{"record":{"id":"7b9953c3f0467aa5","repo":"NousResearch/hermes-agent","slug":"bitwarden-access-token-is-empty","errorCode":null,"errorMessage":"Bitwarden access token is empty","messagePattern":"Bitwarden access token is empty","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"agent/secret_sources/bitwarden.py","lineNumber":532,"sourceCode":"    Cloud accounts.  When empty, ``bws`` uses its built-in default\n    (``https://vault.bitwarden.com``, US Cloud).  This is plumbed into\n    the subprocess as ``BWS_SERVER_URL``.\n\n    ``cache_ttl_seconds`` controls the normal fresh cache.  When\n    ``encrypted_cache_enabled`` is true, fresh cache entries are written as\n    AES-GCM encrypted JSON instead of plaintext, and a last-good encrypted\n    entry may be used after NETWORK/TIMEOUT failures for up to\n    ``encrypted_cache_max_stale_seconds``.  This stale fallback is separate\n    from the fresh-cache TTL so operators can set ``cache_ttl_seconds: 0``\n    while still keeping an encrypted break-glass cache for offline startup.\n\n    Raises :class:`RuntimeError` for fatal conditions (missing binary,\n    auth failure, unparseable output).  Callers in the env_loader path\n    catch this and emit a single warning; callers in the user-facing\n    setup wizard let it propagate.\n    \"\"\"\n    if not access_token:\n        raise RuntimeError(\"Bitwarden access token is empty\")\n    if not project_id:\n        raise RuntimeError(\"Bitwarden project_id is empty\")\n\n    cache_key = (_token_fingerprint(access_token), project_id, server_url or \"\")\n    if use_cache and cache_ttl_seconds > 0:\n        cached = _CACHE.get(cache_key)\n        if cached and cached.is_fresh(cache_ttl_seconds):\n            return cached.secrets, []\n        # L2: disk cache. ~5ms on cache hit vs ~380ms for `bws secret list`.\n        if encrypted_cache_enabled:\n            disk_cached = _read_encrypted_disk_cache(\n                cache_key=cache_key,\n                access_token=access_token,\n                max_age_seconds=cache_ttl_seconds,\n                home_path=home_path,\n            )\n        else:\n            disk_cached = _DISK_CACHE.read(cache_key, cache_ttl_seconds, home_path)","sourceCodeStart":514,"sourceCodeEnd":550,"githubUrl":"https://github.com/NousResearch/hermes-agent/blob/c896c09c42910c584c4c7d2325b58c14713ea42c/agent/secret_sources/bitwarden.py#L514-L550","documentation":"Error \"Bitwarden access token is empty\" thrown in NousResearch/hermes-agent.","triggerScenarios":"Thrown at agent/secret_sources/bitwarden.py:532 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set the Bitwarden access token (BWS access token env or config) before fetching secrets.","Re-run `hermes secrets bitwarden setup` to store the token."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"c896c09c42910c584c4c7d2325b58c14713ea42c","analyzedAt":"2026-08-14T17:18:01.089Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}