@intentius/chant 0.24.0 → 0.26.0

package/src/build.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { describe, test, expect, beforeEach, afterEach, vi } from "vitest";
 import { build, partitionByLexicon, detectCrossLexiconRefs, collectLexiconOutputs, computeStackGraph } from "./build";
 import { output } from "./lexicon-output";
 import { AttrRef } from "./attrref";
@@ -467,6 +467,25 @@ describe("detectCrossLexiconRefs", () => {
     expect(collected[0].getOutputValue()).toEqual({ "Fn::Sub": "http://example.com/path" });
   });
 
+  // chant #1121 — `output(<already-resolved value>, name)`, exactly the
+  // shape of a top-level `export const oParamName = output(data.Name,
+  // "oParamName")`, must reach the serializer as a plain `Value`, never a
+  // `Fn::GetAtt` pointing at the output's own logical id.
+  test("literal-valued output() emits its value verbatim, not a self-referencing Fn::GetAtt", () => {
+    const literalOutput = output("fold-output-repro", "oParamName");
+
+    const entities = new Map<string, Declarable>([
+      ["oParamName", literalOutput as unknown as Declarable],
+    ]);
+
+    const collected = collectLexiconOutputs(entities);
+    expect(collected).toHaveLength(1);
+    expect(collected[0].outputName).toBe("oParamName");
+    expect(collected[0].sourceEntity).toBe("");
+    expect(collected[0].sourceAttribute).toBeNull();
+    expect(collected[0].getOutputValue()).toBe("fold-output-repro");
+  });
+
   test("deduplicates when same cross-lexicon ref appears in multiple entities", () => {
     const alphaBucket = {
       lexicon: "alpha",
@@ -580,6 +599,58 @@ describe("detectCrossLexiconRefs", () => {
     const detected = detectCrossLexiconRefs(entities);
     expect(detected).toHaveLength(0);
   });
+
+  // chant #1137 — `detectCrossLexiconRefs`'s walk used to check
+  // `value instanceof AttrRef`, which returns false for an AttrRef built by
+  // a SEPARATELY-LOADED copy of `./attrref` (the same dual-npm-copy hazard
+  // #1122 fixed for `LexiconOutput`: a lexicon pinned to a chant range that
+  // doesn't overlap the project's own gets its own nested
+  // `node_modules/@intentius/chant`). `vi.resetModules()` + a fresh dynamic
+  // import reproduces that split module graph exactly. Before the fix, a
+  // foreign AttrRef here falls through to the generic object walk instead
+  // of being recognized, and the auto-detected `Outputs` entry vanishes
+  // silently — no error, just a missing cross-lexicon output.
+  test("detects a cross-lexicon ref built by a second, separately-loaded copy of AttrRef", async () => {
+    const alphaBucket = {
+      lexicon: "alpha",
+      entityType: "Alpha::Storage::Bucket",
+      [DECLARABLE_MARKER]: true,
+    } as Declarable;
+
+    vi.resetModules();
+    const secondCopy = await import("./attrref");
+
+    // Sanity check that this really is a distinct module instance — the
+    // premise the rest of the test depends on.
+    expect(secondCopy.AttrRef).not.toBe(AttrRef);
+
+    const foreignRef = new secondCopy.AttrRef(alphaBucket, "Endpoint");
+
+    // The historic bug: instanceof fails across separately-loaded copies of
+    // chant-core, even though the two classes are structurally identical.
+    expect(foreignRef instanceof AttrRef).toBe(false);
+
+    const ghAction = {
+      lexicon: "github",
+      entityType: "Action",
+      [DECLARABLE_MARKER]: true,
+      props: { url: foreignRef },
+    } as unknown as Declarable;
+
+    const entities = new Map<string, Declarable>([
+      ["dataBucket", alphaBucket],
+      ["deployAction", ghAction],
+    ]);
+
+    // The fix: `isAttrRefLike` duck-types on shape, so a foreign-copy
+    // AttrRef is still recognized and auto-detected as a cross-lexicon output.
+    const detected = detectCrossLexiconRefs(entities);
+    expect(detected).toHaveLength(1);
+    expect(detected[0].sourceLexicon).toBe("alpha");
+    expect(detected[0].sourceEntity).toBe("dataBucket");
+    expect(detected[0].sourceAttribute).toBe("Endpoint");
+    vi.resetModules();
+  });
 });
 
