fix(config): reject unknown top-level keys

src/sandbox/sandbox-config.ts

@@ -1140,6 +1140,9 @@ export const SandboxRuntimeConfigSchema = z
         '`safe.directory` without adding them to `filesystem.allowWrite`.',
     ),
   })
+  // Reject unknown top-level keys so misspelled policy settings fail closed
+  // instead of being silently stripped by Zod.
+  .strict()
   .superRefine((cfg, ctx) => {
     const creds = cfg.credentials
     if (!creds) return

test/config-validation.test.ts

@@ -19,6 +19,33 @@ describe('Config Validation', () => {
     expect(result.success).toBe(true)
   })
 
+  test('should reject unknown top-level config keys', () => {
+    const result = SandboxRuntimeConfigSchema.safeParse({
+      network: {
+        allowedDomains: [],
+        deniedDomains: [],
+      },
+      filesystem: {
+        denyRead: [],
+        allowWrite: [],
+        denyWrite: [],
+      },
+      denyWriteTypo: ['/Users/me'],
+    })
+
+    expect(result.success).toBe(false)
+    if (!result.success) {
+      expect(
+        result.error.issues.some(
+          issue =>
+            issue.code === 'unrecognized_keys' &&
+            issue.path.length === 0 &&
+            issue.keys.includes('denyWriteTypo'),
+        ),
+      ).toBe(true)
+    }
+  })
+
   test('should validate a config with valid domains', () => {
     const config = {
       network: {