Further restrict the non-hermetic reads of tsc_wrapped.
Further restrict the non-hermetic reads of tsc_wrapped.

As indicated in this comment, we need to allow TS to read files like node_modules/foo/package.json, and this cannot be included in the files[] list in tsconfig, so we still cannot restrict fileExists to only files in the cache. Ultimately as Martin points out this is the correct behavior.

This fix is needed in Angular, where we compile rxjs in an aspect to get the "ESM5" JavaScript flavor, and this suffers from https://github.com/Microsoft/TypeScript/issues/22208 where we try to read a `.ts` file when the `.d.ts` file was in the root files. In this case we don't have a worker mode so the usual sandboxing doesn't mask the problem.

PiperOrigin-RevId: 194095485

bazelbuild/rules_typescript,bazelbuild/rules_typescript,bazelbuild/rules_typescript