 describe("computeStackGraph (#200 — cross-stack apply ordering)", () => {
@@ -627,4 +698,28 @@ describe("computeStackGraph (#200 — cross-stack apply ordering)", () => {
     );
     expect(g.waves).toEqual([["base"], ["left", "right"], ["top"]]);
   });
+
+  // chant #1137 — same dual-npm-copy hazard as detectCrossLexiconRefs above,
+  // this time for the cross-stack apply-ordering graph: a foreign-copy
+  // AttrRef that fails `instanceof` here used to fall through to the
+  // generic object walk instead of producing an edge, silently dropping a
+  // real cross-stack dependency (which can misorder — or fail to detect a
+  // cycle in — the apply order this graph exists to compute).
+  test("infers a consumer→producer edge from an AttrRef built by a second, separately-loaded copy", async () => {
+    const vpc = ent("aws");
+
+    vi.resetModules();
+    const secondCopy = await import("./attrref");
+    expect(secondCopy.AttrRef).not.toBe(AttrRef);
+
+    const foreignRef = new secondCopy.AttrRef(vpc, "id");
+    expect(foreignRef instanceof AttrRef).toBe(false); // the historic bug
+
+    const svc = ent("k8s", { vpcId: foreignRef });
+    const g = computeStackGraph(new Map([["vpc", vpc], ["svc", svc]]), ["aws", "k8s"]);
+
+    expect(g.edges).toEqual([{ from: "k8s", to: "aws" }]);
+    expect(g.order).toEqual(["aws", "k8s"]);
+    vi.resetModules();
+  });
 });

package/src/build.ts

@@ -7,6 +7,7 @@ import type { BuildParamProvenance } from "./provenance";
 import { DiscoveryError, BuildError as BuildErrorClass } from "./errors";
 import { LexiconOutput, isLexiconOutput } from "./lexicon-output";
 import { AttrRef } from "./attrref";
+import { isAttrRefLike } from "./utils";
 import { isChildProject, type ChildProjectInstance } from "./child-project";
 import { discover, type DiscoveryResult, type FoldDecision } from "./discovery/index";
 import { decodeEntitySet, type DiscoveredEntitiesJson } from "./discovery/entity-wire";
@@ -77,7 +78,13 @@ export function computeStackGraph(
     if (value === null || value === undefined || typeof value !== "object") return;
     if (visited.has(value)) return;
     visited.add(value);
-    if (value instanceof AttrRef) {
+    // Duck-type, not `instanceof` (chant #1137): a lexicon built against a
+    // separate copy of `@intentius/chant` produces AttrRefs that fail
+    // `instanceof AttrRef` here but carry the same shape. Without this, a
+    // real cross-stack dependency silently falls through to the generic
+    // object walk below instead of producing an edge, which can misorder —
+    // or entirely drop — the apply order this graph exists to compute.
+    if (isAttrRefLike(value)) {
       const parent = value.parent.deref();
       const producer = parent ? (parent as Record<string, unknown>).lexicon : undefined;
       if (typeof producer === "string" && producer !== consumer) addEdge(consumer, producer);
@@ -296,18 +303,28 @@ export function collectLexiconOutputs(
   for (const [name, entity] of entities) {
     if (isLexiconOutput(entity as unknown)) {
       const lexiconOutput = entity as unknown as LexiconOutput;
-      // Resolve source entity name from the WeakRef parent identity
-      const parent = lexiconOutput._sourceParent?.deref();
-      let sourceName = name;
-      if (parent) {
-        for (const [entityName, e] of entities) {
-          if (e === parent) {
-            sourceName = entityName;
-            break;
+      // A literal-valued output (chant #1121) has no source entity at all —
+      // it isn't a reference to anything, so it must not fall back to the
+      // output's OWN map key the way an AttrRef whose parent didn't resolve
+      // would. Leaving `sourceEntity` empty keeps `getOutputValue()`'s
+      // (never-reached, for a literal) `Fn::GetAtt` fallback from ever being
+      // handed a bogus source, and keeps consumers that read `sourceEntity`
+      // directly (e.g. `graph-ir.ts`'s cross-stack export, the build
+      // manifest) from reporting the output as its own source.
+      if (lexiconOutput._literalValue === null) {
+        // Resolve source entity name from the WeakRef parent identity
+        const parent = lexiconOutput._sourceParent?.deref();
+        let sourceName = name;
+        if (parent) {
+          for (const [entityName, e] of entities) {
+            if (e === parent) {
+              sourceName = entityName;
+              break;
+            }
           }
         }
+        lexiconOutput._setSourceEntity(sourceName);
       }
-      lexiconOutput._setSourceEntity(sourceName);
       outputs.push(lexiconOutput);
       continue;
     }
@@ -317,7 +334,8 @@ export function collectLexiconOutputs(
       const prevLength = outputs.length;
       walk(entity.props);
       for (let i = prevLength; i < outputs.length; i++) {
-        if (!outputs[i].sourceEntity) {
+        // Same #1121 guard as above — a literal has no source entity to name.
+        if (!outputs[i].sourceEntity && outputs[i]._literalValue === null) {
           outputs[i]._setSourceEntity(name);
         }
       }
@@ -359,7 +377,13 @@ export function detectCrossLexiconRefs(
     if (visited.has(value)) return;
     visited.add(value);
 
