@intentius/chant 0.24.0 → 0.26.0

package/src/config-sandbox.ts

@@ -0,0 +1,138 @@
+import { dirname } from "node:path";
+import { importConfigModule, requireConfigModule, type ConfigModuleNamespace } from "./config-import";
+
+/**
+ * chant #1113 — decides WHERE a project's `chant.config.ts` is evaluated.
+ *
+ * `chant.config.ts` is project-authored code. Every other piece of project
+ * source moved behind the `--sandbox` boundary in chant #1045 (run-fallback
+ * files) and #1093 (composite factories, constructors, intrinsic tags), and
+ * both PRs had to document the config file as a remaining hole: the CLI reads
+ * its configuration by importing it, in-process, before it knows anything else
+ * about the project. This module closes it.
+ *
+ * ## Why an armed process mode rather than a threaded option
+ *
+ * Config is loaded from a dozen call sites (`../cli/main.ts` before command
+ * dispatch, `./cli/plugins.ts`'s `resolveProjectLexicons`,
+ * `./cli/commands/build.ts`, `./lint/policy.ts`, every lifecycle handler …).
+ * Threading a `sandbox` option to each one is fail-OPEN: miss a site and
+ * project code executes in the CLI process with nothing to notice it. Arming
+ * the process once, from the `--sandbox` flag, before any config load happens,
+ * is fail-CLOSED — a call site that nobody remembered still routes through the
+ * child.
+ *
+ * ## The bootstrap limit, stated plainly
+ *
+ * `chant.config.ts`'s own `build.sandbox: true` **cannot** sandbox its own
+ * evaluation. Reading that field requires evaluating the file, so by the time
+ * chant knows the project asked for sandboxing, the project's code has already
+ * run. Only `--sandbox` on the command line — known from `parseArgs`, before
+ * any config is touched — arms this. `chant build` warns when sandboxing was
+ * enabled by config alone, rather than letting the difference stay invisible.
+ * (A `chant.config.json` project has no such limit: JSON is data, parsed and
+ * never executed, so `build.sandbox: true` there is fully honest.)
+ *
+ * ## Memoization
+ *
+ * Armed loads are memoized per config path for the life of the process. That
+ * is not an optimization detail with a semantic cost: the unarmed path is
+ * already memoized by Node's own ESM registry (`await import()` evaluates a
+ * given config file once per process, so `chant build --watch` has never
+ * re-read a config mid-session either). Matching that keeps the two paths
+ * behaviorally identical while keeping a build to one bundle+fork instead of
+ * one per call site.
+ */
+
+/** Whether this process must evaluate project configs inside the sandbox boundary. */
+let armed = false;
+
+/** Armed-mode results, keyed by absolute config path. See the module doc on why this matches unarmed behavior rather than diverging from it. */
+const memo = new Map<string, unknown>();
+
+/**
+ * Arm sandboxed config evaluation for the rest of this process. Called from
+ * `../cli/main.ts` immediately after `parseArgs`, when `--sandbox` was passed
+ * — before the first config load. Idempotent; there is deliberately no
+ * disarm, because a security mode that can be turned off partway through a
+ * process is not one.
+ */
+export function armSandboxConfigEvaluation(): void {
+  armed = true;
+}
+
+/** Whether {@link armSandboxConfigEvaluation} has been called. */
+export function isSandboxConfigEvaluationArmed(): boolean {
+  return armed;
+}
+
+/**
+ * Test-only reset. Vitest gives each test file its own module registry, so
+ * this exists for suites that arm and disarm within one file.
+ */
+export function resetSandboxConfigEvaluationForTests(): void {
+  armed = false;
+  memo.clear();
+}
+
+/**
+ * The export a config module's configuration lives on: an explicit `default`,
+ * a named `config`, else the module namespace itself (a config authored as a
+ * set of top-level named exports). Applied identically on both sides of the
+ * boundary — in the child by `./discovery/sandbox/driver.ts`'s config driver,
+ * here for the in-process path — so `--sandbox` changes only where the file is
+ * evaluated, never how its result is read.
+ */
+export function selectConfigExport(namespace: ConfigModuleNamespace): unknown {
+  return namespace.default ?? namespace.config ?? namespace;
+}
+
+/**
+ * Evaluate a project's `chant.config.ts` and return its configuration object,
+ * pre-`normalizeConfig`. Sandboxed when armed, in-process otherwise.
+ *
+ * @param configPath - Absolute path to the config file.
+ * @param projectRoot - Directory to grant the sandboxed child read access to;
+ *   defaults to the config file's own directory.
+ */
+export async function evaluateProjectConfig(
+  configPath: string,
+  projectRoot: string = dirname(configPath),
+): Promise<unknown> {
+  if (!armed) {
+    return selectConfigExport(await importConfigModule(configPath));
+  }
+
+  if (memo.has(configPath)) return memo.get(configPath);
+
+  // Dynamic, not static, for the same reason `./discovery/index.ts` imports
+  // `./sandbox/run` dynamically: this pulls in `esbuild`, a large CJS package
+  // no unsandboxed build should pay to load.
+  const { evaluateConfigSandboxed } = await import("./discovery/sandbox/config-run");
+  const { config } = await evaluateConfigSandboxed(configPath, projectRoot);
+  memo.set(configPath, config);
+  return config;
+}
+
+/**
+ * Synchronous counterpart for `./lint/config.ts`'s `loadConfig` (`chant lint`
+ * is a sync pipeline and predates the async loader).
+ *
+ * When armed, this cannot spawn a child — so it uses the result of an earlier
+ * armed load of the same file, and refuses if there isn't one. In practice
+ * there always is: `../cli/main.ts` loads the project config before dispatching
+ * to any command. Refusing rather than falling back to an in-process `require`
+ * is the point — a sync call site is exactly where a boundary would otherwise
+ * be lost by accident.
+ */
+export function evaluateProjectConfigSync(configPath: string, dir: string): unknown {
+  if (!armed) {
+    return selectConfigExport(requireConfigModule(configPath, dir));
+  }
+
+  if (memo.has(configPath)) return memo.get(configPath);
+
+  throw new Error(
+    `Cannot read ${configPath} synchronously under --sandbox: it has not yet been evaluated inside the boundary, and evaluating it here would run project code in the chant process. This is a chant bug — the project config should have been loaded before this point.`,
+  );
+}

