@intentius/chant 0.25.0 → 0.27.0

package/dist/lint/policy-sandbox.d.ts

@@ -0,0 +1,89 @@
+import { type PostSynthCheck, type PostSynthContext, type PostSynthDiagnostic } from "./post-synth.js";
+import { armSandboxPolicyExecution, isSandboxPolicyExecutionArmed, resetSandboxPolicyExecutionForTests } from "./policy-import.js";
+import type { EncodablePolicyBuildResult } from "../discovery/sandbox/policy-wire.js";
+/**
+ * chant #1131 — decides WHERE a project's `lint.policies` checks run.
+ *
+ * A policy is project-authored code. Every other piece of project code moved
+ * behind the `--sandbox` boundary in chant #1045 (run-fallback source), #1093
+ * (composite factories, constructors, intrinsic tags) and #1113
+ * (`chant.config.ts`), and all three had to leave this one out: the config
+ * declares its policies as *paths*, so putting the config behind the boundary
+ * did not put them there with it. `chant build` imported each policy module and
+ * called its `check` function in the CLI's own process, after discovery was
+ * over, with the CLI's filesystem, network, environment and process-spawn
+ * access. This module closes it.
+ *
+ * ## Why an armed process mode rather than a threaded option
+ *
+ * The same reason `../config-sandbox.ts` gives. `./policy.ts`'s
+ * `loadPolicyChecks` is exported from chant-core's public surface and called
+ * from more than one place (`../cli/commands/build.ts` for a build, and
+ * `evaluateProjectPolicies` for the `policyGate` Op step). Threading a
+ * `sandbox` flag to each is fail-OPEN: miss one and project code executes in
+ * the CLI process with nothing to notice. Arming the process once, before any
+ * policy is loaded, is fail-CLOSED — `loadPolicyChecks` REFUSES while armed, so
+ * a call site nobody remembered gets a loud error rather than a silent
+ * execution.
+ *
+ * ## What arms it
+ *
+ * Both ways of turning sandboxing on, unlike `../config-sandbox.ts`. That
+ * asymmetry is not an oversight: the config has a bootstrap limit (reading
+ * `build.sandbox` out of `chant.config.ts` means running it, so only the CLI
+ * flag, known before any config is touched, can cover the config's own
+ * evaluation). Policies have no such limit — they are loaded long after the
+ * config is known — so `build.sandbox: true` in a project's config sandboxes
+ * them just as `--sandbox` does, and `../cli/commands/build.ts` arms this from
+ * the RESOLVED value.
+ *
+ * There is deliberately no disarm: a security mode that can be turned off
+ * partway through a process is not one.
+ */
+/**
+ * The mode itself lives on `./policy-import.ts` — the leaf module that actually
+ * performs an in-process policy import, so the refusal sits on the narrowest
+ * possible thing and `./policy.ts` can consult it without importing this file
+ * (which imports `./policy.ts`). Re-exported here because this is where the
+ * decision is documented and where callers look.
+ *
+ * `armSandboxPolicyExecution` is called from `../cli/commands/build.ts` once
+ * `build.sandbox`/`--sandbox` has resolved, and from `../cli/main.ts` off the
+ * parsed flag.
+ */
+export { armSandboxPolicyExecution, isSandboxPolicyExecutionArmed, resetSandboxPolicyExecutionForTests };
+export interface ProjectPolicyRun {
+    /** `lint.policies` as declared in the config — relative paths, resolved against {@link configDir}. */
+    policies: readonly string[];
+    /** The `chant.config.*` directory (`lint.policies` paths are relative to it), also the child's read allowance. */
+    configDir: string;
+    /** The merged, serialized build result the checks run over. */
+    buildResult: EncodablePolicyBuildResult & PostSynthContext["buildResult"];
+    /** `--env`, else `ownership.env`. Becomes `ctx.env`. */
+    env?: string;
+    /**
+     * Checks the caller already loaded into THIS process, before the build ran.
+     *
+     * `chant build` has always loaded `lint.policies` up front rather than at the
+     * point of use, so a policy path that doesn't resolve fails the command
+     * immediately — including when the build itself goes on to fail, which is
+     * exactly when a typo'd path would otherwise go unnoticed. Preserving that
+     * for the unsandboxed path is the whole reason this field exists.
+     *
+     * Ignored when armed: under `--sandbox` there is nothing loaded here to pass,
+     * and `loadPolicyChecks` refuses outright.
+     */
+    preloaded?: PostSynthCheck[];
+}
+/**
+ * Run a project's organizational policy checks over a finished build and return
+ * their diagnostics. Sandboxed in a post-merge child when armed, in-process
+ * otherwise.
+ *
+ * The unarmed path is byte-for-byte what `chant build` has always done: load
+ * the modules, hand every check one `PostSynthContext`, concatenate what they
+ * return. The armed path does the same thing on the other side of a process
+ * boundary — see `../discovery/sandbox/policy-run.ts`.
+ */
+export declare function runProjectPolicies(run: ProjectPolicyRun): Promise<PostSynthDiagnostic[]>;
+//# sourceMappingURL=policy-sandbox.d.ts.map

