@@ -1,6 +1,6 @@
 {
   "id": "bridge",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "name": "Bridge Tunnel Client",
   "description": "Connects to the bridge server running on a Vercel Sandbox to forward inbound requests to local applications and intercept outbound traffic via iptables.",
   "entrypoint": "/usr/local/bin/bridge-entrypoint.sh",
@@ -34,6 +34,11 @@
       "type": "string",
       "description": "Version of bridge CLI to install (e.g., 'v1.0.0' or 'edge')",
       "default": "edge"
+    },
+    "envFile": {
+      "type": "string",
+      "description": "Path to env file containing VERCEL_AUTOMATION_BYPASS_SECRET (relative to workspace)",
+      "default": ".env.development.local"
     }
   },
   "containerEnv": {
 
@@ -77,6 +77,8 @@ install_bridge() {
 
 # Write environment configuration
 write_env_config() {
+    local env_file="${ENVFILE:-.env.development.local}"
+
     # Write to /etc/environment for system-wide availability (read by PAM)
     # Feature options are available as uppercase versions without special chars
     {
@@ -85,6 +87,7 @@ write_env_config() {
         echo "SANDBOX_NAME=${SANDBOXNAME:-}"
         echo "SYNC_SOURCE=${SYNCSOURCE:-.}"
         echo "SYNC_TARGET=${SYNCTARGET:-}"
+        echo "BRIDGE_ENV_FILE=${env_file}"
     } >> /etc/environment
 
     # Also write to /etc/profile.d for shell login sessions
@@ -94,19 +97,41 @@ export FUNCTION_URL="${FUNCTIONURL:-}"
 export SANDBOX_NAME="${SANDBOXNAME:-}"
 export SYNC_SOURCE="${SYNCSOURCE:-.}"
 export SYNC_TARGET="${SYNCTARGET:-}"
+export BRIDGE_ENV_FILE="${env_file}"
 EOF
 }
 
+# Helper to read a value from an env file
+# Usage: read_env_var ENV_FILE VAR_NAME
+read_env_var() {
+    local file="$1" var="$2"
+    if [ -f "$file" ]; then
+        grep -m1 "^${var}=" "$file" | sed "s/^${var}=//" | sed 's/^"//;s/"$//'
+    fi
+}
+
 # Create entrypoint script
 create_entrypoint() {
     cat > /usr/local/bin/bridge-entrypoint.sh << 'EOF'
 #!/bin/bash
 # Source profile in case env vars aren't inherited
 [ -f /etc/profile.d/bridge.sh ] && source /etc/profile.d/bridge.sh
 
+# Read VERCEL_AUTOMATION_BYPASS_SECRET from env file if not already set
+if [ -z "$VERCEL_AUTOMATION_BYPASS_SECRET" ] && [ -n "$BRIDGE_ENV_FILE" ]; then
+    # Try workspace-relative path first, then absolute
+    for candidate in "/workspaces/${BRIDGE_ENV_FILE}" "${BRIDGE_ENV_FILE}"; do
+        if [ -f "$candidate" ]; then
+            VERCEL_AUTOMATION_BYPASS_SECRET=$(grep -m1 '^VERCEL_AUTOMATION_BYPASS_SECRET=' "$candidate" | sed 's/^VERCEL_AUTOMATION_BYPASS_SECRET=//' | sed 's/^"//;s/"$//')
+            export VERCEL_AUTOMATION_BYPASS_SECRET
+            break
+        fi
+    done
+fi
+
 # Run bridge intercept as root (required for iptables), passing env vars explicitly
 if [ -n "$SANDBOX_URL" ]; then
-    sudo -E /usr/local/bin/bridge intercept &
+    sudo -E VERCEL_AUTOMATION_BYPASS_SECRET="$VERCEL_AUTOMATION_BYPASS_SECRET" /usr/local/bin/bridge intercept &
 fi
 
 exec "$@"
 
