@intentius/chant 0.23.0 → 0.25.0

package/src/config-sandbox.ts

@@ -0,0 +1,138 @@
+import { dirname } from "node:path";
+import { importConfigModule, requireConfigModule, type ConfigModuleNamespace } from "./config-import";
+
+/**
+ * chant #1113 — decides WHERE a project's `chant.config.ts` is evaluated.
+ *
+ * `chant.config.ts` is project-authored code. Every other piece of project
+ * source moved behind the `--sandbox` boundary in chant #1045 (run-fallback
+ * files) and #1093 (composite factories, constructors, intrinsic tags), and
+ * both PRs had to document the config file as a remaining hole: the CLI reads
+ * its configuration by importing it, in-process, before it knows anything else
+ * about the project. This module closes it.
+ *
+ * ## Why an armed process mode rather than a threaded option
+ *
+ * Config is loaded from a dozen call sites (`../cli/main.ts` before command
+ * dispatch, `./cli/plugins.ts`'s `resolveProjectLexicons`,
+ * `./cli/commands/build.ts`, `./lint/policy.ts`, every lifecycle handler …).
+ * Threading a `sandbox` option to each one is fail-OPEN: miss a site and
+ * project code executes in the CLI process with nothing to notice it. Arming
+ * the process once, from the `--sandbox` flag, before any config load happens,
+ * is fail-CLOSED — a call site that nobody remembered still routes through the
+ * child.
+ *
+ * ## The bootstrap limit, stated plainly
+ *
+ * `chant.config.ts`'s own `build.sandbox: true` **cannot** sandbox its own
+ * evaluation. Reading that field requires evaluating the file, so by the time
+ * chant knows the project asked for sandboxing, the project's code has already
+ * run. Only `--sandbox` on the command line — known from `parseArgs`, before
+ * any config is touched — arms this. `chant build` warns when sandboxing was
+ * enabled by config alone, rather than letting the difference stay invisible.
+ * (A `chant.config.json` project has no such limit: JSON is data, parsed and
+ * never executed, so `build.sandbox: true` there is fully honest.)
+ *
+ * ## Memoization
+ *
+ * Armed loads are memoized per config path for the life of the process. That
+ * is not an optimization detail with a semantic cost: the unarmed path is
+ * already memoized by Node's own ESM registry (`await import()` evaluates a
+ * given config file once per process, so `chant build --watch` has never
+ * re-read a config mid-session either). Matching that keeps the two paths
+ * behaviorally identical while keeping a build to one bundle+fork instead of
+ * one per call site.
+ */
+
+/** Whether this process must evaluate project configs inside the sandbox boundary. */
+let armed = false;
+
+/** Armed-mode results, keyed by absolute config path. See the module doc on why this matches unarmed behavior rather than diverging from it. */
+const memo = new Map<string, unknown>();
+
+/**
+ * Arm sandboxed config evaluation for the rest of this process. Called from
+ * `../cli/main.ts` immediately after `parseArgs`, when `--sandbox` was passed
+ * — before the first config load. Idempotent; there is deliberately no
+ * disarm, because a security mode that can be turned off partway through a
+ * process is not one.
+ */
+export function armSandboxConfigEvaluation(): void {