package/dist/lint/policy-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-sandbox.d.ts","sourceRoot":"","sources":["../../src/lint/policy-sandbox.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAEnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;;GAUG;AACH,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,mCAAmC,EAAE,CAAC;AAEzG,MAAM,WAAW,gBAAgB;IAC/B,sGAAsG;IACtG,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,kHAAkH;IAClH,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,WAAW,EAAE,0BAA0B,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC1E,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAoB9F"}

package/dist/lint/policy.d.ts

@@ -1,5 +1,16 @@
 import type { PostSynthCheck, PostSynthDiagnostic } from "./post-synth.js";
-/** Load project policy checks (one or more `PostSynthCheck` exports) from files. */
+/**
+ * Load project policy checks (one or more `PostSynthCheck` exports) from files,
+ * **into this process**.
+ *
+ * chant #1131 — refuses while `./policy-sandbox.ts` is armed. Under `--sandbox`
+ * the policy modules are imported and their checks run inside a child process
+ * (`runProjectPolicies`); reaching this function anyway means a call site is
+ * about to execute project-authored code in the CLI's own process, which is
+ * precisely the thing the flag promises does not happen. Failing loudly is the
+ * only honest option — falling through would make `--sandbox` mean less than it
+ * says without anything visible to notice.
+ */
 export declare function loadPolicyChecks(paths: string[], configDir: string): Promise<PostSynthCheck[]>;
 export interface PolicyEvaluation {
     /** All policy diagnostics (errors + warnings). */

package/dist/lint/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/lint/policy.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExE,oFAAoF;AACpF,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAiBpG;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,2EAA2E;IAC3E,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8B5B"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/lint/policy.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGxE;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAuBpG;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,2EAA2E;IAC3E,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8B5B"}

