`agentcore invoke` custom headers are not forwarded when using CUSTOM_JWT / bearer token auth

[jakec-dev]

Description

When invoking an agent with CUSTOM_JWT authentication, custom headers passed via the -H or --header flag are silently ignored.

Steps to Reproduce

1. Configure an agent with authorizerType: "CUSTOM_JWT" in agentcore.json
2. Deploy the agent: agentcore deploy
3. Invoke with custom headers:

agentcore invoke -H "Foo-Header: bar"

4. In the agent code, check context.request_headers

Expected Behavior

Headers include x-amzn-bedrock-agentcore-runtime-custom-foo-header

Actual Behavior

Headers are empty

CLI Version

0.12.0

Operating System

macOS

Additional Context

Seems the root cause is in https://github.com/aws/agentcore-cli/blob/main/src/cli/aws/agentcore.ts#L159 - headers does not include options.headers

Suggested fix:

Merge custom headers in the bearer token path:

async function invokeWithBearerTokenStreaming(options: InvokeAgentRuntimeOptions): Promise<StreamingInvokeResult> {
  const url = buildInvokeUrl(options.region, options.runtimeArn);
  const headers: Record<string, string> = {
    Authorization: `Bearer ${options.bearerToken}`,
    'Content-Type': 'application/json',
    Accept: 'application/json, text/event-stream',

    ...options.headers,  // <<< ADD THIS

  };

[Hweinstock]

Thanks for reporting the issue! We've merged a fix and plan to include with our next release this week. Please let us know if you continue to experience issues on the next version.