jules-orchestrator-kit 0.32.4 → 0.32.5

package/src/evidence.mjs

@@ -0,0 +1,435 @@
+import {
+  readFileSync,
+  mkdirSync,
+  existsSync,
+  readdirSync,
+  statSync,
+  openSync,
+  writeSync,
+  fsyncSync,
+  closeSync,
+  renameSync,
+  unlinkSync,
+} from "node:fs";
+import { join, resolve, relative, isAbsolute, sep } from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { execSync } from "node:child_process";
+
+/**
+ * Normalizes file path to POSIX slashes.
+ * @param {string} p
+ * @returns {string}
+ */
+export function normalizePath(p = "") {
+  return p.split(sep).join("/").replace(/\\/g, "/");
+}
+
+/**
+ * Computes SHA-256 hex digest of a string or buffer.
+ * @param {string | Buffer} content
+ * @returns {string}
+ */
+export function sha256(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+
+/**
+ * Computes SHA-256 of a single file on disk.
+ * @param {string} filePath
+ * @returns {string | null}
+ */
+export function computeFileHash(filePath) {
+  try {
+    if (!existsSync(filePath)) return null;
+    const content = readFileSync(filePath);
+    return "sha256:" + sha256(content);
+  } catch (_) {
+    return null;
+  }
+}
+
+/**
+ * Recursively scans a directory and finds all matching files.
+ * @param {string} dir
+ * @param {string} [baseDir]
+ * @returns {string[]}
+ */
+export function findFilesRecursively(dir, baseDir = dir) {
+  if (!existsSync(dir)) return [];
+  const results = [];
+  try {
+    const entries = readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = join(dir, entry.name);
+      if (entry.name === ".git" || entry.name === "node_modules" || entry.name === "target" || entry.name === "vendor") {
+        continue;
+      }
+      if (entry.isDirectory()) {
+        results.push(...findFilesRecursively(fullPath, baseDir));
+      } else if (entry.isFile()) {
+        results.push(normalizePath(relative(baseDir, fullPath)));
+      }
+    }
+  } catch (_) {}
+  return results.sort();
+}
+
+/**
+ * Deterministically computes SHA-256 tree hash over a directory or set of files.
+ * Ignores mtime and permissions to ensure byte-level determinism.
+ * @param {string} root
+ * @param {object} [options]
+ * @param {string[]} [options.paths] - Specific paths to hash (relative to root)
+ * @param {string[]} [options.directories] - Specific directory names to scan (e.g. ['test', 'tests'])
+ * @returns {{ treeHash: string, fileCount: number, fileHashes: Record<string, string> }}
+ */
+export function computeDirectoryHash(root, options = {}) {
+  let fileList = [];
+
+  if (Array.isArray(options.paths) && options.paths.length > 0) {
+    fileList = options.paths
+      .map((p) => normalizePath(p))
+      .filter((p) => existsSync(join(root, p)) && statSync(join(root, p)).isFile())
+      .sort();
+  } else {
+    const targetDirs = options.directories || ["test", "tests", "__tests__", "spec", "src"];
+    for (const dirName of targetDirs) {
+      const dirPath = join(root, dirName);
+      if (existsSync(dirPath)) {
+        const found = findFilesRecursively(dirPath, root);
+        fileList.push(...found);
+      }
+    }
+    fileList = Array.from(new Set(fileList)).sort();
+  }
+
+  // Filter test files if specifically looking for test suites
+  if (options.testOnly) {
+    fileList = fileList.filter((f) => {
+      const lower = f.toLowerCase();
+      return (
+        lower.startsWith("test/") ||
+        lower.startsWith("tests/") ||
+        lower.startsWith("__tests__/") ||
+        lower.startsWith("spec/") ||
+        lower.includes(".test.") ||
+        lower.includes(".spec.") ||
+        lower.includes("_test.") ||
+        lower.endsWith("test.sol") ||
