@intentius/chant 0.24.0 → 0.25.0

package/src/build.ts

@@ -296,18 +296,28 @@ export function collectLexiconOutputs(
   for (const [name, entity] of entities) {
     if (isLexiconOutput(entity as unknown)) {
       const lexiconOutput = entity as unknown as LexiconOutput;
-      // Resolve source entity name from the WeakRef parent identity
-      const parent = lexiconOutput._sourceParent?.deref();
-      let sourceName = name;
-      if (parent) {
-        for (const [entityName, e] of entities) {
-          if (e === parent) {
-            sourceName = entityName;
-            break;
+      // A literal-valued output (chant #1121) has no source entity at all —
+      // it isn't a reference to anything, so it must not fall back to the
+      // output's OWN map key the way an AttrRef whose parent didn't resolve
+      // would. Leaving `sourceEntity` empty keeps `getOutputValue()`'s
+      // (never-reached, for a literal) `Fn::GetAtt` fallback from ever being
+      // handed a bogus source, and keeps consumers that read `sourceEntity`
+      // directly (e.g. `graph-ir.ts`'s cross-stack export, the build
+      // manifest) from reporting the output as its own source.
+      if (lexiconOutput._literalValue === null) {
+        // Resolve source entity name from the WeakRef parent identity
+        const parent = lexiconOutput._sourceParent?.deref();
+        let sourceName = name;
+        if (parent) {
+          for (const [entityName, e] of entities) {
+            if (e === parent) {
+              sourceName = entityName;
+              break;
+            }
           }
         }
+        lexiconOutput._setSourceEntity(sourceName);
       }
-      lexiconOutput._setSourceEntity(sourceName);
       outputs.push(lexiconOutput);
       continue;
     }
@@ -317,7 +327,8 @@ export function collectLexiconOutputs(
       const prevLength = outputs.length;
       walk(entity.props);
       for (let i = prevLength; i < outputs.length; i++) {
-        if (!outputs[i].sourceEntity) {
+        // Same #1121 guard as above — a literal has no source entity to name.
+        if (!outputs[i].sourceEntity && outputs[i]._literalValue === null) {
           outputs[i]._setSourceEntity(name);
         }
       }

package/src/cli/commands/build.ts

@@ -158,6 +158,19 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // as fold, resolved independently.
   const sandbox = resolveSandboxEnabled(config, options.sandbox);
 
+  // #1113 — the bootstrap limit, surfaced rather than left implicit. Reading
+  // `build.sandbox` out of `chant.config.ts` requires evaluating that file, so
+  // a config-only opt-in cannot have covered its own evaluation; only the CLI
+  // flag, known before any config is touched, arms `../config-sandbox.ts`.
+  // Say so instead of letting two different boundaries share one word.
+  if (sandbox && !options.sandbox && loaded.configPath?.endsWith(".ts")) {
+    warnings.push(
+      formatWarning({
+        message: `build.sandbox is enabled by ${loaded.configPath}, but that file was itself evaluated in this process — reading the setting requires running the config. Pass --sandbox on the command line to evaluate chant.config.ts inside the boundary too.`,
+      }),
+    );
+  }
+
   // #1064 (factored into ../build-params-cli.ts's resolveCliBuildParams by
   // #1108, so the component deploy driver runs the identical sequence) —
   // resolve declared build-time parameters (chant.config.ts's buildParams)

package/src/cli/main.ts

@@ -6,6 +6,7 @@ import { formatSuccess, formatError } from "./format";
 import { loadPlugins, resolveProjectLexicons } from "./plugins";
 import { resolveCommand, type CommandDef, type ParsedArgs } from "./registry";
 import { loadChantConfigUpward } from "../config";
+import { armSandboxConfigEvaluation } from "../config-sandbox";
 import { ENV_VAR, unknownEnvError } from "../env";
 import { initRuntime } from "../runtime-adapter";
 import { runBuild } from "./handlers/build";
@@ -598,6 +599,15 @@ async function main(): Promise<void> {
   // chant.config itself may branch on the env. (#505)
   if (args.env) process.env[ENV_VAR] = args.env;
 
