@intentius/chant 0.79.0 → 0.81.0

package/src/components/sandbox/run.ts

@@ -3,6 +3,7 @@ import { realpathSync, rmSync } from "node:fs";
 import { resolve } from "node:path";
 import { bundleDriver } from "../../discovery/sandbox/bundle";
 import { classifyChildError } from "../../discovery/sandbox/child-errors";
+import { settleOnExitAfterChannelDrains } from "../../discovery/sandbox/fork";
 import { DiscoveryError, type DiscoveryErrorType } from "../../errors";
 import type { Component } from "../component";
 import type { DiscoveredComponent } from "../discover";
@@ -163,7 +164,9 @@ function runChildProcess(
       reject(err);
     });
 
-    child.on("exit", (code, signal) => {
+    // chant#2461 — a payload can still be in the IPC socket when the exit is
+    // handled; see settleOnExitAfterChannelDrains.
+    settleOnExitAfterChannelDrains(child, (code, signal) => {
       if (settled) return;
       settled = true;
       clearTimeout(timeout);

package/src/components/verbs/build-archive.ts

@@ -55,6 +55,8 @@
 
 import type { ArtifactReproducibility, ProvenanceLink } from "./reproducibility";
 import { defaultReproducibility } from "./reproducibility";
+import { contentDigest } from "../../content-digest";
+import { canonicalJson } from "../../effect-receipt";
 
 export type BuildArchiveEntryKind = "image" | "template" | "asset" | "sbom";
 
@@ -129,6 +131,12 @@ export interface BuildArchiveManifest {
    * changed contents, not merely a re-run.
    */
   manifestDigest: string;
+  /**
+   * Set on read, never written: `["legacy-digest"]` when a manifest
+   * persisted on `chant/lifecycle` holds digests from the 32-bit hash chant
+   * used before real SHA-256 (#2514). See ../../lifecycle/legacy-digest.ts.
+   */
+  flags?: Array<"legacy-digest">;
 }
 
 /**
@@ -147,30 +155,28 @@ const DEFAULT_MEDIA_TYPES: Record<BuildArchiveEntryKind, string> = {
 };
 
 /**
- * Deterministic content digest over arbitrary string content. Same shape as
- * the FNV-ish fake digest `MockCloudExecutor` uses, so tests can assert on it
- * without a real `sha256` implementation. Exported so callers that need to
- * digest content that never goes through the `CloudExecutor` (e.g. a
- * synthesized template's serialized bytes, see ./build.ts's
- * `addArchiveTemplate`) share this one algorithm rather than each defining
- * their own. Production `image`/`asset` entries instead carry the real
- * digest their producing capability already computed (e.g. `docker-build`'s
- * `executor.docker.build` digest).
+ * The content digest every entry chant computes itself carries: real
+ * SHA-256 over the UTF-8 bytes of its input (../../content-digest.ts,
+ * chant #2514). Callers that digest content that never goes through the
+ * `CloudExecutor` (a synthesized template's serialized bytes, see ./build.ts's
+ * `addArchiveTemplate`, or an SBOM) use it. Production `image`/`asset`
+ * entries instead carry the digest their producing capability already
+ * computed (e.g. `docker-build`'s `executor.docker.build` digest).
  */
-export function contentDigest(input: string): string {
-  let hash = 0;
-  for (let i = 0; i < input.length; i++) {
-    hash = (Math.imul(hash, 31) + input.charCodeAt(i)) | 0;
-  }
-  const hex = Math.abs(hash).toString(16).padStart(8, "0");
-  return `sha256:${hex.repeat(8).slice(0, 64)}`;
-}
+export { contentDigest };
 
