From e0d41ce74fe26020bfb47ae4bd2c4fd2980eddc7 Mon Sep 17 00:00:00 2001
From: canvrno-oai <kbond@openai.com>
Date: Wed, 27 May 2026 19:29:27 +0000
Subject: [PATCH] Align network config schema strictness

---
 codex-rs/config/src/types.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/codex-rs/config/src/types.rs b/codex-rs/config/src/types.rs
index c76a13a66b..4b9df5d1f7 100644
--- a/codex-rs/config/src/types.rs
+++ b/codex-rs/config/src/types.rs
@@ -101,6 +101,7 @@ impl fmt::Display for NetworkProxyMode {
 /// `http://proxy.example:8080`). It is deliberately not a PAC/WPAD URL, and
 /// callers must redact credentials before logging it.
 #[derive(Serialize, Deserialize, Default, Clone, PartialEq, Eq, JsonSchema)]
+#[schemars(deny_unknown_fields)]
 pub struct NetworkConfigToml {
     /// Proxy selection mode. Defaults to `auto` when omitted.
     #[serde(default)]