+  // chant #1113 — `--sandbox` is a property of the whole invocation, and it
+  // has to be known BEFORE the first config load, because `chant.config.ts` is
+  // itself project-authored code. Arming here, straight off the parsed flag,
+  // is the only ordering that works: the project's own `build.sandbox: true`
+  // cannot cover its own evaluation (reading it means running it), so the
+  // command-line flag is what puts the config inside the boundary. See
+  // `../config-sandbox.ts`.
+  if (args.sandbox) armSandboxConfigEvaluation();
+
   // Initialize runtime adapter early — before plugins or commands run.
   // chant #1117 — walks up from `args.path` to the project root: for a
   // subdirectory build/command (`chant build src/<stack> --env prod`) the

package/src/config-import.ts

@@ -0,0 +1,43 @@
+import { createRequire } from "node:module";
+import { join } from "node:path";
+
+/**
+ * The single place chant evaluates a project's `chant.config.ts` **in the CLI's
+ * own process**.
+ *
+ * This is the config-side analogue of `./discovery/import.ts`'s `importModule`
+ * — one narrow module whose only job is "execute project-authored code here",
+ * so that the question "did any project code run in this process?" has one
+ * place to look and one place to instrument (see
+ * `examples/sandbox-execution-boundary.test.ts`, which spies on both).
+ *
+ * Callers must not `import()` a config file directly. `./config-sandbox.ts`
+ * decides whether a given load is allowed to come through here at all: under
+ * `chant build --sandbox` it routes the evaluation into the sandboxed child
+ * instead (chant #1113), and these functions are never reached.
+ *
+ * `chant.config.json` is pure data and is parsed, not executed — it never goes
+ * through this module.
+ */
+
+/** The shape a config module evaluates to, before `default`/`config`/namespace selection. */
+export type ConfigModuleNamespace = Record<string, unknown>;
+
+/**
+ * Import a `chant.config.ts` into THIS process and return its module namespace.
+ * Node's ESM registry caches it, so repeated loads within one CLI invocation
+ * evaluate the file once — the behavior `loadChantConfig` has always had.
+ */
+export async function importConfigModule(configPath: string): Promise<ConfigModuleNamespace> {
+  return (await import(configPath)) as ConfigModuleNamespace;
+}
+
+/**
+ * `require()` a `chant.config.ts` into THIS process from `dir`'s resolution
+ * context — the synchronous path `./lint/config.ts`'s `loadConfig` has used
+ * since before the async loader existed (`chant lint` is a sync pipeline).
+ */
+export function requireConfigModule(configPath: string, dir: string): ConfigModuleNamespace {
+  const req = createRequire(join(dir, "package.json"));
+  return req(configPath) as ConfigModuleNamespace;
+}

