diff --git a/src/cli/crud.ts b/src/cli/crud.ts
index 370b9ad..af1371f 100644
--- a/src/cli/crud.ts
+++ b/src/cli/crud.ts
@@ -99,9 +99,7 @@ function genericGet(def: ResourceDef) {
   return async (args: Record<string, unknown>) => {
     const id = args.id as string;
     if (!id) throw new Error(`${def.name} id is required`);
-    const row = getDb()
-      .prepare(`SELECT ${cols} FROM ${def.table} WHERE ${def.idColumn} = ?`)
-      .get(id);
+    const row = getDb().prepare(`SELECT ${cols} FROM ${def.table} WHERE ${def.idColumn} = ?`).get(id);
     if (!row) throw new Error(`${def.name} not found: ${id}`);
     return row;
   };
@@ -160,7 +158,9 @@ function genericUpdate(def: ResourceDef) {
       }
     }
     if (Object.keys(updates).length === 0) {
-      throw new Error(`nothing to update — provide at least one of: ${updatableCols.map((c) => '--' + c.name.replace(/_/g, '-')).join(', ')}`);
+      throw new Error(
+        `nothing to update — provide at least one of: ${updatableCols.map((c) => '--' + c.name.replace(/_/g, '-')).join(', ')}`,
+      );
     }
 
     const setClause = Object.keys(updates)
@@ -172,9 +172,7 @@ function genericUpdate(def: ResourceDef) {
     if (result.changes === 0) throw new Error(`${def.name} not found: ${id}`);
 
     const cols = visibleColumns(def).join(', ');
-    return getDb()
-      .prepare(`SELECT ${cols} FROM ${def.table} WHERE ${def.idColumn} = ?`)
-      .get(id);
+    return getDb().prepare(`SELECT ${cols} FROM ${def.table} WHERE ${def.idColumn} = ?`).get(id);
   };
 }
 
@@ -182,9 +180,7 @@ function genericDelete(def: ResourceDef) {
   return async (args: Record<string, unknown>) => {
     const id = args.id as string;
     if (!id) throw new Error(`${def.name} id is required`);
-    const result = getDb()
-      .prepare(`DELETE FROM ${def.table} WHERE ${def.idColumn} = ?`)
-      .run(id);
+    const result = getDb().prepare(`DELETE FROM ${def.table} WHERE ${def.idColumn} = ?`).run(id);
     if (result.changes === 0) throw new Error(`${def.name} not found: ${id}`);
     return { deleted: id };
   };
diff --git a/src/cli/dispatch.ts b/src/cli/dispatch.ts
index a9943c4..f4c8987 100644
--- a/src/cli/dispatch.ts
+++ b/src/cli/dispatch.ts
@@ -18,11 +18,7 @@ export async function dispatch(req: RequestFrame, ctx: CallerContext): Promise<R
   // Agent + approval-gated → approval flow. Wired alongside the first
   // approval-requiring command; until then, return a clear error.
   if (ctx.caller !== 'host' && cmd.access === 'approval') {
-    return err(
-      req.id,
-      'approval-pending',
-      'This command requires approval. (Approval flow not yet wired.)',
-    );
+    return err(req.id, 'approval-pending', 'This command requires approval. (Approval flow not yet wired.)');
   }
 