package/src/config.ts

@@ -8,6 +8,7 @@ import type { Severity } from "./components/verbs/vuln-scan";
 import type { VulnPolicy } from "./components/verbs/vuln-gate";
 import type { BuildParamsConfig } from "./build-params";
 import { findProjectConfig } from "./project-root";
+import { evaluateProjectConfig } from "./config-sandbox";
 
 /**
  * Zod schema for ChantConfig validation.
@@ -274,16 +275,24 @@ export const DEFAULT_CHANT_CONFIG: ChantConfig = {};
 /**
  * Load project configuration from a directory.
  *
- * Tries `chant.config.ts` first (via dynamic import), then `chant.config.json`.
- * Returns default config if neither exists.
+ * Tries `chant.config.ts` first, then `chant.config.json`. Returns default
+ * config if neither exists.
+ *
+ * chant #1113 — `chant.config.ts` is project-authored code, so *where* it is
+ * evaluated is a security question, and the answer is
+ * `./config-sandbox.ts`'s: in a sandboxed child when this process was armed by
+ * `chant build --sandbox`, in-process (exactly as before) otherwise. Either
+ * way the result is the same plain configuration object, and validation
+ * ({@link normalizeConfig}) happens here, in the trusted process.
+ * `chant.config.json` is data, not code — it is parsed in-process under
+ * `--sandbox` too, because there is nothing to execute.
  */
 export async function loadChantConfig(dir: string): Promise<ResolvedConfig> {
   // Try chant.config.ts first
   const tsPath = join(dir, "chant.config.ts");
   if (existsSync(tsPath)) {
-    const mod = await import(tsPath);
-    const config = mod.default ?? mod.config ?? mod;
-    return { config: normalizeConfig(config, tsPath), configPath: tsPath };
+    const config = await evaluateProjectConfig(tsPath, dir);
+    return { config: normalizeConfig(config as Record<string, unknown>, tsPath), configPath: tsPath };
   }
 
