fix: add helper plugin to keep paths within sandbox

[vpanta]

Fixes #58.

Adds a "bazel-sandbox" helper plugin when using Esbuild under Bazel.

It is on by default but can be opted-out by setting bazel_sandbox_plugin = False on an esbuild target.

This PR also adds js_log_level and esbuild_log_level attributes. When js_log_level is debug, the bazel-sandbox plugin will print out resolution changes it makes.

---

Type of change

• Bug fix (change which fixes an issue)

For changes visible to end-users

• Relevant documentation has been updated
• Suggested release notes are provided below:

Addition of an automatic plugin ensuring esbuild resolution remains within the sandbox.

Test plan

• Covered by existing test cases
• Manual testing; please provide instructions so we can reproduce:

Manually tested changing log levels and disabling the new plugin by setting bazel_sandbox_plugin = False. A follow-up with more testing for this plugin would be good.

[jbedard]

@thesayyn and I discussed this and overall agree with what you're suggesting. I think this should be setup 100% of the time by the launcher like you said.

In one sense it would be nice to avoid more node since one of the main advantages of esbuild is the use of go, but when we're already launching esbuild from node I don't think this adds any harm (we're not adding another node process being launched etc).

[vpanta]

Thanks for the review. I attempted an initial stab at integrating it with launcher.js, but not very sure if I did it in an acceptable way (or fully if it works yet).

I agree that I'd prefer this work within esbuild instead, and while I was hesitant to add a JS resolver call for every single resolution call, having the assurance that it plays better with the sandbox seemed worthwhile.

[jbedard]

@vpanta seeing the sandbox issue again reminded me of this PR... did you have a chance to look at the latest comments or have any other updates?

[vpanta]

@vpanta seeing the sandbox issue again reminded me of this PR... did you have a chance to look at the latest comments or have any other updates?

shoot, sorry, I spaced on this PR. Let me see what I can do with it today.

[vpanta]

ugh, sorry again, it's been a crazy time but I am actively working on this PR right now and am hoping to settle it this week.

[vpanta]

Ok, the examples are all compiling and I've verified the plugin is being used, so I think this is good for review again.

All bits are addressed

[gregmagolan]

@vpanta I pushed a few changes and updated the description to get this ready for landing

[gregmagolan]

🚀

[vpanta]

Big thanks @gregmagolan to getting this over the line!