fix: sandboxing and esm imports

[jbedard]

---

Changes are visible to end-users: yes/no

• Searched for relevant documentation and updated as needed: yes/no
• Breaking change (forces users to change their own code or config): yes/no
• Suggested release notes appear below: yes/no

Test plan

• Covered by existing test cases
• New test cases added
• Manual testing; please provide instructions so we can reproduce:

[aspect-workflows]

Bazel 7 (Test)

Buildkite build #10902 is running...

---

Bazel 8 (Test)

⚠️ Buildkite build #10902 failed.

Failed tests (30)

//js/private/test/node-patches:lstat_node16_esm_cjs_test [k8-fastbuild]    🔗
//js/private/test/node-patches:lstat_node16_esm_test [k8-fastbuild]        🔗
//js/private/test/node-patches:lstat_node18_esm_cjs_test [k8-fastbuild]    🔗
//js/private/test/node-patches:lstat_node18_esm_test [k8-fastbuild]        🔗
//js/private/test/node-patches:lstat_node20_esm_cjs_test [k8-fastbuild]    🔗
//js/private/test/node-patches:lstat_node20_esm_test [k8-fastbuild]        🔗
//js/private/test/node-patches:lstat_node22_esm_cjs_test [k8-fastbuild]    🔗
//js/private/test/node-patches:lstat_node22_esm_test [k8-fastbuild]        🔗
//js/private/test/node-patches:lstat_node24_esm_cjs_test [k8-fastbuild]    🔗
//js/private/test/node-patches:lstat_node24_esm_test [k8-fastbuild]        🔗
//js/private/test/node-patches:readlink_node16_esm_cjs_test [k8-fastbuild] 🔗
//js/private/test/node-patches:readlink_node16_esm_test [k8-fastbuild]     🔗
//js/private/test/node-patches:readlink_node18_esm_cjs_test [k8-fastbuild] 🔗
//js/private/test/node-patches:readlink_node18_esm_test [k8-fastbuild]     🔗
//js/private/test/node-patches:readlink_node20_esm_cjs_test [k8-fastbuild] 🔗
//js/private/test/node-patches:readlink_node20_esm_test [k8-fastbuild]     🔗
//js/private/test/node-patches:readlink_node22_esm_cjs_test [k8-fastbuild] 🔗
//js/private/test/node-patches:readlink_node22_esm_test [k8-fastbuild]     🔗
//js/private/test/node-patches:readlink_node24_esm_cjs_test [k8-fastbuild] 🔗
//js/private/test/node-patches:readlink_node24_esm_test [k8-fastbuild]     🔗
//js/private/test/node-patches:realpath_node16_esm_cjs_test [k8-fastbuild] 🔗
//js/private/test/node-patches:realpath_node16_esm_test [k8-fastbuild]     🔗
//js/private/test/node-patches:realpath_node18_esm_cjs_test [k8-fastbuild] 🔗
//js/private/test/node-patches:realpath_node18_esm_test [k8-fastbuild]     🔗
//js/private/test/node-patches:realpath_node20_esm_cjs_test [k8-fastbuild] 🔗
//js/private/test/node-patches:realpath_node20_esm_test [k8-fastbuild]     🔗
//js/private/test/node-patches:realpath_node22_esm_cjs_test [k8-fastbuild] 🔗
//js/private/test/node-patches:realpath_node22_esm_test [k8-fastbuild]     🔗
//js/private/test/node-patches:realpath_node24_esm_cjs_test [k8-fastbuild] 🔗
//js/private/test/node-patches:realpath_node24_esm_test [k8-fastbuild]     🔗

