@intentius/chant 0.26.0 → 0.28.0

package/src/cli/commands/build.test.ts

@@ -1,12 +1,14 @@
 import { describe, test, expect, beforeEach, afterEach, vi } from "vitest";
 import { buildCommand, resolveBuildFormat, type BuildOptions } from "./build";
 import type { Serializer } from "../../serializer";
+import type { LexiconPlugin } from "../../lexicon";
 import { parseYAML } from "../../yaml";
 import { mkdir, rm, writeFile } from "node:fs/promises";
 import { existsSync, readFileSync } from "node:fs";
 import { join, dirname, resolve as resolvePath } from "node:path";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
+import { resetSandboxPolicyExecutionForTests } from "../../lint/policy-sandbox";
 
 describe("buildCommand", () => {
   let testDir: string;
@@ -322,7 +324,7 @@ export const testEntity = {
     expect(byName.get("env")).toEqual({ name: "env", value: "from-file", source: "params-file" });
   });
 
-  test("--fold is opt-in: omitting it builds via the unchanged run path", async () => {
+  test("fold is the default (#1134): omitting the flag folds; --no-fold restores the run path", async () => {
     await writeFile(
       join(testDir, "test.infra.ts"),
       `
@@ -345,7 +347,21 @@ export const testEntity = {
       expect(result.success).toBe(true);
       expect(result.resourceCount).toBe(1);
       const anyFoldLine = errorSpy.mock.calls.map((call) => String(call[0])).some((line) => line.includes("[fold:"));
-      expect(anyFoldLine).toBe(false);
+      expect(anyFoldLine).toBe(true);
+
+      errorSpy.mockClear();
+      const runResult = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        fold: false,
+      });
+      expect(runResult.success).toBe(true);
+      expect(runResult.resourceCount).toBe(1);
+      const anyFoldLineOff = errorSpy.mock.calls
+        .map((call) => String(call[0]))
+        .some((line) => line.includes("[fold:"));
+      expect(anyFoldLineOff).toBe(false);
     } finally {
       errorSpy.mockRestore();
     }
@@ -500,6 +516,194 @@ export const testEntity = {
       { Key: "env", Value: "prod" },
     ]);
   });
+
+  /**
+   * chant #1138 — post-synth findings (a lexicon-shipped check's, and a
+   * project's `lint.policies`') honor `lint.rules` severity overrides the
+   * same way a pre-synth COR/EVL/COMP diagnostic does. `runComponentChecks`
+   * proved the shape (`component-lint.test.ts`); this proves the post-synth
+   * side of the same fix.
+   */
+  describe("post-synth findings honor lint.rules (chant #1138)", () => {
+    // `armSandboxPolicyExecution` is a one-way, process-global latch — once a
+    // `--sandbox` build in this file arms it, EVERY later `buildCommand` call
+    // in this worker (sandboxed or not) would otherwise see it armed and
+    // refuse to load policies in-process. Reset it around each test here so
+    // the plain/sandboxed pairs below are actually independent.
+    beforeEach(() => resetSandboxPolicyExecutionForTests());
+    afterEach(() => resetSandboxPolicyExecutionForTests());
+
+    /**
+     * One trivial declarable using the `mockSerializer`'s "test" lexicon, so
+     * `result.outputs` is non-empty and the build's own "discovered source
+     * but produced no output" guard (`../commands/build.ts`) doesn't fire —
+     * these tests are about post-synth suppression, not that guard.
+     */
+    async function writeTrivialEntity(): Promise<void> {
+      await writeFile(
+        join(testDir, "main.ts"),
+        `export const e = { lexicon: "test", entityType: "TestEntity", [Symbol.for("chant.declarable")]: true };\n`,
+      );
+    }
+
+    /** A minimal `LexiconPlugin` whose one post-synth check always emits one fixed diagnostic — the fixed-input half of a severity-override test. */
+    function fakePostSynthPlugin(checkId: string, severity: "error" | "warning" | "info"): LexiconPlugin {
+      return {
+        name: "fake",
+        serializer: { name: "fake", rulePrefix: "FAKE", serialize: () => "{}" },
+        generate: async () => {},
+        validate: async () => {},
+        coverage: async () => {},
+        package: async () => {},
+        postSynthChecks: () => [
+          {
+            id: checkId,
+            description: "test check",
+            check: () => [{ checkId, severity, message: `${checkId} triggered` }],
+          },
+        ],
+      };
+    }
+
+    test("lint.rules off suppresses a lexicon-shipped post-synth finding and reports a suppressed count", async () => {
+      await writeTrivialEntity();
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { rules: { "FAKE001": "off" } } };\n`,
+      );