+  armed = true;
+}
+
+/** Whether {@link armSandboxConfigEvaluation} has been called. */
+export function isSandboxConfigEvaluationArmed(): boolean {
+  return armed;
+}
+
+/**
+ * Test-only reset. Vitest gives each test file its own module registry, so
+ * this exists for suites that arm and disarm within one file.
+ */
+export function resetSandboxConfigEvaluationForTests(): void {
+  armed = false;
+  memo.clear();
+}
+
+/**
+ * The export a config module's configuration lives on: an explicit `default`,
+ * a named `config`, else the module namespace itself (a config authored as a
+ * set of top-level named exports). Applied identically on both sides of the
+ * boundary — in the child by `./discovery/sandbox/driver.ts`'s config driver,
+ * here for the in-process path — so `--sandbox` changes only where the file is
+ * evaluated, never how its result is read.
+ */
+export function selectConfigExport(namespace: ConfigModuleNamespace): unknown {
+  return namespace.default ?? namespace.config ?? namespace;
+}
+
+/**
+ * Evaluate a project's `chant.config.ts` and return its configuration object,
+ * pre-`normalizeConfig`. Sandboxed when armed, in-process otherwise.
+ *
+ * @param configPath - Absolute path to the config file.
+ * @param projectRoot - Directory to grant the sandboxed child read access to;
+ *   defaults to the config file's own directory.
+ */
+export async function evaluateProjectConfig(
+  configPath: string,
+  projectRoot: string = dirname(configPath),
+): Promise<unknown> {
+  if (!armed) {
+    return selectConfigExport(await importConfigModule(configPath));
+  }
+
+  if (memo.has(configPath)) return memo.get(configPath);
+
+  // Dynamic, not static, for the same reason `./discovery/index.ts` imports
+  // `./sandbox/run` dynamically: this pulls in `esbuild`, a large CJS package
+  // no unsandboxed build should pay to load.
+  const { evaluateConfigSandboxed } = await import("./discovery/sandbox/config-run");
+  const { config } = await evaluateConfigSandboxed(configPath, projectRoot);
+  memo.set(configPath, config);
+  return config;
+}
+
+/**
+ * Synchronous counterpart for `./lint/config.ts`'s `loadConfig` (`chant lint`
+ * is a sync pipeline and predates the async loader).
+ *
+ * When armed, this cannot spawn a child — so it uses the result of an earlier
+ * armed load of the same file, and refuses if there isn't one. In practice
+ * there always is: `../cli/main.ts` loads the project config before dispatching
+ * to any command. Refusing rather than falling back to an in-process `require`
+ * is the point — a sync call site is exactly where a boundary would otherwise
+ * be lost by accident.
+ */
+export function evaluateProjectConfigSync(configPath: string, dir: string): unknown {
+  if (!armed) {
+    return selectConfigExport(requireConfigModule(configPath, dir));
+  }
+
+  if (memo.has(configPath)) return memo.get(configPath);
+
+  throw new Error(
+    `Cannot read ${configPath} synchronously under --sandbox: it has not yet been evaluated inside the boundary, and evaluating it here would run project code in the chant process. This is a chant bug — the project config should have been loaded before this point.`,
+  );
+}