-/** Compute the aggregate `manifestDigest` over a set of entries — sorted by path so entry order never changes the digest, only content does. */
+/**
+ * Compute the aggregate `manifestDigest` over a set of entries. Each entry
+ * contributes its `kind`, `path` and `digest`; entries are sorted by path
+ * (UTF-16 code units, the order `canonicalJson` sorts keys in) so entry order
+ * never changes the digest, only content does. The list is hashed as
+ * `canonicalJson`, so no path or digest can be read as a field separator.
+ */
 export function computeManifestDigest(contents: BuildArchiveEntry[]): string {
-  const sorted = [...contents].sort((a, b) => a.path.localeCompare(b.path));
-  const canonical = sorted.map((e) => `${e.kind}:${e.path}:${e.digest}`).join("\n");
-  return contentDigest(canonical);
+  const sorted = contents
+    .map((e) => ({ kind: e.kind, path: e.path, digest: e.digest }))
+    .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+  return contentDigest(canonicalJson(sorted));
 }
 
 /** Start a new, empty manifest for `component`. Entries are added with `addArchiveEntry`. */

package/src/components/verbs/run-agent.ts

@@ -237,7 +237,7 @@
  *    `externalParameters`, never replacing it), not a shape break.
  */
 
-import { createHash } from "node:crypto";
+import { contentDigest } from "../../content-digest";
 import type { Capability, DeployContext } from "../capability";
 import type { ProvenanceLink } from "./reproducibility";
 import type { BuildArchiveEntry } from "./build-archive";
@@ -555,10 +555,8 @@ export function createRunAgentCapability(
 const PROMPT_PATH = "/work/prompt";
 const OUTPUT_PATH = "/work/output";
 
-/** `sha256:<hex>` over a string, prefixed the same way ./build-archive.ts's `contentDigest` and ./build.ts's zip/jar digests are. */
-function sha256Digest(content: string): string {
-  return `sha256:${createHash("sha256").update(content, "utf8").digest("hex")}`;
-}
+/** `sha256:<hex>` over a string: ../../content-digest.ts's `contentDigest`, the same digest ./build-archive.ts uses. */
+const sha256Digest = contentDigest;
 
 const EMPTY_DIGEST = sha256Digest("");
 

