mweinbach7/26/2026, 4:19:59 PM

`sandbox.escape.test.ts` pins the escape surface. Every probe was executed
against a real Bun realm while designing the seal, so the suite is transcription
rather than speculation: its job is to turn a Bun upgrade that reopens the realm
into a CI failure instead of a silent hole — or, for the determinism traps, into
a failure instead of a journal that replays stale results.

Two probes are deliberately shaped around Bun quirks rather than asserting the
obvious: `typeof require` evaluates to "function" via a transpiler artifact, so
the test asserts that calling it throws; and a literal `import()` is rejected at
compile time while only a computed specifier reaches the runtime denial.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kk98XjGKJrKp5ynbiNFMFu

Parentb8859ff