package/src/config.ts

@@ -7,6 +7,8 @@ import { DEFAULT_SBOM_FORMAT, type SbomFormat } from "./components/verbs/sbom-ge
 import type { Severity } from "./components/verbs/vuln-scan";
 import type { VulnPolicy } from "./components/verbs/vuln-gate";
 import type { BuildParamsConfig } from "./build-params";
+import { findProjectConfig } from "./project-root";
+import { evaluateProjectConfig } from "./config-sandbox";
 
 /**
  * Zod schema for ChantConfig validation.
@@ -273,16 +275,24 @@ export const DEFAULT_CHANT_CONFIG: ChantConfig = {};
 /**
  * Load project configuration from a directory.
  *
- * Tries `chant.config.ts` first (via dynamic import), then `chant.config.json`.
- * Returns default config if neither exists.
+ * Tries `chant.config.ts` first, then `chant.config.json`. Returns default
+ * config if neither exists.
+ *
+ * chant #1113 — `chant.config.ts` is project-authored code, so *where* it is
+ * evaluated is a security question, and the answer is
+ * `./config-sandbox.ts`'s: in a sandboxed child when this process was armed by
+ * `chant build --sandbox`, in-process (exactly as before) otherwise. Either
+ * way the result is the same plain configuration object, and validation
+ * ({@link normalizeConfig}) happens here, in the trusted process.
+ * `chant.config.json` is data, not code — it is parsed in-process under
+ * `--sandbox` too, because there is nothing to execute.
  */
 export async function loadChantConfig(dir: string): Promise<ResolvedConfig> {
   // Try chant.config.ts first
   const tsPath = join(dir, "chant.config.ts");
   if (existsSync(tsPath)) {
-    const mod = await import(tsPath);
-    const config = mod.default ?? mod.config ?? mod;
-    return { config: normalizeConfig(config, tsPath), configPath: tsPath };
+    const config = await evaluateProjectConfig(tsPath, dir);
+    return { config: normalizeConfig(config as Record<string, unknown>, tsPath), configPath: tsPath };
   }
 