package/src/config-static.test.ts

@@ -0,0 +1,136 @@
+/**
+ * chant#2591 — the static reader of a config's `lexicons`: what it reads, and
+ * what it reports as unreadable instead of running the config.
+ */
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { existsSync, mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { readConfigFieldsStatically, readLexiconDeclarationsStatically, unknownPathLexiconsNotice } from "./config-static";
+
+let dir: string;
+
+beforeEach(() => {
+  dir = realpathSync(mkdtempSync(join(tmpdir(), "chant-2591-static-")));
+  // A project boundary, so the upward walk stops here.
+  writeFileSync(join(dir, "package.json"), "{}");
+});
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+function readTs(source: string) {
+  writeFileSync(join(dir, "chant.config.ts"), source);
+  return readLexiconDeclarationsStatically(dir);
+}
+
+const SITE = { name: "site", module: "./lexicon/index.ts" };
+
+describe("readable configs", () => {
+  test.each([
+    ["an object literal default export", `export default { lexicons: ["aws", { name: "site", module: "./lexicon/index.ts" }] };`],
+    [
+      "satisfies and a type import",
+      `import type { ChantConfig } from "@intentius/chant";\nexport default { lexicons: ["aws", { name: "site", module: "./lexicon/index.ts" }] } satisfies ChantConfig;`,
+    ],
+    [
+      "a const alias",
+      `const config = { lexicons: ["aws", { name: "site", module: "./lexicon/index.ts" }], sourceDir: "src" };\nexport default config;`,
+    ],
+    ["a named config export", `export const config = { lexicons: ["aws", { name: "site", module: "./lexicon/index.ts" }] };`],
+    ["named exports", `export const lexicons = ["aws", { name: "site", module: "./lexicon/index.ts" }];\nexport const sourceDir = "src";`],
+    [
+      "consts, a spread and a template",
+      `const dir = "lexicon";\nconst base = ["aws"];\nexport default { lexicons: [...base, { name: "site", module: \`./\${dir}/index.ts\` }] };`,
+    ],
+    [
+      "a spread config",
+      `const shared = { lexicons: ["aws", { name: "site", module: "./lexicon/index.ts" }] };\nexport default { ...shared, sourceDir: "src" };`,
+    ],
+    [
+      "other keys that are not readable",
+      `import { plugin } from "./rules";\nexport default { lexicons: ["aws", { name: "site", module: "./lexicon/index.ts" }], lint: { plugins: [plugin()] } };`,
+    ],
+  ])("%s", (_label, source) => {
+    const read = readTs(source);
+    expect(read).toEqual({ status: "read", configPath: join(dir, "chant.config.ts"), entries: ["aws", SITE] });
+  });
+
+  test("a same-file function the fold subset covers is interpreted, not run", () => {
+    const read = readTs(`const pick = (extra) => ["aws", extra];\nexport default { lexicons: pick("k8s") };`);
+    expect(read).toMatchObject({ status: "read", entries: ["aws", "k8s"] });
+  });
+
+  test("a config with no lexicons reads as none", () => {
+    expect(readTs(`export default { sourceDir: "src" };`)).toMatchObject({ status: "read", entries: [] });
+  });
+
+  test("chant.config.json is parsed", () => {
+    writeFileSync(join(dir, "chant.config.json"), JSON.stringify({ lexicons: ["aws", SITE] }));
+    expect(readLexiconDeclarationsStatically(dir)).toMatchObject({ status: "read", entries: ["aws", SITE] });
+  });
+
+  test("the walk goes up from a subdirectory", () => {
+    writeFileSync(join(dir, "chant.config.ts"), `export default { lexicons: [{ name: "site", module: "./lexicon/index.ts" }] };`);
+    mkdirSync(join(dir, "src", "deep"), { recursive: true });