+        lower.endsWith(".t.sol")
+      );
+    });
+  }
+
+  const fileHashes = {};
+  const hashLines = [];
+
+  for (const relPath of fileList) {
+    const fullPath = join(root, relPath);
+    const hash = computeFileHash(fullPath);
+    if (hash) {
+      fileHashes[relPath] = hash;
+      hashLines.push(`${relPath}:${hash}`);
+    }
+  }
+
+  const treeHash = "sha256:" + sha256(hashLines.join("\n"));
+  return {
+    treeHash,
+    fileCount: hashLines.length,
+    fileHashes,
+  };
+}
+
+/**
+ * Computes canonical hash for an evidence manifest (excluding the evidenceHash field).
+ * @param {object} manifest
+ * @returns {string}
+ */
+export function computeEvidenceHash(manifest) {
+  const canonicalPayload = JSON.stringify({
+    schema: manifest.schema,
+    manifestId: manifest.manifestId,
+    generatedAt: manifest.generatedAt,
+    intent: manifest.intent,
+    provenance: manifest.provenance,
+    testIntegrity: manifest.testIntegrity,
+    executionRecords: manifest.executionRecords,
+    securityChecks: manifest.securityChecks,
+  });
+  return "sha256:" + sha256(canonicalPayload);
+}
+
+/**
+ * Safely writes a file atomically.
+ * @param {string} filePath
+ * @param {string} content
+ */
+function writeFileAtomically(filePath, content) {
+  const tmpPath = `${filePath}.${randomUUID()}.tmp`;
+  let fd;
+  try {
+    fd = openSync(tmpPath, "wx", 0o600);
+    writeSync(fd, content, "utf-8");
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = undefined;
+    renameSync(tmpPath, filePath);
+  } catch (err) {
+    if (fd !== undefined) {
+      try { closeSync(fd); } catch (_) {}
+    }
+    try { unlinkSync(tmpPath); } catch (_) {}
+    throw err;
+  }
+}
+
+/**
+ * Queries current git provenance data safely.
+ * @param {string} root
+ * @returns {object}
+ */
+export function getGitProvenance(root = process.cwd()) {
+  try {
+    const commitSha = execSync("git rev-parse HEAD", { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    let branch = "";
+    try {
+      branch = execSync("git rev-parse --abbrev-ref HEAD", { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    } catch (_) {}
+
+    let statusOutput = "";
+    try {
+      statusOutput = execSync("git status --porcelain", { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    } catch (_) {}
+
+    return {
+      commitSha,
+      branch: branch || "HEAD",
+      dirty: statusOutput.length > 0,
+    };
+  } catch (_) {
+    return {
+      commitSha: "unknown",
+      branch: "unknown",
+      dirty: false,
+    };
+  }
+}
+
+/**
+ * Generates an Evidence Manifest capturing deterministic build, test, and security evidence.
+ * @param {string} root
+ * @param {object} [options]
+ * @returns {object}
+ */
+export function generateEvidenceManifest(root = process.cwd(), options = {}) {
+  const manifestId = options.manifestId || `EVD-${Date.now()}-${randomUUID().slice(0, 8)}`;
+  const generatedAt = new Date().toISOString();
+  const gitInfo = getGitProvenance(root);
+
+  // Compute test tree integrity
+  const preTestHash = options.preTestHash || null;
+  const currentTestState = computeDirectoryHash(root, { testOnly: true });
+  const postTestHash = currentTestState.treeHash;
+
+  let tamperDetected = false;
+  if (preTestHash && preTestHash !== postTestHash) {
+    tamperDetected = true;
+  }
+
+  // Intent metadata
+  const taskPrompt = options.prompt || options.task?.prompt || "";
+  const promptHash = taskPrompt ? "sha256:" + sha256(taskPrompt) : "sha256:empty";
+  const promptExcerpt = taskPrompt ? taskPrompt.slice(0, 140).replace(/[\r\n]+/g, " ") : "";
+
+  // Base manifest
+  const baseManifest = {
