Phase 3d: add actionable configuration parse errors

This change reports malformed JSON separately from typed policy errors and makes configuration failures actionable without leaking secrets or allowing untrusted text to corrupt diagnostics.

Details:
- include complete JSON paths and source locations for one-shot and state-aware failures
- preserve state-aware output ownership while rejecting trailing data and malformed experimental blocks
- escape control characters, redact secret-bearing values, and avoid retaining a full untyped request tree
- document the diagnostic contract and add focused parser coverage

Tests:
- cargo fmt --all -- --check
- cargo check -p wxc_common -p wxc --all-targets
- cargo clippy -p wxc_common -p wxc --all-targets -- -D warnings
- cargo test -p wxc_common -p wxc
- node scripts/versioning/check-schema-codegen.js
- node scripts/versioning/check-sdk-types-codegen.js
- node scripts/versioning/check-schema-versions.js

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Generated-with: gpt-5.6-sol
Copilot-Session: f66f1e4b-72f7-4508-abb2-3bb3d4c808b9

Author: Gudge

.github/copilot-instructions.md

@@ -118,7 +118,7 @@ The Rust workspace (`src/`) implements multiple sandboxing backends behind the `
 
 ### Config flow
 
-1. User provides JSON config (file or base64) → `config_parser.rs` deserializes into the typed wire model (`wxc_common::wire`) → validates and maps to `ExecutionRequest` (the internal execution model in `models.rs`)
+1. User provides JSON config (file or base64) → `config_deserialize.rs` performs path-aware typed deserialization into the wire model (`wxc_common::wire`) → `config_parser.rs` validates and maps it to `ExecutionRequest` (the internal execution model in `models.rs`)
 2. `ExecutionRequest` includes the containment backend selection, process config, filesystem/network policies, and optional experimental features
 3. The appropriate `ScriptRunner` implementation executes the process and returns `ScriptResponse`
 
@@ -210,7 +210,7 @@ The workspace is organized into six top-level directories under `src/`:
 
 ### Config parser pattern
 
-The parser deserializes JSON directly into the typed wire model (`wxc_common::wire`), the single source of truth for the config shape (it also generates the JSON schema). `config_parser.rs` then maps the wire types to the validated domain structs in `models.rs`. The stable surface uses `deny_unknown_fields` (closed); the `experimental` block is permissive.
+The parser deserializes JSON directly into the typed wire model (`wxc_common::wire`), the single source of truth for the config shape (it also generates the JSON schema). All typed config deserialization goes through `config_deserialize.rs`, which distinguishes syntax errors from typed policy errors and adds the complete JSON path plus source line/column when available; state-aware backend errors are prefixed with their full `experimental.<backend>.<phase>` location. `config_parser.rs` then maps the wire types to the validated domain structs in `models.rs`. The stable surface uses `deny_unknown_fields` (closed); the `experimental` block is permissive.
 
 ### TypeScript conventions
 

docs/state-aware-lifecycle/mxc-state-aware-sandbox-api.md

@@ -675,6 +675,13 @@ state-aware mode so `stdout` remains parseable without sentinels. (One-shot disp
 keeps its existing `stdout` logger behaviour — the stricter routing applies to
 state-aware only.)
 
+Configuration parse-phase failures follow the same state-aware contract: the typed
+`{error}` envelope is the only primary output, while the human-readable actionable
+parse diagnostic is written only to configured auxiliary sinks (`--log-file` and the
+Windows diagnostic console). It is not duplicated to the logger's primary
+console/buffer output, so a parse failure does not add stderr noise even with
+`--debug`.
+
 For exec specifically, MXC diagnostic output mixes with the script's own stderr when
 `--debug` is passed. This is a small amount of pre- and post-dispatch noise; consumers
 wanting clean separation should use `--log-file <path>` instead, which routes diagnostic

docs/versioning.md

@@ -438,6 +438,14 @@ HRESULT EnumerateSandboxSpecVersionInfo(
 
 Negotiation failures are **typed and actionable** — never a silent fallback:
 
+- **JSON and policy-shape failures** distinguish malformed JSON syntax from
+  valid JSON that does not match the typed wire contract. Typed failures name
+  the full policy path (for example, `network.proxy.localhost`), retain Serde's
+  expected type/value information, and include source line/column when parsing
+  directly from request text. State-aware per-backend configuration errors are
+  prefixed with their full `experimental.<backend>.<phase>` location. Diagnostic
+  text escapes control characters, and errors at secret-bearing paths redact the
+  submitted value.
 - **Schema-range failures** (Stage 1) carry a clear "older than supported" /
   "newer than supported" message telling the caller whether to update the config
   or upgrade `wxc-exec`.

src/Cargo.lock

@@ -94,6 +94,7 @@ windows = { version = "0.62", features = [
 windows-core = "0.62"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+serde_path_to_error = "0.1"
 thiserror = "2"
 anyhow = "1"
 base64 = "0.22"

src/Cargo.toml

@@ -12,7 +12,8 @@ schema-gen = ["dep:schemars"]
 
 [dependencies]
 serde = { workspace = true }
-serde_json = { workspace = true }
+serde_json = { workspace = true, features = ["raw_value"] }
+serde_path_to_error = { workspace = true }
 thiserror = { workspace = true }
 base64 = { workspace = true }
 url = { workspace = true }