package/src/config-sandbox.ts

@@ -0,0 +1,138 @@
+import { dirname } from "node:path";
+import { importConfigModule, requireConfigModule, type ConfigModuleNamespace } from "./config-import";
+
+/**
+ * chant #1113 — decides WHERE a project's `chant.config.ts` is evaluated.
+ *
+ * `chant.config.ts` is project-authored code. Every other piece of project
+ * source moved behind the `--sandbox` boundary in chant #1045 (run-fallback
+ * files) and #1093 (composite factories, constructors, intrinsic tags), and
+ * both PRs had to document the config file as a remaining hole: the CLI reads
+ * its configuration by importing it, in-process, before it knows anything else
+ * about the project. This module closes it.
+ *
+ * ## Why an armed process mode rather than a threaded option
+ *
+ * Config is loaded from a dozen call sites (`../cli/main.ts` before command
+ * dispatch, `./cli/plugins.ts`'s `resolveProjectLexicons`,
+ * `./cli/commands/build.ts`, `./lint/policy.ts`, every lifecycle handler …).
+ * Threading a `sandbox` option to each one is fail-OPEN: miss a site and
+ * project code executes in the CLI process with nothing to notice it. Arming
+ * the process once, from the `--sandbox` flag, before any config load happens,
+ * is fail-CLOSED — a call site that nobody remembered still routes through the
+ * child.
+ *
+ * ## The bootstrap limit, stated plainly
+ *
+ * `chant.config.ts`'s own `build.sandbox: true` **cannot** sandbox its own
+ * evaluation. Reading that field requires evaluating the file, so by the time
+ * chant knows the project asked for sandboxing, the project's code has already
+ * run. Only `--sandbox` on the command line — known from `parseArgs`, before
+ * any config is touched — arms this. `chant build` warns when sandboxing was
+ * enabled by config alone, rather than letting the difference stay invisible.
+ * (A `chant.config.json` project has no such limit: JSON is data, parsed and
+ * never executed, so `build.sandbox: true` there is fully honest.)
+ *
+ * ## Memoization
+ *
+ * Armed loads are memoized per config path for the life of the process. That
+ * is not an optimization detail with a semantic cost: the unarmed path is
+ * already memoized by Node's own ESM registry (`await import()` evaluates a
+ * given config file once per process, so `chant build --watch` has never
+ * re-read a config mid-session either). Matching that keeps the two paths
+ * behaviorally identical while keeping a build to one bundle+fork instead of
+ * one per call site.
+ */
+
+/** Whether this process must evaluate project configs inside the sandbox boundary. */
+let armed = false;
+
+/** Armed-mode results, keyed by absolute config path. See the module doc on why this matches unarmed behavior rather than diverging from it. */
+const memo = new Map<string, unknown>();
+
+/**
+ * Arm sandboxed config evaluation for the rest of this process. Called from
+ * `../cli/main.ts` immediately after `parseArgs`, when `--sandbox` was passed
+ * — before the first config load. Idempotent; there is deliberately no
+ * disarm, because a security mode that can be turned off partway through a
+ * process is not one.
+ */
+export function armSandboxConfigEvaluation(): void {
+  armed = true;
+}
+
+/** Whether {@link armSandboxConfigEvaluation} has been called. */
+export function isSandboxConfigEvaluationArmed(): boolean {
+  return armed;
+}
+
+/**
+ * Test-only reset. Vitest gives each test file its own module registry, so
+ * this exists for suites that arm and disarm within one file.
+ */
+export function resetSandboxConfigEvaluationForTests(): void {
+  armed = false;
+  memo.clear();
+}
+
+/**
+ * The export a config module's configuration lives on: an explicit `default`,
+ * a named `config`, else the module namespace itself (a config authored as a
+ * set of top-level named exports). Applied identically on both sides of the
+ * boundary — in the child by `./discovery/sandbox/driver.ts`'s config driver,
+ * here for the in-process path — so `--sandbox` changes only where the file is
+ * evaluated, never how its result is read.
+ */
+export function selectConfigExport(namespace: ConfigModuleNamespace): unknown {
+  return namespace.default ?? namespace.config ?? namespace;
+}
+
+/**
+ * Evaluate a project's `chant.config.ts` and return its configuration object,
+ * pre-`normalizeConfig`. Sandboxed when armed, in-process otherwise.
+ *
+ * @param configPath - Absolute path to the config file.
+ * @param projectRoot - Directory to grant the sandboxed child read access to;
+ *   defaults to the config file's own directory.
+ */
+export async function evaluateProjectConfig(
+  configPath: string,
+  projectRoot: string = dirname(configPath),
+): Promise<unknown> {
+  if (!armed) {
+    return selectConfigExport(await importConfigModule(configPath));
+  }
+
+  if (memo.has(configPath)) return memo.get(configPath);
+
+  // Dynamic, not static, for the same reason `./discovery/index.ts` imports
+  // `./sandbox/run` dynamically: this pulls in `esbuild`, a large CJS package
+  // no unsandboxed build should pay to load.
+  const { evaluateConfigSandboxed } = await import("./discovery/sandbox/config-run");
+  const { config } = await evaluateConfigSandboxed(configPath, projectRoot);
+  memo.set(configPath, config);
+  return config;
+}
+
+/**
+ * Synchronous counterpart for `./lint/config.ts`'s `loadConfig` (`chant lint`
+ * is a sync pipeline and predates the async loader).
+ *
+ * When armed, this cannot spawn a child — so it uses the result of an earlier
+ * armed load of the same file, and refuses if there isn't one. In practice
+ * there always is: `../cli/main.ts` loads the project config before dispatching
+ * to any command. Refusing rather than falling back to an in-process `require`
+ * is the point — a sync call site is exactly where a boundary would otherwise
+ * be lost by accident.
+ */
+export function evaluateProjectConfigSync(configPath: string, dir: string): unknown {
+  if (!armed) {
+    return selectConfigExport(requireConfigModule(configPath, dir));
+  }
+
+  if (memo.has(configPath)) return memo.get(configPath);
+
+  throw new Error(
+    `Cannot read ${configPath} synchronously under --sandbox: it has not yet been evaluated inside the boundary, and evaluating it here would run project code in the chant process. This is a chant bug — the project config should have been loaded before this point.`,
+  );
+}

package/src/config.ts

@@ -8,6 +8,7 @@ import type { Severity } from "./components/verbs/vuln-scan";
 import type { VulnPolicy } from "./components/verbs/vuln-gate";
 import type { BuildParamsConfig } from "./build-params";
 import { findProjectConfig } from "./project-root";
+import { evaluateProjectConfig } from "./config-sandbox";
 
