From 47f13da5356db8e25cdaf81991f738ff0be288f7 Mon Sep 17 00:00:00 2001
From: aiirvizionz <david.lopezhuerta01@gmail.com>
Date: Tue, 28 Jul 2026 22:31:50 -0600
Subject: [PATCH] Guard Discord bot integer env config

---
 packages/bots/discord/src/index.test.ts | 18 +++++++++++++++++-
 packages/bots/discord/src/index.ts      | 12 +++++++++---
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/packages/bots/discord/src/index.test.ts b/packages/bots/discord/src/index.test.ts
index 947d47ea..0d605652 100644
--- a/packages/bots/discord/src/index.test.ts
+++ b/packages/bots/discord/src/index.test.ts
@@ -1,4 +1,20 @@
+import { describe, expect, it } from 'vitest';
 import { contractTestBot } from '@profullstack/sh1pt-core/testing';
-import bot from './index.js';
+import bot, { loadConfig } from './index.js';
 
 contractTestBot(bot, { sampleConfig: {}, sampleChannel: '1234567890' });
+
+describe('loadConfig', () => {
+  it('uses safe defaults for invalid positive integer env values', () => {
+    const config = loadConfig({
+      DISCORD_BOT_TOKEN: 'discord-token',
+      SESSION_TIMEOUT_MS: 'not-a-number',
+      MAX_OUTPUT_LENGTH: '0',
+      MAX_CONCURRENT_SESSIONS: '-2',
+    });
+
+    expect(config.sessionTimeoutMs).toBe(1800000);
+    expect(config.maxOutputLength).toBe(2000);
+    expect(config.maxConcurrentSessions).toBe(5);
+  });
+});
diff --git a/packages/bots/discord/src/index.ts b/packages/bots/discord/src/index.ts
index db57ebb6..df014a77 100644
--- a/packages/bots/discord/src/index.ts
+++ b/packages/bots/discord/src/index.ts
@@ -154,15 +154,21 @@ export function loadConfig(env: Record<string, string | undefined>): Config {
     aiProvider: (env.AI_PROVIDER as any) || "claude-code",
     aiCliPath: env.AI_CLI_PATH || "claude",
     aiModel: env.AI_MODEL,
-    sessionTimeoutMs: parseInt(env.SESSION_TIMEOUT_MS || "1800000", 10),
-    maxOutputLength: parseInt(env.MAX_OUTPUT_LENGTH || "2000", 10),
-    maxConcurrentSessions: parseInt(env.MAX_CONCURRENT_SESSIONS || "5", 10),
+    sessionTimeoutMs: parsePositiveIntegerEnv(env.SESSION_TIMEOUT_MS, 1800000),
+    maxOutputLength: parsePositiveIntegerEnv(env.MAX_OUTPUT_LENGTH, 2000),
+    maxConcurrentSessions: parsePositiveIntegerEnv(env.MAX_CONCURRENT_SESSIONS, 5),
     allowedUsers: env.ALLOWED_USERS?.split(",").map((u) => u.trim()).filter(Boolean) || [],
     allowedChannels: env.ALLOWED_CHANNELS?.split(",").map((c) => c.trim()).filter(Boolean),
     adminUsers: env.ADMIN_USERS?.split(",").map((u) => u.trim()).filter(Boolean) || [],
   });
 }
 
+function parsePositiveIntegerEnv(value: string | undefined, fallback: number): number {
+  if (!value) return fallback;
+  const parsed = Number(value);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+
 interface SendableChannel {
   send(message: string): Promise<unknown>;
   sendTyping?: () => Promise<unknown>;