+    expect(readLexiconDeclarationsStatically(join(dir, "src", "deep"))).toMatchObject({ status: "read", entries: [SITE] });
+  });
+
+  test("no config", () => {
+    expect(readLexiconDeclarationsStatically(dir)).toEqual({ status: "no-config" });
+  });
+});
+
+describe("unreadable configs are reported, never run", () => {
+  test.each([
+    ["an imported binding", `import { lexicons } from "./shared";\nexport default { lexicons };`, /lexicons/],
+    ["process.env", `export default { lexicons: process.env.CI ? ["aws"] : ["aws", "k8s"] };`, /process/],
+    ["a call as the default export", `export default defineConfig({ lexicons: ["aws"] });`, /not an object literal/],
+    ["a re-export", `export { default } from "./base";`, /export/],
+    ["an imported function in lexicons", `import { pick } from "./pick";\nexport default { lexicons: pick() };`, /line 4: .*pick/],
+    ["entries of the wrong shape", `export default { lexicons: [{ name: "site" }] };`, /not a list of lexicon entries/],
+  ])("%s", (_label, source, reason) => {
+    const marker = join(dir, "ran");
+    const read = readTs(`import { writeFileSync } from "node:fs";\nwriteFileSync(${JSON.stringify(marker)}, "x");\n${source}`);
+    expect(read.status).toBe("unknown");
+    expect(read.status === "unknown" && read.reason).toMatch(reason);
+    expect(unknownPathLexiconsNotice(read)).toContain("is unknown here and is treated as a package");
+    expect(existsSync(marker)).toBe(false);
+  });
+
+  test("a readable config has no notice", () => {
+    expect(unknownPathLexiconsNotice(readTs(`export default { lexicons: ["aws"] };`))).toBeUndefined();
+  });
+});
+
+describe("readConfigFieldsStatically (#2641)", () => {
+  test("reads the asked-for fields of a default export, a named config or named exports, and leaves unset ones out", () => {
+    writeFileSync(join(dir, "chant.config.ts"), `const env = "prod";\nexport default { environments: [env, { name: "staging" }], ownership: { stack: "shop", env }, lexicons: ["aws"] };`);
+    expect(readConfigFieldsStatically(dir, ["ownership", "environments", "sourceDir"])).toEqual({
+      status: "read",
+      configPath: join(dir, "chant.config.ts"),
+      fields: { ownership: { stack: "shop", env: "prod" }, environments: ["prod", { name: "staging" }] },
+    });
+    writeFileSync(join(dir, "chant.config.ts"), `export const ownership = { stack: "named" };`);
+    expect(readConfigFieldsStatically(dir, ["ownership"])).toMatchObject({ status: "read", fields: { ownership: { stack: "named" } } });
+  });
+
+  test("a value it can't fold is unknown, with the reason, and the config is not run", () => {
+    const marker = join(dir, "ran");
+    writeFileSync(
+      join(dir, "chant.config.ts"),
+      `import { writeFileSync } from "node:fs";\nwriteFileSync(${JSON.stringify(marker)}, "x");\nexport default { ownership: { stack: process.env.STACK } };`,
+    );
+    const read = readConfigFieldsStatically(dir, ["ownership"]);
+    expect(read.status).toBe("unknown");
+    expect(existsSync(marker)).toBe(false);
+  });
+
+  test("reads chant.config.json, and only in the directory itself", () => {
+    writeFileSync(join(dir, "chant.config.json"), JSON.stringify({ environments: ["prod"] }));
+    expect(readConfigFieldsStatically(dir, ["environments"])).toMatchObject({ status: "read", fields: { environments: ["prod"] } });
+    mkdirSync(join(dir, "sub"));
+    expect(readConfigFieldsStatically(join(dir, "sub"), ["environments"])).toEqual({ status: "no-config" });
+  });
+});