package/dist/stack-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stack-output.d.ts","sourceRoot":"","sources":["../src/stack-output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE1D;;GAEG;AACH,eAAO,MAAM,mBAAmB,eAAkC,CAAC;AAEnE;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC;IACrC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;mDAC+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAgBD;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAOlE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,GAAG,SAAS,EACxB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,WAAW,CAuBb"}
+{"version":3,"file":"stack-output.d.ts","sourceRoot":"","sources":["../src/stack-output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAG1D;;GAEG;AACH,eAAO,MAAM,mBAAmB,eAAkC,CAAC;AAEnE;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC;IACrC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;mDAC+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAqBD;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAOlE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,GAAG,SAAS,EACxB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,WAAW,CAiCb"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/build.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { describe, test, expect, beforeEach, afterEach, vi } from "vitest";
 import { build, partitionByLexicon, detectCrossLexiconRefs, collectLexiconOutputs, computeStackGraph } from "./build";
 import { output } from "./lexicon-output";
 import { AttrRef } from "./attrref";
@@ -599,6 +599,58 @@ describe("detectCrossLexiconRefs", () => {
     const detected = detectCrossLexiconRefs(entities);
     expect(detected).toHaveLength(0);
   });
+
+  // chant #1137 — `detectCrossLexiconRefs`'s walk used to check
+  // `value instanceof AttrRef`, which returns false for an AttrRef built by
+  // a SEPARATELY-LOADED copy of `./attrref` (the same dual-npm-copy hazard
+  // #1122 fixed for `LexiconOutput`: a lexicon pinned to a chant range that
+  // doesn't overlap the project's own gets its own nested
+  // `node_modules/@intentius/chant`). `vi.resetModules()` + a fresh dynamic
+  // import reproduces that split module graph exactly. Before the fix, a
+  // foreign AttrRef here falls through to the generic object walk instead
+  // of being recognized, and the auto-detected `Outputs` entry vanishes
+  // silently — no error, just a missing cross-lexicon output.
+  test("detects a cross-lexicon ref built by a second, separately-loaded copy of AttrRef", async () => {
+    const alphaBucket = {
+      lexicon: "alpha",
+      entityType: "Alpha::Storage::Bucket",
+      [DECLARABLE_MARKER]: true,
+    } as Declarable;
+
+    vi.resetModules();
+    const secondCopy = await import("./attrref");
+
+    // Sanity check that this really is a distinct module instance — the
+    // premise the rest of the test depends on.
+    expect(secondCopy.AttrRef).not.toBe(AttrRef);
+
+    const foreignRef = new secondCopy.AttrRef(alphaBucket, "Endpoint");
+
+    // The historic bug: instanceof fails across separately-loaded copies of
+    // chant-core, even though the two classes are structurally identical.
+    expect(foreignRef instanceof AttrRef).toBe(false);
+
+    const ghAction = {
+      lexicon: "github",
+      entityType: "Action",
+      [DECLARABLE_MARKER]: true,
+      props: { url: foreignRef },
+    } as unknown as Declarable;
+
+    const entities = new Map<string, Declarable>([
+      ["dataBucket", alphaBucket],
+      ["deployAction", ghAction],
+    ]);
+
+    // The fix: `isAttrRefLike` duck-types on shape, so a foreign-copy
+    // AttrRef is still recognized and auto-detected as a cross-lexicon output.
+    const detected = detectCrossLexiconRefs(entities);
+    expect(detected).toHaveLength(1);
+    expect(detected[0].sourceLexicon).toBe("alpha");
+    expect(detected[0].sourceEntity).toBe("dataBucket");
+    expect(detected[0].sourceAttribute).toBe("Endpoint");
+    vi.resetModules();
+  });
 });
 
 describe("computeStackGraph (#200 — cross-stack apply ordering)", () => {
@@ -646,4 +698,28 @@ describe("computeStackGraph (#200 — cross-stack apply ordering)", () => {
     );
     expect(g.waves).toEqual([["base"], ["left", "right"], ["top"]]);
   });
+
+  // chant #1137 — same dual-npm-copy hazard as detectCrossLexiconRefs above,
+  // this time for the cross-stack apply-ordering graph: a foreign-copy
+  // AttrRef that fails `instanceof` here used to fall through to the
+  // generic object walk instead of producing an edge, silently dropping a
+  // real cross-stack dependency (which can misorder — or fail to detect a
+  // cycle in — the apply order this graph exists to compute).
+  test("infers a consumer→producer edge from an AttrRef built by a second, separately-loaded copy", async () => {
+    const vpc = ent("aws");
+
+    vi.resetModules();
+    const secondCopy = await import("./attrref");
+    expect(secondCopy.AttrRef).not.toBe(AttrRef);
+
+    const foreignRef = new secondCopy.AttrRef(vpc, "id");
+    expect(foreignRef instanceof AttrRef).toBe(false); // the historic bug
+
+    const svc = ent("k8s", { vpcId: foreignRef });
+    const g = computeStackGraph(new Map([["vpc", vpc], ["svc", svc]]), ["aws", "k8s"]);
+
+    expect(g.edges).toEqual([{ from: "k8s", to: "aws" }]);
+    expect(g.order).toEqual(["aws", "k8s"]);
+    vi.resetModules();
+  });
 });