   // Fall back to chant.config.json
@@ -297,6 +307,28 @@ export async function loadChantConfig(dir: string): Promise<ResolvedConfig> {
   return { config: DEFAULT_CHANT_CONFIG };
 }
 
+/**
+ * Load project configuration by walking up from `startDir` to the project
+ * root (chant #1117), instead of trying only `startDir` itself.
+ *
+ * `chant build src/<stack>` (and anything else invoked with a subdirectory —
+ * `lint.policies`' `evaluateProjectPolicies`, `--components --generate`)
+ * builds scoped to that subdirectory, but `chant.config.ts` almost always
+ * lives at the project root, one or more levels up. Before this, callers
+ * either read `startDir` alone or bolted on a single `dirname()` fallback —
+ * fine for a one-level-deep stack, silently blind to anything deeper
+ * (loomster's `src/<stack>` layout is exactly one level too deep: `buildParams`'
+ * declared `env:` mappings never resolved, so `LOOM_TIER`/`LOOM_ENV` were inert
+ * under every `npm run synth:*` for two releases — loomster#162). Uses the
+ * same walk `chant lint`/`chant graph` already used ({@link findProjectConfig},
+ * shared with `./lint/config.ts`'s `findProjectRoot`) — one config-discovery
+ * contract for the whole CLI.
+ */
+export async function loadChantConfigUpward(startDir: string): Promise<ResolvedConfig> {
+  const { dir } = findProjectConfig(startDir);
+  return loadChantConfig(dir);
+}
+
 /**
  * Resolve the ownership marker to stamp from project config, or undefined when
  * ownership marking is off (no `stack`, or `enabled: false`).

package/src/discovery/entity-wire-codec.ts

@@ -58,7 +58,7 @@ import { DECLARABLE_MARKER, isResourceDeclarable, type Declarable } from "../dec
 import { AttrRef } from "../attrref";
 import { INTRINSIC_MARKER, type Intrinsic } from "../intrinsic";
 import { isAttrRefLike } from "../utils";
-import { isLexiconOutput, LexiconOutput } from "../lexicon-output";
+import { isLexiconOutput, LexiconOutput, type LexiconOutputLiteral } from "../lexicon-output";
 import { isChildProject } from "../child-project";
 
 /**
@@ -137,7 +137,7 @@ export interface WireLexiconOutputEntity {
   form: "lexiconOutput";
   name: string;
   outputName: string;
-  /** The wrapped `AttrRef` or `Intrinsic` — encodes to `{__attrRef}` or `{__intrinsic}` respectively (see {@link WireValue}). */
+  /** The wrapped `AttrRef`, `Intrinsic`, or literal — encodes to `{__attrRef}`, `{__intrinsic}`, or a plain JSON primitive respectively (chant #1121; see {@link WireValue}). */
   ref: WireValue;
 }
 
@@ -156,15 +156,22 @@ const CORE_FIELD_NAMES = new Set(["lexicon", "entityType", "kind", "props", "att
 