package/src/config-static.ts

@@ -0,0 +1,232 @@
+/**
+ * chant#2591, chant#2589 — read the `lexicons` a project's config declares
+ * without running the config.
+ *
+ * `chant.config.ts` is project code. Most commands evaluate it (see
+ * `./config-sandbox.ts`), but a few only need to know which lexicons it
+ * declares by path (#2520) so their messages can name the path instead of a
+ * package: `init --force`, `dev onboard`, `import --agents` and `audit`.
+ * Those read the config here, statically, and never evaluate it.
+ *
+ * The reader parses the file and reduces the `lexicons` value with the fold
+ * machinery (`./fold/fold.ts`'s {@link fold}), given the file's own top-level
+ * `const`s and nothing else. It never imports anything, so an imported
+ * binding, a function call or `process.env` is not readable. When the value
+ * cannot be read, the result says why and callers treat path lexicons as
+ * unknown. They never fall back to evaluating the config.
+ *
+ * What the config's export looks like follows `selectConfigExport` in
+ * `./config-sandbox.ts`: `export default`, else `export const config`, else
+ * the module's named exports (`export const lexicons`).
+ *
+ * `chant.config.json` is data and is simply parsed.
+ *
+ * {@link readConfigFieldsStatically} reads other top-level fields the same
+ * way. `chant workspace check` reads a member's `ownership` and
+ * `environments` with it for the ledger checks (#2641).
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import * as ts from "typescript";
+import { ChantConfigSchema, findProjectConfigPastFragments } from "./config";
+import { collectConsts, fold, propName, FoldError } from "./fold/fold";
+import type { LexiconDeclaration } from "./lexicon-module";
+
+/** What {@link readLexiconDeclarationsStatically} found. */
+export type StaticLexiconRead =
+  /** No `chant.config.ts` or `chant.config.json` for the directory. */
+  | { status: "no-config" }
+  /** The declarations, in order. Empty when the config declares no `lexicons`. */
+  | { status: "read"; configPath: string; entries: LexiconDeclaration[] }
+  /** The config exists, but its `lexicons` could not be read without running it. */
+  | { status: "unknown"; configPath: string; reason: string };
+
+/** Signals a config shape the reader does not follow. The message is the reason reported. */
+class Unreadable extends Error {}
+
+/**
+ * Find the project config for `startDir` (the walk `loadChantConfigUpward`
+ * makes) and read its `lexicons` without evaluating it.
+ */
+export function readLexiconDeclarationsStatically(startDir: string): StaticLexiconRead {
+  const { configPath } = findProjectConfigPastFragments(startDir);
+  if (configPath === undefined) return { status: "no-config" };
+  try {
+    const value = readFields(configPath, ["lexicons"]).lexicons;
+    if (value === undefined) return { status: "read", configPath, entries: [] };
+    const parsed = ChantConfigSchema.shape.lexicons.safeParse(value);
+    if (!parsed.success) {
+      return { status: "unknown", configPath, reason: "`lexicons` is not a list of lexicon entries" };
+    }
+    return { status: "read", configPath, entries: (parsed.data ?? []) as LexiconDeclaration[] };
+  } catch (err) {
+    return { status: "unknown", configPath, reason: unreadableReason(err) };
+  }
+}
+
+function unreadableReason(err: unknown): string {
+  return err instanceof FoldError
+    ? `line ${err.line}: ${err.message}`
+    : err instanceof Unreadable
+      ? err.message
+      : `the file could not be read (${err instanceof Error ? err.message : String(err)})`;
+}
+
+/** What {@link readConfigFieldsStatically} found. */
+export type StaticFieldsRead =
+  /** No `chant.config.ts` or `chant.config.json` in the directory. */
+  | { status: "no-config" }
+  /** Each asked-for field the config sets, folded to a value. A field it doesn't set is absent. */
+  | { status: "read"; configPath: string; fields: Record<string, unknown> }
+  /** The config exists, but a field could not be read without running it. */
+  | { status: "unknown"; configPath: string; reason: string };
+
+/**
+ * Read top-level `fields` of the config in `dir` itself, as
+ * `loadChantConfig(dir)` finds it (`chant.config.ts`, else
+ * `chant.config.json`), without evaluating it. The values are not checked
+ * against the config schema; the caller does that for the fields it reads.
+ */
+export function readConfigFieldsStatically(dir: string, fields: readonly string[]): StaticFieldsRead {
+  const configPath = ["chant.config.ts", "chant.config.json"].map((f) => join(dir, f)).find((f) => existsSync(f));
+  if (configPath === undefined) return { status: "no-config" };
+  try {
+    return { status: "read", configPath, fields: readFields(configPath, fields) };
+  } catch (err) {
+    return { status: "unknown", configPath, reason: unreadableReason(err) };
+  }
+}
+
+function readFields(configPath: string, fields: readonly string[]): Record<string, unknown> {
+  const values = configPath.endsWith(".json") ? readJsonFields(configPath, fields) : readTsFields(configPath, fields);
+  // Absent fields are left out rather than set to undefined.
+  return Object.fromEntries(Object.entries(values).filter(([, v]) => v !== undefined));
+}
+
+/** The directory a read config's relative module paths resolve against. */
+export function staticConfigBaseDir(read: { configPath: string }): string {