+    schema: "agentctl/evidence-manifest-v1",
+    manifestId,
+    generatedAt,
+    intent: {
+      taskId: options.taskId || options.task?.id || "local-task",
+      title: options.title || options.task?.title || "Verification Run",
+      promptHash,
+      promptExcerpt,
+    },
+    provenance: {
+      commitSha: gitInfo.commitSha,
+      branch: gitInfo.branch,
+      dirty: gitInfo.dirty,
+      repository: options.repository || "local",
+    },
+    testIntegrity: {
+      preTestHash: preTestHash || postTestHash,
+      postTestHash,
+      tamperDetected,
+      testFileCount: currentTestState.fileCount,
+      fileHashes: currentTestState.fileHashes,
+    },
+    executionRecords: options.executionRecords || [],
+    securityChecks: {
+      secretScanOk: options.secretScanOk ?? true,
+      diffKb: options.diffKb || 0,
+      maxDiffKb: options.maxDiffKb || 75,
+      protectedScopeOk: options.protectedScopeOk ?? true,
+    },
+  };
+
+  const evidenceHash = computeEvidenceHash(baseManifest);
+  return {
+    ...baseManifest,
+    evidenceHash,
+  };
+}
+
+/**
+ * Persists an evidence manifest to disk.
+ * @param {string} root
+ * @param {object} manifest
+ * @param {string} [customPath]
+ * @returns {string} Target path
+ */
+export function writeEvidenceManifest(root, manifest, customPath = null) {
+  const evidenceDir = join(root, ".agent", "evidence");
+  if (!existsSync(evidenceDir)) {
+    mkdirSync(evidenceDir, { recursive: true });
+  }
+
+  const targetPath = customPath
+    ? isAbsolute(customPath) ? customPath : join(root, customPath)
+    : join(evidenceDir, `${manifest.manifestId}.json`);
+
+  writeFileAtomically(targetPath, JSON.stringify(manifest, null, 2));
+
+  // Also maintain symlink/latest pointer
+  const latestPath = join(evidenceDir, "manifest.v1.json");
+  try {
+    writeFileAtomically(latestPath, JSON.stringify(manifest, null, 2));
+  } catch (_) {}
+
+  return targetPath;
+}
+
+/**
+ * Loads and validates an evidence manifest from disk.
+ * @param {string} root
+ * @param {string} [manifestIdOrPath]
+ * @returns {object}
+ */
+export function loadEvidenceManifest(root, manifestIdOrPath = "manifest.v1.json") {
+  const evidenceDir = resolve(root, ".agent", "evidence");
+  let targetPath;
+
+  if (manifestIdOrPath.endsWith(".json")) {
+    targetPath = isAbsolute(manifestIdOrPath) ? resolve(manifestIdOrPath) : resolve(evidenceDir, manifestIdOrPath);
+    if (!existsSync(targetPath)) {
+      targetPath = resolve(root, manifestIdOrPath);
+    }
+  } else {
+    targetPath = join(evidenceDir, `${manifestIdOrPath}.json`);
+  }
+
+  if (!existsSync(targetPath)) {
+    throw new Error(`Evidence manifest not found: ${targetPath}`);
+  }
+
+  const raw = readFileSync(targetPath, "utf-8");
+  const manifest = JSON.parse(raw);
+
+  if (manifest.schema !== "agentctl/evidence-manifest-v1") {
+    throw new Error(`Invalid evidence manifest schema: ${manifest.schema}`);
+  }
+
+  const expectedHash = computeEvidenceHash(manifest);
+  if (manifest.evidenceHash !== expectedHash) {
+    throw new Error(`Tampered evidence manifest hash mismatch in ${targetPath}`);
+  }
+
+  return manifest;
+}
+
+/**
+ * Validates current workspace state against an evidence manifest.
+ * Asserts zero test tampering and matching test suite tree hash.
+ * @param {string} root
+ * @param {object | string} manifestOrPath
+ * @returns {{ ok: boolean, reason?: string, details?: object }}
+ */
+export function verifyEvidenceManifest(root = process.cwd(), manifestOrPath = "manifest.v1.json") {
+  let manifest;
+  try {
+    manifest = typeof manifestOrPath === "object" && manifestOrPath !== null
