fix(browser): reject unknown Electron input fields

src/domain/electronObservation.ts

@@ -25,7 +25,7 @@ const approvedElectronInput = {
 };
 
 /** Input for listing root-confined file:// page targets from Electron CDP. */
-export const listElectronTargetsInputSchema = z.object({
+export const listElectronTargetsInputSchema = z.strictObject({
   ...approvedElectronInput,
 });
 export type ListElectronTargetsInput = z.infer<
@@ -38,7 +38,7 @@ const inspectElectronPageFacts = {
   target_id: z.string().trim().min(1).max(256),
   observation_ms: z.number().int().min(0).max(10_000).default(100),
   limits: z
-    .object({
+    .strictObject({
       max_frames: z.number().int().min(1).max(1_000).default(200),
       max_dom_nodes: z.number().int().min(1).max(10_000).default(2_000),
       max_scripts: z.number().int().min(1).max(2_000).default(500),
@@ -69,11 +69,11 @@ const inspectElectronPageFacts = {
 } as const;
 export const inspectElectronPageInputSchema = z
   .union([
-    z.object({
+    z.strictObject({
       ...inspectElectronPageFacts,
       include_script_sources: z.literal(false).default(false),
     }),
-    z.object({
+    z.strictObject({
       ...inspectElectronPageFacts,
       include_script_sources: z.literal(true),
     }),

tests/boundary/browser/cdpElectronProvider.test.ts

@@ -179,6 +179,26 @@ describe("CdpElectronProvider target access", () => {
   });
 });
 
+describe("Electron request schemas", () => {
+  it("rejects unknown fields and misspelled inspection limits", () => {
+    expect(
+      listElectronTargetsInputSchema.safeParse({
+        cdp_endpoint: "http://127.0.0.1:9223",
+        allowed_file_roots: ["/tmp/app"],
+        allowed_file_root: "/tmp/app",
+      }).success,
+    ).toBe(false);
+    expect(
+      inspectElectronPageInputSchema.safeParse({
+        cdp_endpoint: "http://127.0.0.1:9223",
+        allowed_file_roots: ["/tmp/app"],
+        target_id: "page-1",
+        limits: { max_dom_nodes: 20, max_dom_node: 20 },
+      }).success,
+    ).toBe(false);
+  });
+});
+
 describe("CdpElectronProvider capture", () => {
   it("captures Electron script source only after separate approval", async () => {
     const root = await electronFixture();