CLI hangs when requesting items

Options
sagmor
sagmor
Community Member
in CLI

the cli had been working without issues for a while but about a day ago it began to indefinitely hang when fetching an item.

When I run: op item get XXX --otp --debug I get:

9:35AM | DEBUG | Session delegation enabled
9:35AM | DEBUG | NM request: NmRequestAccounts
9:35AM | DEBUG | NM response: Success
9:35AM | DEBUG | NM request: NmRequestAccounts
9:35AM | DEBUG | NM response: Success
9:35AM | DEBUG | account not signed in, filter=XXXX latest_signin_user=XXXXXXXXXX
9:35AM | DEBUG | not signed in reason: session file not found
9:35AM | DEBUG | NM request: NmRequestAccounts
9:35AM | DEBUG | NM response: Success
9:35AM | DEBUG | NM request: NmRequestAuthorization
9:35AM | DEBUG | NM response: Success
9:35AM | DEBUG | NM request: NmRequestAccounts
9:35AM | DEBUG | NM response: Success
9:35AM | DEBUG | NM request: NmRequestDelegatedSession

and it just hangs there. Any idea of what could be wrong here?

1Password Version: 8.10.3 (81003012)
Extension Version: 2.15.0
OS Version: macOS 13.2.1 (22D68)
Browser:_ zsh

«1

Comments

  • ArunV1P
    ArunV1P
    Options

    Hey @sagmor, thanks for reaching out and sorry for the delay here.

    I am not seeing the same behavior at my end, but I'd like to help troubleshoot further.

    It has been a while since you posted this, so would you mind downloading the latest version of op CLI and testing with it? If the issue persists with the latest version as well, could you share the output of the same command with the --cache=false flag?

  • wonnage
    wonnage
    Community Member
    Options

    +1 to this. Latest version of OP CLI (2.21.0) on Ventura 13.5 with 1password 8.10.13. The problem seems to occur when 1Password isn't open. Running the CLI command brings up a popup to allow access; allowing access brings up the 1PW master password unlock screen. However, unlocking here doesn't seem to do anything - the screen goes away and I'm left with the same debug logs as @sagmor:

    12:48PM | DEBUG | NM request: NmRequestAccounts
12:48PM | DEBUG | NM response: Success
12:48PM | DEBUG | NM request: NmRequestAuthorization
12:48PM | DEBUG | NM response: Success
12:48PM | DEBUG | NM request: NmRequestAccounts
12:48PM | DEBUG | NM response: Success
12:48PM | DEBUG | NM request: NmRequestDelegatedSession
<hangs forever here>

    The workaround is to open the 1password app first, but that seems like an unnecessary step given that you can already pop up the auth window.

  • iwehrman
    iwehrman
    Community Member
    Options

    Same, this happens every time for me unless I unlock the app first. macOS Sonoma 14.0, OP CLI 2.21.0. This is not recent behavior w.r.t. the macOS or OP CLI version history.

    6:15AM | DEBUG | Session delegation enabled
6:15AM | DEBUG | NM request: NmRequestAccounts
6:15AM | DEBUG | NM response: Success
6:15AM | DEBUG | NM request: NmRequestAccounts
6:15AM | DEBUG | NM response: Success
6:15AM | DEBUG | account not signed in, filter= latest_signin_user=[...]
6:15AM | DEBUG | NM request: NmRequestAccounts
6:15AM | DEBUG | NM response: Success
6:15AM | DEBUG | NM request: NmRequestAuthorization
6:15AM | DEBUG | NM response: Success
6:15AM | DEBUG | NM request: NmRequestAccounts
6:15AM | DEBUG | NM response: Success
6:15AM | DEBUG | NM request: NmRequestDelegatedSession
  • teacy123
    teacy123
    Community Member
    Options

    +1, exactly same behaviour. Unlocking through the UI prior to using the CLI command works. Running the CLI command a second time also works. Running it only once hangs.

  • JKnockaert
    JKnockaert
    Community Member
    Options

    Same issue here

    • OP CLI 2.22.0
    • MacOS 14.1
    • 1Password for Mac 8.10.18 (81018040)
  • dewe
    dewe
    Community Member
    edited November 2023
    Options

    Same here, hangs on NmRequestDelegatedSession. Usually works after a ctrl-c and retry.

    op version 2.22.0

  • dewe
    dewe
    Community Member
    Options

    @ArunV1P I tested running with --cache=false but still get the same issue, hanging on NmRequestDelegatedSession. Which kind of makes sense, since the caching happens after a successful login, right?

