fix: reject non-decimal numeric config values

CHANGELOG.md

@@ -13,6 +13,7 @@
 
 ### Fixed
 
+- Reject exponent, hexadecimal, and signed syntax in non-negative integer environment settings instead of interpreting them as decimal configuration values.
 - Preserve embed titles, descriptions, and URLs in live MCP `read-messages` results.
 - Prevent `!guild` server-memory responses from triggering Discord mentions from stored memory or server names.
 - Verify recent, legacy, and full-text-search history reads before assembling model context; reject symbolic-link files and replaced storage directories.

src/config.ts

@@ -165,9 +165,12 @@ function parseNonNegativeInteger(
     fallback: number,
     maximum = Number.MAX_SAFE_INTEGER,
 ): number {
-    if (value === undefined || value.trim() === "") return fallback;
+    if (value === undefined) return fallback;
 
-    const parsed = Number(value);
+    const normalized = value.trim();
+    if (!/^\d+$/.test(normalized)) return fallback;
+
+    const parsed = Number(normalized);
     return Number.isSafeInteger(parsed) && parsed >= 0 && parsed <= maximum
         ? parsed
         : fallback;

tests/configLimits.test.mjs

@@ -146,6 +146,16 @@ test("context limits fall back for malformed values", () => {
     );
 });
 
+test("context limits reject non-decimal integer syntax", () => {
+    assert.deepEqual(
+        readConfigValues(
+            ["LIVE_CONTEXT_LIMIT", "DEEP_LIVE_CONTEXT_LIMIT", "HISTORY_RECENT_LINES"],
+            ["1e2", "0x10", "+5"],
+        ),
+        [35, 500, 80],
+    );
+});
+
 test("context limits preserve valid integers including zero", () => {
     assert.deepEqual(readLimits(["0", "1", "2", "3", "4", "5", "6", "12345"]), [
         0,