fix(core): sandbox exclusions, multi-line typeof import detection, global ensurePackage mock (#35056)

## Current Behavior

1. **Sandboxing false positives**: `tsc --build` reads `.tsbuildinfo`
files as an optimization hint, and the `nx-plugin-checks` lint rule
reads `schema.json` from `dist/` directories. Both are flagged as
sandbox violations even though they don't affect caching correctness.

2. **Missing dependencies in project graph**: `typeof import('...')`
inside multi-line generic type parameters (e.g. `ensurePackage<typeof
import('@nx/playwright')>()`) is not detected by the import analyzer.
The newline between `<` and `import()` resets the import type to
Dynamic, so packages like `@nx/playwright` and `@nx/storybook` are
missing from the dependency graph.

3. **ensurePackage mock duplication**: Multiple test files individually
mock `@nx/devkit` just to override `ensurePackage` so it resolves from
source instead of `node_modules`. This is repetitive and easy to miss in
new tests.

## Expected Behavior

1. **Sandboxing**: `.tsbuildinfo` reads are globally excluded.
`dist/**/*.json` reads are excluded for lint targets.

2. **Import analyzer**: `typeof import('...')` inside multi-line
generics is correctly detected as a static import by tracking angle
bracket depth and preserving import type across newlines inside
generics.

3. **ensurePackage mock**: A global `ensurePackage` mock in
`scripts/unit-test-setup.js` replaces per-file mocks, using
`jest.requireActual` to resolve from source code.

## Related Issue(s)

<!-- No directly related open issues found -->

---------

Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>

(cherry picked from commit c59040f)

Author: FrozenPandaz

.nx/workflows/sandboxing-config.yaml

@@ -0,0 +1,9 @@
+exclude-reads:
+  - packages/nx/src/native/*.node
+exclude-writes:
+  - '**/.swc/**'
+
+task-exclusions:
+  - target: lint
+    exclude-reads:
+      - '**/dist/**/*.json'

packages/angular/src/generators/application/application.spec.ts

@@ -30,17 +30,6 @@ jest.mock('@nx/cypress/src/utils/versions', () => ({
   getInstalledCypressMajorVersion: jest.fn(),
 }));
 jest.mock('enquirer');
-jest.mock('@nx/devkit', () => {
-  const original = jest.requireActual('@nx/devkit');
-  return {
-    ...original,
-    ensurePackage: (pkg: string) => jest.requireActual(pkg),
-    createProjectGraphAsync: jest.fn().mockResolvedValue({
-      nodes: {},
-      dependencies: {},
-    }),
-  };
-});
 
 describe('app', () => {
   let appTree: Tree;

packages/nx/src/native/plugins/js/ts_import_locators.rs

@@ -58,6 +58,7 @@ struct State<'a> {
     pub import_type: ImportType,
     open_brace_count: i128,
     open_bracket_count: i128,
+    open_angle_count: i128,
     blocks_stack: Vec<BlockType>,
     next_block_type: BlockType,
 }
@@ -70,6 +71,7 @@ impl<'a> State<'a> {
             previous_token: None,
             open_brace_count: 0,
             open_bracket_count: 0,
+            open_angle_count: 0,
             blocks_stack: vec![],
             next_block_type: BlockType::Block,
             import_type: ImportType::Dynamic,
@@ -127,8 +129,8 @@ impl<'a> State<'a> {
             let new_line = self.lexer.had_line_break_before_last();
 
             // This is the beginning of a new statement, reset the import type to the default
-            // Reset import type when there is new line not in braces
-            if new_line && self.open_brace_count == 0 {
+            // Reset import type when there is new line not in braces or angle brackets (generics)
+            if new_line && self.open_brace_count == 0 && self.open_angle_count == 0 {
                 self.import_type = ImportType::Dynamic;
             }
 
@@ -214,11 +216,17 @@ impl<'a> State<'a> {
                                 _ if is_identifier(&t.token) => {
                                     // Generic
                                     self.import_type = ImportType::Static;
+                                    self.open_angle_count += 1;
                                 }
                                 _ => {}
                             }
                         }
                     }
+                    BinOpToken::Gt => {
+                        if self.open_angle_count > 0 {
+                            self.open_angle_count -= 1;
+                        }
+                    }
 