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakePostSynthPlugin("FAKE001", "error")],
+      });
+
+      expect(result.success).toBe(true);
+      expect(result.errors).toEqual([]);
+      expect(result.errors.join("\n")).not.toContain("FAKE001 triggered");
+      expect(result.warnings.some((w) => w.includes("1 post-synth finding(s) suppressed"))).toBe(true);
+    });
+
+    test("lint.rules downgrades an error-severity post-synth check to warning, so it no longer fails the build", async () => {
+      await writeTrivialEntity();
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { rules: { "FAKE002": "warning" } } };\n`,
+      );
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakePostSynthPlugin("FAKE002", "error")],
+      });
+
+      expect(result.success).toBe(true);
+      expect(result.errors).toEqual([]);
+      expect(result.warnings.some((w) => w.includes("FAKE002 triggered"))).toBe(true);
+    });
+
+    test("lint.rules upgrades a warning-severity post-synth check to error, so it now fails the build", async () => {
+      await writeTrivialEntity();
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { rules: { "FAKE003": "error" } } };\n`,
+      );
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakePostSynthPlugin("FAKE003", "warning")],
+      });
+
+      expect(result.success).toBe(false);
+      expect(result.errors.some((e) => e.includes("FAKE003 triggered"))).toBe(true);
+    });
+
+    test("an unconfigured post-synth check id is unaffected — no drift from this fix for the common case", async () => {
+      await writeTrivialEntity();
+      await writeFile(join(testDir, "chant.config.ts"), `export default {};\n`);
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakePostSynthPlugin("FAKE004", "error")],
+      });
+
+      expect(result.success).toBe(false);
+      expect(result.errors.some((e) => e.includes("FAKE004 triggered"))).toBe(true);
+      expect(result.warnings.some((w) => w.includes("suppressed"))).toBe(false);
+    });
+
+    /** Write a `lint.policies` project: one policy file whose check always emits one fixed diagnostic. */
+    async function writePolicyProject(checkId: string, severity: "error" | "warning", rules: Record<string, string>): Promise<void> {
+      await mkdir(join(testDir, "policies"), { recursive: true });
+      await writeTrivialEntity();
+      await writeFile(
+        join(testDir, "policies", "org.ts"),
+        `export const check = {\n` +
+          `  id: ${JSON.stringify(checkId)},\n` +
+          `  description: "test policy",\n` +
+          `  check: () => [{ checkId: ${JSON.stringify(checkId)}, severity: ${JSON.stringify(severity)}, message: ${JSON.stringify(`${checkId} triggered`)} }],\n` +
+          `};\n`,
+      );
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { policies: ["policies/org.ts"], rules: ${JSON.stringify(rules)} } };\n`,
+      );
+    }
+
+    test(
+      "lint.rules off suppresses a lint.policies finding identically under plain and --sandbox builds",
+      async () => {
+        await writePolicyProject("ORG-OFF", "error", { "ORG-OFF": "off" });
+
+        const plain = await buildCommand({ path: testDir, format: "json", serializers: [mockSerializer], plugins: [] });
+        const sandboxed = await buildCommand({
+          path: testDir,
+          format: "json",
+          serializers: [mockSerializer],
+          plugins: [],
+          fold: true,
+          sandbox: true,
+        });
+
+        for (const result of [plain, sandboxed]) {
+          expect(result.success).toBe(true);
+          expect(result.errors).toEqual([]);
+          expect(result.warnings.some((w) => w.includes("1 post-synth finding(s) suppressed"))).toBe(true);
+        }
+      },
+      30_000,
+    );
+
+    test(
+      "lint.rules upgrades a lint.policies warning to error identically under plain and --sandbox builds",
+      async () => {
+        await writePolicyProject("ORG-UP", "warning", { "ORG-UP": "error" });
+
+        const plain = await buildCommand({ path: testDir, format: "json", serializers: [mockSerializer], plugins: [] });
+        const sandboxed = await buildCommand({
+          path: testDir,
+          format: "json",
+          serializers: [mockSerializer],
+          plugins: [],
+          fold: true,
+          sandbox: true,
+        });
+
+        for (const result of [plain, sandboxed]) {
+          expect(result.success).toBe(false);
+          expect(result.errors.some((e) => e.includes("[policy:ORG-UP]") && e.includes("ORG-UP triggered"))).toBe(true);
+          expect(result.warnings.some((w) => w.includes("suppressed"))).toBe(false);
+        }
+      },
+      30_000,
+    );
+  });
 });
 
