Disallow unknown fields

Signed-off-by: David Gageot <david.gageot@docker.com>

Author: dgageot

pkg/session/session.go

@@ -1,6 +1,8 @@
 package session
 
 import (
+	"bytes"
+	"encoding/json"
 	"log/slog"
 	"os"
 	"slices"
@@ -217,6 +219,21 @@ type EvalCriteria struct {
 	Setup      string   `json:"setup,omitempty"`       // Optional sh script to run in the container before docker agent run --exec
 }
 
+// UnmarshalJSON implements custom JSON unmarshaling for EvalCriteria that
+// rejects unknown fields. This ensures eval JSON files don't contain typos
+// or unsupported fields that would be silently ignored.
+func (e *EvalCriteria) UnmarshalJSON(data []byte) error {
+	type evalCriteria EvalCriteria // alias to avoid infinite recursion
+	var v evalCriteria
+	dec := json.NewDecoder(bytes.NewReader(data))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&v); err != nil {
+		return err
+	}
+	*e = EvalCriteria(v)
+	return nil
+}
+
 // deepCopyMessage returns a deep copy of a session Message.
 // It copies the inner chat.Message's slice and pointer fields so that the
 // returned value shares no mutable state with the original.

pkg/session/session_test.go

@@ -1,6 +1,7 @@
 package session
 
 import (
+	"encoding/json"
 	"strings"
 	"testing"
 
@@ -292,6 +293,52 @@ func TestGetLastUserMessages(t *testing.T) {
 	})
 }
 
+func TestEvalCriteriaUnmarshalJSON(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		input   string
+		want    EvalCriteria
+		wantErr bool
+	}{
+		{
+			name:  "valid fields",
+			input: `{"relevance":["is correct"],"size":"M","setup":"echo hello","working_dir":"mydir"}`,
+			want: EvalCriteria{
+				Relevance:  []string{"is correct"},
+				Size:       "M",
+				Setup:      "echo hello",
+				WorkingDir: "mydir",
+			},
+		},
+		{
+			name:  "empty object",
+			input: `{}`,
+			want:  EvalCriteria{},
+		},
+		{
+			name:    "unknown field rejected",
+			input:   `{"relevance":[],"unknown_field":"value"}`,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			var got EvalCriteria
+			err := json.Unmarshal([]byte(tt.input), &got)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
 func TestTransferTaskPromptExcludesParents(t *testing.T) {
 	t.Parallel()