💡 To reproduce 17 of the test failures, run

bazel test //js/private/test/node-patches:readlink_node16_esm_cjs_test //js/private/test/node-patches:lstat_node20_esm_cjs_test //js/private/test/node-patches:lstat_node16_esm_cjs_test //js/private/test/node-patches:realpath_node20_esm_test //js/private/test/node-patches:lstat_node22_esm_test //js/private/test/node-patches:realpath_node18_esm_test //js/private/test/node-patches:realpath_node24_esm_cjs_test //js/private/test/node-patches:readlink_node20_esm_test //js/private/test/node-patches:lstat_node18_esm_test //js/private/test/node-patches:lstat_node18_esm_cjs_test //js/private/test/node-patches:readlink_node22_esm_test //js/private/test/node-patches:lstat_node22_esm_cjs_test //js/private/test/node-patches:realpath_node16_esm_cjs_test //js/private/test/node-patches:realpath_node16_esm_test //js/private/test/node-patches:lstat_node24_esm_test //js/private/test/node-patches:readlink_node18_esm_test //js/private/test/node-patches:realpath_node22_esm_test

---

Bazel 7 (Test)

e2e/bzlmod

2 test targets passed

Targets

//:jasmine_test [k8-fastbuild]362ms
//:test [k8-fastbuild]524ms

Total test execution time was 886ms. 3 tests (60.0%) were fully cached saving 129ms.

---

Bazel 7 (Test)

e2e/git_dep_metadata

All tests were cache hits

1 test (100.0%) was fully cached saving 31ms.

---

Bazel 7 (Test)

e2e/gyp_no_install_script

1 test target passed

Targets

//:test [k8-fastbuild]96ms

Total test execution time was 96ms. 1 test (50.0%) was fully cached saving 86ms.

---

Bazel 7 (Test)

e2e/js_image_oci

Buildkite build #10902 is running...

---

Bazel 7 (Test)

e2e/npm_link_package

1 test target passed

Targets

//src:test [k8-fastbuild]347ms

Total test execution time was 347ms. 1 test (50.0%) was fully cached saving 52ms.

---

Bazel 7 (Test)

e2e/npm_link_package-esm

1 test target passed

Targets

//src:test [k8-fastbuild]138ms

Total test execution time was 138ms. 1 test (50.0%) was fully cached saving 52ms.

---

Bazel 7 (Test)

e2e/npm_link_package-rerooted

1 test target passed

Targets

//root/src:test [k8-fastbuild]152ms

Total test execution time was 152ms. 1 test (50.0%) was fully cached saving 42ms.

---

Bazel 7 (Test)

e2e/npm_translate_lock

2 test targets passed

Targets

//:test_dev_filtering [k8-fastbuild]214ms
//:test_prod_filtering [k8-fastbuild]477ms

Total test execution time was 691ms. 1 test (33.3%) was fully cached saving 55ms.

---

Bazel 7 (Test)

e2e/npm_translate_lock_disable_hooks

All tests were cache hits

3 tests (100.0%) were fully cached saving 257ms.

---

Bazel 7 (Test)

e2e/npm_translate_lock_empty

Buildkite build #10902 is running...

---

Bazel 7 (Test)

e2e/npm_translate_lock_exclude_package_contents

All tests were cache hits

1 test (100.0%) was fully cached saving 34ms.

---

Bazel 7 (Test)

e2e/npm_translate_lock_link_workspace

1 test target passed

Targets

//foo:test [k8-fastbuild]101ms

Total test execution time was 101ms. 1 test (50.0%) was fully cached saving 56ms.

---

Bazel 7 (Test)

e2e/npm_translate_lock_multi

All tests were cache hits

2 tests (100.0%) were fully cached saving 164ms.

---

Bazel 7 (Test)

e2e/npm_translate_lock_partial_clone

All tests were cache hits

1 test (100.0%) was fully cached saving 61ms.

---

Bazel 7 (Test)

e2e/npm_translate_lock_replace_packages

2 test targets passed

Targets

//:test [k8-fastbuild]190ms
//:utils_test [k8-fastbuild]182ms

Total test execution time was 372ms. 2 tests (50.0%) were fully cached saving 200ms.

---

Bazel 7 (Test)

e2e/npm_translate_lock_subdir_patch

Buildkite build #10902 is running...

---

Bazel 7 (Test)

e2e/npm_translate_package_lock

All tests were cache hits

1 test (100.0%) was fully cached saving 31ms.

---

Bazel 7 (Test)

e2e/npm_translate_yarn_lock

Buildkite build #10902 is running...