 // ── #284 bug 1: -o extension drives format when --format is absent ────────

package/src/cli/commands/build.ts

@@ -4,6 +4,7 @@ import { resolveCliBuildParams } from "../build-params-cli";
 import type { Serializer, SerializerResult } from "../../serializer";
 import type { LexiconPlugin } from "../../lexicon";
 import { runPostSynthChecks } from "../../lint/post-synth";
+import { applyConfiguredSeverity } from "../../lint/config";
 import { loadPolicyChecks } from "../../lint/policy";
 import { armSandboxPolicyExecution, runProjectPolicies } from "../../lint/policy-sandbox";
 import { sortedJsonReplacer } from "../../utils";
@@ -35,11 +36,12 @@ export interface BuildOptions {
    */
   env?: string;
   /**
-   * chant #1022 (epic #1019) — opt-in: fold source modules statically
-   * instead of importing/running them (`chant build --fold`). Falls back to
-   * run per-file for anything the folder can't represent. Merged with the
-   * project's `chant.config.ts` `build.fold` via {@link resolveFoldEnabled}
-   * — this flag, when true, always wins for the invocation.
+   * chant #1022/#1134 (epic #1019) — fold source modules statically instead
+   * of importing/running them; the DEFAULT build path since #1134. Falls
+   * back to run per-file for anything the folder can't represent. Tri-state:
+   * `--fold` → true, `--no-fold` → false, unset → the project config /
+   * default via {@link resolveFoldEnabled}. An explicit flag always wins for
+   * the invocation, in either direction.
    */
   fold?: boolean;
 
@@ -147,9 +149,9 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   const configDir = loaded.configPath ? dirname(loaded.configPath) : infraPath;
   const policies = config.lint?.policies ?? [];
 
-  // #1022 — opt-in fold path: the CLI flag wins over `chant.config.ts`'s
-  // `build.fold`, which wins over the (unchanged) default of running every
-  // module.
+  // #1022/#1134 — fold is the default build path: an explicit CLI flag
+  // (--fold/--no-fold) wins over `chant.config.ts`'s `build.fold`, which
+  // wins over the default of `true`.
   const fold = resolveFoldEnabled(config, options.fold);
 
   // #1045 Phase 2 — opt-in sandboxed execution of run-fallback files (or,
@@ -281,6 +283,16 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   }
 