  • JKnockaert
    JKnockaert
    Community Member
    edited November 2023
    Options

    I have two debug logs with cache disabled using this command: op plugin run --cache=false --debug -- aws s3 ls --profile my-profile

    1) where it is hanging

    1:38PM | WARN | unable to find default credentials: lstat/var/folders/... .terminal_session.aws: no such file or directory
1:38PM | WARN | unable to find default credentials: directory configuration not found
1:38PM | INFO | Using profile from /Users/.../.config/op/plugins/aws.json
1:38PM | DEBUG | Session delegation enabled
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | account not signed in, filter=... latest_signin_user=...
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestAuthorization
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestDelegatedSession

    2) where it works

    1:38PM | WARN | unable to find default credentials: lstat /var/folders/... .terminal_session.aws: no such file or directory
1:38PM | WARN | unable to find default credentials: directory configuration not found
1:38PM | INFO | Using profile from /Users/.../.config/op/plugins/aws.json
1:38PM | DEBUG | Session delegation enabled
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | account not signed in, filter=... latest_signin_user=...
1:38PM | DEBUG | not signed in reason: session file not found
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestAuthorization
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestDelegatedSession
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success

    The parts that are edited out are the same in both logs.

  • JKnockaert
    JKnockaert
    Community Member
    Options

    I have two debug logs with cache disabled, running this command:

    op plugin run --cache=false --debug -- aws s3 ls --profile my-profile

    1) where it is hanging

    1:38PM | WARN | unable to find default credentials: lstat /var/folders/ ... .terminal_session.aws: no such file or directory
1:38PM | WARN | unable to find default credentials: directory configuration not found
1:38PM | INFO | Using profile from /Users/.../.config/op/plugins/aws.json
1:38PM | DEBUG | Session delegation enabled
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | account not signed in, filter=... latest_signin_user=...
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestAuthorization
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestDelegatedSession

    2) executed after aborting the first attempt, now it succeeds

    1:38PM | WARN | unable to find default credentials: lstat /var/folders/ ... .terminal_session.aws: no such file or directory
1:38PM | WARN | unable to find default credentials: directory configuration not found
1:38PM | INFO | Using profile from /Users/.../.config/op/plugins/aws.json
1:38PM | DEBUG | Session delegation enabled
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | account not signed in, filter=... latest_signin_user=...
1:38PM | DEBUG | not signed in reason: session file not found
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestAuthorization
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestDelegatedSession
1:38PM | DEBUG | NM response: Success
1:38PM | DEBUG | NM request: NmRequestAccounts
1:38PM | DEBUG | NM response: Success

    The parts that are edited out are the same in both attempts.

  • dewe
    dewe
    Community Member
    edited November 2023
    Options

    I see the same behaviour when using the aws plugin

    That is, running

     op plugin run --debug -- aws sts get-caller-identity

    hangs on NmRequestDelegatedSession

  • tannerellen
    tannerellen
    Community Member
    Options

    Yep, this is affecting me as well. Even running op signin will properly bring up the sign in window but the process will never complete leaving the terminal hung. I have to ctr + c to exit the command.

    MacOS 14.1.1
    1Password 8.10.20
    OP CLI 2.23.0

    This is a pretty frustrating bug because I either have to open the 1password app and unlock it before running my cli commands, or I need to run the cli command, unlock 1password through the modal window, then ctrl + c to exit, then run the same command again.

  • dewe
    dewe
    Community Member
    Options

    Yeah, I've gotten used to run pkill -f "op plugin" a few times during the day. Not fun. Considering moving out of this solution...

  • jeb1138
    jeb1138
    Community Member
    edited December 2023
    Options

    Same behavior here when using op plugin run.

    I end up running my script, and then ctrl+c to kill it after it gets stuck at the op point, and then run my script again.

    macOS 14.1.2, 1Password 8.10.20, OP CLI 2.23.0.

  • tamird
    tamird
    Community Member
    Options

    I am seeing this as well. Since the op binary is signed, I was not able to attach a debugger. I was able to collect stack traces using the sample command: https://gist.github.com/tamird/37007fefb7a4a9ceac25b4a980c6f8d9. It looks like the binary doesn't have debug symbols so I can't symbolicate, but it is 1password-cli 2.24.0 on arm64 installed via homebrew. The binary's SHA-1 hash is be5be5649dedf18460a7608d2107ea346f7c323e.

    Looks like a bunch of threads are stuck in __psynch_cvwait under a cgo call. I guess 1password-cli is written in Go?

  • ScottS1P
    ScottS1P
    Options

    Hello everyone,

    If you are encountering an issue with the 1Password CLI not authenticating correctly, or the command hangs after a NmRequestDelegatedSession debug line, there are a few things that may help to resolve this.