 /**
  * Read a `LexiconOutput`'s internal ref without re-deriving it — see the
- * `_intrinsic`/`_sourceParent` fields in `../lexicon-output.ts`. When it was
- * built from an `AttrRef`, `LexiconOutput` keeps only the parent `WeakRef` +
- * attribute name (not the original `AttrRef` instance), so a fresh one is
- * synthesized here — its logical name must be set explicitly (from
- * `entityNames`, the same map every other reference in this module resolves
- * names through) since it never went through `resolveAttrRefs`.
+ * `_intrinsic`/`_sourceParent`/`_literalValue` fields in `../lexicon-output.ts`.
+ * When it was built from an `AttrRef`, `LexiconOutput` keeps only the parent
+ * `WeakRef` + attribute name (not the original `AttrRef` instance), so a
+ * fresh one is synthesized here — its logical name must be set explicitly
+ * (from `entityNames`, the same map every other reference in this module
+ * resolves names through) since it never went through `resolveAttrRefs`.
+ *
+ * chant #1121 — a literal-valued output (a real string/number/boolean the
+ * author's code already computed, not a reference) has neither a parent nor
+ * an intrinsic to hand back; its `_literalValue` round-trips as a plain wire
+ * primitive instead, and `LexiconOutput`'s own constructor reconstructs it
+ * identically on decode (see `decodeEntitySet` below).
  */
-function lexiconOutputRef(output: LexiconOutput, entityNames: Map<unknown, string>): AttrRef | Intrinsic {
+function lexiconOutputRef(output: LexiconOutput, entityNames: Map<unknown, string>): AttrRef | Intrinsic | LexiconOutputLiteral {
   if (output._intrinsic) return output._intrinsic;
+  if (output._literalValue !== null) return output._literalValue;
   const parent = output._sourceParent?.deref();
   const parentName = parent ? entityNames.get(parent) : undefined;
   if (!parent || output.sourceAttribute === null || !parentName) {
@@ -475,9 +482,11 @@ export function decodeEntitySet(wire: EntitySetWire): Map<string, Declarable> {
     }
 
     // LexiconOutput — constructed via its real constructor from the decoded
-    // ref, so it derives sourceLexicon/_sourceParent/sourceAttribute exactly
-    // the way constructing it from a live AttrRef/Intrinsic would.
-    const ref = decodeValue(entry.ref, registry) as AttrRef | Intrinsic;
+    // ref, so it derives sourceLexicon/_sourceParent/sourceAttribute/
+    // _literalValue exactly the way constructing it from a live
+    // AttrRef/Intrinsic/literal would (chant #1121 for the literal case: a
+    // plain wire primitive decodes back to itself, see `decodeValue` above).
+    const ref = decodeValue(entry.ref, registry) as AttrRef | Intrinsic | LexiconOutputLiteral;
     const output = new LexiconOutput(ref, entry.outputName);
     registry.set(entry.name, output);
     result.set(entry.name, output as unknown as Declarable);

package/src/discovery/entity-wire.test.ts

@@ -197,6 +197,32 @@ describe("entity-wire round trip (chant #1045 Phase 1)", () => {
     expect(isAttrRefLike(embedded[0])).toBe(true);
   });
 
+  // chant #1121 — before this fix, encoding a literal-valued LexiconOutput
+  // (neither an AttrRef nor an Intrinsic) threw
+  // `encodeEntitySet: LexiconOutput "..." has neither a resolvable AttrRef
+  // parent nor an intrinsic` — this is the sandboxed-child boundary a
+  // `chant build --sandbox` run crosses for every entity, so a project using
+  // `output("literal", "name")` could not build under `--sandbox` at all.
+  test.each([
+    ["string", "fold-output-repro"],
+    ["number", 42],
+    ["boolean", true],
+  ] as const)("LexiconOutput built from a %s literal round-trips via its real constructor", (_kind, value) => {
+    const lexOutput = new LexiconOutput(value, "LiteralOut");
+    const entities = new Map<string, Declarable>([["LiteralOut", lexOutput as unknown as Declarable]]);
+
+    const wire = encodeEntitySet(entities);
+    assertPureJson(wire);
+
+    const decoded = decodeEntitySet(JSON.parse(JSON.stringify(wire)) as EntitySetWire);
+    const decodedOutput = decoded.get("LiteralOut") as unknown as LexiconOutput;
+    expect(isLexiconOutput(decodedOutput)).toBe(true);
+    expect(decodedOutput.outputName).toBe("LiteralOut");
+    expect(decodedOutput.sourceEntity).toBe("");
+    expect(decodedOutput.sourceAttribute).toBeNull();
+    expect(decodedOutput.getOutputValue()).toBe(value);
+  });
+
   test("a lexicon-specific marker symbol (not core-owned) round-trips generically", () => {
     const MARKER = Symbol.for("chant.test.customMarker");
     const custom: Declarable = {

