fix: address review feedback and code scanning alerts

src/web/pages/helpers/accountConnection.test.ts

@@ -10,6 +10,11 @@ describe('accountConnection helpers', () => {
     expect(resolveAccountCredentialMode({ credentialMode: 'apikey' })).toBe('apikey');
     expect(resolveAccountCredentialMode({ capabilities: { proxyOnly: true } })).toBe('apikey');
     expect(resolveAccountCredentialMode({ accessToken: ' session-token ' })).toBe('session');
+    expect(resolveAccountCredentialMode({
+      credentialMode: 'session',
+      capabilities: { proxyOnly: true },
+      accessToken: 'api-token-ignored-by-explicit-mode',
+    })).toBe('session');
     expect(resolveAccountCredentialMode({})).toBe('apikey');
   });
 
@@ -17,6 +22,9 @@ describe('accountConnection helpers', () => {
     expect(parsePositiveInt('42')).toBe(42);
     expect(parsePositiveInt(' 0 ')).toBe(0);
     expect(parsePositiveInt('abc')).toBe(0);
+    expect(parsePositiveInt('42abc')).toBe(0);
+    expect(parsePositiveInt('1e3')).toBe(0);
+    expect(parsePositiveInt('1.5')).toBe(0);
     expect(parsePositiveInt(null)).toBe(0);
   });
 

src/web/pages/helpers/accountConnection.ts

@@ -11,7 +11,9 @@ export function resolveAccountCredentialMode(account: any): 'session' | 'apikey'
 }
 
 export function parsePositiveInt(input: string | null): number {
-  const value = Number.parseInt(String(input || '').trim(), 10);
+  const normalized = String(input || '').trim();
+  if (!/^\d+$/.test(normalized)) return 0;
+  const value = Number.parseInt(normalized, 10);
   if (!Number.isFinite(value) || value <= 0) return 0;
   return value;
 }

src/web/pages/helpers/conversationFileCapabilities.test.ts

@@ -75,5 +75,9 @@ describe('resolveConversationFileCapability', () => {
       filename: 'voice.mp3',
       mimeType: 'audio/mpeg',
     })).toBe(false);
+    expect(isConversationUploadedFileSupported(claudeCapability, {
+      filename: 'paper.pdf',
+      mimeType: 'application/octet-stream',
+    })).toBe(true);
   });
 });