 /**
  * Zod schema for ChantConfig validation.
@@ -274,16 +275,24 @@ export const DEFAULT_CHANT_CONFIG: ChantConfig = {};
 /**
  * Load project configuration from a directory.
  *
- * Tries `chant.config.ts` first (via dynamic import), then `chant.config.json`.
- * Returns default config if neither exists.
+ * Tries `chant.config.ts` first, then `chant.config.json`. Returns default
+ * config if neither exists.
+ *
+ * chant #1113 — `chant.config.ts` is project-authored code, so *where* it is
+ * evaluated is a security question, and the answer is
+ * `./config-sandbox.ts`'s: in a sandboxed child when this process was armed by
+ * `chant build --sandbox`, in-process (exactly as before) otherwise. Either
+ * way the result is the same plain configuration object, and validation
+ * ({@link normalizeConfig}) happens here, in the trusted process.
+ * `chant.config.json` is data, not code — it is parsed in-process under
+ * `--sandbox` too, because there is nothing to execute.
  */
 export async function loadChantConfig(dir: string): Promise<ResolvedConfig> {
   // Try chant.config.ts first
   const tsPath = join(dir, "chant.config.ts");
   if (existsSync(tsPath)) {
-    const mod = await import(tsPath);
-    const config = mod.default ?? mod.config ?? mod;
-    return { config: normalizeConfig(config, tsPath), configPath: tsPath };
+    const config = await evaluateProjectConfig(tsPath, dir);
+    return { config: normalizeConfig(config as Record<string, unknown>, tsPath), configPath: tsPath };
   }
 
   // Fall back to chant.config.json

package/src/discovery/entity-wire-codec.ts

@@ -58,7 +58,7 @@ import { DECLARABLE_MARKER, isResourceDeclarable, type Declarable } from "../dec
 import { AttrRef } from "../attrref";
 import { INTRINSIC_MARKER, type Intrinsic } from "../intrinsic";
 import { isAttrRefLike } from "../utils";
-import { isLexiconOutput, LexiconOutput } from "../lexicon-output";
+import { isLexiconOutput, LexiconOutput, type LexiconOutputLiteral } from "../lexicon-output";
 import { isChildProject } from "../child-project";
 
 /**
@@ -137,7 +137,7 @@ export interface WireLexiconOutputEntity {
   form: "lexiconOutput";
   name: string;
   outputName: string;
-  /** The wrapped `AttrRef` or `Intrinsic` — encodes to `{__attrRef}` or `{__intrinsic}` respectively (see {@link WireValue}). */
+  /** The wrapped `AttrRef`, `Intrinsic`, or literal — encodes to `{__attrRef}`, `{__intrinsic}`, or a plain JSON primitive respectively (chant #1121; see {@link WireValue}). */
   ref: WireValue;
 }
 
@@ -156,15 +156,22 @@ const CORE_FIELD_NAMES = new Set(["lexicon", "entityType", "kind", "props", "att
 
 /**
  * Read a `LexiconOutput`'s internal ref without re-deriving it — see the
- * `_intrinsic`/`_sourceParent` fields in `../lexicon-output.ts`. When it was
- * built from an `AttrRef`, `LexiconOutput` keeps only the parent `WeakRef` +
- * attribute name (not the original `AttrRef` instance), so a fresh one is
- * synthesized here — its logical name must be set explicitly (from
- * `entityNames`, the same map every other reference in this module resolves
- * names through) since it never went through `resolveAttrRefs`.
+ * `_intrinsic`/`_sourceParent`/`_literalValue` fields in `../lexicon-output.ts`.
+ * When it was built from an `AttrRef`, `LexiconOutput` keeps only the parent
+ * `WeakRef` + attribute name (not the original `AttrRef` instance), so a
+ * fresh one is synthesized here — its logical name must be set explicitly
+ * (from `entityNames`, the same map every other reference in this module
+ * resolves names through) since it never went through `resolveAttrRefs`.
+ *
+ * chant #1121 — a literal-valued output (a real string/number/boolean the
+ * author's code already computed, not a reference) has neither a parent nor
+ * an intrinsic to hand back; its `_literalValue` round-trips as a plain wire
+ * primitive instead, and `LexiconOutput`'s own constructor reconstructs it
+ * identically on decode (see `decodeEntitySet` below).
  */
-function lexiconOutputRef(output: LexiconOutput, entityNames: Map<unknown, string>): AttrRef | Intrinsic {
+function lexiconOutputRef(output: LexiconOutput, entityNames: Map<unknown, string>): AttrRef | Intrinsic | LexiconOutputLiteral {
   if (output._intrinsic) return output._intrinsic;
+  if (output._literalValue !== null) return output._literalValue;
   const parent = output._sourceParent?.deref();
   const parentName = parent ? entityNames.get(parent) : undefined;
   if (!parent || output.sourceAttribute === null || !parentName) {
@@ -475,9 +482,11 @@ export function decodeEntitySet(wire: EntitySetWire): Map<string, Declarable> {
     }
 
