They probably did, and it probably went along these lines:

> Very dangerous model, please implement an unescapable sandbox.

> Certainly, here's an unescapable sandbox!

  function execInUnescapableSandbox(cmd) {
    if (cmd.split()[0].startsWith("cd") && !cmd.split[1].startsWith("/sandbox"))
       throw new Error("[usbox] Rejected!");
    exec(cmd);
  }