package/src/build.ts

@@ -7,6 +7,7 @@ import type { BuildParamProvenance } from "./provenance";
 import { DiscoveryError, BuildError as BuildErrorClass } from "./errors";
 import { LexiconOutput, isLexiconOutput } from "./lexicon-output";
 import { AttrRef } from "./attrref";
+import { isAttrRefLike } from "./utils";
 import { isChildProject, type ChildProjectInstance } from "./child-project";
 import { discover, type DiscoveryResult, type FoldDecision } from "./discovery/index";
 import { decodeEntitySet, type DiscoveredEntitiesJson } from "./discovery/entity-wire";
@@ -77,7 +78,13 @@ export function computeStackGraph(
     if (value === null || value === undefined || typeof value !== "object") return;
     if (visited.has(value)) return;
     visited.add(value);
-    if (value instanceof AttrRef) {
+    // Duck-type, not `instanceof` (chant #1137): a lexicon built against a
+    // separate copy of `@intentius/chant` produces AttrRefs that fail
+    // `instanceof AttrRef` here but carry the same shape. Without this, a
+    // real cross-stack dependency silently falls through to the generic
+    // object walk below instead of producing an edge, which can misorder —
+    // or entirely drop — the apply order this graph exists to compute.
+    if (isAttrRefLike(value)) {
       const parent = value.parent.deref();
       const producer = parent ? (parent as Record<string, unknown>).lexicon : undefined;
       if (typeof producer === "string" && producer !== consumer) addEdge(consumer, producer);
@@ -370,7 +377,13 @@ export function detectCrossLexiconRefs(
     if (visited.has(value)) return;
     visited.add(value);
 
-    if (value instanceof AttrRef) {
+    // Duck-type, not `instanceof` (chant #1137): a lexicon built against a
+    // separate copy of `@intentius/chant` produces AttrRefs that fail
+    // `instanceof AttrRef` here but carry the same shape. Without this, a
+    // real cross-lexicon reference silently falls through to the generic
+    // object walk below instead of auto-creating a `LexiconOutput`, and the
+    // whole `Outputs` entry for it vanishes (same failure shape as #1122).
+    if (isAttrRefLike(value)) {
       const parent = value.parent.deref();
       if (!parent) return;
 

package/src/cli/commands/build.test.ts

@@ -322,7 +322,7 @@ export const testEntity = {
     expect(byName.get("env")).toEqual({ name: "env", value: "from-file", source: "params-file" });
   });
 
-  test("--fold is opt-in: omitting it builds via the unchanged run path", async () => {
+  test("fold is the default (#1134): omitting the flag folds; --no-fold restores the run path", async () => {
     await writeFile(
       join(testDir, "test.infra.ts"),
       `
@@ -345,7 +345,21 @@ export const testEntity = {
       expect(result.success).toBe(true);
       expect(result.resourceCount).toBe(1);
       const anyFoldLine = errorSpy.mock.calls.map((call) => String(call[0])).some((line) => line.includes("[fold:"));
-      expect(anyFoldLine).toBe(false);
+      expect(anyFoldLine).toBe(true);
+
+      errorSpy.mockClear();
+      const runResult = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        fold: false,
+      });
+      expect(runResult.success).toBe(true);
+      expect(runResult.resourceCount).toBe(1);
+      const anyFoldLineOff = errorSpy.mock.calls
+        .map((call) => String(call[0]))
+        .some((line) => line.includes("[fold:"));
+      expect(anyFoldLineOff).toBe(false);
     } finally {
       errorSpy.mockRestore();
     }