---

Bazel 7 (Test)

e2e/package_json_module

1 test target passed

Targets

//:test368ms

---

Bazel 7 (Test)

e2e/patch_from_repo

All tests were cache hits

1 test (100.0%) was fully cached saving 31ms.

---

Bazel 7 (Test)

e2e/pnpm_lockfiles

11 test targets passed

Targets

//cases/versionless-patch-v9:versionless_patch_test [k8-fastbuild]378ms
//v101:aliases-test [k8-fastbuild]133ms
//v101:patch-test [k8-fastbuild]143ms
//v54:aliases-test [k8-fastbuild]183ms
//v54:patch-test [k8-fastbuild]196ms
//v60:aliases-test [k8-fastbuild]620ms
//v60:patch-test [k8-fastbuild]272ms
//v61:aliases-test [k8-fastbuild]527ms
//v61:patch-test [k8-fastbuild]209ms
//v90:aliases-test [k8-fastbuild]355ms
//v90:patch-test [k8-fastbuild]157ms

Total test execution time was 3s. 66 tests (85.7%) were fully cached saving 7s.

---

Bazel 7 (Test)

e2e/pnpm_repo_install

1 test target passed

Targets

//:pnpm_install_test1s

---

Bazel 7 (Test)

e2e/pnpm_version

Waiting for runner...

---

Bazel 7 (Test)

e2e/pnpm_workspace

6 test targets passed

Targets

//app/a:aspect_test_a_bin_test [k8-fastbuild]2s
//app/a:test [k8-fastbuild]417ms
//app/b:test [k8-fastbuild]2s
//app/c:aspect_test_a_bin_test [k8-fastbuild]779ms
//app/c:test [k8-fastbuild]805ms
//app/d:test [k8-fastbuild]530ms

Total test execution time was 7s. 9 tests (60.0%) were fully cached saving 1s.

---

Bazel 7 (Test)

e2e/pnpm_workspace_deps

3 test targets passed

Targets

//tests:direct [k8-fastbuild]170ms
//tests:dupes [k8-fastbuild]93ms
//tests:pkg [k8-fastbuild]170ms

---

Bazel 7 (Test)

e2e/pnpm_workspace_rerooted

6 test targets passed

Targets

//app/a:aspect_test_a_bin_test [k8-fastbuild]318ms
//app/a:test [k8-fastbuild]175ms
//app/b:test [k8-fastbuild]125ms
//app/c:aspect_test_a_bin_test [k8-fastbuild]318ms
//app/c:test [k8-fastbuild]228ms
//app/d:test [k8-fastbuild]404ms

Total test execution time was 2s. 9 tests (60.0%) were fully cached saving 938ms.

---

Bazel 7 (Test)

e2e/repo_mapping

1 test target passed

Targets

//:test [k8-fastbuild]127ms

Total test execution time was 127ms. 2 tests (66.7%) were fully cached saving 310ms.

---

Bazel 7 (Test)

e2e/runfiles

Buildkite build #10902 is running...

---

Bazel 7 (Test)

e2e/stamped_package_json

All tests were cache hits

1 test (100.0%) was fully cached saving 44ms.

---

Bazel 7 (Test)

e2e/vendored_node

1 test target passed

Targets

//:test [k8-fastbuild]134ms

---

Bazel 7 (Test)

e2e/vendored_tarfile

All tests were cache hits

1 test (100.0%) was fully cached saving 31ms.

---

Bazel 7 (Test)

e2e/verify_patches

All tests were cache hits

2 tests (100.0%) were fully cached saving 109ms.

---

Bazel 7 (Test)

e2e/worker

All tests were cache hits

1 test (100.0%) was fully cached saving 35ms.

---

Bazel 7 (Test)

e2e/workspace

All tests were cache hits

1 test (100.0%) was fully cached saving 35ms.

---

Buildifier      Format

[matthewjh]

@jbedard are you still working on this?

[jbedard]

I still hope to do it but haven't been able to put any time/testing into it recently. It might be nice to enable by default in a v3, so merge for opt-in sooner?