From 153acb7f644d755c45533b7c5311e3ffa47e8973 Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Fri, 18 Sep 2026 05:31:09 -0400
Subject: fix: harden engine across casino, economy, concurrency, security, and
 content

---
 internal/config/config.go | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

(limited to 'internal/config/config.go')

diff --git a/internal/config/config.go b/internal/config/config.go
index 362c9c1..852a6d6 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -3,6 +3,9 @@
 package config
 
 import (
+	"bytes"
+	"errors"
+	"io"
 	"os"
 
 	"gopkg.in/yaml.v3"
@@ -242,7 +245,15 @@ func Load(path string) (*Config, error) {
 		return nil, err
 	}
 	cfg := Default()
-	if err := yaml.Unmarshal(data, cfg); err != nil {
+	// KnownFields makes a misspelled key (e.g. telnet_listen) a hard error
+	// instead of silently leaving the default in place. ColorsConfig is a map,
+	// so arbitrary color keys remain allowed.
+	dec := yaml.NewDecoder(bytes.NewReader(data))
+	dec.KnownFields(true)
+	// An empty or comment-only file yields io.EOF, which means "no keys set"
+	// rather than a broken config: the defaults above stay in effect. A real
+	// syntax/unknown-field error is still returned.
+	if err := dec.Decode(cfg); err != nil && !errors.Is(err, io.EOF) {
 		return nil, err
 	}
 	return cfg, nil
-- 
cgit v1.2.3