fix: resolve npm_install rule path resolution issue with hermetic npm wrapper

Fixed npm binary dependency issue where npm script couldn't find node binary in Bazel sandbox.
Created hermetic npm wrapper script similar to jco wrapper that directly invokes node with npm.
This resolves CI failures and enables successful JavaScript component npm dependency management.

- Fixed npm_install script output directory creation
- Working single-file JavaScript components (simple_js_component)
- Multi-file components still have module resolution limitations (documented)

Author: avrabe

MODULE.bazel.lock

@@ -358,12 +358,14 @@ def _npm_install_impl(ctx):
         "# Copy package.json to workspace",
         "cp \"{}\" \"$WORK_DIR/package.json\"".format(package_json.path),
         "",
-        "# Change to workspace and run npm install",
+        "# Save original directory and change to workspace", 
+        "ORIGINAL_DIR=\"$(pwd)\"",
         "cd \"$WORK_DIR\"",
-        "\"$PWD/{}\" install".format(npm.path),
+        "\"$ORIGINAL_DIR/{}\" install".format(npm.path),
         "",
-        "# Copy node_modules to output",
-        "cp -r node_modules \"{}\"".format(node_modules.path),
+        "# Copy node_modules to output directory",
+        "mkdir -p \"$(dirname \\\"$ORIGINAL_DIR/{}\\\")\"".format(node_modules.path),
+        "cp -r node_modules \"$ORIGINAL_DIR/{}\"".format(node_modules.path),
         "",
         "echo \"NPM install complete\"",
     ]

js/defs.bzl

@@ -269,9 +269,28 @@ exec "{node}" "{workspace}/node_modules/@bytecodealliance/jco/src/jco.js" "$@"
         )
         repository_ctx.file("jco", wrapper_content, executable = True)
 
-    # Create symlinks for Node.js and npm binaries for the toolchain
+    # Create wrapper script for npm (similar to jco) because npm is a node script
+    if platform.startswith("windows"):
+        npm_wrapper_content = """@echo off
+"{node}" "{npm}" %*
+""".format(
+            node = node_binary.realpath,
+            npm = npm_binary.realpath,
+        )
+        repository_ctx.file("npm_wrapper.cmd", npm_wrapper_content, executable = True)
+        repository_ctx.symlink("npm_wrapper.cmd", "npm_wrapper")
+    else:
+        npm_wrapper_content = """#!/bin/bash
+exec "{node}" "{npm}" "$@"
+""".format(
+            node = node_binary.realpath,
+            npm = npm_binary.realpath,
+        )
+        repository_ctx.file("npm_wrapper", npm_wrapper_content, executable = True)
+
+    # Create symlinks for Node.js binary and use wrapper for npm
     repository_ctx.symlink(node_binary, "node")
-    repository_ctx.symlink(npm_binary, "npm")
+    repository_ctx.symlink("npm_wrapper", "npm")
 
     print("Hermetic jco toolchain setup complete")
 

toolchains/jco_toolchain.bzl

@@ -315,25 +315,58 @@ def setup_js_workspace_action(ctx, sources, package_json = None, npm_deps = None
     if npm_deps:
         all_inputs.append(npm_deps)
 
-    # Use a simpler direct shell approach
-    cp_commands = ["mkdir -p {}".format(workspace_dir.path)]
+    # Create a shell script that properly copies files (not symlinks)
+    setup_script = ctx.actions.declare_file(ctx.label.name + "_setup_workspace.sh")
+    
+    script_lines = [
+        "#!/bin/bash",
+        "set -euo pipefail",
+        "",
+        "WORKSPACE_DIR=\"$1\"",
+        "shift",
+        "",
+        "# Create workspace directory",
+        "mkdir -p \"$WORKSPACE_DIR\"",
+        "echo \"Setting up JavaScript workspace: $WORKSPACE_DIR\"",
+        "",
+    ]
 
     # Copy source files to workspace root (flatten structure)
     for src in sources:
-        cp_commands.append("cp {} {}/{}".format(src.path, workspace_dir.path, src.basename))
+        script_lines.extend([
+            "echo \"Copying {} to $WORKSPACE_DIR/{}\"".format(src.path, src.basename),
+            "cp \"{}\" \"$WORKSPACE_DIR/{}\"".format(src.path, src.basename),
+        ])
 
     if package_json:
-        cp_commands.append("cp {} {}/package.json".format(package_json.path, workspace_dir.path))
+        script_lines.extend([
+            "echo \"Copying package.json\"",
+            "cp \"{}\" \"$WORKSPACE_DIR/package.json\"".format(package_json.path),
+        ])
 
     if npm_deps:
-        cp_commands.append("cp -r {} {}/node_modules".format(npm_deps.path, workspace_dir.path))
+        script_lines.extend([
+            "echo \"Copying npm dependencies\"",
+            "cp -r \"{}\" \"$WORKSPACE_DIR/node_modules\"".format(npm_deps.path),
+        ])
 
-    # Add debugging
-    cp_commands.append("echo 'JavaScript workspace files:'") 
-    cp_commands.append("ls -la {}".format(workspace_dir.path))
+    script_lines.extend([
+        "",
+        "echo \"JavaScript workspace setup complete\"",
+        "echo \"Files in workspace:\"",
+        "ls -la \"$WORKSPACE_DIR\"",
+    ])
 
-    ctx.actions.run_shell(
-        command = " && ".join(cp_commands),
+    ctx.actions.write(
+        output = setup_script,
+        content = "\n".join(script_lines),
+        is_executable = True,
+    )
+    
+    # Run the setup script
+    ctx.actions.run(
+        executable = setup_script,
+        arguments = [workspace_dir.path],
         inputs = all_inputs,
         outputs = [workspace_dir],
         mnemonic = "SetupJSWorkspace",