   // Fall back to chant.config.json

package/src/discovery/entity-wire-codec.ts

@@ -23,20 +23,25 @@
  * value) becomes a name-keyed marker instead. {@link decodeEntitySet} is the
  * inverse — it rebuilds a live `Map<string, Declarable>` whose entities are
  * BEHAVIORALLY indistinguishable from what `discover()` would have produced
- * in-process: real `AttrRef` instances (several call sites downstream key off
- * `instanceof AttrRef`, not just duck typing — `intrinsic-interpolation.ts`'s
+ * in-process: real `AttrRef` instances, not a duck-typed `{__attrRef}`
+ * envelope alone. `new AttrRef(...)` here is plain, direct construction from
+ * this module's own class — this codec runs inside the same module graph as
+ * every downstream reader (`intrinsic-interpolation.ts`'s
  * `defaultInterpolationSerializer`, `discovery/graph.ts`'s
  * `buildDependencyGraph`, `build.ts`'s `detectCrossLexiconRefs`/
- * `computeStackGraph` — so a plain `{__attrRef}` envelope alone is not
- * enough), and whole-entity embeds restored to the SAME object reference
- * (not a structurally-equal clone), so `entityNames.get(decl)` keeps working
- * by identity exactly as it does today.
+ * `computeStackGraph`, all converted to `isAttrRefLike` duck-typing by chant
+ * #1137 for the OTHER hazard, a separately-loaded lexicon copy) — so there is
+ * no dual-package boundary to duck-type across here, and building the real
+ * class is simply less code than hand-assembling a shape-alike stand-in with
+ * matching methods, and whole-entity embeds restored to the SAME object
+ * reference (not a structurally-equal clone), so `entityNames.get(decl)`
+ * keeps working by identity exactly as it does today.
  *
  * `serializer-walker.ts`'s `walkValue` needs NO changes for this: it already
  * falls back to reading a plain `{__attrRef}` envelope (added for intrinsics
  * whose own `toJSON()` embeds one). `decodeEntitySet` goes further and
- * reconstructs the real class so every OTHER `instanceof AttrRef` call site
- * keeps working too, not just the walker.
+ * reconstructs the real class, both simpler here and a belt-and-suspenders
+ * match for any call site that still checks `instanceof AttrRef` directly.
  *
  * Naming happens exactly once, inside the boundary — `resolveAttrRefs`
  * (./resolve.ts) runs as part of `discover()`, before `encodeEntitySet` is
@@ -58,7 +63,7 @@ import { DECLARABLE_MARKER, isResourceDeclarable, type Declarable } from "../dec
 import { AttrRef } from "../attrref";
 import { INTRINSIC_MARKER, type Intrinsic } from "../intrinsic";
 import { isAttrRefLike } from "../utils";
-import { isLexiconOutput, LexiconOutput } from "../lexicon-output";
+import { isLexiconOutput, LexiconOutput, type LexiconOutputLiteral } from "../lexicon-output";
 import { isChildProject } from "../child-project";
 
 /**
@@ -85,7 +90,7 @@ import { isChildProject } from "../child-project";
  *   form. `refs` additionally captures any `AttrRef`/whole-entity reference
  *   found while walking the intrinsic's OWN fields (not through `toJSON()`)
  *   — `buildDependencyGraph` and `detectCrossLexiconRefs`/`computeStackGraph`
- *   walk raw entity property trees looking for `instanceof AttrRef`/a
+ *   walk raw entity property trees looking for an `AttrRef`-like value/a
  *   tracked `Declarable`, not through `toJSON()`, so a ref nested inside e.g.
  *   a `Sub` template needs to still be discoverable post-decode for
  *   cross-lexicon output auto-detection and dependency ordering to keep
@@ -137,7 +142,7 @@ export interface WireLexiconOutputEntity {
   form: "lexiconOutput";
   name: string;
   outputName: string;
-  /** The wrapped `AttrRef` or `Intrinsic` — encodes to `{__attrRef}` or `{__intrinsic}` respectively (see {@link WireValue}). */
+  /** The wrapped `AttrRef`, `Intrinsic`, or literal — encodes to `{__attrRef}`, `{__intrinsic}`, or a plain JSON primitive respectively (chant #1121; see {@link WireValue}). */
   ref: WireValue;
 }
 
@@ -156,15 +161,22 @@ const CORE_FIELD_NAMES = new Set(["lexicon", "entityType", "kind", "props", "att
 