+  return dirname(read.configPath);
+}
+
+/**
+ * The line a command prints when {@link readLexiconDeclarationsStatically}
+ * could not read the config, or `undefined` when it could.
+ */
+export function unknownPathLexiconsNotice(read: StaticLexiconRead): string | undefined {
+  if (read.status !== "unknown") return undefined;
+  return (
+    `note: could not read the lexicons in ${read.configPath} without running it (${read.reason}). ` +
+    "chant does not run it for this command, so any lexicon it declares by path is unknown here and is treated as a package."
+  );
+}
+
+function readJsonFields(configPath: string, fields: readonly string[]): Record<string, unknown> {
+  const parsed = JSON.parse(readFileSync(configPath, "utf-8")) as unknown;
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Unreadable("the config is not a JSON object");
+  }
+  return Object.fromEntries(fields.map((f) => [f, (parsed as Record<string, unknown>)[f]]));
+}
+
+function readTsFields(configPath: string, fields: readonly string[]): Record<string, unknown> {
+  const source = ts.createSourceFile(configPath, readFileSync(configPath, "utf-8"), ts.ScriptTarget.Latest, true);
+  const consts = collectConsts(source);
+
+  let defaultExport: ts.Expression | undefined;
+  const named = new Map<string, ts.Expression>();
+  for (const statement of source.statements) {
+    if (ts.isExportAssignment(statement)) {
+      if (statement.isExportEquals) throw new Unreadable("`export =` is not read");
+      defaultExport = statement.expression;
+    } else if (ts.isExportDeclaration(statement)) {
+      // `export { x as default }`, `export * from "./other"`: the export's
+      // value lives elsewhere, possibly in another module.
+      throw new Unreadable("an `export { … }` or `export … from` declaration is not read");
+    } else if (ts.isVariableStatement(statement) && hasExportModifier(statement)) {
+      if ((statement.declarationList.flags & ts.NodeFlags.Const) === 0) {
+        throw new Unreadable("an exported `let` or `var` is not read");
+      }
+      for (const decl of statement.declarationList.declarations) {
+        if (ts.isIdentifier(decl.name) && decl.initializer) named.set(decl.name.text, decl.initializer);
+        else throw new Unreadable("a destructured export is not read");
+      }
+    } else if (hasExportModifier(statement) && hasDefaultModifier(statement)) {
+      throw new Unreadable("the default export is not an object");
+    }
+  }
+
+  const configExpr = defaultExport ?? named.get("config");
+  if (configExpr === undefined) {
+    // The module's named exports are the config.
+    return Object.fromEntries(
+      fields.map((f) => {
+        const expr = named.get(f);
+        return [f, expr === undefined ? undefined : fold(expr, consts)];
+      }),
+    );
+  }
+  const obj = configObject(configExpr, consts, new Set());
+  return Object.fromEntries(fields.map((f) => [f, fieldOfObject(obj, f, consts)]));
+}
+
+/** The object literal a config export reduces to, following `const` aliases. */
+function configObject(
+  node: ts.Expression,
+  consts: Map<string, ts.Expression>,
+  seen: Set<string>,
+): ts.ObjectLiteralExpression {
+  const inner = unwrap(node);
+  if (ts.isObjectLiteralExpression(inner)) return inner;
+  if (ts.isIdentifier(inner)) {
+    const init = consts.get(inner.text);
+    if (init === undefined || seen.has(inner.text)) {
+      throw new Unreadable(`the exported config \`${inner.text}\` is not a top-level const of this file`);
+    }
+    seen.add(inner.text);
+    return configObject(init, consts, seen);
+  }
+  throw new Unreadable("the exported config is not an object literal");
+}
+
+/** The value `field` takes in a config object literal, or `undefined` when it sets none. */
+function fieldOfObject(obj: ts.ObjectLiteralExpression, field: string, consts: Map<string, ts.Expression>): unknown {
+  let value: unknown = undefined;
+  for (const prop of obj.properties) {
+    if (ts.isSpreadAssignment(prop)) {
+      const spread = fold(prop.expression, consts);
+      if (spread !== null && typeof spread === "object" && Object.prototype.hasOwnProperty.call(spread, field)) {
+        value = (spread as Record<string, unknown>)[field];
+      }
+      continue;
+    }
+    if (prop.name === undefined) continue;
+    const name = propName(prop.name);
+    if (name !== field) continue;
+    if (ts.isPropertyAssignment(prop)) value = fold(prop.initializer, consts);
+    else if (ts.isShorthandPropertyAssignment(prop)) value = fold(prop.name, consts);
+    else throw new Unreadable(`\`${field}\` is a method or accessor`);
+  }
+  return value;
+}
+
+function unwrap(node: ts.Expression): ts.Expression {
+  let current = node;
+  while (
+    ts.isParenthesizedExpression(current) ||
+    ts.isAsExpression(current) ||
+    ts.isSatisfiesExpression(current) ||
+    ts.isNonNullExpression(current) ||
+    ts.isTypeAssertionExpression(current)
+  ) {
+    current = current.expression;
+  }
+  return current;
+}
+
+function hasExportModifier(node: ts.Node): boolean {
+  return (ts.canHaveModifiers(node) && ts.getModifiers(node)?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword)) ?? false;
+}
+
+function hasDefaultModifier(node: ts.Node): boolean {
+  return (ts.canHaveModifiers(node) && ts.getModifiers(node)?.some((m) => m.kind === ts.SyntaxKind.DefaultKeyword)) ?? false;
+}

