feat(cli): add --strict-config flag to reject unknown config keys

apps/kimi-code/src/cli/commands.ts

@@ -73,7 +73,8 @@ export function createProgram(
     )
     .addOption(new Option('--yes').hideHelp().default(false))
     .addOption(new Option('--auto-approve').hideHelp().default(false))
-    .option('--plan', 'Start in plan mode.', false);
+    .option('--plan', 'Start in plan mode.', false)
+    .option('--strict-config', 'Reject unknown keys in config.toml.', false);
 
   registerExportCommand(program);
   registerProviderCommand(program);
@@ -119,6 +120,7 @@ export function createProgram(
       outputFormat: raw['outputFormat'] as CLIOptions['outputFormat'],
       prompt: raw['prompt'] as string | undefined,
       skillsDirs: raw['skillsDir'] as string[],
+      strictConfig: raw['strictConfig'] as boolean,
     };
 
     onMain(opts);

apps/kimi-code/src/cli/options.ts

@@ -11,6 +11,7 @@ export interface CLIOptions {
   outputFormat: PromptOutputFormat | undefined;
   prompt: string | undefined;
   skillsDirs: string[];
+  strictConfig: boolean;
 }
 
 export interface ValidatedOptions {

apps/kimi-code/src/cli/run-prompt.ts

@@ -76,6 +76,7 @@ export async function runPrompt(
     uiMode: PROMPT_UI_MODE,
     skillDirs: opts.skillsDirs,
     telemetry: telemetryClient,
+    strictConfig: opts.strictConfig,
     onOAuthRefresh: (outcome) => {
       if (outcome.success) {
         track('oauth_refresh', { success: true });

apps/kimi-code/src/cli/run-shell.ts

@@ -60,6 +60,7 @@ export async function runShell(
     homeDir: telemetryBootstrap.homeDir,
     identity: createKimiCodeHostIdentity(version),
     telemetry: telemetryClient,
+    strictConfig: opts.strictConfig,
     onOAuthRefresh: (outcome) => {
       if (outcome.success) {
         track('oauth_refresh', { success: true });

apps/kimi-code/src/main.ts

@@ -109,6 +109,7 @@ const MIGRATE_CLI_OPTIONS: CLIOptions = {
   yolo: false,
   auto: false,
   plan: false,
+  strictConfig: false,
   model: undefined,
   outputFormat: undefined,
   prompt: undefined,

apps/kimi-code/test/cli/goal-prompt.test.ts

@@ -142,6 +142,7 @@ function opts(overrides: Partial<Parameters<typeof runPrompt>[0]> = {}) {
     yolo: false,
     auto: false,
     plan: false,
+    strictConfig: false,
     model: undefined,
     outputFormat: undefined,
     prompt: '/goal Ship feature X',

apps/kimi-code/test/cli/main.test.ts

@@ -140,6 +140,7 @@ function defaultOpts(): CLIOptions {
     yolo: false,
     auto: false,
     plan: false,
+    strictConfig: false,
     model: undefined,
     outputFormat: undefined,
     prompt: undefined,

apps/kimi-code/test/cli/options.test.ts

@@ -161,6 +161,16 @@ describe('CLI options parsing', () => {
     });
   });
 
+  describe('--strict-config', () => {
+    it('defaults to false', () => {
+      expect(parse([]).strictConfig).toBe(false);
+    });
+
+    it('sets strict config flag', () => {
+      expect(parse(['--strict-config']).strictConfig).toBe(true);
+    });
+  });
+
   describe('--model / -m', () => {
     it('parses -m as a model override', () => {
       expect(parse(['-m', 'kimi-code/k2']).model).toBe('kimi-code/k2');

apps/kimi-code/test/cli/run-prompt.test.ts

@@ -129,6 +129,7 @@ function opts(overrides: Partial<Parameters<typeof runPrompt>[0]> = {}) {
     yolo: false,
     auto: false,
     plan: false,
+    strictConfig: false,
     model: undefined,
     outputFormat: undefined,
     prompt: 'say hello',

