From b5c252df0c285f6460fe55a5719d993dd723ea84 Mon Sep 17 00:00:00 2001
From: aiirvizionz <david.lopezhuerta01@gmail.com>
Date: Sun, 12 Jul 2026 16:35:56 -0600
Subject: [PATCH] Reject non-decimal run max values

---
 bin/moshcode.mjs          | 3 +++
 test/run-options.test.mjs | 9 +++++++++
 2 files changed, 12 insertions(+)

diff --git a/bin/moshcode.mjs b/bin/moshcode.mjs
index 07c57cb..4cff777 100755
--- a/bin/moshcode.mjs
+++ b/bin/moshcode.mjs
@@ -28,6 +28,9 @@ function readScript(arg) {
 
 function parseMax(value) {
   if (value === undefined) throw new Error("moshcode run: --max requires a positive integer");
+  if (!/^\d+$/.test(value)) {
+    throw new Error(`moshcode run: --max must be a positive integer, got ${JSON.stringify(value)}`);
+  }
   const max = Number(value);
   if (!Number.isInteger(max) || max < 1) {
     throw new Error(`moshcode run: --max must be a positive integer, got ${JSON.stringify(value)}`);
diff --git a/test/run-options.test.mjs b/test/run-options.test.mjs
index 43ac876..03cf92d 100644
--- a/test/run-options.test.mjs
+++ b/test/run-options.test.mjs
@@ -33,3 +33,12 @@ test("run rejects multiple script files", () => {
   assert.equal(result.status, 1);
   assert.match(result.stderr, /moshcode run: expected one script file/);
 });
+
+test("run rejects non-decimal max values", () => {
+  for (const value of ["0x10", "1e2", "3.5"]) {
+    const result = run(["--max", value, "--dry-run"]);
+
+    assert.equal(result.status, 1);
+    assert.match(result.stderr, /moshcode run: --max must be a positive integer/);
+  }
+});