package/src/config.test.ts

@@ -12,6 +12,7 @@ import {
   environmentEndpoint,
   matchesEnvironmentPattern,
   matchesDeclaredEnvironment,
+  resolveDiscoveryGlobs,
 } from "./config";
 import { writeFileSync, mkdirSync, rmSync } from "fs";
 import { join } from "path";
@@ -448,3 +449,42 @@ describe("resolveKnowledgeDir (#1864, design #1059)", () => {
     expect(resolveKnowledgeDir({ knowledge: {} }, "/proj")).toBe(join("/proj", "knowledge"));
   });
 });
+
+describe("exclude / include discovery globs (#2519)", () => {
+  test("loads string arrays", async () => {
+    writeFileSync(join(TEST_DIR, "chant.config.json"), JSON.stringify({ exclude: ["ops/**"], include: ["ops/keep.ts"] }));
+    const { config } = await loadChantConfig(TEST_DIR);
+    expect(config.exclude).toEqual(["ops/**"]);
+    expect(config.include).toEqual(["ops/keep.ts"]);
+  });
+
+  test.each([
+    ["a non-string entry", { exclude: ["ops/**", 42] }, /exclude\.1: .*expected string/],
+    ["a bare string", { exclude: "ops/**" }, /exclude: .*expected array/],
+    ["an empty pattern", { include: [""] }, /include\.0: /],
+  ])("rejects %s loudly", async (_label, raw, message) => {
+    writeFileSync(join(TEST_DIR, "chant.config.json"), JSON.stringify(raw));
+    await expect(loadChantConfig(TEST_DIR)).rejects.toThrow(message);
+    await expect(resolveDiscoveryGlobs(TEST_DIR)).rejects.toThrow(message);
+  });
+
+  test("resolveDiscoveryGlobs returns include alone, since it re-admits the walk's default skips (#2527)", async () => {
+    expect(await resolveDiscoveryGlobs(TEST_DIR)).toBeUndefined();
+    writeFileSync(join(TEST_DIR, "chant.config.json"), JSON.stringify({ include: ["ops/**"] }));
+    expect(await resolveDiscoveryGlobs(TEST_DIR)).toEqual({ root: TEST_DIR, exclude: [], include: ["ops/**"] });
+  });
+
+  test("resolveDiscoveryGlobs anchors the globs at the project config's directory, past a lint fragment", async () => {
+    const src = join(TEST_DIR, "src");
+    mkdirSync(src, { recursive: true });
+    writeFileSync(join(src, "chant.config.json"), JSON.stringify({ rules: { COR001: "off" } }));
+    writeFileSync(join(TEST_DIR, "chant.config.json"), JSON.stringify({ exclude: ["ops"] }));
+    expect(await resolveDiscoveryGlobs(src)).toEqual({ root: TEST_DIR, exclude: ["ops"], include: [] });
+  });
+
+  test("resolveDiscoveryGlobs leaves an unrelated config error to the command's own load", async () => {
+    writeFileSync(join(TEST_DIR, "chant.config.json"), JSON.stringify({ lexicons: [7], exclude: ["ops"] }));
+    await expect(loadChantConfig(TEST_DIR)).rejects.toThrow(/lexicons\.0/);
+    expect(await resolveDiscoveryGlobs(TEST_DIR)).toBeUndefined();
+  });
+});