From b2c58f634e98cb57ef3dfedb2169e96dfdf28093 Mon Sep 17 00:00:00 2001
From: aiirvizionz <david.lopezhuerta01@gmail.com>
Date: Sat, 1 Aug 2026 15:32:57 -0600
Subject: [PATCH] fix(discord): validate integer env values strictly

---
 packages/bots/discord/src/index.test.ts | 13 +++++++++++++
 packages/bots/discord/src/index.ts      |  4 ++--
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/packages/bots/discord/src/index.test.ts b/packages/bots/discord/src/index.test.ts
index 0d605652..08ff37e9 100644
--- a/packages/bots/discord/src/index.test.ts
+++ b/packages/bots/discord/src/index.test.ts
@@ -17,4 +17,17 @@ describe('loadConfig', () => {
     expect(config.maxOutputLength).toBe(2000);
     expect(config.maxConcurrentSessions).toBe(5);
   });
+
+  it.each(['1e3', '0x10', ' 10 ', '+10', '10.5', '9007199254740992'])('rejects non-decimal integer env value %s', (value) => {
+    const config = loadConfig({
+      DISCORD_BOT_TOKEN: 'discord-token',
+      SESSION_TIMEOUT_MS: value,
+      MAX_OUTPUT_LENGTH: value,
+      MAX_CONCURRENT_SESSIONS: value,
+    });
+
+    expect(config.sessionTimeoutMs).toBe(1800000);
+    expect(config.maxOutputLength).toBe(2000);
+    expect(config.maxConcurrentSessions).toBe(5);
+  });
 });
diff --git a/packages/bots/discord/src/index.ts b/packages/bots/discord/src/index.ts
index df014a77..a3a3b809 100644
--- a/packages/bots/discord/src/index.ts
+++ b/packages/bots/discord/src/index.ts
@@ -164,9 +164,9 @@ export function loadConfig(env: Record<string, string | undefined>): Config {
 }
 
 function parsePositiveIntegerEnv(value: string | undefined, fallback: number): number {
-  if (!value) return fallback;
+  if (!value || !/^\d+$/.test(value)) return fallback;
   const parsed = Number(value);
-  return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+  return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : fallback;
 }
 
 interface SendableChannel {