package/src/discovery/sandbox/config-boundary.test.ts

@@ -0,0 +1,239 @@
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdir, writeFile, rm, realpath } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { loadChantConfig } from "../../config";
+import {
+  armSandboxConfigEvaluation,
+  evaluateProjectConfigSync,
+  isSandboxConfigEvaluationArmed,
+  resetSandboxConfigEvaluationForTests,
+} from "../../config-sandbox";
+import { ENV_VAR } from "../../env";
+
+/**
+ * chant #1113 — `chant.config.ts` is project-authored code, and under
+ * `--sandbox` it must not execute in the CLI's process.
+ *
+ * Same shape of proof as `./fold-boundary.test.ts` (chant #1093): the fixture
+ * config sets a `globalThis` marker at module top level, and a marker set
+ * inside the sandboxed child cannot reach this process. Every pair asserts the
+ * UNARMED half fires the marker first, so the probe is proven capable of
+ * failing before the armed half asserts it stays clean.
+ *
+ * Fixtures go to a fresh tmpdir per test — never the source tree — so no two
+ * tests share a module path and nothing bleeds through Node's module cache.
+ */
+
+const MARKER = "__chant1113ConfigEvaluated";
+
+type MarkerHost = Record<string, boolean | undefined>;
+
+function marker(): boolean | undefined {
+  return (globalThis as unknown as MarkerHost)[MARKER];
+}
+
+describe("chant.config.ts evaluation under --sandbox (chant #1113)", () => {
+  let testDir: string;
+  let savedEnv: string | undefined;
+
+  beforeEach(async () => {
+    const dir = join(tmpdir(), `chant-1113-config-${Date.now()}-${Math.random()}`);
+    await mkdir(dir, { recursive: true });
+    testDir = await realpath(dir);
+    delete (globalThis as unknown as MarkerHost)[MARKER];
+    savedEnv = process.env[ENV_VAR];
+    resetSandboxConfigEvaluationForTests();
+  });
+
+  afterEach(async () => {
+    delete (globalThis as unknown as MarkerHost)[MARKER];
+    if (savedEnv === undefined) delete process.env[ENV_VAR];
+    else process.env[ENV_VAR] = savedEnv;
+    resetSandboxConfigEvaluationForTests();
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  /** A config that announces its own evaluation, the way any project file's top level can. */
+  async function writeMarkerConfig(body = `{ lexicons: ["aws"], ownership: { stack: "s" } }`): Promise<void> {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `globalThis[${JSON.stringify(MARKER)}] = true;\nexport default ${body};\n`,
+    );
+  }
+
+  test("without --sandbox the config DOES evaluate in this process (the probe fires)", async () => {
+    await writeMarkerConfig();
+
+    const { config } = await loadChantConfig(testDir);
+
+    expect(isSandboxConfigEvaluationArmed()).toBe(false);
+    expect(marker(), "the config's top level ran in this process").toBe(true);
+    expect(config.lexicons).toEqual(["aws"]);
+    expect(config.ownership).toEqual({ stack: "s" });
+  });
+
+  test("armed, the same config evaluates in the child: no marker here, same config", async () => {
+    await writeMarkerConfig();
+    armSandboxConfigEvaluation();
+
+    const { config, configPath } = await loadChantConfig(testDir);
+
+    expect(marker(), "the config's top level must NOT run in the CLI process").toBeUndefined();
+    expect(configPath).toBe(join(testDir, "chant.config.ts"));
+    expect(config.lexicons).toEqual(["aws"]);
+    expect(config.ownership).toEqual({ stack: "s" });
+  });
+
+  test("a config authored as a named `config` export crosses the same way", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `globalThis[${JSON.stringify(MARKER)}] = true;\nexport const config = { lexicons: ["k8s"] };\n`,
+    );
+    armSandboxConfigEvaluation();
+
+    const { config } = await loadChantConfig(testDir);
+
+    expect(marker()).toBeUndefined();
+    expect(config.lexicons).toEqual(["k8s"]);
+  });
+
+  test("nested data — buildParams, stacks, lint rules — survives the round trip", async () => {
+    await writeMarkerConfig(
+      `{
+         lexicons: ["aws"],
+         stacks: [{ name: "net", src: "src/net" }, { name: "app", src: "src/app" }],
+         buildParams: { tier: { type: "string", default: "light", enum: ["light", "prod"] } },
+         lint: { rules: { COR001: "error", COR002: ["warning", { max: 3 }] }, policies: ["policies/org.ts"] },
+       }`,
+    );
+    armSandboxConfigEvaluation();
+
+    const { config } = await loadChantConfig(testDir);
+
+    expect(marker()).toBeUndefined();
+    expect(config.stacks).toEqual([
+      { name: "net", src: "src/net" },