    • If the 1Password app is installed:

      • Check if the Settings > Developer > Integrate with 1Password CLI option is enabled.
      • Also check Settings > General > Show 1Password in the menu bar (Mac) or Keep 1Password in the notification area (Windows).
      • Make sure both option are also enabled, then try the CLI command again.

    • Fully quit the 1Password app from the menu bar or system tray, then reopen it, unlock 1Password, and try the CLI command again.

    • Make sure you have 1Password CLI and 1Password app fully updated to the latest version.
    • Reboot your device.

    If the problem still occurs after trying the above steps, send an email to support@1password.com so we can help you investigate further. To help expedite your case, include a link to this thread, your community username if you've posted here already, a copy of the output from the CLI command with --debug specified (do not include any secret or confidential information. Please review and redact the log lines before sending), any troubleshooting steps you've tried, the installed version of the CLI tool and 1Password app, and a diagnostics report if the 1Password app is installed on your device.

    Thank you,

  • Joshua_ag
    Joshua_ag
    edited January 23
    Options

    Hi @sagmor, @wonnage, @iwehrman, @teacy123, @JKnockaert, @dewe, @tannerellen, @jeb1138, @tamrid,

    I wanted to let you all know that we have been able to reproduce the issue with the op plugin command failing if run while 1Password is locked our developers are aware and looking into the issue.

    For user's who have reported the issue running other op commands. Can you let me know if you still experience the issue and answer the following questions:

    • What command(s) are failing?
    • Do you have 1Password set to appear in your menu bar / notification area / task bar?
    • Is 1Password running but locked, running and unlocked, or not running at all when you run the command(s)?
    • What operating system are you running?
    • What shell are you running?
    • What version of 1Password the app and op are you running?
    • Do you have biometrics enabled to unlock 1Password?

    Josh

    ref: dev/b5/op#3948

  • tannerellen
    tannerellen
    Community Member
    edited January 22
    Options

    @Joshua_ag Thanks for the response. Yes I am still experiencing the issue...

    1. To my knowledge all commands fail but specifically I am using op insert and op read.
    2. Yes, 1Password is set to appear in my menu bar (which is the default when installing).
    3. It fails if 1password is locked. It never fails if it is unlocked. If 1password isn't running the CLI doesn't work at all because you get an error that it can't connect to the desktop app so that isn't a legitimate scenario. This should be pretty easy to reproduce. On a mac make sure 1password is locked and in the terminal attempt any op command. It will prompt for a password, once password is confirmed It will never complete the task.
    4. MacOS Sonoma 14.1.1
    5. ZSH, It's the default shell on MacOS. The terminal apps I'm using are Kitty primarily but the bug happens in all of them (allacritty, built in terminal, iTerm2).
    6. 1Password 8.10.23 and op cli is 2.23.0 (just updated to 2.24.0 and bug still exists)
    7. No, I'm using a password to unlock.
  • iwehrman
    iwehrman
    Community Member
    Options

    Thanks @Joshua_ag. One thing I've noticed is that this failure started happening much less frequently after enabling 1Password in the menu bar. To your other questions:

    • op item get
    • I do now, and it still occasionally fails. Before I enabled this, it failed on the initial request most of the time.
    • Typically running and locked. But failures sometimes happened when running and unlocked.
    • Mac OS 14.2.1
    • fish 3.1.2
    • 1Password 8.10.23 and op 2.23.0
    • Yes, Apple Watch is set to unlock.
  • Joshua_ag
    Joshua_ag
    Options

    Thank you @tannerellen and @iwehrman,

    I have passed along these details to the development team. We really appreciate the help!

  • tamird
    tamird
    Community Member
    Options

    @Joshua_ag any updates on the op plugin issue?

  • Joshua_ag
    Joshua_ag
    Options

    Hi @tamird,

    No not yet, still investigating. Hopefully the developers can figure out things soon.

  • ecerulm
    ecerulm
    Community Member
    Options

    I'm also experiencing this.