+      ? manifestOrPath
+      : loadEvidenceManifest(root, manifestOrPath);
+  } catch (err) {
+    return { ok: false, reason: `Failed to load evidence manifest: ${err.message}` };
+  }
+
+  // 1. Verify schema & cryptographic hash
+  if (manifest.schema !== "agentctl/evidence-manifest-v1") {
+    return { ok: false, reason: `Invalid schema version: ${manifest.schema}` };
+  }
+  if (manifest.evidenceHash !== computeEvidenceHash(manifest)) {
+    return { ok: false, reason: "Evidence manifest hash signature mismatch (tampered file)" };
+  }
+
+  // 2. Verify test integrity / No test weakening
+  const currentTestState = computeDirectoryHash(root, { testOnly: true });
+  if (manifest.testIntegrity?.tamperDetected) {
+    return {
+      ok: false,
+      reason: "Test suite tampering detected in evidence manifest",
+      details: { preTestHash: manifest.testIntegrity.preTestHash, postTestHash: manifest.testIntegrity.postTestHash },
+    };
+  }
+
+  if (manifest.testIntegrity?.postTestHash && currentTestState.treeHash !== manifest.testIntegrity.postTestHash) {
+    return {
+      ok: false,
+      reason: `Current test suite tree hash (${currentTestState.treeHash}) does not match manifest evidence (${manifest.testIntegrity.postTestHash})`,
+      details: { currentHash: currentTestState.treeHash, manifestHash: manifest.testIntegrity.postTestHash },
+    };
+  }
+
+  // 3. Verify security checks
+  if (manifest.securityChecks?.secretScanOk === false) {
+    return { ok: false, reason: "Evidence manifest records secret scanning failure" };
+  }
+  if (manifest.securityChecks?.protectedScopeOk === false) {
+    return { ok: false, reason: "Evidence manifest records protected scope violation" };
+  }
+
+  return { ok: true, manifestId: manifest.manifestId, evidenceHash: manifest.evidenceHash };
+}
+
+/**
+ * Renders PR-ready Markdown evidence section.
+ * @param {object} manifest
+ * @returns {string}
+ */
+export function generateEvidenceMarkdown(manifest) {
+  const lines = [
+    "### 🛡️ Autonomous Verification & Evidence Proof",
+    "",
+    `> **Evidence Manifest**: \`${manifest.manifestId}\` | **Signature**: \`${manifest.evidenceHash?.slice(0, 16)}...\``,
+    "",
+    "| Gate / Policy | Status | Evidence Record |",
+    "| :--- | :---: | :--- |",
+    `| **Test Suite Integrity** | ${manifest.testIntegrity?.tamperDetected ? "❌ Tampered" : "✅ Verified"} | \`${manifest.testIntegrity?.testFileCount || 0} test files\` (Tree: \`${manifest.testIntegrity?.postTestHash?.slice(0, 16)}...\`) |`,
+    `| **Secret Leak Scanner** | ${manifest.securityChecks?.secretScanOk ? "✅ Clean" : "❌ Detected"} | High-confidence entropy scan passed |`,
+    `| **Payload Governor** | ${manifest.securityChecks?.diffKb <= manifest.securityChecks?.maxDiffKb ? "✅ Bounded" : "❌ Exceeded"} | \`${manifest.securityChecks?.diffKb || 0} KB\` / \`${manifest.securityChecks?.maxDiffKb || 75} KB\` limit |`,
+  ];
+
+  if (Array.isArray(manifest.executionRecords) && manifest.executionRecords.length > 0) {
+    lines.push("", "#### Executed Verification Stages");
+    lines.push("| Stage | Command | Policy | Exit Code | Duration |");
+    lines.push("| :--- | :--- | :---: | :---: | :---: |");
+    for (const rec of manifest.executionRecords) {
+      const statusIcon = rec.exitCode === 0 ? "✅" : "❌";
+      const policyStr = rec.networkAccess === "forbidden" ? "🔒 Offline" : rec.networkAccess === "read-only" ? "📖 Read-Only" : "🌐 Online";
+      lines.push(`| \`${rec.id || rec.kind}\` | \`${rec.cmd}\` | ${policyStr} | ${statusIcon} \`${rec.exitCode}\` | \`${rec.durationMs || 0}ms\` |`);
+    }
+  }
+
+  return lines.join("\n");
+}