 /**
  * Read a `LexiconOutput`'s internal ref without re-deriving it — see the
- * `_intrinsic`/`_sourceParent` fields in `../lexicon-output.ts`. When it was
- * built from an `AttrRef`, `LexiconOutput` keeps only the parent `WeakRef` +
- * attribute name (not the original `AttrRef` instance), so a fresh one is
- * synthesized here — its logical name must be set explicitly (from
- * `entityNames`, the same map every other reference in this module resolves
- * names through) since it never went through `resolveAttrRefs`.
+ * `_intrinsic`/`_sourceParent`/`_literalValue` fields in `../lexicon-output.ts`.
+ * When it was built from an `AttrRef`, `LexiconOutput` keeps only the parent
+ * `WeakRef` + attribute name (not the original `AttrRef` instance), so a
+ * fresh one is synthesized here — its logical name must be set explicitly
+ * (from `entityNames`, the same map every other reference in this module
+ * resolves names through) since it never went through `resolveAttrRefs`.
+ *
+ * chant #1121 — a literal-valued output (a real string/number/boolean the
+ * author's code already computed, not a reference) has neither a parent nor
+ * an intrinsic to hand back; its `_literalValue` round-trips as a plain wire
+ * primitive instead, and `LexiconOutput`'s own constructor reconstructs it
+ * identically on decode (see `decodeEntitySet` below).
  */
-function lexiconOutputRef(output: LexiconOutput, entityNames: Map<unknown, string>): AttrRef | Intrinsic {
+function lexiconOutputRef(output: LexiconOutput, entityNames: Map<unknown, string>): AttrRef | Intrinsic | LexiconOutputLiteral {
   if (output._intrinsic) return output._intrinsic;
+  if (output._literalValue !== null) return output._literalValue;
   const parent = output._sourceParent?.deref();
   const parentName = parent ? entityNames.get(parent) : undefined;
   if (!parent || output.sourceAttribute === null || !parentName) {
@@ -475,9 +487,11 @@ export function decodeEntitySet(wire: EntitySetWire): Map<string, Declarable> {
     }
 
     // LexiconOutput — constructed via its real constructor from the decoded
-    // ref, so it derives sourceLexicon/_sourceParent/sourceAttribute exactly
-    // the way constructing it from a live AttrRef/Intrinsic would.
-    const ref = decodeValue(entry.ref, registry) as AttrRef | Intrinsic;
+    // ref, so it derives sourceLexicon/_sourceParent/sourceAttribute/
+    // _literalValue exactly the way constructing it from a live
+    // AttrRef/Intrinsic/literal would (chant #1121 for the literal case: a
+    // plain wire primitive decodes back to itself, see `decodeValue` above).
+    const ref = decodeValue(entry.ref, registry) as AttrRef | Intrinsic | LexiconOutputLiteral;
     const output = new LexiconOutput(ref, entry.outputName);
     registry.set(entry.name, output);
     result.set(entry.name, output as unknown as Declarable);

package/src/discovery/entity-wire.test.ts

@@ -197,6 +197,32 @@ describe("entity-wire round trip (chant #1045 Phase 1)", () => {
     expect(isAttrRefLike(embedded[0])).toBe(true);
   });
 
+  // chant #1121 — before this fix, encoding a literal-valued LexiconOutput
+  // (neither an AttrRef nor an Intrinsic) threw
+  // `encodeEntitySet: LexiconOutput "..." has neither a resolvable AttrRef
+  // parent nor an intrinsic` — this is the sandboxed-child boundary a
+  // `chant build --sandbox` run crosses for every entity, so a project using
+  // `output("literal", "name")` could not build under `--sandbox` at all.
+  test.each([
+    ["string", "fold-output-repro"],
+    ["number", 42],
+    ["boolean", true],
+  ] as const)("LexiconOutput built from a %s literal round-trips via its real constructor", (_kind, value) => {
+    const lexOutput = new LexiconOutput(value, "LiteralOut");
+    const entities = new Map<string, Declarable>([["LiteralOut", lexOutput as unknown as Declarable]]);
+
+    const wire = encodeEntitySet(entities);
+    assertPureJson(wire);
+
+    const decoded = decodeEntitySet(JSON.parse(JSON.stringify(wire)) as EntitySetWire);
+    const decodedOutput = decoded.get("LiteralOut") as unknown as LexiconOutput;
+    expect(isLexiconOutput(decodedOutput)).toBe(true);
+    expect(decodedOutput.outputName).toBe("LiteralOut");
+    expect(decodedOutput.sourceEntity).toBe("");
+    expect(decodedOutput.sourceAttribute).toBeNull();
+    expect(decodedOutput.getOutputValue()).toBe(value);
+  });
+
   test("a lexicon-specific marker symbol (not core-owned) round-trips generically", () => {
     const MARKER = Symbol.for("chant.test.customMarker");
     const custom: Declarable = {