   // Run post-synth checks from plugins — each plugin only sees its own lexicon's output
+  //
+  // chant #1138 — every diagnostic collected below (a lexicon-shipped check's
+  // AND a project's `lint.policies`') is resolved against `lint.rules` before
+  // it becomes an error/warning line, through the exact same
+  // `applyConfiguredSeverity` (../../lint/post-synth.ts) that keys off
+  // `diag.checkId` the way `lintCommand` keys an AST/COMP* diagnostic off its
+  // rule id — so `lint.rules: { WAW019: "off" }` suppresses a post-synth
+  // finding just as it suppresses a pre-synth one. A finding it suppresses is
+  // counted, not dropped silently — see `suppressedPostSynthCount` below.
+  let suppressedPostSynthCount = 0;
   if (result.errors.length === 0 && options.plugins) {
     for (const plugin of options.plugins) {
       if (!plugin.postSynthChecks) continue;
@@ -300,7 +312,9 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
 
       const scopedResult = { ...result, outputs: scopedOutputs };
       const postDiags = runPostSynthChecks(checks, scopedResult, env);
-      for (const diag of postDiags) {
+      const { diagnostics: activeDiags, suppressed } = applyConfiguredSeverity(postDiags, config.lint?.rules);
+      suppressedPostSynthCount += suppressed.length;
+      for (const diag of activeDiags) {
         const prefix = diag.entity ? `[${diag.entity}] ` : "";
         const lexiconSuffix = diag.lexicon ? ` (${diag.lexicon})` : "";
         if (diag.severity === "error") {
@@ -320,6 +334,15 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
     // result to a post-merge sandboxed child, which imports the policy modules
     // and runs their checks there, and only plain `PostSynthDiagnostic`s come
     // back. Unsandboxed, it is the same in-process load-and-run as before.
+    //
+    // #1138 — `applyConfiguredSeverity` runs HERE, in the parent, after the
+    // sandboxed child (when armed) has already returned — never inside it.
+    // The child only knows the policy paths and the encoded build result, not
+    // this project's resolved `lint.rules`, and by design nothing about the
+    // suppression surface needs to cross that boundary: both the plain and
+    // the `--sandbox` path funnel through this identical call with the
+    // identical `config.lint?.rules`, so a sandboxed and an unsandboxed build
+    // of the same project apply the same config to the same diagnostics.
     if (policies.length > 0) {
       const policyDiags = await runProjectPolicies({
         policies,
@@ -328,7 +351,9 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
         env,
         preloaded: preloadedPolicyChecks,
       });
-      for (const diag of policyDiags) {
+      const { diagnostics: activePolicyDiags, suppressed } = applyConfiguredSeverity(policyDiags, config.lint?.rules);
+      suppressedPostSynthCount += suppressed.length;
+      for (const diag of activePolicyDiags) {
         const prefix = diag.entity ? `[${diag.entity}] ` : "";
         const where = diag.lexicon ? ` (${diag.lexicon})` : "";
         const msg = `[policy:${diag.checkId}] ${prefix}${diag.message}${where}`;
@@ -336,6 +361,14 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
         else warnings.push(formatWarning({ message: msg }));
       }
     }
+
+    if (suppressedPostSynthCount > 0) {
+      warnings.push(
+        formatWarning({
+          message: `${suppressedPostSynthCount} post-synth finding(s) suppressed via lint.rules (severity "off")`,
+        }),
+      );
+    }
   }
 
   // Empty-output guard: source files were discovered but no lexicon produced

package/src/cli/commands/lint.ts

@@ -18,8 +18,7 @@ import { formatError, formatInfo } from "../format";
 import { GENERATED_MARKER } from "../../discovery/files";
 
 // Import config loader
-import { loadConfig, resolveRulesForFile, parseRuleConfig, findProjectRoot } from "../../lint/config";
-import type { RuleConfig } from "../../lint/rule";
+import { loadConfig, resolveRulesForFile, resolveConfiguredSeverity, findProjectRoot } from "../../lint/config";
 
