SandboxRuntimeConfigSchema in sandbox-config.js is not .strict() at the top level. A settings file containing "denyWriteTypo": ["/Users/me"] and "allowEverything": true loads without warning and the command runs (srt 0.0.67, macOS 26.5.2, Node v22.23.1). The boundary itself still enforces correctly, so this is not an escape – but the failure is silent. An operator who mistypes a key in filesystem.denyWrite gets a policy that appears to apply and protects nothing.
Sub-schemas already reject unknown keys (the credentials.injectHosts comment at sandbox-config.js:559 describes exactly this reasoning); the top level does not.
Suggested fix: .strict() on the top-level object, or a stderr warning naming each unrecognised key.
SandboxRuntimeConfigSchemainsandbox-config.jsis not.strict()at the top level. A settings file containing"denyWriteTypo": ["/Users/me"]and"allowEverything": trueloads without warning and the command runs (srt 0.0.67, macOS 26.5.2, Node v22.23.1). The boundary itself still enforces correctly, so this is not an escape – but the failure is silent. An operator who mistypes a key infilesystem.denyWritegets a policy that appears to apply and protects nothing.Sub-schemas already reject unknown keys (the
credentials.injectHostscomment atsandbox-config.js:559describes exactly this reasoning); the top level does not.Suggested fix:
.strict()on the top-level object, or a stderr warning naming each unrecognised key.