diff --git a/extensions/irc/src/setup-surface.ts b/extensions/irc/src/setup-surface.ts
index fdfcab8c4468..abce7f2f9b83 100644
--- a/extensions/irc/src/setup-surface.ts
+++ b/extensions/irc/src/setup-surface.ts
@@ -272,7 +272,7 @@ export const ircSetupWizard: ChannelSetupWizard = {
       },
       validate: ({ value }) => {
         const raw = normalizeStringifiedOptionalString(value) ?? "";
-        const parsed = /^\+?\d+$/.test(raw.trim()) ? Number(raw.trim()) : NaN;
+        const parsed = /^\+?\d+$/.test(raw.trim()) ? Number(raw.trim()) : Number.NaN;
         return Number.isSafeInteger(parsed) && parsed >= 1 && parsed <= 65535
           ? undefined
           : "Use a port between 1 and 65535";
diff --git a/extensions/policy/src/cli.ts b/extensions/policy/src/cli.ts
index 9007deee63f3..3fd42bfeb121 100644
--- a/extensions/policy/src/cli.ts
+++ b/extensions/policy/src/cli.ts
@@ -313,7 +313,11 @@ function normalizeWatchIntervalMs(value: string | number | undefined): number {
     return 2000;
   }
   const raw =
-    typeof value === "number" ? value : /^\+?\d+$/.test(value.trim()) ? Number(value.trim()) : NaN;
+    typeof value === "number"
+      ? value
+      : /^\+?\d+$/.test(value.trim())
+        ? Number(value.trim())
+        : Number.NaN;
   if (!Number.isSafeInteger(raw) || raw < 250) {
     throw new Error("--interval-ms must be an integer >= 250.");
   }
diff --git a/src/agents/tools/image-tool.test.ts b/src/agents/tools/image-tool.test.ts
index 1bee808210ff..ff11eb2f625f 100644
--- a/src/agents/tools/image-tool.test.ts
+++ b/src/agents/tools/image-tool.test.ts
@@ -598,10 +598,14 @@ function installFastLocalImageProviderStubs(...providers: MediaUnderstandingProv
     }),
     loadImageWebMediaRuntime: async () => ({
       loadWebMedia: async (mediaUrl, options) => {
+        const inboundRoots =
+          options && typeof options === "object" && "inboundRoots" in options
+            ? options.inboundRoots
+            : [];
         if (
           !isInboundPathAllowed({
             filePath: mediaUrl,
-            roots: options?.inboundRoots ?? [],
+            roots: inboundRoots ?? [],
           })
         ) {
           throw new Error(`Local media path is not under an allowed directory: ${mediaUrl}`);