From e6f41a4df0051100a99f1dae6a6af2b75ea901ab Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Sun, 21 Jun 2026 13:37:55 +0200
Subject: [PATCH] fix(test): reject loose env report limits

---
 scripts/test-env-mutation-report.ts           | 17 +++++++++----
 test/scripts/test-env-mutation-report.test.ts | 25 +++++++++++++++++++
 2 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/scripts/test-env-mutation-report.ts b/scripts/test-env-mutation-report.ts
index 0f702c215347..9a80ec709e0c 100644
--- a/scripts/test-env-mutation-report.ts
+++ b/scripts/test-env-mutation-report.ts
@@ -397,11 +397,7 @@ function parseArgs(argv: string[]): {
       continue;
     }
     if (arg === "--limit") {
-      const value = Number(argv[index + 1]);
-      if (!Number.isInteger(value) || value < 0) {
-        throw new Error("--limit expects a non-negative integer");
-      }
-      limit = value;
+      limit = readNonNegativeIntArg(argv[index + 1]);
       index += 1;
       continue;
     }
@@ -420,6 +416,17 @@ function parseArgs(argv: string[]): {
   return { help, includeAllowed, json, limit, repoRoot };
 }
 
+function readNonNegativeIntArg(raw: string | undefined): number {
+  if (!raw || raw.startsWith("--") || !/^\d+$/u.test(raw)) {
+    throw new Error("--limit expects a non-negative integer");
+  }
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value)) {
+    throw new Error("--limit expects a non-negative integer");
+  }
+  return value;
+}
+
 function printHelp(): void {
   process.stdout.write(`OpenClaw test env mutation report
 
diff --git a/test/scripts/test-env-mutation-report.test.ts b/test/scripts/test-env-mutation-report.test.ts
index 062c1f8578a7..6da083a72e78 100644
--- a/test/scripts/test-env-mutation-report.test.ts
+++ b/test/scripts/test-env-mutation-report.test.ts
@@ -182,4 +182,29 @@ describe("collectTestEnvMutationReport", () => {
     expect(result.status).toBe(1);
     expect(result.stderr).toContain("--repo-root expects a path");
   });
+
+  it("rejects loose CLI limits before scanning the repository", () => {
+    for (const limit of ["1e3", ""]) {
+      const result = spawnSync(
+        process.execPath,
+        [
+          "--import",
+          "tsx",
+          path.join(process.cwd(), "scripts/test-env-mutation-report.ts"),
+          "--",
+          "--limit",
+          limit,
+          "--repo-root",
+          createTempDir("openclaw-env-limit-"),
+        ],
+        {
+          encoding: "utf8",
+        },
+      );
+
+      expect(result.status).toBe(1);
+      expect(result.stderr).toContain("--limit expects a non-negative integer");
+      expect(result.stdout).not.toContain("Scanned files:");
+    }
+  });
 });