+      { name: "app", src: "src/app" },
+    ]);
+    expect(config.buildParams).toEqual({
+      tier: { type: "string", default: "light", enum: ["light", "prod"] },
+    });
+    expect(config.lint?.rules).toEqual({ COR001: "error", COR002: ["warning", { max: 3 }] });
+    expect(config.lint?.policies).toEqual(["policies/org.ts"]);
+  });
+
+  test("chant.config.json needs no child — it is data, parsed in-process either way", async () => {
+    await writeFile(
+      join(testDir, "chant.config.json"),
+      JSON.stringify({ lexicons: ["gcp"], build: { sandbox: true } }),
+    );
+    armSandboxConfigEvaluation();
+
+    const { config, configPath } = await loadChantConfig(testDir);
+
+    expect(configPath).toBe(join(testDir, "chant.config.json"));
+    expect(config.lexicons).toEqual(["gcp"]);
+  });
+
+  test("a value that cannot cross as JSON is refused, naming the key", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `export default { lexicons: ["aws"], hooks: { beforeBuild: () => 1 } };\n`,
+    );
+    armSandboxConfigEvaluation();
+
+    await expect(loadChantConfig(testDir)).rejects.toThrow(/hooks\.beforeBuild: a function/);
+    expect(marker()).toBeUndefined();
+  });
+
+  test("a Date is refused too — JSON.stringify would silently turn it into a string", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `export default { lexicons: ["aws"], meta: { generatedAt: new Date(0) } };\n`,
+    );
+    armSandboxConfigEvaluation();
+
+    await expect(loadChantConfig(testDir)).rejects.toThrow(/meta\.generatedAt: a Date/);
+  });
+
+  test("a config that reads outside the project is denied, naming the config file", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `import { readFileSync } from "node:fs";\n` +
+        `const stolen = readFileSync("/etc/hosts", "utf-8");\n` +
+        `export default { lexicons: [stolen.slice(0, 3)] };\n`,
+    );
+    armSandboxConfigEvaluation();
+
+    await expect(loadChantConfig(testDir)).rejects.toThrow(/sandbox denied FileSystemRead/);
+  });
+
+  test("a config that tries to spawn a process is denied", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `import { execSync } from "node:child_process";\n` +
+        `execSync("echo pwned");\n` +
+        `export default { lexicons: ["aws"] };\n`,
+    );
+    armSandboxConfigEvaluation();
+
+    await expect(loadChantConfig(testDir)).rejects.toThrow(/sandbox denied/);
+  });
+
+  test("the child's environment is scrubbed — but --env still reaches the config", async () => {
+    process.env[ENV_VAR] = "prod";
+    process.env.CHANT_1113_SECRET = "hunter2";
+    try {
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default {\n` +
+          `  environments: [process.env[${JSON.stringify(ENV_VAR)}] ?? "none"],\n` +
+          `  sourceDir: process.env.CHANT_1113_SECRET ?? "scrubbed",\n` +
+          `};\n`,
+      );
+      armSandboxConfigEvaluation();
+
+      const { config } = await loadChantConfig(testDir);
+
+      expect(config.environments, "--env is forwarded so the config resolves the same either way").toEqual(["prod"]);
+      expect(config.sourceDir, "nothing else from the CLI's environment is visible").toBe("scrubbed");
+    } finally {
+      delete process.env.CHANT_1113_SECRET;
+    }
+  });
+
+  test("an armed load is memoized, so repeated loads cost one child, not one each", async () => {
+    await writeMarkerConfig();
+    armSandboxConfigEvaluation();
+
+    const first = await loadChantConfig(testDir);
+    const second = await loadChantConfig(testDir);
+
+    expect(second.config).toBe(first.config);
+    expect(marker()).toBeUndefined();
+  });
+
+  test("the sync lint loader reuses that result rather than requiring the file", async () => {
+    await writeMarkerConfig(`{ lexicons: ["aws"], lint: { rules: { COR001: "warning" } } }`);
+    armSandboxConfigEvaluation();
+
+    await loadChantConfig(testDir);
+    const config = evaluateProjectConfigSync(join(testDir, "chant.config.ts"), testDir) as {
+      lint?: { rules?: Record<string, unknown> };
+    };
+
+    expect(config.lint?.rules?.COR001).toBe("warning");
+    expect(marker()).toBeUndefined();
+  });
+
+  test("the sync lint loader refuses rather than importing when nothing was evaluated yet", async () => {
+    await writeMarkerConfig();
+    armSandboxConfigEvaluation();
+
+    expect(() => evaluateProjectConfigSync(join(testDir, "chant.config.ts"), testDir)).toThrow(
+      /Cannot read .* synchronously under --sandbox/,
+    );
+    expect(marker()).toBeUndefined();
+  });
+});

