fix: sandboxing and esm imports

[jbedard]

---

Changes are visible to end-users: yes/no

• Searched for relevant documentation and updated as needed: yes/no
• Breaking change (forces users to change their own code or config): yes/no
• Suggested release notes appear below: yes/no

Test plan

• Covered by existing test cases
• New test cases added
• Manual testing; please provide instructions so we can reproduce:

[aspect-workflows]

Test

Buildkite build #9524 is running...

---

Test

e2e/bzlmod

Buildkite build #9524 is running...

---

Test

e2e/gyp_no_install_script

1 test target passed

Targets

//:test [k8-fastbuild]131ms

Total test execution time was 131ms. 1 test (50.0%) was fully cached saving 103ms.

---

Test

e2e/js_image_oci

⚠️ Buildkite build #9524 failed.

Failed tests (1)

//src:image_test [k8-fastbuild]🔗

💡 To reproduce the test failures, run

bazel test //src:image_test

---

Test

e2e/npm_link_package

Buildkite build #9524 is running...

---

Test

e2e/npm_link_package-esm

Buildkite build #9524 is running...

---

Test

e2e/npm_translate_lock

All tests were cache hits

1 test (100.0%) was fully cached saving 31ms.

---

Test

e2e/npm_translate_lock_empty

All tests were cache hits

1 test (100.0%) was fully cached saving 31ms.

---

Test

e2e/npm_translate_lock_multi

All tests were cache hits

2 tests (100.0%) were fully cached saving 164ms.

---

Test

e2e/npm_translate_lock_partial_clone

All tests were cache hits

1 test (100.0%) was fully cached saving 61ms.

---

Test

e2e/npm_translate_lock_replace_packages

⚠️ Buildkite build #9524 failed.

Failed tests (1)

//:test [k8-fastbuild]🔗

💡 To reproduce the test failures, run

bazel test //:test

---

Test

e2e/npm_translate_lock_subdir_patch

⚠️ Buildkite build #9524 failed.

Failed tests (1)

//subdir:test🔗

💡 To reproduce the test failures, run

bazel test //subdir:test

---

Test

e2e/npm_translate_package_lock

Buildkite build #9524 is running...

---

Test

e2e/npm_translate_yarn_lock

Buildkite build #9524 is running...

---

Test

e2e/package_json_module

Buildkite build #9524 is running...

---

Test

e2e/pnpm_lockfiles

11 test targets passed

Targets

//cases/versionless-patch-v9:versionless_patch_test [k8-fastbuild]144ms
//v101:aliases-test [k8-fastbuild]146ms
//v101:patch-test [k8-fastbuild]171ms
//v54:aliases-test [k8-fastbuild]447ms
//v54:patch-test [k8-fastbuild]146ms
//v60:aliases-test [k8-fastbuild]407ms
//v60:patch-test [k8-fastbuild]137ms
//v61:aliases-test [k8-fastbuild]236ms
//v61:patch-test [k8-fastbuild]148ms
//v90:aliases-test [k8-fastbuild]217ms
//v90:patch-test [k8-fastbuild]189ms

Total test execution time was 2s. 56 tests (83.6%) were fully cached saving 6s.

---

Test

e2e/pnpm_workspace

Buildkite build #9524 is running...

---

Test

e2e/pnpm_workspace_rerooted

Buildkite build #9524 is running...

---

Test

e2e/repo_mapping

⚠️ Buildkite build #9524 failed.

Failed tests (1)

//:test [k8-fastbuild]🔗

💡 To reproduce the test failures, run

bazel test //:test

---

Test

e2e/rules_foo

Buildkite build #9524 is running...

---

Test

e2e/runfiles

⚠️ Buildkite build #9524 failed.

Failed tests (1)

//:runfiles [k8-fastbuild]🔗

💡 To reproduce the test failures, run

bazel test //:runfiles

---

Test

e2e/vendored_node

Buildkite build #9524 is running...

---

Buildifier      Format

[matthewjh]

@jbedard are you still working on this?

[jbedard]

I still hope to do it but haven't been able to put any time/testing into it recently. It might be nice to enable by default in a v3, so merge for opt-in sooner?