package/src/cli/commands/build.ts

@@ -5,6 +5,7 @@ import type { Serializer, SerializerResult } from "../../serializer";
 import type { LexiconPlugin } from "../../lexicon";
 import { runPostSynthChecks } from "../../lint/post-synth";
 import { loadPolicyChecks } from "../../lint/policy";
+import { armSandboxPolicyExecution, runProjectPolicies } from "../../lint/policy-sandbox";
 import { sortedJsonReplacer } from "../../utils";
 import { formatError, formatWarning, formatSuccess, formatBold, formatInfo } from "../format";
 import { writeFileSync, mkdirSync } from "fs";
@@ -34,11 +35,12 @@ export interface BuildOptions {
    */
   env?: string;
   /**
-   * chant #1022 (epic #1019) — opt-in: fold source modules statically
-   * instead of importing/running them (`chant build --fold`). Falls back to
-   * run per-file for anything the folder can't represent. Merged with the
-   * project's `chant.config.ts` `build.fold` via {@link resolveFoldEnabled}
-   * — this flag, when true, always wins for the invocation.
+   * chant #1022/#1134 (epic #1019) — fold source modules statically instead
+   * of importing/running them; the DEFAULT build path since #1134. Falls
+   * back to run per-file for anything the folder can't represent. Tri-state:
+   * `--fold` → true, `--no-fold` → false, unset → the project config /
+   * default via {@link resolveFoldEnabled}. An explicit flag always wins for
+   * the invocation, in either direction.
    */
   fold?: boolean;
 
@@ -144,13 +146,11 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // Project-authored organizational policy checks (lint.policies), run over the
   // resolved resources during build. Resolve paths relative to the config dir.
   const configDir = loaded.configPath ? dirname(loaded.configPath) : infraPath;
-  const policyChecks = config.lint?.policies?.length
-    ? await loadPolicyChecks(config.lint.policies, configDir)
-    : [];
+  const policies = config.lint?.policies ?? [];
 
-  // #1022 — opt-in fold path: the CLI flag wins over `chant.config.ts`'s
-  // `build.fold`, which wins over the (unchanged) default of running every
-  // module.
+  // #1022/#1134 — fold is the default build path: an explicit CLI flag
+  // (--fold/--no-fold) wins over `chant.config.ts`'s `build.fold`, which
+  // wins over the default of `true`.
   const fold = resolveFoldEnabled(config, options.fold);
 
   // #1045 Phase 2 — opt-in sandboxed execution of run-fallback files (or,
@@ -158,6 +158,22 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // as fold, resolved independently.
   const sandbox = resolveSandboxEnabled(config, options.sandbox);
 
+  // #1131 — arm sandboxed policy execution from the RESOLVED value, before any
+  // policy module could be loaded. Resolved, not `options.sandbox`, because
+  // policies have none of the config's bootstrap limit: they are loaded long
+  // after `build.sandbox` is known, so a config-only opt-in sandboxes them just
+  // as the CLI flag does. Arming (rather than threading a flag to each caller)
+  // makes `loadPolicyChecks` refuse process-wide — a call site that forgot to
+  // ask gets a loud error instead of quietly running project code here.
+  if (sandbox) armSandboxPolicyExecution();
+
+  // Unsandboxed, the policy pack is still loaded HERE, before the build — a
+  // policy path that doesn't resolve has always failed the command up front,
+  // including when the build itself then fails, and #1131 does not change that.
+  // Sandboxed, there is nothing to load in this process at all.
+  const preloadedPolicyChecks =
+    !sandbox && policies.length > 0 ? await loadPolicyChecks([...policies], configDir) : undefined;
+
   // #1113 — the bootstrap limit, surfaced rather than left implicit. Reading
   // `build.sandbox` out of `chant.config.ts` requires evaluating that file, so
   // a config-only opt-in cannot have covered its own evaluation; only the CLI
@@ -298,8 +314,21 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
 