-    if (value instanceof AttrRef) {
+    // Duck-type, not `instanceof` (chant #1137): a lexicon built against a
+    // separate copy of `@intentius/chant` produces AttrRefs that fail
+    // `instanceof AttrRef` here but carry the same shape. Without this, a
+    // real cross-lexicon reference silently falls through to the generic
+    // object walk below instead of auto-creating a `LexiconOutput`, and the
+    // whole `Outputs` entry for it vanishes (same failure shape as #1122).
+    if (isAttrRefLike(value)) {
       const parent = value.parent.deref();
       if (!parent) return;
 

package/src/cli/commands/build.ts

@@ -5,6 +5,7 @@ import type { Serializer, SerializerResult } from "../../serializer";
 import type { LexiconPlugin } from "../../lexicon";
 import { runPostSynthChecks } from "../../lint/post-synth";
 import { loadPolicyChecks } from "../../lint/policy";
+import { armSandboxPolicyExecution, runProjectPolicies } from "../../lint/policy-sandbox";
 import { sortedJsonReplacer } from "../../utils";
 import { formatError, formatWarning, formatSuccess, formatBold, formatInfo } from "../format";
 import { writeFileSync, mkdirSync } from "fs";
@@ -144,9 +145,7 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // Project-authored organizational policy checks (lint.policies), run over the
   // resolved resources during build. Resolve paths relative to the config dir.
   const configDir = loaded.configPath ? dirname(loaded.configPath) : infraPath;
-  const policyChecks = config.lint?.policies?.length
-    ? await loadPolicyChecks(config.lint.policies, configDir)
-    : [];
+  const policies = config.lint?.policies ?? [];
 
   // #1022 — opt-in fold path: the CLI flag wins over `chant.config.ts`'s
   // `build.fold`, which wins over the (unchanged) default of running every
@@ -158,6 +157,35 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // as fold, resolved independently.
   const sandbox = resolveSandboxEnabled(config, options.sandbox);
 
