fix(test): reject loose env report limits

scripts/test-env-mutation-report.ts

@@ -397,11 +397,7 @@ function parseArgs(argv: string[]): {
       continue;
     }
     if (arg === "--limit") {
-      const value = Number(argv[index + 1]);
-      if (!Number.isInteger(value) || value < 0) {
-        throw new Error("--limit expects a non-negative integer");
-      }
-      limit = value;
+      limit = readNonNegativeIntArg(argv[index + 1]);
       index += 1;
       continue;
     }
@@ -420,6 +416,17 @@ function parseArgs(argv: string[]): {
   return { help, includeAllowed, json, limit, repoRoot };
 }
 
+function readNonNegativeIntArg(raw: string | undefined): number {
+  if (!raw || raw.startsWith("--") || !/^\d+$/u.test(raw)) {
+    throw new Error("--limit expects a non-negative integer");
+  }
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value)) {
+    throw new Error("--limit expects a non-negative integer");
+  }
+  return value;
+}
+
 function printHelp(): void {
   process.stdout.write(`OpenClaw test env mutation report
 

test/scripts/test-env-mutation-report.test.ts

@@ -182,4 +182,29 @@ describe("collectTestEnvMutationReport", () => {
     expect(result.status).toBe(1);
     expect(result.stderr).toContain("--repo-root expects a path");
   });
+
+  it("rejects loose CLI limits before scanning the repository", () => {
+    for (const limit of ["1e3", ""]) {
+      const result = spawnSync(
+        process.execPath,
+        [
+          "--import",
+          "tsx",
+          path.join(process.cwd(), "scripts/test-env-mutation-report.ts"),
+          "--",
+          "--limit",
+          limit,
+          "--repo-root",
+          createTempDir("openclaw-env-limit-"),
+        ],
+        {
+          encoding: "utf8",
+        },
+      );
+
+      expect(result.status).toBe(1);
+      expect(result.stderr).toContain("--limit expects a non-negative integer");
+      expect(result.stdout).not.toContain("Scanned files:");
+    }
+  });
 });