package/src/mcp.mjs

@@ -98,6 +98,8 @@ export const MCP_TOOLS = [
       properties: {
         title: { type: "string", description: "Short descriptive title for the task" },
         prompt: { type: "string", description: "Detailed task instructions and prompt" },
+        role: { type: "string", description: "Specialist agent role (overseer | bolt | sentinel | janitor)" },
+        tier: { type: "string", description: "Force the Cost Router tier when router.enabled (fast | complex); omit to let the heuristic classifier decide" },
       },
       required: ["prompt"],
     },
@@ -178,6 +180,20 @@ export const MCP_TOOLS = [
       },
     },
   },
+  {
+    name: "record_system_learning",
+    description: "Record a persistent system learning or platform quirk into .agent/SYSTEM_LEARNINGS.md (SPORE Memory).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        trigger: { type: "string", description: "Trigger condition or symptom (e.g. 'Cloudflare Workers SSR')" },
+        solution: { type: "string", description: "Mandatory rule or resolution (e.g. 'Do not use node:fs in edge runtime')" },
+        agent: { type: "string", description: "Agent name (defaults to 'agent')" },
+        category: { type: "string", description: "Category (e.g. 'EDGE', 'DATABASE', 'GENERAL')" },
+      },
+      required: ["trigger", "solution"],
+    },
+  },
 ];
 
 export async function handleMcpRequest(request, opts = {}) {
@@ -220,7 +236,12 @@ export async function handleMcpRequest(request, opts = {}) {
     try {
       if (toolName === "dispatch_jules_task") {
         const session = await dispatch(
-          { title: args.title || "MCP Task Dispatch", prompt: args.prompt },
+          {
+            title: args.title || "MCP Task Dispatch",
+            prompt: args.prompt,
+            role: args.role,
+            tier: args.tier === "fast" || args.tier === "complex" ? args.tier : undefined,
+          },
           { root, config }
         );
         return {
@@ -232,6 +253,23 @@ export async function handleMcpRequest(request, opts = {}) {
         };
       }
 
+      if (toolName === "record_system_learning") {
+        const { recordLearning } = await import("./memory.mjs");
+        const result = recordLearning(root, {
+          trigger: args.trigger,
+          solution: args.solution,
+          agent: args.agent || "mcp-agent",
+          category: args.category || "GENERAL",
+        });
+        return {
+          jsonrpc: "2.0",
+          id,
+          result: {
+            content: [{ type: "text", text: JSON.stringify({ ok: true, ...result }, null, 2) }],
+          },
+        };
+      }
+
       if (toolName === "audit_jules_gate") {
         const res = await gate({
           root,

package/src/ops/evidence-actions.mjs

@@ -0,0 +1,74 @@
+import {
+  generateEvidenceManifest,
+  writeEvidenceManifest,
+  loadEvidenceManifest,
+  verifyEvidenceManifest,
+  generateEvidenceMarkdown,
+} from "../evidence.mjs";
+import { resolveRoot } from "../config.mjs";
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+/**
+ * Generates an evidence manifest and optional markdown summary.
+ * @param {string} root
+ * @param {object} [options]
+ * @returns {object}
+ */
+export function planEvidenceGenerate(root = resolveRoot(), options = {}) {
+  const manifest = generateEvidenceManifest(root, options);
+  const manifestPath = writeEvidenceManifest(root, manifest, options.output);
+  const markdown = generateEvidenceMarkdown(manifest);
+
+  if (options.markdownOutput) {
+    const mdPath = options.markdownOutput.endsWith(".md")
+      ? options.markdownOutput
+      : join(root, ".agent", "evidence", "EVIDENCE.md");
+    try {
+      writeFileSync(mdPath, markdown, "utf-8");
+    } catch (_) {}
+  }
+
+  return {
+    ok: true,
+    manifest,
+    manifestPath,
+    markdown,
+  };
+}
+
+/**
+ * Verifies an evidence manifest against the current working directory.
+ * @param {string} root
+ * @param {object} [options]
+ * @returns {object}
+ */
+export function planEvidenceVerify(root = resolveRoot(), options = {}) {
+  const manifestTarget = options.manifest || "manifest.v1.json";
+  const result = verifyEvidenceManifest(root, manifestTarget);
+  return result;
+}
+
+/**
+ * Loads and displays the latest evidence manifest.
+ * @param {string} root
+ * @param {object} [options]
+ * @returns {object}
+ */
+export function planEvidenceShow(root = resolveRoot(), options = {}) {
+  const manifestTarget = options.manifest || "manifest.v1.json";
+  try {
+    const manifest = loadEvidenceManifest(root, manifestTarget);
+    const markdown = generateEvidenceMarkdown(manifest);
+    return {
+      ok: true,
+      manifest,
+      markdown,
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: err.message,
+    };
+  }
+}

package/src/provider.mjs

@@ -37,6 +37,19 @@ export const CODEX_PRESET = {
   promptViaStdin: false,
 };
 