 /**
  * Type guard to check if a value conforms to the LintRule interface.
@@ -263,28 +262,22 @@ function getDefaultRules(
   const ruleOptions = new Map<string, Record<string, unknown>>();
 
   for (const [ruleId, rule] of allRules) {
-    const configValue: RuleConfig | undefined = effectiveRules?.[ruleId];
-
-    if (configValue === undefined) {
-      // Rule not mentioned in config — include with default severity
-      rules.push(rule);
-      continue;
-    }
-
-    const parsed = parseRuleConfig(configValue);
+    // chant #1138 — the same resolution post-synth checks and COMP* checks
+    // now go through too (`resolveConfiguredSeverity`, ../../lint/config.ts),
+    // so `lint.rules: { ID: "off" }` suppresses a rule id identically no
+    // matter which phase produced it.
+    const { severity, options } = resolveConfiguredSeverity(effectiveRules, ruleId, rule.severity);
 
     // Skip rules that are explicitly turned off
-    if (parsed.severity === "off") continue;
+    if (severity === "off") continue;
 
-    // Override severity from config
-    rules.push({
-      ...rule,
-      severity: parsed.severity as "error" | "warning" | "info",
-    });
+    // Override severity from config (a no-op when the rule wasn't mentioned —
+    // `severity` is then just `rule.severity` again)
+    rules.push({ ...rule, severity });
 
     // Store options if present
-    if (parsed.options) {
-      ruleOptions.set(ruleId, parsed.options);
+    if (options) {
+      ruleOptions.set(ruleId, options);
     }
   }
 
@@ -394,12 +387,11 @@ async function runComponentCheckDiagnostics(
     // Discovery errors (COMP000) always surface at error severity — not user-configurable.
     let severity = d.severity;
     if (d.checkId !== "COMP000") {
-      const configValue = config.rules?.[d.checkId];
-      if (configValue !== undefined) {
-        const parsed = parseRuleConfig(configValue);
-        if (parsed.severity === "off") continue;
-        severity = parsed.severity;
-      }
+      // chant #1138 — same resolution function AST rules and post-synth
+      // checks use (`resolveConfiguredSeverity`, ../../lint/config.ts).
+      const resolved = resolveConfiguredSeverity(config.rules, d.checkId, d.severity);
+      if (resolved.severity === "off") continue;
+      severity = resolved.severity;
     }
 
     const disable = fileLevelDisable(d.file, d.checkId);

package/src/cli/main.test.ts

@@ -4,6 +4,12 @@ import { parseArgs, waitForStreamDrain } from "./main";
 import { resolveCommand, type CommandDef, type ParsedArgs } from "./registry";
 
 describe("parseArgs", () => {
+  test("--fold and --no-fold set the tri-state fold option (#1134)", () => {
+    expect(parseArgs(["build", "src"]).fold).toBeUndefined();
+    expect(parseArgs(["build", "src", "--fold"]).fold).toBe(true);
+    expect(parseArgs(["build", "src", "--no-fold"]).fold).toBe(false);
+  });
+
   test("parses command as first positional arg", () => {
     const result = parseArgs(["build"]);
     expect(result.command).toBe("build");

package/src/cli/main.ts

@@ -69,6 +69,7 @@ const BOOLEAN_FLAGS = new Set([
   "--bump",
   "--no-release-record",
   "--fold",
+  "--no-fold",
   "--sandbox",
 ]);
 