+  // #1131 — arm sandboxed policy execution from the RESOLVED value, before any
+  // policy module could be loaded. Resolved, not `options.sandbox`, because
+  // policies have none of the config's bootstrap limit: they are loaded long
+  // after `build.sandbox` is known, so a config-only opt-in sandboxes them just
+  // as the CLI flag does. Arming (rather than threading a flag to each caller)
+  // makes `loadPolicyChecks` refuse process-wide — a call site that forgot to
+  // ask gets a loud error instead of quietly running project code here.
+  if (sandbox) armSandboxPolicyExecution();
+
+  // Unsandboxed, the policy pack is still loaded HERE, before the build — a
+  // policy path that doesn't resolve has always failed the command up front,
+  // including when the build itself then fails, and #1131 does not change that.
+  // Sandboxed, there is nothing to load in this process at all.
+  const preloadedPolicyChecks =
+    !sandbox && policies.length > 0 ? await loadPolicyChecks([...policies], configDir) : undefined;
+
+  // #1113 — the bootstrap limit, surfaced rather than left implicit. Reading
+  // `build.sandbox` out of `chant.config.ts` requires evaluating that file, so
+  // a config-only opt-in cannot have covered its own evaluation; only the CLI
+  // flag, known before any config is touched, arms `../config-sandbox.ts`.
+  // Say so instead of letting two different boundaries share one word.
+  if (sandbox && !options.sandbox && loaded.configPath?.endsWith(".ts")) {
+    warnings.push(
+      formatWarning({
+        message: `build.sandbox is enabled by ${loaded.configPath}, but that file was itself evaluated in this process — reading the setting requires running the config. Pass --sandbox on the command line to evaluate chant.config.ts inside the boundary too.`,
+      }),
+    );
+  }
+
   // #1064 (factored into ../build-params-cli.ts's resolveCliBuildParams by
   // #1108, so the component deploy driver runs the identical sequence) —
   // resolve declared build-time parameters (chant.config.ts's buildParams)
@@ -285,8 +313,21 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
 
     // Project-authored organizational policy — cross-cutting, so it sees every
     // lexicon's output at once (not scoped per-plugin), with the current env.
-    if (policyChecks.length > 0) {
-      const policyDiags = runPostSynthChecks(policyChecks, result, env);
+    //
+    // #1131 — under `--sandbox` this is where the LAST piece of project-
+    // authored code the CLI used to execute in its own process moves behind
+    // the boundary: `runProjectPolicies` hands the merged, serialized build
+    // result to a post-merge sandboxed child, which imports the policy modules
+    // and runs their checks there, and only plain `PostSynthDiagnostic`s come
+    // back. Unsandboxed, it is the same in-process load-and-run as before.
+    if (policies.length > 0) {
+      const policyDiags = await runProjectPolicies({
+        policies,
+        configDir,
+        buildResult: result,
+        env,
+        preloaded: preloadedPolicyChecks,
+      });
       for (const diag of policyDiags) {
         const prefix = diag.entity ? `[${diag.entity}] ` : "";
         const where = diag.lexicon ? ` (${diag.lexicon})` : "";

package/src/cli/main.test.ts

@@ -130,10 +130,23 @@ describe("parseArgs", () => {
     expect(result.help).toBe(false);
   });
 
-  test("ignores unknown flags", () => {
-    const result = parseArgs(["build", "--unknown", "value"]);
+  test("throws on an unknown bare flag instead of silently ignoring it (chant #1127)", () => {
+    // Was "ignores unknown flags" — pinned the old silent-drop as intended
+    // behavior. #1127 flips it: an unrecognized `--flag` is a hard error.
+    expect(() => parseArgs(["build", "--unknown", "value"])).toThrow(/Unknown flag: --unknown/);
+  });
+
+  test("unknown flag error points at --help", () => {
+    expect(() => parseArgs(["build", "--unknown"])).toThrow(/--help/);
+  });
+
+  test("throws on an unknown joined flag (--unknown=value)", () => {
+    expect(() => parseArgs(["build", "--unknown=value"])).toThrow(/Unknown flag: --unknown/);
+  });
+
+  test("unknown short flags are still silently ignored (unchanged; out of #1127 scope)", () => {
+    const result = parseArgs(["build", "-x", "value"]);
     expect(result.command).toBe("build");
-    // Unknown flags are silently ignored
   });
 
   test("parses --watch flag", () => {
@@ -271,27 +284,90 @@ describe("parseArgs", () => {
     expect(result.paramsFile).toBe("./params.json");
   });
 