+// Google Gemini CLI (`npm i -g @google/gemini-cli`), headless mode. Reads the
+// prompt from stdin (non-TTY input triggers headless mode without needing a
+// dangling `-p` flag), auto-approves file/shell actions, and defaults to the
+// Gemini 3.6 Flash model — a cheap, fast tier suited for trivial/mechanical
+// tasks routed by src/router.mjs. Auth via GEMINI_API_KEY (env, not CLI arg).
+export const GEMINI_PRESET = {
+  name: "gemini-flash",
+  type: "exec",
+  command: "gemini",
+  args: ["--model", "gemini-3.6-flash", "--approval-mode=yolo", "--output-format", "json"],
+  promptViaStdin: true,
+};
+
 export class MissingApiKeyError extends Error {
   constructor(message = "JULES_API_KEY environment variable is required for Google Jules API dispatch.") {
     super(message);
@@ -105,18 +118,33 @@ function interpolateDeep(node, data) {
 /**
  * Creates an HTTP or Exec provider adapter based on spec/config.
  */
+const NAMED_PRESETS = {
+  jules: JULES_PRESET,
+  "claude-code": CLAUDE_PRESET,
+  codex: CODEX_PRESET,
+  "gemini-flash": GEMINI_PRESET,
+  "gemini-cli": GEMINI_PRESET,
+};
+
 export function createProvider(spec = "jules", config = {}) {
   if (spec && typeof spec === "object" && typeof spec.dispatch === "function") {
     return spec;
   }
-  const providerSpec = typeof spec === "string"
-    ? (spec === "claude-code" ? CLAUDE_PRESET : spec === "codex" ? CODEX_PRESET : JULES_PRESET)
-    : spec || JULES_PRESET;
+  const providerSpec = typeof spec === "string" ? (NAMED_PRESETS[spec] || JULES_PRESET) : spec || JULES_PRESET;
 
   if (!providerSpec || typeof providerSpec !== "object") {
     throw new TypeError("Provider specification must be a string or object");
   }
 
+  if (providerSpec.type === "http") {
+    if (typeof providerSpec.url === "string" && providerSpec.url.includes("{token}")) {
+      throw new Error("CRITICAL: Insecure token interpolation in provider URL template. API tokens must be passed via headers, not URL paths or query params.");
+    }
+    if (typeof providerSpec.sendMessageUrl === "string" && providerSpec.sendMessageUrl.includes("{token}")) {
+      throw new Error("CRITICAL: Insecure token interpolation in provider sendMessageUrl template. API tokens must be passed via headers, not URL paths or query params.");
+    }
+  }
+
   return {
     name: providerSpec.name || "custom-provider",
 
@@ -165,11 +193,12 @@ export function createProvider(spec = "jules", config = {}) {
       }
 
       if (providerSpec.type === "http") {
-        const urlData = { ...data, token: rawToken };
+        const urlData = { ...data };
         const url = interpolateString(providerSpec.url, urlData);
+        const headerData = { ...urlData, token: rawToken };
         const headers = {};
         for (const [k, v] of Object.entries(providerSpec.headers || {})) {
-          const val = interpolateString(v, urlData);
+          const val = interpolateString(v, headerData);
           if (val.includes("\r") || val.includes("\n")) {
             throw new Error(`CRITICAL: Header injection attempt detected in header "${k}"`);
           }
@@ -335,12 +364,13 @@ export function createProvider(spec = "jules", config = {}) {
 
       if (providerSpec.type === "http") {
         const sendMessageUrlTemplate = providerSpec.sendMessageUrl || `${providerSpec.url}/${sessionId}:sendMessage`;
-        const urlData = { sessionId, token: rawToken, ...ctx };
+        const urlData = { sessionId, ...ctx };
         const url = interpolateString(sendMessageUrlTemplate, urlData);
 
+        const headerData = { ...urlData, token: rawToken };
         const headers = {};
         for (const [k, v] of Object.entries(providerSpec.headers || {})) {
-          const val = interpolateString(v, urlData);
+          const val = interpolateString(v, headerData);
           if (val.includes("\r") || val.includes("\n")) {
             throw new Error(`CRITICAL: Header injection attempt detected in header "${k}"`);
           }