                     BinOpToken::Div => {
                         if let Some(t) = &self.previous_token {
@@ -1492,6 +1500,63 @@ import(myTag`react@${version}`);
         );
     }
 
+    #[test]
+    fn should_find_typeof_import_in_ensure_package_pattern() {
+        let temp_dir = TempDir::new().unwrap();
+        temp_dir
+            .child("test.ts")
+            .write_str(
+                r#"
+      import { ensurePackage } from '@nx/devkit';
+
+      const { configurationGenerator } = ensurePackage<
+        typeof import('@nx/playwright')
+      >('@nx/playwright', nxVersion);
+
+      const { storybookGenerator } = ensurePackage<
+        typeof import('@nx/storybook')
+      >('@nx/storybook', nxVersion);
+
+      const { cypressGenerator } = ensurePackage<
+        typeof import('@nx/cypress')
+      >('@nx/cypress', nxVersion);
+                "#,
+            )
+            .unwrap();
+
+        let test_file_path = temp_dir.display().to_string() + "/test.ts";
+
+        let results = find_imports(HashMap::from([(
+            String::from("a"),
+            vec![test_file_path.clone()],
+        )]))
+        .unwrap();
+
+        let result = results.get(0).unwrap();
+
+        assert!(
+            result
+                .static_import_expressions
+                .contains(&String::from("@nx/playwright")),
+            "Should detect @nx/playwright from typeof import in generic. Found: {:?}",
+            result.static_import_expressions
+        );
+        assert!(
+            result
+                .static_import_expressions
+                .contains(&String::from("@nx/storybook")),
+            "Should detect @nx/storybook from typeof import in generic. Found: {:?}",
+            result.static_import_expressions
+        );
+        assert!(
+            result
+                .static_import_expressions
+                .contains(&String::from("@nx/cypress")),
+            "Should detect @nx/cypress from typeof import in generic. Found: {:?}",
+            result.static_import_expressions
+        );
+    }
+
     #[test]
     #[ignore]
     fn should_find_imports_properly_for_all_files_in_nx_repo() {

packages/web/src/generators/application/application.legacy.spec.ts

@@ -11,12 +11,6 @@ jest.mock('@nx/cypress/src/utils/versions', () => ({
   ...jest.requireActual('@nx/cypress/src/utils/versions'),
   getInstalledCypressMajorVersion: jest.fn(),
 }));
-jest.mock('@nx/devkit', () => {
-  return {
-    ...jest.requireActual('@nx/devkit'),
-    ensurePackage: jest.fn((pkg) => jest.requireActual(pkg)),
-  };
-});
 describe('web app generator (legacy)', () => {
   let tree: Tree;
   let mockedInstalledCypressVersion: jest.Mock<

packages/web/src/generators/application/application.spec.ts

@@ -22,12 +22,6 @@ jest.mock('@nx/cypress/src/utils/versions', () => ({
   ...jest.requireActual('@nx/cypress/src/utils/versions'),
   getInstalledCypressMajorVersion: jest.fn(),
 }));
-jest.mock('@nx/devkit', () => {
-  return {
-    ...jest.requireActual('@nx/devkit'),
-    ensurePackage: jest.fn((pkg) => jest.requireActual(pkg)),
-  };
-});
 
 describe('app', () => {
   let tree: Tree;

scripts/unit-test-setup.js

@@ -30,5 +30,12 @@ module.exports = () => {
         dependencies: {},
       };
     }),
+    /**
+     * `ensurePackage` calls `require(pkg)` which resolves from node_modules
+     * (the installed version) instead of the local source code. Using
+     * `jest.requireActual` routes through Jest's module resolver which
+     * respects tsconfig paths, so it picks up the source code instead.
+     */
+    ensurePackage: jest.fn((pkg) => jest.requireActual(pkg)),
   }));
 };