@@ -294,6 +295,10 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.noReleaseRecord = true;
     } else if (arg === "--fold") {
       result.fold = true;
+    } else if (arg === "--no-fold") {
+      // chant #1134 — fold is the default build path; this is the explicit
+      // opt-out, and like --fold it beats chant.config.ts's build.fold.
+      result.fold = false;
     } else if (arg === "--sandbox") {
       result.sandbox = true;
     } else if (arg === "--param") {
@@ -514,8 +519,11 @@ Options:
                         to run per-file for anything else outside the fold
                         subset (a cross-file-only reference, a re-export,
                         \`export default\`, ...). Logs which path each file
-                        took. Default: off (also settable via
-                        chant.config.ts's build.fold: true; #1022)
+                        took. DEFAULT since #1134 — this flag forces it on
+                        over a chant.config.ts \`build.fold: false\`.
+  --no-fold             (build) Opt out of folding for this invocation: every
+                        source module is imported and run, the pre-#1134
+                        behavior. Beats chant.config.ts's build.fold.
   --sandbox             (build) Run run-fallback source files (or every
                         file, without --fold) together, isolated, in one
                         sandboxed child process instead of in-process

package/src/config.test.ts

@@ -1,5 +1,11 @@
 import { describe, test, expect, beforeEach, afterEach } from "vitest";
-import { loadChantConfig, DEFAULT_CHANT_CONFIG, resolveAutoReleaseDisabled, resolveSbomFormat } from "./config";
+import {
+  loadChantConfig,
+  DEFAULT_CHANT_CONFIG,
+  resolveAutoReleaseDisabled,
+  resolveFoldEnabled,
+  resolveSbomFormat,
+} from "./config";
 import { writeFileSync, mkdirSync, rmSync } from "fs";
 import { join } from "path";
 
@@ -128,6 +134,27 @@ describe("loadChantConfig", () => {
   });
 });
 
+describe("resolveFoldEnabled (#1134 — fold is the default build path)", () => {
+  test("default (no flag, no config) → fold ON", () => {
+    expect(resolveFoldEnabled({})).toBe(true);
+  });
+
+  test("config build.fold: false turns it off; true keeps it on", () => {
+    expect(resolveFoldEnabled({ build: { fold: false } })).toBe(false);
+    expect(resolveFoldEnabled({ build: { fold: true } })).toBe(true);
+    expect(resolveFoldEnabled({ build: {} })).toBe(true);
+  });
+
+  test("--fold (flag true) beats config false", () => {
+    expect(resolveFoldEnabled({ build: { fold: false } }, true)).toBe(true);
+  });
+
+  test("--no-fold (flag false) beats config true and the default", () => {
+    expect(resolveFoldEnabled({ build: { fold: true } }, false)).toBe(false);
+    expect(resolveFoldEnabled({}, false)).toBe(false);
+  });
+});
+
 describe("resolveAutoReleaseDisabled", () => {
   test("default (no flag, no config) → not disabled", () => {
     expect(resolveAutoReleaseDisabled({})).toBe(false);

package/src/config.ts

@@ -139,12 +139,12 @@ export interface ChantConfig {
    */
   build?: {
     /**
-     * Opt-in: fold source modules statically instead of importing/running
-     * them, falling back to run per-file for anything the folder can't
-     * represent (composite factory calls, non-`new` exports, …). Default
-     * `false`. The `--fold` CLI flag overrides this per-invocation (a flag
-     * of `true` always wins; the flag cannot force fold *off* when this is
-     * `true`). See {@link resolveFoldEnabled}.
+     * Fold source modules statically instead of importing/running them,
+     * falling back to run per-file for anything the folder can't represent.
+     * DEFAULT `true` since chant #1134 — set `false` to make this project
+     * run every module (the pre-#1134 behavior). The `--fold`/`--no-fold`
+     * CLI flags override this per-invocation in either direction. See
+     * {@link resolveFoldEnabled}.
      */
     fold?: boolean;
 
@@ -353,14 +353,18 @@ export function resolveAutoReleaseDisabled(config: ChantConfig, cliFlag?: boolea
 