     // LexiconOutput — constructed via its real constructor from the decoded
-    // ref, so it derives sourceLexicon/_sourceParent/sourceAttribute exactly
-    // the way constructing it from a live AttrRef/Intrinsic would.
-    const ref = decodeValue(entry.ref, registry) as AttrRef | Intrinsic;
+    // ref, so it derives sourceLexicon/_sourceParent/sourceAttribute/
+    // _literalValue exactly the way constructing it from a live
+    // AttrRef/Intrinsic/literal would (chant #1121 for the literal case: a
+    // plain wire primitive decodes back to itself, see `decodeValue` above).
+    const ref = decodeValue(entry.ref, registry) as AttrRef | Intrinsic | LexiconOutputLiteral;
     const output = new LexiconOutput(ref, entry.outputName);
     registry.set(entry.name, output);
     result.set(entry.name, output as unknown as Declarable);

package/src/discovery/entity-wire.test.ts

@@ -197,6 +197,32 @@ describe("entity-wire round trip (chant #1045 Phase 1)", () => {
     expect(isAttrRefLike(embedded[0])).toBe(true);
   });
 
+  // chant #1121 — before this fix, encoding a literal-valued LexiconOutput
+  // (neither an AttrRef nor an Intrinsic) threw
+  // `encodeEntitySet: LexiconOutput "..." has neither a resolvable AttrRef
+  // parent nor an intrinsic` — this is the sandboxed-child boundary a
+  // `chant build --sandbox` run crosses for every entity, so a project using
+  // `output("literal", "name")` could not build under `--sandbox` at all.
+  test.each([
+    ["string", "fold-output-repro"],
+    ["number", 42],
+    ["boolean", true],
+  ] as const)("LexiconOutput built from a %s literal round-trips via its real constructor", (_kind, value) => {
+    const lexOutput = new LexiconOutput(value, "LiteralOut");
+    const entities = new Map<string, Declarable>([["LiteralOut", lexOutput as unknown as Declarable]]);
+
+    const wire = encodeEntitySet(entities);
+    assertPureJson(wire);
+
+    const decoded = decodeEntitySet(JSON.parse(JSON.stringify(wire)) as EntitySetWire);
+    const decodedOutput = decoded.get("LiteralOut") as unknown as LexiconOutput;
+    expect(isLexiconOutput(decodedOutput)).toBe(true);
+    expect(decodedOutput.outputName).toBe("LiteralOut");
+    expect(decodedOutput.sourceEntity).toBe("");
+    expect(decodedOutput.sourceAttribute).toBeNull();
+    expect(decodedOutput.getOutputValue()).toBe(value);
+  });
+
   test("a lexicon-specific marker symbol (not core-owned) round-trips generically", () => {
     const MARKER = Symbol.for("chant.test.customMarker");
     const custom: Declarable = {