apps/kimi-code/test/cli/run-shell.test.ts

@@ -175,6 +175,7 @@ describe('runShell', () => {
       yolo: true,
       auto: false,
       plan: true,
+      strictConfig: false,
       model: undefined,
       outputFormat: undefined,
       prompt: undefined,
@@ -263,6 +264,7 @@ describe('runShell', () => {
         yolo: false,
         auto: false,
         plan: false,
+        strictConfig: false,
         model: undefined,
         outputFormat: undefined,
         prompt: undefined,
@@ -303,6 +305,7 @@ describe('runShell', () => {
         yolo: false,
         auto: false,
         plan: false,
+        strictConfig: false,
         model: undefined,
         outputFormat: undefined,
         prompt: undefined,
@@ -341,6 +344,7 @@ describe('runShell', () => {
         yolo: false,
         auto: false,
         plan: false,
+        strictConfig: false,
         model: undefined,
         outputFormat: undefined,
         prompt: undefined,
@@ -379,6 +383,7 @@ describe('runShell', () => {
         yolo: false,
         auto: false,
         plan: false,
+        strictConfig: false,
         model: undefined,
         outputFormat: undefined,
         prompt: undefined,
@@ -412,6 +417,7 @@ describe('runShell', () => {
         yolo: false,
         auto: false,
         plan: false,
+        strictConfig: false,
         model: undefined,
         outputFormat: undefined,
         prompt: undefined,
@@ -463,6 +469,7 @@ describe('runShell', () => {
         yolo: false,
         auto: false,
         plan: false,
+        strictConfig: false,
         model: undefined,
         outputFormat: undefined,
         prompt: undefined,
@@ -499,6 +506,7 @@ describe('runShell', () => {
           yolo: false,
         auto: false,
           plan: false,
+          strictConfig: false,
           model: undefined,
           outputFormat: undefined,
           prompt: undefined,
@@ -536,6 +544,7 @@ describe('runShell', () => {
           yolo: false,
         auto: false,
           plan: false,
+          strictConfig: false,
           model: undefined,
           outputFormat: undefined,
           prompt: undefined,
@@ -589,6 +598,7 @@ describe('runShell', () => {
           yolo: false,
         auto: false,
           plan: false,
+          strictConfig: false,
           model: undefined,
           outputFormat: undefined,
           prompt: undefined,

apps/kimi-code/test/tui/activity-pane.test.ts

@@ -22,6 +22,7 @@ function makeStartupInput(): KimiTUIStartupInput {
       yolo: false,
       auto: false,
       plan: false,
+      strictConfig: false,
       model: undefined,
       outputFormat: undefined,
       prompt: undefined,

apps/kimi-code/test/tui/kimi-tui-message-flow.test.ts

@@ -95,6 +95,7 @@ function makeStartupInput(): KimiTUIStartupInput {
       yolo: false,
       auto: false,
       plan: false,
+      strictConfig: false,
       model: undefined,
       outputFormat: undefined,
       prompt: undefined,

apps/kimi-code/test/tui/kimi-tui-startup.test.ts

@@ -75,6 +75,7 @@ function makeStartupInput(
       yolo: false,
       auto: false,
       plan: false,
+      strictConfig: false,
       model: undefined,
       outputFormat: undefined,
       prompt: undefined,

apps/kimi-code/test/tui/message-replay.test.ts

@@ -45,6 +45,7 @@ function makeStartupInput(): KimiTUIStartupInput {
       yolo: false,
       auto: false,
       plan: false,
+      strictConfig: false,
       model: undefined,
       outputFormat: undefined,
       prompt: undefined,

apps/kimi-code/test/tui/signal-handlers.test.ts

@@ -18,6 +18,7 @@ function makeStartupInput(): KimiTUIStartupInput {
       yolo: false,
       auto: false,
       plan: false,
+      strictConfig: false,
       model: undefined,
       outputFormat: undefined,
       prompt: undefined,

packages/agent-core/src/config/schema.ts

@@ -128,6 +128,13 @@ export const MoonshotServiceConfigSchema = z.object({
 
 export type MoonshotServiceConfig = z.infer<typeof MoonshotServiceConfigSchema>;
 