package/src/discovery/sandbox/config-run.ts

@@ -0,0 +1,130 @@
+import { realpathSync, rmSync } from "node:fs";
+import { resolve } from "node:path";
+import { bundleDriver } from "./bundle";
+import { generateConfigDriverSource } from "./driver";
+import { formatConfigWireOffenders, type ConfigWireOffender } from "./config-wire";
+import { forkSandboxed } from "./fork";
+import { ENV_VAR } from "../../env";
+
+/**
+ * chant #1113 — evaluates a project's `chant.config.ts` inside the same
+ * sandboxed child `--sandbox` already uses for run-fallback source, and brings
+ * back plain JSON.
+ *
+ * This closes the residual chant #1093 documented and #1113 filed: `loadConfig`
+ * imported the project's own `chant.config.ts` into the CLI process, so a
+ * hostile repo's config executed with full CLI trust even under `--sandbox`.
+ * The config is project-authored code like any other file in the repo; the
+ * only reason it was ever treated differently is that the CLI has to read it
+ * before it knows anything else about the project.
+ *
+ * Deliberately the same machinery, not a parallel one:
+ *  - `./bundle.ts` bundles the generated driver (`./driver.ts`'s
+ *    `generateConfigDriverSource`) with esbuild, so the child needs no runtime
+ *    module resolution and no TypeScript loader.
+ *  - `./fork.ts` spawns it with the identical `--permission` profile
+ *    `runFallbackFilesSandboxed` uses — one function, so the two cannot drift.
+ *  - `./child-errors.ts` classifies whatever it throws, so a permission denial
+ *    names the config file instead of leaking `ERR_ACCESS_DENIED`.
+ *
+ * The one deliberate difference from the run-fallback child is `CHANT_ENV`.
+ * `../../cli/main.ts` sets it from `--env` *before* loading the config,
+ * specifically because a config may branch on the environment; dropping it
+ * would silently produce a different configuration under `--sandbox` than
+ * without. It is a value the user typed on the command line, not an ambient
+ * secret, so forwarding exactly that one key — and nothing else from
+ * `process.env` — keeps the scrub meaningful while keeping `--env` honest.
+ */
+
+/** How long to wait for the config child. A config is one small module; anything approaching this is hung, not slow. */
+const CONFIG_CHILD_TIMEOUT_MS = 60_000;
+
+interface ConfigChildResponse {
+  kind: "chant-config";
+  ok: boolean;
+  config?: unknown;
+  offenders?: ConfigWireOffender[];
+  error?: { name: string; file: string; message: string; type: string };
+}
+
+function isConfigChildResponse(value: unknown): value is ConfigChildResponse {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    (value as { kind?: unknown }).kind === "chant-config" &&
+    typeof (value as { ok?: unknown }).ok === "boolean"
+  );
+}
+
+export interface SandboxConfigResult {
+  /** The evaluated configuration, as plain JSON. Interpreted (default/config/namespace selection already applied in the child; Zod validation still to come) by `../../config.ts`'s `normalizeConfig`, in the parent, unchanged. */
+  config: unknown;
+  /** esbuild bundling wall-clock time. */
+  bundleMs: number;
+  /** Bundle size in bytes. */
+  bundleBytes: number;
+}
+
+/**
+ * Evaluate `configPath` in a sandboxed child and return its configuration as
+ * plain data.
+ *
+ * Throws — rather than degrading to an in-process import or to defaults — when
+ * the config cannot be evaluated inside the boundary or cannot cross it as
+ * JSON. Under `--sandbox` a config that "almost" loaded is not a safe thing to
+ * proceed with, and quietly falling back would give away the property the flag
+ * exists to provide.
+ *
+ * @param configPath - Absolute path to the project's `chant.config.ts`.
+ * @param projectRoot - Directory the child is granted `--allow-fs-read` for
+ *   (the config's own project root, i.e. `findProjectConfig`'s `dir`).
+ */
+export async function evaluateConfigSandboxed(
+  configPath: string,
+  projectRoot: string,
+): Promise<SandboxConfigResult> {
+  const driverSource = generateConfigDriverSource(configPath);
+  const { bundlePath, bundleDir, externalReadPaths, durationMs, bytes } = await bundleDriver(driverSource);
+
+  try {
+    let projectRealpath: string;
+    try {
+      projectRealpath = realpathSync(resolve(projectRoot));
+    } catch {
+      projectRealpath = resolve(projectRoot);
+    }
+
+    const env: Record<string, string> = { PATH: process.env.PATH ?? "" };
+    // See the module doc: the one forwarded variable, and only when set.
+    const activeEnv = process.env[ENV_VAR];
+    if (activeEnv) env[ENV_VAR] = activeEnv;
+
+    const response = await forkSandboxed(
+      {
+        bundlePath,
+        bundleDir,
+        projectRealpath,
+        externalReadPaths,
+        env,
+        timeoutMs: CONFIG_CHILD_TIMEOUT_MS,
+        label: `sandboxed evaluation of ${configPath}`,
+      },
+      isConfigChildResponse,
+    );
+
+    if (!response.ok) {
+      if (response.offenders && response.offenders.length > 0) {
+        throw new Error(formatConfigWireOffenders(configPath, response.offenders));
+      }
+      throw new Error(
+        response.error?.message
+          ? `Failed to evaluate ${configPath} inside the --sandbox boundary: ${response.error.message}`
+          : `Failed to evaluate ${configPath} inside the --sandbox boundary`,
+      );
+    }
+
+    return { config: response.config ?? {}, bundleMs: durationMs, bundleBytes: bytes };
+  } finally {
+    rmSync(bundleDir, { recursive: true, force: true });
+  }
+}