 /**
  * Whether `chant build` should use the fold path (#1022, epic #1019)
- * instead of running each source module. Opt-in: off unless the CLI's
- * `--fold` flag was passed (`cliFlag`) or the project config sets
- * `build.fold: true` — the flag always wins for that one invocation,
- * regardless of config.
+ * instead of running each source module. DEFAULT-ON since chant #1134: fold
+ * is the build path unless something turns it off. Precedence, most specific
+ * wins: an explicit CLI flag (`--fold` → true, `--no-fold` → false, arriving
+ * here as `cliFlag`), then the project config's `build.fold`, then the
+ * default of `true`. The epic's evidence base for the flip — coverage,
+ * byte-identity, and the sandbox execution boundary — is recorded on #1134
+ * and #1090.
  */
 export function resolveFoldEnabled(config: ChantConfig, cliFlag?: boolean): boolean {
-  if (cliFlag) return true;
-  return config.build?.fold === true;
+  if (cliFlag !== undefined) return cliFlag;
+  if (config.build?.fold !== undefined) return config.build.fold;
+  return true;
 }
 
 /**

package/src/discovery/sandbox/config-boundary.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { describe, test, expect, beforeEach, afterEach, vi } from "vitest";
 import { mkdir, writeFile, rm, realpath } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
@@ -236,4 +236,58 @@ describe("chant.config.ts evaluation under --sandbox (chant #1113)", () => {
     );
     expect(marker()).toBeUndefined();
   });
+
+  /**
+   * chant #1148 — `chant.config.ts`'s own `console.log`/`console.error` used
+   * to go nowhere under `--sandbox`. Same relay as the run-fallback child
+   * (`./run.test.ts`), just this child's own prefix.
+   */
+  describe("console output forwarding (chant #1148)", () => {
+    beforeEach(() => {
+      vi.restoreAllMocks();
+    });
+
+    afterEach(() => {
+      vi.restoreAllMocks();
+    });
+
+    /** Spies on `process.stderr.write` and returns the lines captured so far — same shape as `../../cli/handlers/emulator.test.ts`'s `stdout()`/`stderr()` helpers. */
+    function captureStderr(): string[] {
+      const lines: string[] = [];
+      vi.spyOn(process.stderr, "write").mockImplementation((chunk: unknown) => {
+        lines.push(String(chunk));
+        return true;
+      });
+      return lines;
+    }
+
+    // See ./run.test.ts's identical helper doc: the IPC "message" the awaited
+    // call resolves on and the child's stdout/stderr pipe data are
+    // independent channels, so polling briefly avoids a flaky assertion.
+    async function waitFor(lines: string[], matcher: RegExp, timeoutMs = 5000): Promise<void> {
+      const start = Date.now();
+      while (Date.now() - start < timeoutMs) {
+        if (matcher.test(lines.join(""))) return;
+        await new Promise((r) => setTimeout(r, 10));
+      }
+      throw new Error(`stderr never matched ${matcher}. Captured so far:\n${lines.join("")}`);
+    }
+
+    test("the config's own console.log/console.error are forwarded, prefixed with [sandbox:config]", async () => {
+      const stderr = captureStderr();
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `console.log("hello from config stdout");\n` +
+          `console.error("hello from config stderr");\n` +
+          `export default { lexicons: ["aws"] };\n`,
+      );
+      armSandboxConfigEvaluation();
+
+      const { config } = await loadChantConfig(testDir);
+
+      expect(config.lexicons).toEqual(["aws"]);
+      await waitFor(stderr, /^\[sandbox:config\] hello from config stdout$/m);
+      await waitFor(stderr, /^\[sandbox:config\] hello from config stderr$/m);
+    });
+  });
 });

package/src/discovery/sandbox/config-run.ts

@@ -108,6 +108,9 @@ export async function evaluateConfigSandboxed(
         env,
         timeoutMs: CONFIG_CHILD_TIMEOUT_MS,
         label: `sandboxed evaluation of ${configPath}`,
+        // chant #1148 — the config's own console.log/error no longer goes
+        // nowhere; see `./fork.ts`'s `outputPrefix` doc.
+        outputPrefix: "[sandbox:config]",
       },
       isConfigChildResponse,
     );