{"record":{"id":"bb793a3d4405f7c5","repo":"basecamp/kamal","slug":"you-must-specify-what-to-retrieve-from-bitwarden-s","errorCode":null,"errorMessage":"You must specify what to retrieve from Bitwarden Secrets Manager","messagePattern":"You must specify what to retrieve from Bitwarden Secrets Manager","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"lib/kamal/secrets/adapters/bitwarden_secrets_manager.rb","lineNumber":13,"sourceCode":"class Kamal::Secrets::Adapters::BitwardenSecretsManager < Kamal::Secrets::Adapters::Base\n  def requires_account?\n    false\n  end\n\n  private\n    LIST_ALL_SELECTOR = \"all\"\n    LIST_ALL_FROM_PROJECT_SUFFIX = \"/all\"\n    LIST_COMMAND = \"secret list\"\n    GET_COMMAND = \"secret get\"\n\n    def fetch_secrets(secrets, from:, account:, session:)\n      raise RuntimeError, \"You must specify what to retrieve from Bitwarden Secrets Manager\" if secrets.length == 0\n\n      secrets = prefixed_secrets(secrets, from: from)\n      command, project = extract_command_and_project(secrets)\n\n      {}.tap do |results|\n        if command.nil?\n          secrets.each do |secret_uuid|\n            item_json = run_command(\"#{GET_COMMAND} #{secret_uuid.shellescape}\")\n            raise RuntimeError, \"Could not read #{secret_uuid} from Bitwarden Secrets Manager\" unless $?.success?\n            item_json = JSON.parse(item_json)\n            results[item_json[\"key\"]] = item_json[\"value\"]\n          end\n        else\n          items_json = run_command(command)\n          raise RuntimeError, \"Could not read secrets from Bitwarden Secrets Manager\" unless $?.success?\n\n          JSON.parse(items_json).each do |item_json|\n            results[item_json[\"key\"]] = item_json[\"value\"]","sourceCodeStart":1,"sourceCodeEnd":31,"githubUrl":"https://github.com/basecamp/kamal/blob/eee0083b38661c3707c6b6052cc89e85038a096c/lib/kamal/secrets/adapters/bitwarden_secrets_manager.rb#L1-L31","documentation":"The Bitwarden Secrets Manager adapter (bws) fetches secrets by UUID, or lists them with `all` / `<project-id>/all` selectors. fetch_secrets raises RuntimeError when the effective secrets array is empty (after applying the --from prefix), i.e. nothing was specified to retrieve.","triggerScenarios":"kamal secrets fetch -a bitwarden-sm with no secret arguments and no --from; passing only --from with an empty positional list that still resolves to zero secrets; programmatic adapter.fetch([], from: nil).","commonSituations":"Copy-pasting a fetch command and deleting the arguments while testing; scripts that interpolate a secrets list which turns out empty; misunderstanding that this adapter needs UUIDs or the all selector, not item names.","solutions":["Pass one or more secret UUIDs: kamal secrets fetch -a bitwarden-sm <uuid1> <uuid2>","Or list everything accessible: kamal secrets fetch -a bitwarden-sm all","Or scope to one project: kamal secrets fetch -a bitwarden-sm <project-id>/all (or use --from <project-id> with /all)"],"exampleFix":"# before\nkamal secrets fetch -a bitwarden-sm\n# => RuntimeError: You must specify what to retrieve from Bitwarden Secrets Manager\n\n# after\nkamal secrets fetch -a bitwarden-sm 5c8e8d3a-xxxx-xxxx-xxxx-xxxxxxxxxxxx\n# or list all secrets the machine account can access:\nkamal secrets fetch -a bitwarden-sm all","handlingStrategy":"validation","validationCode":"secrets = ARGV.dup\nsecrets << \"#{options[:from]}/all\" if secrets.empty? && options[:from]\nabort \"nothing to fetch — pass secret UUIDs, `all`, or <project-id>/all\" if secrets.empty?","typeGuard":"def bws_request_valid?(secrets, from: nil)\n  (secrets + (from ? [\"#{from}/all\"] : [])).any? { |s| !s.to_s.strip.empty? }\nend","tryCatchPattern":null,"preventionTips":["Make fetch scripts take an explicit list of UUIDs (or `all`) so an empty interpolation fails your own check first","Remember this adapter resolves UUIDs/selectors — item names from the bitwarden adapter will not work here"],"tags":["kamal","secrets","bitwarden","cli","missing-argument"],"backgroundTag":"missing-required-option","analyzedSha":"eee0083b38661c3707c6b6052cc89e85038a096c","analyzedAt":"2026-08-21T15:17:22.045Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}