CLI: 'bw get password' fails offline after successful login check and unlock (connect/token ECONNREFUSED)
- Dominant language
- TypeScript
- Stars
- 13.8k
- Forks
- 2k
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 393
Description
### Summary
When using Bitwarden CLI against a self-hosted server that is unreachable (offline/travel scenario), `bw login --check` and `bw unlock --raw` succeed, but `bw get password ` fails with a network call to `/identity/connect/token` and exits with code 1.
### Expected behavior
If the vault is already logged in and unlocked locally, `bw get password ` should work from local cached data in offline mode (or fail with a clear offline/cache-specific error without Node uncaught exception output).
### Actual behavior
`bw get password MyItem` fails with `ExitCode=1` and tries to call:
`https://myraspi.bitwarden/identity/connect/token`
Error excerpt:
- `FetchError: request to https://myraspi.bitwarden/identity/connect/token failed, reason: connect ECONNREFUSED`
- followed by Node uncaught exception output (`triggerUncaughtException`, `Node.js v22.15.1`)
### Environment
- OS: Windows
- Bitwarden server: self-hosted, configured via `bw config server`
- CLI output includes `Node.js v22.15.1`
### Reproduction steps
1. Configure CLI to a self-hosted server URL.
2. Ensure account was logged in previously and vault has local data.
3. Disconnect from network that can reach the self-hosted server (server unreachable).
4. Run:
- `bw login --check`
- `bw unlock --raw`
- `bw get password VeraCrypt`
### Observed command sequence (from logs)
- `bw status` -> includes offline error against `/api/config`, but returns status JSON.
- `bw login --check` -> `ExitCode=0`, output contains `You are logged in!`
- `bw unlock --raw` -> `ExitCode=0`, session returned
- `bw get password MyItem` -> `ExitCode=1`, stderr shows `/identity/connect/token` ECONNREFUSED
- `bw lock` -> also fails with same `/identity/connect/token` ECONNREFUSED
### Notes
This was reproduced in two consecutive runs with identical results.
Contributor guide
Research direction
Start by reproducing the listed bw status, bw login --check, bw unlock --raw, bw get password, and bw lock sequence while the self-hosted server is unreachable. Trace the CLI paths for offline cached-vault access and the /identity/connect/token request; done means local retrieval works after unlock, or failure reports a clear offline/cache-specific error without uncaught exception output.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- authentication, cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100