Create command fails if permissions are too limited

[joelanman]

Description of the issue

When running the create command, you get an error and a prototype is not successfully created

Steps to reproduce the issue

On a managed mac, run npx govuk-prototype-kit create

Actual vs expected behaviour

actual:

[redacted] juggling-licence % npx [email protected] create


Need to install the following packages:
  [email protected]
Ok to proceed? (y) y
Creating your prototype

added 380 packages in 5s

33 packages are looking for funding
  run `npm fund` for details
sh: /Users/[redacted]/Documents/prototypes/juggling-licence/node_modules/.bin/govuk-prototype-kit: /usr/bin/env: bad interpreter: Permission denied
/Users/[redacted]/.npm/_npx/fb72d33463aacf66/node_modules/govuk-prototype-kit/lib/exec.js:43
          reject(new Error(`Exit code was ${code}`))
                 ^

Error: Exit code was 126
    at ChildProcess.<anonymous> (/Users/[redacted]/.npm/_npx/fb72d33463aacf66/node_modules/govuk-prototype-kit/lib/exec.js:43:18)
    at ChildProcess.emit (node:events:513:28)
    at maybeClose (node:internal/child_process:1091:16)
    at ChildProcess._handle.onexit (node:internal/child_process:302:5)

Node.js v18.12.1

in addition, this popup appears:

Environment (where applicable)

• Operating system: macos (managed)
• Browser:
• Browser version:
• GOV.UK Prototype Kit version: 13.1.0, 13.0.1

[nataliecarey]

PLEASE DO NOT USE THIS SOLUTION FOR REAL PROTOTYPES - if you find that this solves a problem for you please contact the Prototype Kit Team who will help with a longer-term solution.

To get this working I ran the following on a non-managed laptop:

1. npx govuk-prototype-kit create downloadable-prototype-kit
2. cd downloadable-prototype-kit
3. echo "require('./node_modules/govuk-prototype-kit/lib/dev-server').runDevServer()" > dev.js
4. rm -R node_modules

I then created a zip of the downloadable-prototype-kit directory and sent that to the person with a managed laptop. They could unizip it and run:

1. cd WHEREVER_THEY_UNZIPPED_IT
2. npm install
3. node dev.js

There are a few reasons why this isn't an ideal situation but for a short-term work around it would work to get someone started and the kit seems to work well after following these steps. If we end up needing a solution like this longer term I'd like to look at the contents of the dev.js file so it's not referencing specific files/details inside the module. Something like require('govuk-prototype-kit').commands.startDevServer() would be achievable.

[nataliecarey]

To be clearer about the longer-term solution: This problem comes up because we're using npx to create the kit and to start it. If that isn't working for people then we can go back to providing a download, the steps I've laid out above could be used to generate that download but I'd want to refine step 3 (the file that is created) before I'm willing to commit to longer term support, the current approach is suitable as a workaround to get someone started who would otherwise be blocked but there's a chance it would break in later releases and need fixing.

[joelanman]

Tried to reproduce on another GDS managed mac and it worked - the issue did not occur. Will speak to IT team

[joelanman]

In this case, the problem resolved after installing xcode command line tools

[joelanman]

reopening as it happened again

[joelanman]

~I'm wondering if this happens because we try to run git, if we ran which instead it might not trigger~ does not appear to be git, see below

[joelanman]

currently have 2 people with this issue

[joelanman]

we fixed the kit running today by changing the package.json script to:

scripts": {
    "dev": "node node_modules/govuk-prototype-kit/bin/cli dev",
    "serve": "govuk-prototype-kit serve",
    "start": "govuk-prototype-kit start"
  },
...

as in, calling node explicitly as opposed to using node via the shebang

[joelanman]

just a thought, I think this is because nothing is allowed to 'execute' outside of whats allowed (installed apps). In this case, without the node command added, whats being executed is node_modules/govuk-prototype-kit/bin/cli (not allowed). With the command, node is being executed, which is allowed.

[joelanman]

a little more logging that we added recently:

npx govuk-prototype-kit create test1
Creating your prototype
 - Installing dependencies
 - Setting up your prototype
sh: /Users/[redacted]/Documents/[redacted]/test1/node_modules/.bin/govuk-prototype-kit: /usr/bin/env: bad interpreter: Permission denied
/Users/[redacted]/.npm/_npx/1998d3cc354829cb/node_modules/govuk-prototype-kit/lib/exec.js:46
    reject(new Error(`Exit code was ${code}`))
        ^
Error: Exit code was 126
  at ChildProcess.<anonymous> (/Users/[redacted]/.npm/_npx/1998d3cc354829cb/node_modules/govuk-prototype-kit/lib/exec.js:46:16)
  at ChildProcess.emit (node:events:513:28)
  at maybeClose (node:internal/child_process:1091:16)
  at ChildProcess._handle.onexit (node:internal/child_process:302:5)

[joelanman]

I think changing line 247 of bin/cli to:

await spawn('node', ['node_modules/govuk-prototype-kit/bin/cli', 'init', runningWithinCreateScriptFlag, installDirectory, `--created-from-version=${kitVersion}`, ...(getArgumentsToPassThrough())], {

might fix it. As mentioned above, this executes node (which is allowed) rather than /bin/cli in a prototype's node_module folder, which is not

it works on my machine but obviously mine is not locked down

[joelanman]

found the previous PR where we fixed this last time, it was to call node directly instead of executing a file in the prototype folder:

https://github.com/alphagov/govuk-prototype-kit/pull/1039

[joelanman]

had another case of this on support

[ruthhammond]

@nataliecarey please review this on Monday 18th as this needs to be resolved urgently

[nataliecarey]

The solution that's worked for everyone I've heard back from is to run xcode-select --install and then they should be able to use the kit.

[nataliecarey]

Today I caught up with the only person I knew still had this issue. They are no longer having the issue. To the best of my knowledge xcode-select --install resolves the issue.

[ruthhammond]

@nataliecarey to add to the documentation of commonly asked support questions