     // Project-authored organizational policy — cross-cutting, so it sees every
     // lexicon's output at once (not scoped per-plugin), with the current env.
-    if (policyChecks.length > 0) {
-      const policyDiags = runPostSynthChecks(policyChecks, result, env);
+    //
+    // #1131 — under `--sandbox` this is where the LAST piece of project-
+    // authored code the CLI used to execute in its own process moves behind
+    // the boundary: `runProjectPolicies` hands the merged, serialized build
+    // result to a post-merge sandboxed child, which imports the policy modules
+    // and runs their checks there, and only plain `PostSynthDiagnostic`s come
+    // back. Unsandboxed, it is the same in-process load-and-run as before.
+    if (policies.length > 0) {
+      const policyDiags = await runProjectPolicies({
+        policies,
+        configDir,
+        buildResult: result,
+        env,
+        preloaded: preloadedPolicyChecks,
+      });
       for (const diag of policyDiags) {
         const prefix = diag.entity ? `[${diag.entity}] ` : "";
         const where = diag.lexicon ? ` (${diag.lexicon})` : "";

package/src/cli/main.test.ts

@@ -4,6 +4,12 @@ import { parseArgs, waitForStreamDrain } from "./main";
 import { resolveCommand, type CommandDef, type ParsedArgs } from "./registry";
 
 describe("parseArgs", () => {
+  test("--fold and --no-fold set the tri-state fold option (#1134)", () => {
+    expect(parseArgs(["build", "src"]).fold).toBeUndefined();
+    expect(parseArgs(["build", "src", "--fold"]).fold).toBe(true);
+    expect(parseArgs(["build", "src", "--no-fold"]).fold).toBe(false);
+  });
+
   test("parses command as first positional arg", () => {
     const result = parseArgs(["build"]);
     expect(result.command).toBe("build");
@@ -130,10 +136,23 @@ describe("parseArgs", () => {
     expect(result.help).toBe(false);
   });
 
-  test("ignores unknown flags", () => {
-    const result = parseArgs(["build", "--unknown", "value"]);
+  test("throws on an unknown bare flag instead of silently ignoring it (chant #1127)", () => {
+    // Was "ignores unknown flags" — pinned the old silent-drop as intended
+    // behavior. #1127 flips it: an unrecognized `--flag` is a hard error.
+    expect(() => parseArgs(["build", "--unknown", "value"])).toThrow(/Unknown flag: --unknown/);
+  });
+
+  test("unknown flag error points at --help", () => {
+    expect(() => parseArgs(["build", "--unknown"])).toThrow(/--help/);
+  });
+
+  test("throws on an unknown joined flag (--unknown=value)", () => {
+    expect(() => parseArgs(["build", "--unknown=value"])).toThrow(/Unknown flag: --unknown/);
+  });
+
+  test("unknown short flags are still silently ignored (unchanged; out of #1127 scope)", () => {
+    const result = parseArgs(["build", "-x", "value"]);
     expect(result.command).toBe("build");
-    // Unknown flags are silently ignored
   });
 
   test("parses --watch flag", () => {
@@ -271,27 +290,90 @@ describe("parseArgs", () => {
     expect(result.paramsFile).toBe("./params.json");
   });
 
-  // ── --param=name=value hard error (chant #1118) ──────────────────────────
-  // The joined `--flag=value` form is not supported anywhere in this parser
-  // (see "ignores unknown flags" above) — a dropped --param can silently
-  // change what a build measures/deploys, so this form is rejected loudly
-  // instead of silently accepted as a no-op.
+  test("plain --param name=value is unaffected", () => {
+    const result = parseArgs(["build", "src", "--param", "tier=production"]);
+    expect(result.param).toEqual(["tier=production"]);
+  });
+
+  // ── generic --flag=value joined form (chant #1127) ────────────────────────
+  // #1118 taught this parser to hard-error `--param=name=value` specifically,
+  // because it was the one flag known (from #1118's investigation) to sit
+  // behind a silent drop. #1127's audit found the drop was general — every
+  // value-taking flag shares it — so the fix is general too: split any
+  // `--flag=value` token at its first `=` and re-dispatch as `--flag` +
+  // `value`, the exact shape every branch below already handles. This
+  // supersedes #1118's `--param=` hard error entirely: the joined form is now
+  // just as valid as the space-separated one, for every flag, not a rejected
+  // special case for one flag.
 