package/src/discovery/graph.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "vitest";
+import { describe, test, expect, vi } from "vitest";
 import { buildDependencyGraph } from "./graph";
 import { DECLARABLE_MARKER, type Declarable } from "../declarable";
 import { AttrRef } from "../attrref";
@@ -513,4 +513,43 @@ describe("buildDependencyGraph", () => {
     expect(graph.get("Entity3")?.has("Entity2")).toBe(true);
     expect(graph.get("Entity3")?.size).toBe(1);
   });
+
+  // chant #1137 — `findDependencies` used to check `value instanceof
+  // AttrRef`, which returns false for an AttrRef built by a SEPARATELY-
+  // LOADED copy of `../attrref` (the same dual-npm-copy hazard #1122 fixed
+  // for `LexiconOutput`). `vi.resetModules()` + a fresh dynamic import
+  // reproduces that split module graph exactly. Before the fix, a foreign
+  // AttrRef here recurses into the object's own (unhelpful) fields instead
+  // of being recorded as a dependency, silently dropping the edge — which
+  // can misorder the file-discovery build order this graph exists to compute.
+  test("detects dependency from an AttrRef built by a second, separately-loaded copy", async () => {
+    const parent: Declarable = {
+      lexicon: "test",
+      entityType: "parent",
+      [DECLARABLE_MARKER]: true,
+    };
+
+    vi.resetModules();
+    const secondCopy = await import("../attrref");
+    expect(secondCopy.AttrRef).not.toBe(AttrRef);
+
+    const foreignRef = new secondCopy.AttrRef(parent, "someAttr");
+    expect(foreignRef instanceof AttrRef).toBe(false); // the historic bug
+
+    const child: Declarable & { ref: AttrRef } = {
+      lexicon: "test",
+      entityType: "child",
+      [DECLARABLE_MARKER]: true,
+      ref: foreignRef,
+    };
+
+    const entities = new Map([
+      ["Parent", parent],
+      ["Child", child],
+    ]);
+    const graph = buildDependencyGraph(entities);
+
+    expect(graph.get("Child")?.has("Parent")).toBe(true);
+    vi.resetModules();
+  });
 });

package/src/discovery/graph.ts

@@ -1,6 +1,7 @@
 import type { Declarable } from "../declarable";
 import { isDeclarable } from "../declarable";
 import { AttrRef } from "../attrref";
+import { isAttrRefLike } from "../utils";
 
 /**
  * Builds a dependency graph from a collection of entities
@@ -95,8 +96,13 @@ function findDependencies(
     return;
   }
 
-  // Check if this is an AttrRef
-  if (value instanceof AttrRef) {
+  // Check if this is an AttrRef. Duck-type, not `instanceof` (chant #1137):
+  // a lexicon built against a separate copy of `@intentius/chant` produces
+  // AttrRefs that fail `instanceof AttrRef` here but carry the same shape.
+  // Without this, the dependency edge is silently dropped instead of
+  // recorded, which can misorder — or fail to detect a cycle in — the
+  // file-discovery build order this graph exists to compute.
+  if (isAttrRefLike(value)) {
     if (visited.has(value)) {
       return;
     }