package/src/discovery/sandbox/config-boundary.test.ts

@@ -0,0 +1,239 @@
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdir, writeFile, rm, realpath } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { loadChantConfig } from "../../config";
+import {
+  armSandboxConfigEvaluation,
+  evaluateProjectConfigSync,
+  isSandboxConfigEvaluationArmed,
+  resetSandboxConfigEvaluationForTests,
+} from "../../config-sandbox";
+import { ENV_VAR } from "../../env";
+
+/**
+ * chant #1113 — `chant.config.ts` is project-authored code, and under
+ * `--sandbox` it must not execute in the CLI's process.
+ *
+ * Same shape of proof as `./fold-boundary.test.ts` (chant #1093): the fixture
+ * config sets a `globalThis` marker at module top level, and a marker set
+ * inside the sandboxed child cannot reach this process. Every pair asserts the
+ * UNARMED half fires the marker first, so the probe is proven capable of
+ * failing before the armed half asserts it stays clean.
+ *
+ * Fixtures go to a fresh tmpdir per test — never the source tree — so no two
+ * tests share a module path and nothing bleeds through Node's module cache.
+ */
+
+const MARKER = "__chant1113ConfigEvaluated";
+
+type MarkerHost = Record<string, boolean | undefined>;
+
+function marker(): boolean | undefined {
+  return (globalThis as unknown as MarkerHost)[MARKER];
+}
+
+describe("chant.config.ts evaluation under --sandbox (chant #1113)", () => {
+  let testDir: string;
+  let savedEnv: string | undefined;
+
+  beforeEach(async () => {
+    const dir = join(tmpdir(), `chant-1113-config-${Date.now()}-${Math.random()}`);
+    await mkdir(dir, { recursive: true });
+    testDir = await realpath(dir);
+    delete (globalThis as unknown as MarkerHost)[MARKER];
+    savedEnv = process.env[ENV_VAR];
+    resetSandboxConfigEvaluationForTests();
+  });
+
+  afterEach(async () => {
+    delete (globalThis as unknown as MarkerHost)[MARKER];
+    if (savedEnv === undefined) delete process.env[ENV_VAR];
+    else process.env[ENV_VAR] = savedEnv;
+    resetSandboxConfigEvaluationForTests();
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  /** A config that announces its own evaluation, the way any project file's top level can. */
+  async function writeMarkerConfig(body = `{ lexicons: ["aws"], ownership: { stack: "s" } }`): Promise<void> {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `globalThis[${JSON.stringify(MARKER)}] = true;\nexport default ${body};\n`,
+    );
+  }
+
+  test("without --sandbox the config DOES evaluate in this process (the probe fires)", async () => {
+    await writeMarkerConfig();
+
+    const { config } = await loadChantConfig(testDir);
+
+    expect(isSandboxConfigEvaluationArmed()).toBe(false);
+    expect(marker(), "the config's top level ran in this process").toBe(true);
+    expect(config.lexicons).toEqual(["aws"]);
+    expect(config.ownership).toEqual({ stack: "s" });
+  });
+
+  test("armed, the same config evaluates in the child: no marker here, same config", async () => {
+    await writeMarkerConfig();
+    armSandboxConfigEvaluation();
+
+    const { config, configPath } = await loadChantConfig(testDir);
+
+    expect(marker(), "the config's top level must NOT run in the CLI process").toBeUndefined();
+    expect(configPath).toBe(join(testDir, "chant.config.ts"));
+    expect(config.lexicons).toEqual(["aws"]);
+    expect(config.ownership).toEqual({ stack: "s" });
+  });
+
+  test("a config authored as a named `config` export crosses the same way", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `globalThis[${JSON.stringify(MARKER)}] = true;\nexport const config = { lexicons: ["k8s"] };\n`,
+    );
+    armSandboxConfigEvaluation();
+
+    const { config } = await loadChantConfig(testDir);
+
+    expect(marker()).toBeUndefined();
+    expect(config.lexicons).toEqual(["k8s"]);
+  });
+
+  test("nested data — buildParams, stacks, lint rules — survives the round trip", async () => {
+    await writeMarkerConfig(
+      `{
+         lexicons: ["aws"],
+         stacks: [{ name: "net", src: "src/net" }, { name: "app", src: "src/app" }],
+         buildParams: { tier: { type: "string", default: "light", enum: ["light", "prod"] } },
+         lint: { rules: { COR001: "error", COR002: ["warning", { max: 3 }] }, policies: ["policies/org.ts"] },
+       }`,
+    );
+    armSandboxConfigEvaluation();
+
+    const { config } = await loadChantConfig(testDir);
+
+    expect(marker()).toBeUndefined();
+    expect(config.stacks).toEqual([
+      { name: "net", src: "src/net" },