@@ -1,18 +1,18 @@
 {
   "id": "vercel-cli",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "name": "Vercel CLI",
-  "description": "Installs the Vercel CLI with automatic token passthrough from VERCEL_TOKEN environment variable or env file.",
+  "description": "Installs the Vercel CLI with automatic token passthrough from env file.",
   "options": {
     "version": {
       "type": "string",
       "description": "Vercel CLI version to install (e.g., 'latest', '50.8.1')",
       "default": "latest"
     },
-    "envFileVar": {
+    "envFile": {
       "type": "string",
-      "description": "Name of environment variable containing the path to env file with VERCEL_TOKEN",
-      "default": "VERCEL_ENV_FILE"
+      "description": "Path to env file containing VERCEL_TOKEN (relative to workspace)",
+      "default": ".env.development.local"
     }
   },
   "installsAfter": [
 
@@ -2,7 +2,7 @@
 set -e
 
 VERSION="${VERSION:-latest}"
-ENVFILEVAR="${ENVFILEVAR:-VERCEL_ENV_FILE}"
+ENVFILE="${ENVFILE:-.env.development.local}"
 
 # Remove yarn repository if it exists (often has expired GPG keys causing apt-get update to fail)
 rm -f /etc/apt/sources.list.d/yarn.list 2>/dev/null || true
@@ -13,7 +13,6 @@ echo "Installing Vercel CLI (version: $VERSION)..."
 if ! command -v node &> /dev/null; then
     echo "Node.js is required but not installed. Installing Node.js..."
     if command -v apt-get &> /dev/null; then
-        # Remove yarn repository if it exists (often has expired GPG keys)
         rm -f /etc/apt/sources.list.d/yarn.list 2>/dev/null || true
         apt-get update
         apt-get install -y curl
@@ -45,28 +44,32 @@ echo "Vercel CLI installed at: $VERCEL_BIN"
 # Move the original binary to a different name
 mv "$VERCEL_BIN" "${VERCEL_BIN}-bin"
 
-# Create wrapper script for vercel
-cat > "$VERCEL_BIN" << EOF
+# Create wrapper script for vercel that reads VERCEL_TOKEN from env file every time
+cat > "$VERCEL_BIN" << 'WRAPPER'
 #!/bin/bash
-# Vercel CLI wrapper - auto-passes VERCEL_TOKEN if set or from env file
+# Vercel CLI wrapper - reads VERCEL_TOKEN from env file on every invocation
 
-# Get env file path from environment variable
-ENV_FILE_PATH="\${$ENVFILEVAR:-}"
-
-# If VERCEL_TOKEN not set, try to source from env file
-if [ -z "\$VERCEL_TOKEN" ] && [ -n "\$ENV_FILE_PATH" ] && [ -f "\$ENV_FILE_PATH" ]; then
-  set -a
-  source "\$ENV_FILE_PATH"
-  set +a
+# If VERCEL_TOKEN not already set, read it from the env file
+if [ -z "$VERCEL_TOKEN" ]; then
+  # Try workspace-relative path first, then absolute
+  for candidate in "/workspaces/${ENVFILE}" "${ENVFILE}"; do
+    if [ -f "$candidate" ]; then
+      VERCEL_TOKEN=$(grep -m1 '^VERCEL_TOKEN=' "$candidate" | sed 's/^VERCEL_TOKEN=//' | sed 's/^"//;s/"$//')
+      break
+    fi
+  done
 fi
 
 # Use token if available
-if [ -n "\$VERCEL_TOKEN" ]; then
-  exec "\$(dirname "\$0")/vercel-bin" --token "\$VERCEL_TOKEN" "\$@"
+if [ -n "$VERCEL_TOKEN" ]; then
+  exec "$(dirname "$0")/vercel-bin" --token "$VERCEL_TOKEN" "$@"
 else
-  exec "\$(dirname "\$0")/vercel-bin" "\$@"
+  exec "$(dirname "$0")/vercel-bin" "$@"
 fi
-EOF
+WRAPPER
+
+# Inject the env file path into the wrapper
+sed -i "s|\${ENVFILE}|${ENVFILE}|g" "$VERCEL_BIN"
 chmod +x "$VERCEL_BIN"
 
 # Create wrapper script for vc (symlink to vercel wrapper)
@@ -82,5 +85,4 @@ echo "Usage:"
 echo "  vercel whoami"
 echo "  vc dev"
 echo ""
-echo "Token will be read from env file path in \$$ENVFILEVAR"
-echo "Or set VERCEL_TOKEN environment variable to auto-authenticate."
+echo "Token will be read from ${ENVFILE} on every invocation."