fix: resolve lint errors from transformation phases

- Remove unnecessary escape character in exec-blocklist regex
- Fix header spread in clawdhub client to handle all HeadersInit types
- Remove unused InjectionSeverity import from chat-sanitize test

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/clawdhub/client.ts

@@ -92,14 +92,28 @@ async function fetchJson<T>(url: string, options: RequestInit = {}, timeoutMs =
   const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
 
   try {
+    const headers: Record<string, string> = {
+      Accept: "application/json",
+      "User-Agent": "clawdbot-gateway",
+    };
+    if (options.headers) {
+      const h = options.headers;
+      if (h instanceof Headers) {
+        h.forEach((value, key) => {
+          headers[key] = value;
+        });
+      } else if (Array.isArray(h)) {
+        for (const [key, value] of h) {
+          headers[key] = value;
+        }
+      } else {
+        Object.assign(headers, h);
+      }
+    }
     const response = await fetch(url, {
       ...options,
       signal: controller.signal,
-      headers: {
+      headers,
-        Accept: "application/json",
-        "User-Agent": "clawdbot-gateway",
-        ...options.headers,
-      },
     });
 
     if (!response.ok) {

src/gateway/chat-sanitize.test.ts

@@ -6,7 +6,6 @@ import {
   wrapWithBoundaries,
   sanitizeIncomingMessage,
   PROMPT_BOUNDARIES,
-  type InjectionSeverity,
 } from "./chat-sanitize.js";
 
 describe("stripEnvelopeFromMessage", () => {

src/infra/exec-blocklist.ts

@@ -37,7 +37,7 @@ type BlocklistEntry = {
 const CRITICAL_BLOCKLIST: BlocklistEntry[] = [
   // Destructive filesystem operations
   {
-    pattern: /\brm\s+(-[a-zA-Z]*r[a-zA-Z]*\s+)?(-[a-zA-Z]*f[a-zA-Z]*\s+)?[\/~]\s*$/i,
+    pattern: /\brm\s+(-[a-zA-Z]*r[a-zA-Z]*\s+)?(-[a-zA-Z]*f[a-zA-Z]*\s+)?[/~]\s*$/i,
     description: "rm -rf / (root filesystem deletion)",
     severity: "critical",
     requiresExplicitApproval: true,