+export const ServicesConfigStrictSchema = z.object({
+  moonshotSearch: MoonshotServiceConfigSchema.strict().optional(),
+  moonshotFetch: MoonshotServiceConfigSchema.strict().optional(),
+}).strict();
+
+export type ServicesConfigStrict = z.infer<typeof ServicesConfigStrictSchema>;
+
 export const ServicesConfigSchema = z.object({
   moonshotSearch: MoonshotServiceConfigSchema.optional(),
   moonshotFetch: MoonshotServiceConfigSchema.optional(),
@@ -208,6 +215,18 @@ export const KimiConfigSchema = z.object({
   raw: z.record(z.string(), z.unknown()).optional(),
 });
 
+/**
+ * Strict variant used by `--strict-config`. Rejects unknown keys at the
+ * section level while keeping provider/model aliases open for custom fields.
+ */
+export const KimiConfigStrictSchema = KimiConfigSchema.extend({
+  permission: PermissionConfigSchema.strict().optional(),
+  services: ServicesConfigStrictSchema.optional(),
+  loopControl: LoopControlSchema.strict().optional(),
+  background: BackgroundConfigSchema.strict().optional(),
+  thinking: ThinkingConfigSchema.strict().optional(),
+}).strict();
+
 export type KimiConfig = z.infer<typeof KimiConfigSchema>;
 
 const ProviderConfigPatchSchema = ProviderConfigSchema.partial();

packages/agent-core/src/config/toml.ts

@@ -6,6 +6,7 @@ import { ErrorCodes, KimiError } from '#/errors';
 import { applyEnvModelConfig, stripEnvModelConfig } from './env-model';
 import {
   KimiConfigSchema,
+  KimiConfigStrictSchema,
   formatConfigValidationError,
   getDefaultConfig,
   type BackgroundConfig,
@@ -62,12 +63,19 @@ export async function ensureConfigFile(filePath: string): Promise<void> {
   }
 }
 
-export function readConfigFile(filePath: string): KimiConfig {
+export interface ReadConfigOptions {
+  readonly strict?: boolean;
+}
+
+export function readConfigFile(
+  filePath: string,
+  options: ReadConfigOptions = {},
+): KimiConfig {
   if (!existsSync(filePath)) {
     return getDefaultConfig();
   }
   const text = readFileSync(filePath, 'utf-8');
-  return parseConfigString(text, filePath);
+  return parseConfigString(text, filePath, options);
 }
 
 /**
@@ -79,11 +87,16 @@ export function readConfigFile(filePath: string): KimiConfig {
 export function loadRuntimeConfig(
   filePath: string,
   env: Readonly<Record<string, string | undefined>> = process.env,
+  options: ReadConfigOptions = {},
 ): KimiConfig {
-  return applyEnvModelConfig(readConfigFile(filePath), env);
+  return applyEnvModelConfig(readConfigFile(filePath, options), env);
 }
 
-export function parseConfigString(tomlText: string, filePath = 'config.toml'): KimiConfig {
+export function parseConfigString(
+  tomlText: string,
+  filePath = 'config.toml',
+  options: ReadConfigOptions = {},
+): KimiConfig {
   if (tomlText.trim().length === 0) {
     return getDefaultConfig();
   }
@@ -97,16 +110,21 @@ export function parseConfigString(tomlText: string, filePath = 'config.toml'): K
     });
   }
 
-  return parseConfigData(data, filePath);
+  return parseConfigData(data, filePath, options);
 }
 
-function parseConfigData(data: Record<string, unknown>, filePath: string): KimiConfig {
+function parseConfigData(
+  data: Record<string, unknown>,
+  filePath: string,
+  options: ReadConfigOptions = {},
+): KimiConfig {
   const raw = cloneRecord(data);
   const transformed = transformTomlData(data);
   transformed['raw'] = raw;
 