package/src/discovery/sandbox/config-boundary.test.ts

@@ -0,0 +1,239 @@
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdir, writeFile, rm, realpath } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { loadChantConfig } from "../../config";
+import {
+  armSandboxConfigEvaluation,
+  evaluateProjectConfigSync,
+  isSandboxConfigEvaluationArmed,
+  resetSandboxConfigEvaluationForTests,
+} from "../../config-sandbox";
+import { ENV_VAR } from "../../env";
+
+/**
+ * chant #1113 — `chant.config.ts` is project-authored code, and under
+ * `--sandbox` it must not execute in the CLI's process.
+ *
+ * Same shape of proof as `./fold-boundary.test.ts` (chant #1093): the fixture
+ * config sets a `globalThis` marker at module top level, and a marker set
+ * inside the sandboxed child cannot reach this process. Every pair asserts the
+ * UNARMED half fires the marker first, so the probe is proven capable of
+ * failing before the armed half asserts it stays clean.
+ *
+ * Fixtures go to a fresh tmpdir per test — never the source tree — so no two
+ * tests share a module path and nothing bleeds through Node's module cache.
+ */
+
+const MARKER = "__chant1113ConfigEvaluated";
+
+type MarkerHost = Record<string, boolean | undefined>;
+
+function marker(): boolean | undefined {
+  return (globalThis as unknown as MarkerHost)[MARKER];
+}
+
+describe("chant.config.ts evaluation under --sandbox (chant #1113)", () => {
+  let testDir: string;
+  let savedEnv: string | undefined;
+
+  beforeEach(async () => {
+    const dir = join(tmpdir(), `chant-1113-config-${Date.now()}-${Math.random()}`);
+    await mkdir(dir, { recursive: true });
+    testDir = await realpath(dir);
+    delete (globalThis as unknown as MarkerHost)[MARKER];
+    savedEnv = process.env[ENV_VAR];
+    resetSandboxConfigEvaluationForTests();
+  });
+
+  afterEach(async () => {
+    delete (globalThis as unknown as MarkerHost)[MARKER];
+    if (savedEnv === undefined) delete process.env[ENV_VAR];
+    else process.env[ENV_VAR] = savedEnv;
+    resetSandboxConfigEvaluationForTests();
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  /** A config that announces its own evaluation, the way any project file's top level can. */
+  async function writeMarkerConfig(body = `{ lexicons: ["aws"], ownership: { stack: "s" } }`): Promise<void> {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `globalThis[${JSON.stringify(MARKER)}] = true;\nexport default ${body};\n`,
+    );
+  }
+
+  test("without --sandbox the config DOES evaluate in this process (the probe fires)", async () => {
+    await writeMarkerConfig();
+
+    const { config } = await loadChantConfig(testDir);
+
+    expect(isSandboxConfigEvaluationArmed()).toBe(false);
+    expect(marker(), "the config's top level ran in this process").toBe(true);
+    expect(config.lexicons).toEqual(["aws"]);
+    expect(config.ownership).toEqual({ stack: "s" });
+  });
+
+  test("armed, the same config evaluates in the child: no marker here, same config", async () => {
+    await writeMarkerConfig();
+    armSandboxConfigEvaluation();
+
+    const { config, configPath } = await loadChantConfig(testDir);
+
+    expect(marker(), "the config's top level must NOT run in the CLI process").toBeUndefined();
+    expect(configPath).toBe(join(testDir, "chant.config.ts"));
+    expect(config.lexicons).toEqual(["aws"]);
+    expect(config.ownership).toEqual({ stack: "s" });
+  });
+
+  test("a config authored as a named `config` export crosses the same way", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `globalThis[${JSON.stringify(MARKER)}] = true;\nexport const config = { lexicons: ["k8s"] };\n`,
+    );
+    armSandboxConfigEvaluation();
+
+    const { config } = await loadChantConfig(testDir);
+
+    expect(marker()).toBeUndefined();
+    expect(config.lexicons).toEqual(["k8s"]);
+  });
+
+  test("nested data — buildParams, stacks, lint rules — survives the round trip", async () => {
+    await writeMarkerConfig(
+      `{
+         lexicons: ["aws"],
+         stacks: [{ name: "net", src: "src/net" }, { name: "app", src: "src/app" }],
+         buildParams: { tier: { type: "string", default: "light", enum: ["light", "prod"] } },
+         lint: { rules: { COR001: "error", COR002: ["warning", { max: 3 }] }, policies: ["policies/org.ts"] },
+       }`,
+    );
+    armSandboxConfigEvaluation();
+
+    const { config } = await loadChantConfig(testDir);
+
+    expect(marker()).toBeUndefined();
+    expect(config.stacks).toEqual([
+      { name: "net", src: "src/net" },