-  test("--param=name=value throws instead of silently dropping", () => {
-    expect(() => parseArgs(["build", "src", "--param=tier=production"])).toThrow(/--param=tier=production/);
+  test("--param=name=value now works instead of throwing — joined form matches the space-separated form", () => {
+    const result = parseArgs(["build", "src", "--param=tier=production"]);
+    expect(result.param).toEqual(["tier=production"]);
   });
 
-  test("--param=name=value error names the working form", () => {
-    expect(() => parseArgs(["build", "src", "--param=tier=production"])).toThrow(/--param name=value/);
+  test("--env=value joined form works", () => {
+    const result = parseArgs(["build", "src", "--env=staging"]);
+    expect(result.env).toBe("staging");
   });
 
-  test("--param= (empty value) also throws", () => {
-    expect(() => parseArgs(["build", "src", "--param="])).toThrow(/--param=/);
+  test("--format=value joined form works", () => {
+    const result = parseArgs(["build", "src", "--format=yaml"]);
+    expect(result.format).toBe("yaml");
   });
 
-  test("plain --param name=value is unaffected", () => {
-    const result = parseArgs(["build", "src", "--param", "tier=production"]);
-    expect(result.param).toEqual(["tier=production"]);
+  test("--lexicon=value joined form works", () => {
+    const result = parseArgs(["build", "src", "--lexicon=aws"]);
+    expect(result.lexicon).toBe("aws");
+  });
+
+  test("repeated --param=name=value (joined) accumulates in order, same as space-separated", () => {
+    const result = parseArgs(["build", "src", "--param=tier=production", "--param=env=staging"]);
+    expect(result.param).toEqual(["tier=production", "env=staging"]);
+  });
+
+  test("joined form only splits on the FIRST '=' — a value containing '=' is preserved whole", () => {
+    // --param's own value shape is `name=value`, so `--param=tier=production`
+    // must split into flag `--param` + value `tier=production`, not further
+    // fragment on the second `=`.
+    const result = parseArgs(["build", "src", "--param=tier=production=east"]);
+    expect(result.param).toEqual(["tier=production=east"]);
+  });
+
+  test("joined form works mixed with space-separated flags in the same invocation", () => {
+    const result = parseArgs(["build", "src", "--env=prod", "--format", "json", "--lexicon=k8s"]);
+    expect(result.env).toBe("prod");
+    expect(result.format).toBe("json");
+    expect(result.lexicon).toBe("k8s");
+  });
+
+  // ── boolean-only flag given a joined value (chant #1127) ──────────────────
+  // Decision: reject it. A boolean flag (--fold, --watch, --json, ...) has no
+  // value slot — its branch just sets a field to `true` and never consumes a
+  // following token. Silently coercing "true"/"false" would need to invent
+  // parsing rules (what about "1", "yes", mixed case?) for a form none of
+  // this CLI's flags need; silently dropping the value and reinterpreting it
+  // as the next positional (a path, a component name, ...) is exactly the
+  // silent misparse #1127 closes. So it errors, naming the flag as boolean.
+
+  test("a boolean flag given a joined value throws, naming the flag as boolean", () => {
+    expect(() => parseArgs(["build", "src", "--fold=true"])).toThrow(/--fold is a boolean flag/);
+  });
+
+  test("boolean-with-value error does not silently reinterpret the value as a positional", () => {
+    expect(() => parseArgs(["build", "src", "--watch=false"])).toThrow(/--watch is a boolean flag/);
+  });
+
+  test("--json=1 (another boolean flag) also throws", () => {
+    expect(() => parseArgs(["run", "myop", "--json=1"])).toThrow(/--json is a boolean flag/);
+  });
+
+  test("--report keeps its context-sensitive bare-vs-value behavior when joined", () => {
+    // --report is deliberately not in the boolean-reject set: bare --report is
+    // a boolean (`run`), but --report <path> is a SARIF destination (migrate).
+    // The joined form should resolve the same way the space-separated one does.
+    const result = parseArgs(["migrate", "wf.yml", "--report=out.sarif"]);
+    expect(result.reportFile).toBe("out.sarif");
+    expect(result.report).toBeUndefined();
   });
 });