diff --git a/src/clawdhub/client.ts b/src/clawdhub/client.ts
index 2f5fe4ac8..e9214e12e 100644
--- a/src/clawdhub/client.ts
+++ b/src/clawdhub/client.ts
@@ -92,14 +92,28 @@ async function fetchJson<T>(url: string, options: RequestInit = {}, timeoutMs =
   const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
 
   try {
+    const headers: Record<string, string> = {
+      Accept: "application/json",
+      "User-Agent": "clawdbot-gateway",
+    };
+    if (options.headers) {
+      const h = options.headers;
+      if (h instanceof Headers) {
+        h.forEach((value, key) => {
+          headers[key] = value;
+        });
+      } else if (Array.isArray(h)) {
+        for (const [key, value] of h) {
+          headers[key] = value;
+        }
+      } else {
+        Object.assign(headers, h);
+      }
+    }
     const response = await fetch(url, {
       ...options,
       signal: controller.signal,
-      headers: {
-        Accept: "application/json",
-        "User-Agent": "clawdbot-gateway",
-        ...options.headers,
-      },
+      headers,
     });
 
     if (!response.ok) {
diff --git a/src/gateway/chat-sanitize.test.ts b/src/gateway/chat-sanitize.test.ts
index 44f38d4fd..0311cf715 100644
--- a/src/gateway/chat-sanitize.test.ts
+++ b/src/gateway/chat-sanitize.test.ts
@@ -6,7 +6,6 @@ import {
   wrapWithBoundaries,
   sanitizeIncomingMessage,
   PROMPT_BOUNDARIES,
-  type InjectionSeverity,
 } from "./chat-sanitize.js";
 
 describe("stripEnvelopeFromMessage", () => {
diff --git a/src/infra/exec-blocklist.ts b/src/infra/exec-blocklist.ts
index c6cc6ad7b..725298312 100644
--- a/src/infra/exec-blocklist.ts
+++ b/src/infra/exec-blocklist.ts
@@ -37,7 +37,7 @@ type BlocklistEntry = {
 const CRITICAL_BLOCKLIST: BlocklistEntry[] = [
   // Destructive filesystem operations
   {
-    pattern: /\brm\s+(-[a-zA-Z]*r[a-zA-Z]*\s+)?(-[a-zA-Z]*f[a-zA-Z]*\s+)?[\/~]\s*$/i,
+    pattern: /\brm\s+(-[a-zA-Z]*r[a-zA-Z]*\s+)?(-[a-zA-Z]*f[a-zA-Z]*\s+)?[/~]\s*$/i,
     description: "rm -rf / (root filesystem deletion)",
     severity: "critical",
     requiresExplicitApproval: true,