What happened?

The bazel-sandbox plugin throws an error when esbuild resolves paths marked as external, even though external modules are intentionally excluded from bundling and don't need to exist in the Bazel sandbox. The plugin incorrectly validates external paths before checking the result.external flag, causing builds to fail with legitimate external imports.

✘ [ERROR] Error: esbuild resolved a path outside of BAZEL_BINDIR (bazel-out/k8-fastbuild/bin): /assets/fonts/effra-light.woff2 [plugin bazel-sandbox]

Version

Development (host) and target OS/architectures: Ubuntu 22.04/x64

Output of bazel --version: 8.3.1

Version of the Aspect rules, or other relevant rules from your
WORKSPACE or MODULE.bazel file: 0.24.0

Language(s) and/or frameworks involved:

How to reproduce

Create the following files in a test directory:

BUILD.bazel

load("@aspect_rules_esbuild//esbuild:defs.bzl", "esbuild")

esbuild(
    name = "bundle",
    entry_point = "main.js",
    external = ["/assets/*"],
    srcs = ["main.js"],
)

main.js

// External JS module that doesn't exist in the build
import { someFunction } from '/assets/runtime-lib.js'

console.log('External module imported')

Reproduce the Bug

bazel build //:bundle

Expected Result

Build succeeds. The /assets/runtime-lib.js import is marked as external and excluded from the bundle without path validation.

Any other information?

No response