   let parsed: unknown;
diff --git a/src/cli/resources/approvals.ts b/src/cli/resources/approvals.ts
index a5310a4..c67f4bc 100644
--- a/src/cli/resources/approvals.ts
+++ b/src/cli/resources/approvals.ts
@@ -8,20 +8,37 @@ registerResource({
     'Pending approval — in-flight approval cards waiting for an admin response. Created by requestApproval() (self-mod install_packages/add_mcp_server) and OneCLI credential approval flow. Rows are deleted after the admin approves/rejects or the request expires.',
   idColumn: 'approval_id',
   columns: [
-    { name: 'approval_id', type: 'string', description: 'Unique approval identifier (also used as the card questionId).' },
-    { name: 'session_id', type: 'string', description: 'Session that requested the approval. Null for OneCLI credential approvals.' },
-    { name: 'request_id', type: 'string', description: 'Original request identifier (OneCLI request UUID or same as approval_id).' },
+    {
+      name: 'approval_id',
+      type: 'string',
+      description: 'Unique approval identifier (also used as the card questionId).',
+    },
+    {
+      name: 'session_id',
+      type: 'string',
+      description: 'Session that requested the approval. Null for OneCLI credential approvals.',
+    },
+    {
+      name: 'request_id',
+      type: 'string',
+      description: 'Original request identifier (OneCLI request UUID or same as approval_id).',
+    },
     {
       name: 'action',
       type: 'string',
-      description: 'Action type — matches the registered approval handler (e.g. install_packages, add_mcp_server, onecli_credential).',
+      description:
+        'Action type — matches the registered approval handler (e.g. install_packages, add_mcp_server, onecli_credential).',
     },
     { name: 'payload', type: 'json', description: 'JSON payload carried through to the approval handler.' },
     { name: 'created_at', type: 'string', description: 'Auto-set.' },
     { name: 'agent_group_id', type: 'string', description: 'Originating agent group.' },
     { name: 'channel_type', type: 'string', description: 'Channel the approval card was delivered on.' },
     { name: 'platform_id', type: 'string', description: 'Platform chat ID the card was delivered to.' },
-    { name: 'platform_message_id', type: 'string', description: 'Platform message ID of the delivered card (for editing on expiry).' },
+    {
+      name: 'platform_message_id',
+      type: 'string',
+      description: 'Platform message ID of the delivered card (for editing on expiry).',
+    },
     { name: 'expires_at', type: 'string', description: 'When this approval expires (OneCLI gateway TTL).' },
     {
       name: 'status',
diff --git a/src/cli/resources/destinations.ts b/src/cli/resources/destinations.ts
index ea67035..4a56029 100644
--- a/src/cli/resources/destinations.ts
+++ b/src/cli/resources/destinations.ts
@@ -29,7 +29,7 @@ registerResource({
     {
       name: 'target_id',
       type: 'string',
-      description: 'The target\'s ID — messaging_groups.id for channels, agent_groups.id for agents.',
+      description: "The target's ID — messaging_groups.id for channels, agent_groups.id for agents.",
     },
     { name: 'created_at', type: 'string', description: 'Auto-set.' },
   ],
diff --git a/src/cli/resources/dropped-messages.ts b/src/cli/resources/dropped-messages.ts
index 3404fc2..88bdf26 100644
--- a/src/cli/resources/dropped-messages.ts
+++ b/src/cli/resources/dropped-messages.ts
@@ -5,7 +5,7 @@ registerResource({
   plural: 'dropped-messages',
   table: 'unregistered_senders',
   description:
-    'Dropped message log — tracks messages that were dropped by the router or access gate. Aggregates by (channel_type, platform_id) with a running count. Reasons include: no_agent_wired (no wiring exists), no_agent_engaged (wiring exists but engage rules didn\'t fire), unknown_sender_strict (sender not recognized, strict policy), unknown_sender_request_approval (sender not recognized, approval requested).',
+    "Dropped message log — tracks messages that were dropped by the router or access gate. Aggregates by (channel_type, platform_id) with a running count. Reasons include: no_agent_wired (no wiring exists), no_agent_engaged (wiring exists but engage rules didn't fire), unknown_sender_strict (sender not recognized, strict policy), unknown_sender_request_approval (sender not recognized, approval requested).",
   idColumn: 'channel_type',
   columns: [
     { name: 'channel_type', type: 'string', description: 'Channel adapter type of the dropped message.' },
diff --git a/src/cli/resources/groups.ts b/src/cli/resources/groups.ts
index 5181bee..e334fc1 100644
--- a/src/cli/resources/groups.ts
+++ b/src/cli/resources/groups.ts
@@ -26,7 +26,8 @@ registerResource({
     {
       name: 'agent_provider',
       type: 'string',
-      description: 'LLM provider. Null means the default (claude). Skill-installed providers (e.g. opencode) register via /add-<provider>.',
+      description:
+        'LLM provider. Null means the default (claude). Skill-installed providers (e.g. opencode) register via /add-<provider>.',
       updatable: true,
       default: null,
     },
diff --git a/src/cli/resources/roles.ts b/src/cli/resources/roles.ts
index 4e0a20b..9d51815 100644
--- a/src/cli/resources/roles.ts
+++ b/src/cli/resources/roles.ts
@@ -19,7 +19,8 @@ registerResource({
     {
       name: 'agent_group_id',
       type: 'string',
-      description: 'Null = global (all groups). A specific ID limits the role to that group. Owner must always be null.',
+      description:
+        'Null = global (all groups). A specific ID limits the role to that group. Owner must always be null.',
     },
     { name: 'granted_by', type: 'string', description: 'Who granted this role. Informational.' },
     { name: 'granted_at', type: 'string', description: 'Auto-set.' },
diff --git a/src/cli/resources/user-dms.ts b/src/cli/resources/user-dms.ts
index 8b7b1cd..50b2763 100644
--- a/src/cli/resources/user-dms.ts
+++ b/src/cli/resources/user-dms.ts
@@ -5,7 +5,7 @@ registerResource({
   plural: 'user-dms',
   table: 'user_dms',
   description:
-    'User DM cache — maps (user, channel_type) to the messaging group used for DM delivery. Populated lazily by ensureUserDm() when the host needs to cold-DM a user (approvals, pairing). For direct-addressable channels (Telegram, WhatsApp) the handle IS the DM chat ID. For resolution-required channels (Discord, Slack) the adapter\'s openDM resolves it.',
+    "User DM cache — maps (user, channel_type) to the messaging group used for DM delivery. Populated lazily by ensureUserDm() when the host needs to cold-DM a user (approvals, pairing). For direct-addressable channels (Telegram, WhatsApp) the handle IS the DM chat ID. For resolution-required channels (Discord, Slack) the adapter's openDM resolves it.",
   idColumn: 'user_id',
   columns: [
     { name: 'user_id', type: 'string', description: 'User this DM route is for.' },
diff --git a/src/cli/resources/users.ts b/src/cli/resources/users.ts
index 5cd003e..0c4fd56 100644
--- a/src/cli/resources/users.ts
+++ b/src/cli/resources/users.ts
@@ -11,7 +11,8 @@ registerResource({
     {
       name: 'id',
       type: 'string',
-      description: 'Namespaced "channel_type:handle" — e.g. "tg:6037840640", "discord:123456789", "email:user@example.com". Must be provided on create.',
+      description:
+        'Namespaced "channel_type:handle" — e.g. "tg:6037840640", "discord:123456789", "email:user@example.com". Must be provided on create.',
       required: true,
     },
     {
@@ -24,7 +25,8 @@ registerResource({
     {
       name: 'display_name',
       type: 'string',
-      description: 'Human-readable name. Shown in approval cards and logs. Often auto-populated from the channel adapter.',
+      description:
+        'Human-readable name. Shown in approval cards and logs. Often auto-populated from the channel adapter.',
       updatable: true,
     },
     { name: 'created_at', type: 'string', description: 'Auto-set.', generated: true },