-  // ── --param=name=value hard error (chant #1118) ──────────────────────────
-  // The joined `--flag=value` form is not supported anywhere in this parser
-  // (see "ignores unknown flags" above) — a dropped --param can silently
-  // change what a build measures/deploys, so this form is rejected loudly
-  // instead of silently accepted as a no-op.
+  test("plain --param name=value is unaffected", () => {
+    const result = parseArgs(["build", "src", "--param", "tier=production"]);
+    expect(result.param).toEqual(["tier=production"]);
+  });
+
+  // ── generic --flag=value joined form (chant #1127) ────────────────────────
+  // #1118 taught this parser to hard-error `--param=name=value` specifically,
+  // because it was the one flag known (from #1118's investigation) to sit
+  // behind a silent drop. #1127's audit found the drop was general — every
+  // value-taking flag shares it — so the fix is general too: split any
+  // `--flag=value` token at its first `=` and re-dispatch as `--flag` +
+  // `value`, the exact shape every branch below already handles. This
+  // supersedes #1118's `--param=` hard error entirely: the joined form is now
+  // just as valid as the space-separated one, for every flag, not a rejected
+  // special case for one flag.
 
-  test("--param=name=value throws instead of silently dropping", () => {
-    expect(() => parseArgs(["build", "src", "--param=tier=production"])).toThrow(/--param=tier=production/);
+  test("--param=name=value now works instead of throwing — joined form matches the space-separated form", () => {
+    const result = parseArgs(["build", "src", "--param=tier=production"]);
+    expect(result.param).toEqual(["tier=production"]);
   });
 
-  test("--param=name=value error names the working form", () => {
-    expect(() => parseArgs(["build", "src", "--param=tier=production"])).toThrow(/--param name=value/);
+  test("--env=value joined form works", () => {
+    const result = parseArgs(["build", "src", "--env=staging"]);
+    expect(result.env).toBe("staging");
   });
 
-  test("--param= (empty value) also throws", () => {
-    expect(() => parseArgs(["build", "src", "--param="])).toThrow(/--param=/);
+  test("--format=value joined form works", () => {
+    const result = parseArgs(["build", "src", "--format=yaml"]);
+    expect(result.format).toBe("yaml");
   });
 