+  const schema = options.strict ? KimiConfigStrictSchema : KimiConfigSchema;
   try {
-    return KimiConfigSchema.parse(transformed);
+    return schema.parse(transformed);
   } catch (error) {
     throw new KimiError(ErrorCodes.CONFIG_INVALID, `Invalid configuration in ${filePath}: ${formatConfigValidationError(error)}`, {
       cause: error,
@@ -185,7 +203,7 @@ function transformModelData(data: Record<string, unknown>): Record<string, unkno
 
 function transformPermissionData(data: Record<string, unknown>): Record<string, unknown> {
   const raw = transformPlainObject(data);
-  const out: Record<string, unknown> = {};
+  const out: Record<string, unknown> = { ...raw };
 
   const rules: unknown[] = [];
   appendPermissionRules(rules, raw['rules']);

packages/agent-core/src/rpc/core-impl.ts

@@ -117,6 +117,7 @@ export interface KimiCoreOptions {
   readonly skillDirs?: readonly string[];
   readonly telemetry?: TelemetryClient | undefined;
   readonly appVersion?: string;
+  readonly strictConfig?: boolean;
 }
 
 export class KimiCore implements PromisableMethods<CoreAPI> {
@@ -140,6 +141,7 @@ export class KimiCore implements PromisableMethods<CoreAPI> {
   private pluginsLoadError: Error | undefined;
   private readonly appVersion: string | undefined;
   private readonly experimentalFlags: FlagResolver;
+  private readonly strictConfig: boolean;
 
   constructor(
     protected readonly rpcClient: CoreRPCClient,
@@ -158,8 +160,11 @@ export class KimiCore implements PromisableMethods<CoreAPI> {
     this.skillDirs = options.skillDirs ?? [];
     this.telemetry = options.telemetry ?? noopTelemetryClient;
     this.appVersion = options.appVersion;
+    this.strictConfig = options.strictConfig ?? false;
     ensureKimiHome(this.homeDir);
-    this.config = loadRuntimeConfig(this.configPath);
+    this.config = loadRuntimeConfig(this.configPath, process.env, {
+      strict: this.strictConfig,
+    });
     this.experimentalFlags = new FlagResolver(
       process.env,
       FLAG_DEFINITIONS,
@@ -447,15 +452,15 @@ export class KimiCore implements PromisableMethods<CoreAPI> {
 
   async getKimiConfig(input?: GetKimiConfigPayload): Promise<KimiConfig> {
     if (input?.reload) {
-      this.setRuntimeConfig(loadRuntimeConfig(this.configPath));
+      this.setRuntimeConfig(loadRuntimeConfig(this.configPath, process.env, { strict: this.strictConfig }));
     }
     return this.config;
   }
 
   async setKimiConfig(input: SetKimiConfigPayload): Promise<KimiConfig> {
     const config = mergeConfigPatch(readConfigFile(this.configPath), input);
     await writeConfigFile(this.configPath, config);
-    return this.setRuntimeConfig(loadRuntimeConfig(this.configPath));
+    return this.setRuntimeConfig(loadRuntimeConfig(this.configPath, process.env, { strict: this.strictConfig }));
   }
 
   async removeKimiProvider(input: RemoveKimiProviderPayload): Promise<KimiConfig> {
@@ -486,7 +491,7 @@ export class KimiCore implements PromisableMethods<CoreAPI> {
     }
 
     await writeConfigFile(this.configPath, config);
-    return this.setRuntimeConfig(loadRuntimeConfig(this.configPath));
+    return this.setRuntimeConfig(loadRuntimeConfig(this.configPath, process.env, { strict: this.strictConfig }));
   }
 
   prompt({ sessionId, ...payload }: SessionAgentPayload<PromptPayload>) {
@@ -860,7 +865,7 @@ export class KimiCore implements PromisableMethods<CoreAPI> {
   }
 
   private reloadProviderManager(): KimiConfig {
-    return this.setRuntimeConfig(loadRuntimeConfig(this.configPath));
+    return this.setRuntimeConfig(loadRuntimeConfig(this.configPath, process.env, { strict: this.strictConfig }));
   }
 
   private setRuntimeConfig(config: KimiConfig): KimiConfig {