    Im on macOS Sonoma 14.3.1

    I can reproduce 100% of the time, by

    1. Closing down both 1Password app and 1Password in the menu bar
    2. Start 1Password again (that opens both the app and the 1password menu bar. I leave it locked
    3. From kitty or iTerm or Terminal , I run op --debug --cache=false read "op://Personal/xxxx"
    4. It will pop up the "1Password Access Requested" I use the Autorize with Touch ID
    5. I see the 1Password desktop app unlocking
    6. But the op read hangs forever
    7. If I kill it and run it again it will works (presumably because 1Password is already unlocked)

    Responses to your questions @Joshua_ag

    1. What command(s) are failing?
      • op --debug --cache=false read "op://Personal/xxxx"
    2. Do you have 1Password set to appear in your menu bar / notification area / task bar? yes
    3. Is 1Password running but locked, running and unlocked, or not running at all when you run the command(s)?
      • Is running locked (both the app and the icon menu bar are visible)
      • when the app is unlocked then op read won't hang for me.
    4. What operating system are you running? macOS Sonoma 14.3.1
    5. What shell are you running?
      • I tried both zsh and bash, in macOS Terminal, kitty and iTerm2
    6. What version of 1Password the app and op are you running?
      • op --version 2.25.0
      • 1Password for Mac 8.10.27 (81027003)
    7. Do you have biometrics enabled to unlock 1Password?
      • yes, I use TouchID
    op --debug --cache=false read "op://Personal/xxxx"
9:19AM | DEBUG | Session delegation enabled
9:19AM | DEBUG | NM request: NmRequestAccounts
9:19AM | DEBUG | NM response: Success
9:19AM | DEBUG | NM request: NmRequestAccounts
9:19AM | DEBUG | NM response: Success
9:19AM | DEBUG | account not signed in, filter= latest_signin_user=xxxxx
9:19AM | DEBUG | NM request: NmRequestAccounts
9:19AM | DEBUG | NM response: Success
9:19AM | DEBUG | NM request: NmRequestAuthorization
9:19AM | DEBUG | NM response: Success
9:19AM | DEBUG | NM request: NmRequestAccounts
9:19AM | DEBUG | NM response: Success
9:19AM | DEBUG | NM request: NmRequestDelegatedSession
  • Joshua_ag
    Joshua_ag
    Options

    Hi @ecerulm,

    Thanks so much for for the answers to those questions, I have added you as an impacted user and shared the details and your reproduction steps with our developers.

  • tamird
    tamird
    Community Member
    Options

    Hello, it's been a few months now. Any progress?

  • Joshua_ag
    Joshua_ag
    Options

    Hi @tamird,

    I do not have public progress to share though I can confirm our team is actively working on the issue and has been able to reproduce more of the above scenarios.

    Hopefully they will find a solution soon.

  • sebastianreloaded
    sebastianreloaded
    Community Member
    Options
    1. What command(s) are failing?
      "op --account https://companyname.1password.eu signin" but also every other command which requires re-authentication
    2. Do you have 1Password set to appear in your menu bar / notification area / task bar? yes
    3. Is 1Password running but locked, running and unlocked, or not running at all when you run the command(s)?
      running, and i guess locked because of the re-authentication
    4. What operating system are you running? MacOS Sonoma 14.3 (23D56)
    5. What shell are you running? bash script within zsh
    6. What version of 1Password the app and op are you running? 1Password for Mac 8.10.28 (81028034) + op 2.24.0
    7. Do you have biometrics enabled to unlock 1Password? yes
  • MimerPlusPlus
    MimerPlusPlus
    Community Member
    edited April 10
    Options

    Hi there,

    I'm experiencing the same issue with all plugin commands, but one thing that hasn't been mentioned, is that the failing op read does prompt me for a login (put up a unlock screen and accept my fingerprint) before i hangs, and if i break the command with ctrl+c and run the exact same op command again, everything works just fine, since i'm already logged in to 1Password - which also might explain why running 1Password in the menu helps in some cases, since it might keep the login session running a bit longer...

    Update: Just updated to latest CLI version (2.26.1), and so far it seems to be working quite a lot better

  • Joshua_ag
    Joshua_ag
    Options

    Hi @sagmor, @wonnage, @iwehrman, @teacy123, @JKnockaert, @dewe, @tannerellen, @jeb1138, @tamrid, @ecerulm, @sebastianreloaded, @MimerPlusPlus,

    I have an update to share for the original reported issue of the CLI hanging when the 1Password app is locked. The latest nightly version of the 1Password app has a fix for this issue!

    If anyone is willing to test it out that would be really helpful to confirm we have fully resolved the issue.

    Please make sure you are running:

    If you are still experiencing the same issue with the CLI hanging when trying to authenticate with a locked copy of the 1Password app (or new issues) please let me know.

    If you are not able to switch the nightly version of the 1Password app the fix should make it to the beta version and then eventually production version barring any potential regressions or issues (hopefully there are none).

  • JKnockaert
    JKnockaert
    Community Member
    Options

    Hi @Joshua_ag, seems to work for me with the update!

  • Joshua_ag
    Joshua_ag
    Options

    Thanks so much for the update @JKnockaert glad to hear the fix has helped!