-  test("plain --param name=value is unaffected", () => {
-    const result = parseArgs(["build", "src", "--param", "tier=production"]);
-    expect(result.param).toEqual(["tier=production"]);
+  test("--lexicon=value joined form works", () => {
+    const result = parseArgs(["build", "src", "--lexicon=aws"]);
+    expect(result.lexicon).toBe("aws");
+  });
+
+  test("repeated --param=name=value (joined) accumulates in order, same as space-separated", () => {
+    const result = parseArgs(["build", "src", "--param=tier=production", "--param=env=staging"]);
+    expect(result.param).toEqual(["tier=production", "env=staging"]);
+  });
+
+  test("joined form only splits on the FIRST '=' — a value containing '=' is preserved whole", () => {
+    // --param's own value shape is `name=value`, so `--param=tier=production`
+    // must split into flag `--param` + value `tier=production`, not further
+    // fragment on the second `=`.
+    const result = parseArgs(["build", "src", "--param=tier=production=east"]);
+    expect(result.param).toEqual(["tier=production=east"]);
+  });
+
+  test("joined form works mixed with space-separated flags in the same invocation", () => {
+    const result = parseArgs(["build", "src", "--env=prod", "--format", "json", "--lexicon=k8s"]);
+    expect(result.env).toBe("prod");
+    expect(result.format).toBe("json");
+    expect(result.lexicon).toBe("k8s");
+  });
+
+  // ── boolean-only flag given a joined value (chant #1127) ──────────────────
+  // Decision: reject it. A boolean flag (--fold, --watch, --json, ...) has no
+  // value slot — its branch just sets a field to `true` and never consumes a
+  // following token. Silently coercing "true"/"false" would need to invent
+  // parsing rules (what about "1", "yes", mixed case?) for a form none of
+  // this CLI's flags need; silently dropping the value and reinterpreting it
+  // as the next positional (a path, a component name, ...) is exactly the
+  // silent misparse #1127 closes. So it errors, naming the flag as boolean.
+
+  test("a boolean flag given a joined value throws, naming the flag as boolean", () => {
+    expect(() => parseArgs(["build", "src", "--fold=true"])).toThrow(/--fold is a boolean flag/);
+  });
+
+  test("boolean-with-value error does not silently reinterpret the value as a positional", () => {
+    expect(() => parseArgs(["build", "src", "--watch=false"])).toThrow(/--watch is a boolean flag/);
+  });
+
+  test("--json=1 (another boolean flag) also throws", () => {
+    expect(() => parseArgs(["run", "myop", "--json=1"])).toThrow(/--json is a boolean flag/);
+  });
+
+  test("--report keeps its context-sensitive bare-vs-value behavior when joined", () => {
+    // --report is deliberately not in the boolean-reject set: bare --report is
+    // a boolean (`run`), but --report <path> is a SARIF destination (migrate).
+    // The joined form should resolve the same way the space-separated one does.
+    const result = parseArgs(["migrate", "wf.yml", "--report=out.sarif"]);
+    expect(result.reportFile).toBe("out.sarif");
+    expect(result.report).toBeUndefined();
   });
 });
 

package/src/cli/main.ts

@@ -6,6 +6,8 @@ import { formatSuccess, formatError } from "./format";
 import { loadPlugins, resolveProjectLexicons } from "./plugins";
 import { resolveCommand, type CommandDef, type ParsedArgs } from "./registry";
 import { loadChantConfigUpward } from "../config";
+import { armSandboxConfigEvaluation } from "../config-sandbox";
+import { armSandboxPolicyExecution } from "../lint/policy-import";
 import { ENV_VAR, unknownEnvError } from "../env";
 import { initRuntime } from "../runtime-adapter";
 import { runBuild } from "./handlers/build";
@@ -26,10 +28,60 @@ import { runGraph } from "./handlers/graph";
 import { runOp, runOpList, runOpStatus, runOpSignal, runOpCancel, runOpLog } from "./handlers/run";
 import { runEmulator } from "./handlers/emulator";
 
+/**
+ * Long-form flags that are pure booleans in {@link parseArgs} — their branch
+ * below sets a field to `true` and never consumes a following array element.
+ * Used only to reject a joined `--flag=value` form for these (chant #1127):
+ * a boolean has no value to assign, and silently reinterpreting the joined
+ * value as the next positional argument (path, component name, ...) would be
+ * exactly the kind of silent misparse this issue exists to close. `--report`
+ * is deliberately excluded — it's context-sensitive (bare boolean vs a SARIF
+ * path, decided by lookahead), so a joined value for it is legitimate and
+ * already handled correctly once split.
+ */
+const BOOLEAN_FLAGS = new Set([
+  "--help",
+  "--force",
+  "--fix",
+  "--watch",
+  "--verbose",
+  "--live",
+  "--overlay",
+  "--owned",
+  "--verbatim",
+  "--apply-rewrites",
+  "--write",
+  "--strict",
+  "--validate",
+  "--use-composites",
+  "--stacks",
+  "--components",
+  "--up",
+  "--down",
+  "--include-dependents",
+  "--local",
+  "--temporal",
+  "--json",
+  "--progress-json",
+  "--update-snapshot",
+  "--run-examples",
+  "--check",
+  "--bump",
+  "--no-release-record",
+  "--fold",
+  "--sandbox",
+]);
+
 /**
  * Parse command line arguments
  */
 export function parseArgs(args: string[]): ParsedArgs {
+  // Local mutable copy — chant #1127's joined-`--flag=value` splitting below
+  // rewrites the array in place (one token becomes two), so this must not
+  // mutate whatever array the caller passed in (e.g. `process.argv.slice(2)`
+  // is already a fresh copy, but callers shouldn't have to know that).
+  args = args.slice();
+
   const result: ParsedArgs = {
     command: "",
     path: ".",
@@ -66,7 +118,29 @@ export function parseArgs(args: string[]): ParsedArgs {
 