+      { name: "app", src: "src/app" },
+    ]);
+    expect(config.buildParams).toEqual({
+      tier: { type: "string", default: "light", enum: ["light", "prod"] },
+    });
+    expect(config.lint?.rules).toEqual({ COR001: "error", COR002: ["warning", { max: 3 }] });
+    expect(config.lint?.policies).toEqual(["policies/org.ts"]);
+  });
+
+  test("chant.config.json needs no child — it is data, parsed in-process either way", async () => {
+    await writeFile(
+      join(testDir, "chant.config.json"),
+      JSON.stringify({ lexicons: ["gcp"], build: { sandbox: true } }),
+    );
+    armSandboxConfigEvaluation();
+
+    const { config, configPath } = await loadChantConfig(testDir);
+
+    expect(configPath).toBe(join(testDir, "chant.config.json"));
+    expect(config.lexicons).toEqual(["gcp"]);
+  });
+
+  test("a value that cannot cross as JSON is refused, naming the key", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `export default { lexicons: ["aws"], hooks: { beforeBuild: () => 1 } };\n`,
+    );
+    armSandboxConfigEvaluation();
+
+    await expect(loadChantConfig(testDir)).rejects.toThrow(/hooks\.beforeBuild: a function/);
+    expect(marker()).toBeUndefined();
+  });
+
+  test("a Date is refused too — JSON.stringify would silently turn it into a string", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `export default { lexicons: ["aws"], meta: { generatedAt: new Date(0) } };\n`,
+    );
+    armSandboxConfigEvaluation();
+
+    await expect(loadChantConfig(testDir)).rejects.toThrow(/meta\.generatedAt: a Date/);
+  });
+
+  test("a config that reads outside the project is denied, naming the config file", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `import { readFileSync } from "node:fs";\n` +
+        `const stolen = readFileSync("/etc/hosts", "utf-8");\n` +
+        `export default { lexicons: [stolen.slice(0, 3)] };\n`,
+    );
+    armSandboxConfigEvaluation();
+
+    await expect(loadChantConfig(testDir)).rejects.toThrow(/sandbox denied FileSystemRead/);
+  });
+
+  test("a config that tries to spawn a process is denied", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `import { execSync } from "node:child_process";\n` +
+        `execSync("echo pwned");\n` +
+        `export default { lexicons: ["aws"] };\n`,
+    );
+    armSandboxConfigEvaluation();
+
+    await expect(loadChantConfig(testDir)).rejects.toThrow(/sandbox denied/);
+  });
+
+  test("the child's environment is scrubbed — but --env still reaches the config", async () => {
+    process.env[ENV_VAR] = "prod";
+    process.env.CHANT_1113_SECRET = "hunter2";
+    try {
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default {\n` +
+          `  environments: [process.env[${JSON.stringify(ENV_VAR)}] ?? "none"],\n` +
+          `  sourceDir: process.env.CHANT_1113_SECRET ?? "scrubbed",\n` +
+          `};\n`,
+      );
+      armSandboxConfigEvaluation();
+
+      const { config } = await loadChantConfig(testDir);
+
+      expect(config.environments, "--env is forwarded so the config resolves the same either way").toEqual(["prod"]);
+      expect(config.sourceDir, "nothing else from the CLI's environment is visible").toBe("scrubbed");
+    } finally {
+      delete process.env.CHANT_1113_SECRET;
+    }
+  });
+
+  test("an armed load is memoized, so repeated loads cost one child, not one each", async () => {
+    await writeMarkerConfig();
+    armSandboxConfigEvaluation();
+
+    const first = await loadChantConfig(testDir);
+    const second = await loadChantConfig(testDir);
+
+    expect(second.config).toBe(first.config);
+    expect(marker()).toBeUndefined();
+  });
+
+  test("the sync lint loader reuses that result rather than requiring the file", async () => {
+    await writeMarkerConfig(`{ lexicons: ["aws"], lint: { rules: { COR001: "warning" } } }`);
+    armSandboxConfigEvaluation();
+
+    await loadChantConfig(testDir);
+    const config = evaluateProjectConfigSync(join(testDir, "chant.config.ts"), testDir) as {
+      lint?: { rules?: Record<string, unknown> };
+    };
+
+    expect(config.lint?.rules?.COR001).toBe("warning");
+    expect(marker()).toBeUndefined();
+  });
+
+  test("the sync lint loader refuses rather than importing when nothing was evaluated yet", async () => {
+    await writeMarkerConfig();
+    armSandboxConfigEvaluation();
+
+    expect(() => evaluateProjectConfigSync(join(testDir, "chant.config.ts"), testDir)).toThrow(
+      /Cannot read .* synchronously under --sandbox/,
+    );
+    expect(marker()).toBeUndefined();
+  });
+});