+      { name: "app", src: "src/app" },
+    ]);
+    expect(config.buildParams).toEqual({
+      tier: { type: "string", default: "light", enum: ["light", "prod"] },
+    });
+    expect(config.lint?.rules).toEqual({ COR001: "error", COR002: ["warning", { max: 3 }] });
+    expect(config.lint?.policies).toEqual(["policies/org.ts"]);
+  });
+
+  test("chant.config.json needs no child — it is data, parsed in-process either way", async () => {
+    await writeFile(
+      join(testDir, "chant.config.json"),
+      JSON.stringify({ lexicons: ["gcp"], build: { sandbox: true } }),
+    );
+    armSandboxConfigEvaluation();
+
+    const { config, configPath } = await loadChantConfig(testDir);
+
+    expect(configPath).toBe(join(testDir, "chant.config.json"));
+    expect(config.lexicons).toEqual(["gcp"]);
+  });
+
+  test("a value that cannot cross as JSON is refused, naming the key", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `export default { lexicons: ["aws"], hooks: { beforeBuild: () => 1 } };\n`,
+    );
+    armSandboxConfigEvaluation();
+
+    await expect(loadChantConfig(testDir)).rejects.toThrow(/hooks\.beforeBuild: a function/);
+    expect(marker()).toBeUndefined();
+  });
+
+  test("a Date is refused too — JSON.stringify would silently turn it into a string", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `export default { lexicons: ["aws"], meta: { generatedAt: new Date(0) } };\n`,
+    );
+    armSandboxConfigEvaluation();
+
+    await expect(loadChantConfig(testDir)).rejects.toThrow(/meta\.generatedAt: a Date/);
+  });
+
+  test("a config that reads outside the project is denied, naming the config file", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `import { readFileSync } from "node:fs";\n` +
+        `const stolen = readFileSync("/etc/hosts", "utf-8");\n` +
+        `export default { lexicons: [stolen.slice(0, 3)] };\n`,
+    );
+    armSandboxConfigEvaluation();
+
+    await expect(loadChantConfig(testDir)).rejects.toThrow(/sandbox denied FileSystemRead/);
+  });
+
+  test("a config that tries to spawn a process is denied", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `import { execSync } from "node:child_process";\n` +
+        `execSync("echo pwned");\n` +
+        `export default { lexicons: ["aws"] };\n`,
+    );
+    armSandboxConfigEvaluation();
+
+    await expect(loadChantConfig(testDir)).rejects.toThrow(/sandbox denied/);
+  });
+
+  test("the child's environment is scrubbed — but --env still reaches the config", async () => {
+    process.env[ENV_VAR] = "prod";
+    process.env.CHANT_1113_SECRET = "hunter2";
+    try {
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default {\n` +
+          `  environments: [process.env[${JSON.stringify(ENV_VAR)}] ?? "none"],\n` +
+          `  sourceDir: process.env.CHANT_1113_SECRET ?? "scrubbed",\n` +
+          `};\n`,
+      );
+      armSandboxConfigEvaluation();
+
+      const { config } = await loadChantConfig(testDir);
+
+      expect(config.environments, "--env is forwarded so the config resolves the same either way").toEqual(["prod"]);
+      expect(config.sourceDir, "nothing else from the CLI's environment is visible").toBe("scrubbed");
+    } finally {
+      delete process.env.CHANT_1113_SECRET;
+    }
+  });
+
+  test("an armed load is memoized, so repeated loads cost one child, not one each", async () => {
+    await writeMarkerConfig();
+    armSandboxConfigEvaluation();
+
+    const first = await loadChantConfig(testDir);
+    const second = await loadChantConfig(testDir);
+
+    expect(second.config).toBe(first.config);
+    expect(marker()).toBeUndefined();
+  });
+
+  test("the sync lint loader reuses that result rather than requiring the file", async () => {
+    await writeMarkerConfig(`{ lexicons: ["aws"], lint: { rules: { COR001: "warning" } } }`);
+    armSandboxConfigEvaluation();
+
+    await loadChantConfig(testDir);
+    const config = evaluateProjectConfigSync(join(testDir, "chant.config.ts"), testDir) as {
+      lint?: { rules?: Record<string, unknown> };
+    };
+
+    expect(config.lint?.rules?.COR001).toBe("warning");
+    expect(marker()).toBeUndefined();
+  });
+
+  test("the sync lint loader refuses rather than importing when nothing was evaluated yet", async () => {
+    await writeMarkerConfig();
+    armSandboxConfigEvaluation();
+
+    expect(() => evaluateProjectConfigSync(join(testDir, "chant.config.ts"), testDir)).toThrow(
+      /Cannot read .* synchronously under --sandbox/,
+    );
+    expect(marker()).toBeUndefined();
+  });
+});