @AfterEach
+    void stopServer() {
+        if (server != null) {
+            server.stop(0);
+        }
+    }
+
+    /** A local TypeSafe-compatible server answering every evaluate with one noul answer. */
+    private URI startServer() throws Exception {
+        byte[] body = """
+                {"model": "jev-latest", "answers": {"urgent": {"type": "noul", "noul": 0.92}},
+                 "usage": {"input_tokens": 1, "output_tokens": 1}}
+                """.getBytes(StandardCharsets.UTF_8);
+        server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+        server.createContext("/v1/systemone", exchange -> {
+            authorizations.add(exchange.getRequestHeaders().getFirst("Authorization"));
+            exchange.getResponseHeaders().add("Content-Type", "application/json");
+            exchange.sendResponseHeaders(200, body.length);
+            exchange.getResponseBody().write(body);
+            exchange.close();
+        });
+        server.start();
+        return URI.create("http://127.0.0.1:" + server.getAddress().getPort() + "/v1/systemone");
+    }
+
     private static EvaluateResponse response(Map<String, Answer> answers) {
         return new EvaluateResponse(Model.LATEST, answers, new Usage(0, 0),
                 new EvaluateResponse.Metadata(null, null));
 
@@ -60,6 +60,17 @@ void equalsComparesTheBodyByContent() {
         assertThat(new HttpTransportResponse(200, Map.of("X-A", "1"), bytes("other"))).isNotEqualTo(sut);
     }
 
+    @Test
+    void equalsComparesStatusCodeAndHeadersToo() {
+        // Given
+        HttpTransportResponse sut = new HttpTransportResponse(200, Map.of("X-A", "1"), bytes("body"));
+
+        // Then
+        assertThat(new HttpTransportResponse(404, Map.of("X-A", "1"), bytes("body"))).isNotEqualTo(sut);
+        assertThat(new HttpTransportResponse(200, Map.of("X-A", "2"), bytes("body"))).isNotEqualTo(sut);
+        assertThat(sut).isNotEqualTo("body");
+    }
+
     private static byte[] bytes(String text) {
         return text.getBytes(StandardCharsets.UTF_8);
     }
 
@@ -245,17 +245,7 @@ private static OnnxTensor bools(long[] mask, int n, int k) throws OrtException {
 
     /** rl_agent_api: logits / temperature for this (type, option count) bucket, softmaxed over the real options. */
     private double[] probabilities(float[] logits, int k, int qtype) {
-        String size;
-        if (k <= 2) {
-            size = "2";
-        } else if (k <= 5) {
-            size = "3-5";
-        } else if (k <= 10) {
-            size = "6-10";
-        } else {
-            size = "11+";
-        }
-        String bucket = List.of("choice", "score", "noul").get(qtype) + ":" + size;
+        String bucket = List.of("choice", "score", "noul").get(qtype) + ":" + sizeBucket(k);
         double t = temperatureByOptions.getOrDefault(bucket, temperature[qtype]);
         float[] z = new float[k];
         for (int i = 0; i < k; i++) {
@@ -264,6 +254,18 @@ private double[] probabilities(float[] logits, int k, int qtype) {
         return Probabilities.softmax(z);
     }
 
+    /** The option-count part of a temperature bucket name, as rl_agent_api spells it. */
+    static String sizeBucket(int k) {
+        if (k <= 2) {
+            return "2";
+        } else if (k <= 5) {
+            return "3-5";
+        } else if (k <= 10) {
+            return "6-10";
+        }
+        return "11+";
+    }
+
     /** Everything but the markers is caller text, so [CLS]/[SEP] spelled there stay text. */
     private long[] encode(String text) {
         return tokenizer.encodeText(text);
 
@@ -0,0 +1,20 @@
+package io.github.dfa1.typesafe.client.local;
+
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/** Untagged: needs no model files, unlike {@link LayaEngineTest}. */
+class LayaEngineSizeBucketTest {
+
+    @ParameterizedTest
+    @CsvSource({"2, 2", "3, 3-5", "5, 3-5", "6, 6-10", "10, 6-10", "11, 11+", "40, 11+"})
+    void sizeBucketGroupsOptionCountsLikeRlAgentApi(int k, String expected) {
+        // When
+        String result = LayaEngine.sizeBucket(k);
+
+        // Then
+        assertThat(result).isEqualTo(expected);
+    }
+}