   let i = 0;
   while (i < args.length) {
-    const arg = args[i];
+    let arg = args[i];
+
+    // chant #1127 — generic joined `--flag=value` support. Every value-taking
+    // flag below is matched by an exact `arg === "--flag"` check and then
+    // consumes the *next* array element (`args[++i]`) as its value; a joined
+    // token like `--env=prod` never matches any of those, doesn't match the
+    // trailing positional branch either (it starts with `-`), and used to
+    // vanish with no error. Splitting the token at its FIRST `=` and
+    // re-dispatching as two array elements makes every flag below see the
+    // exact shape it already handles — including a flag like `--param`
+    // whose own value legitimately contains `=` (`--param=tier=production`
+    // splits to flag `--param`, value `tier=production`, not further split
+    // on the second `=`).
+    if (arg.startsWith("--") && arg.includes("=")) {
+      const eq = arg.indexOf("=");
+      const flag = arg.slice(0, eq);
+      const value = arg.slice(eq + 1);
+      if (BOOLEAN_FLAGS.has(flag)) {
+        throw new Error(`${arg} — ${flag} is a boolean flag and does not take a value. Pass ${flag} on its own.`);
+      }
+      args.splice(i, 1, flag, value);
+      arg = args[i];
+    }
 
     if (arg === "--help" || arg === "-h") {
       result.help = true;
@@ -223,19 +297,28 @@ export function parseArgs(args: string[]): ParsedArgs {
     } else if (arg === "--sandbox") {
       result.sandbox = true;
     } else if (arg === "--param") {
+      // chant #1118/#1127 — `--param name=value` (space-separated) and
+      // `--param=name=value` (joined, split above at its first `=` into flag
+      // `--param` + value `name=value`) both land here and behave
+      // identically; there is no separate joined-form error anymore (the
+      // #1118 hard error this superseded only existed because the parser
+      // didn't support joined forms at all — now that it does, the joined
+      // form is just as valid as the space-separated one).
       (result.param ??= []).push(args[++i]);
-    } else if (arg.startsWith("--param=")) {
-      // chant #1118 — this parser never supports an `--flag=value` joined
-      // form for any value-taking flag (every branch above is an exact `===`
-      // match, so a joined token falls through unrecognized and is silently
-      // dropped — see the "ignores unknown flags" case below). `--param
-      // name=value` (space-separated) is the only accepted form. Rather than
-      // teach the parser joined forms generally, `--param=name=value` is
-      // called out as a hard error instead of a silent no-op: a dropped
-      // `--param` can silently change what a build measures/deploys.
-      throw new Error(`${arg} is not supported. Use --param name=value (space-separated) instead.`);
     } else if (arg === "--params-file") {
       result.paramsFile = args[++i];
+    } else if (arg.startsWith("--")) {
+      // chant #1127 — every recognized flag is matched above; anything left
+      // starting with `--` is unrecognized, whether it arrived bare
+      // (`--bogus`) or joined (`--bogus=value`, already split into
+      // `--bogus` + `value` above). This used to fall through silently (the
+      // "ignores unknown flags" case) — a typo'd or misremembered flag would
+      // vanish with no diagnostic, exactly like the silent-drop this issue
+      // closes for joined values. Point at --help rather than enumerating
+      // every flag here: this parser's flag set is one flat list shared by
+      // every command, not scoped per-command, so "the command's known
+      // flags" isn't something this loop can name in isolation.
+      throw new Error(`Unknown flag: ${arg}\nRun "chant --help" to see supported flags.`);
     } else if (!arg.startsWith("-")) {
       if (!result.command) {
         result.command = arg;
@@ -598,6 +681,23 @@ async function main(): Promise<void> {
   // chant.config itself may branch on the env. (#505)
   if (args.env) process.env[ENV_VAR] = args.env;
 
+  // chant #1113 — `--sandbox` is a property of the whole invocation, and it
+  // has to be known BEFORE the first config load, because `chant.config.ts` is
+  // itself project-authored code. Arming here, straight off the parsed flag,
+  // is the only ordering that works: the project's own `build.sandbox: true`
+  // cannot cover its own evaluation (reading it means running it), so the
+  // command-line flag is what puts the config inside the boundary. See
+  // `../config-sandbox.ts`.
+  if (args.sandbox) armSandboxConfigEvaluation();
+
+  // chant #1131 — the same for `lint.policies`. Armed from the flag here so
+  // the mode is set for the whole invocation, not just `chant build`; the build
+  // command arms it again from the RESOLVED value (a project's own
+  // `build.sandbox: true` also sandboxes its policies — unlike the config,
+  // policies have no bootstrap limit, since they load long after the config is
+  // known). See `../lint/policy-sandbox.ts`.
+  if (args.sandbox) armSandboxPolicyExecution();
+
   // Initialize runtime adapter early — before plugins or commands run.
   // chant #1117 — walks up from `args.path` to the project root: for a
   // subdirectory build/command (`chant build src/<stack> --env prod`) the

package/src/config-import.ts

@@ -0,0 +1,43 @@
+import { createRequire } from "node:module";
+import { join } from "node:path";
+
+/**
+ * The single place chant evaluates a project's `chant.config.ts` **in the CLI's
+ * own process**.
+ *
+ * This is the config-side analogue of `./discovery/import.ts`'s `importModule`
+ * — one narrow module whose only job is "execute project-authored code here",
+ * so that the question "did any project code run in this process?" has one
+ * place to look and one place to instrument (see
+ * `examples/sandbox-execution-boundary.test.ts`, which spies on both).
+ *
+ * Callers must not `import()` a config file directly. `./config-sandbox.ts`
+ * decides whether a given load is allowed to come through here at all: under
+ * `chant build --sandbox` it routes the evaluation into the sandboxed child
+ * instead (chant #1113), and these functions are never reached.
+ *
+ * `chant.config.json` is pure data and is parsed, not executed — it never goes
+ * through this module.
+ */
+
+/** The shape a config module evaluates to, before `default`/`config`/namespace selection. */
+export type ConfigModuleNamespace = Record<string, unknown>;
+
+/**
+ * Import a `chant.config.ts` into THIS process and return its module namespace.
+ * Node's ESM registry caches it, so repeated loads within one CLI invocation
+ * evaluate the file once — the behavior `loadChantConfig` has always had.
+ */
+export async function importConfigModule(configPath: string): Promise<ConfigModuleNamespace> {
+  return (await import(configPath)) as ConfigModuleNamespace;
+}
+
+/**
+ * `require()` a `chant.config.ts` into THIS process from `dir`'s resolution
+ * context — the synchronous path `./lint/config.ts`'s `loadConfig` has used
+ * since before the async loader existed (`chant lint` is a sync pipeline).
+ */
+export function requireConfigModule(configPath: string, dir: string): ConfigModuleNamespace {
+  const req = createRequire(join(dir, "package.json"));
+  return req(configPath) as ConfigModuleNamespace;
+}