Syncing is failing every time

[Damariobros]

Syncing is failing every time now. I added a new URI for a login I wanted to autotype into one of my programs, synced it on Bitwarden, then waited a few minutes and synced it on Autotype, and now it is failing every single time and will not autofill anything at all. Logging out and back in, closing the application, syncing at different times, nothing is working.

Here is the error log:

{
"A_Error": {
"Extra": "Unexpected character at position 1: 'm'",
"File": "bw-at.exe",
"Line": 832,
"Message": "Failed to parse JSON (-1,0)",
"What": "-1"
},
"A_Info": {
"locked": 0,
"logged": 1,
"portable": 0,
"session": 1,
"status": "unlocked",
"sync": "2024-08-27T23:18:23.413Z",
"version": "1.1.33.10",
"windows": "10.0.19045"
},
"ADVANCED": {
"field": "auto-type",
"NODE_EXTRA_CA_CERTS": "",
"pin-length": "6",
"reprompt-with-pin": "1",
"server": "",
"tcato-ksps": "10",
"tcato-wait": "250",
"update-frequency": "1"
},
"CREDENTIALS": {
"api-key": "1",
"client-id": "Present",
"client-secret": "Present",
"tsl": "2",
"user": "Present"
},
"DATA": {
"pin": "Present",
"update": "1724798822",
"version": "1.1"
},
"GENERAL": {
"action": "1",
"favicons": "1",
"pin": "1",
"sync": "0",
"tcato": "1",
"timeout": "10",
"totp": "0",
"updates": "1"
},
"GENERATOR": {
"digits": "1",
"exclude": "",
"length": "39",
"lower": "1",
"symbols": "1",
"upper": "1"
},
"HOTKEYS": {
"default": "#^!a",
"password": "#^!p",
"totp": "^!o",
"username": "^!u"
},
"SEQUENCES": {
"default": "{ClearField}{Username}{SmartTab}{Password}{Enter}",
"password": "{ClearField}{Password}{Enter}",
"totp": "{TOTP}",
"username": "{ClearField}{Username}"
}
}

[Damariobros]

I found a temporary solution but it's fucked

First, download the latest CLI from Bitwarden's official CLI documentation on the Bitwarden website, then replace C:\Program Files\Auto-Type\bw.exe with the new one extracted from the archive.

Then, go to C:\Users\Damariobros\AppData\Roaming\Auto-Type and delete data.json.

If you didn't do so already, close AutoType. Then open it back up and login using your API key. Should sync successfully.

Also of note is that if you don't delete data.json and try to sync the M in the debug log will be capitalized instead of lowercase. Dunno if that's significant but it's something I noticed.

This problem needs to be fixed though.

[Damariobros]

Update: The above workaround seems to not remember your login. If you exit Autotype, the next time it opens it will ask for login again but then attempting to login will result in an error that says you are already logged in, resulting in you having to delete data.json again to be able to login. Fuck.

[Damariobros]

This issue where it gives the "m" in position 1 error is happening for EVERY version of Bitwarden CLI except for the latest version as downloaded from Bitwarden's CLI documentation, which instead glitches the login state on restart. I think Bitwarden maybe did something that broke this app.

[Damariobros]

Trying to click the logout button with the latest CLI installed also results in a glitched login state, and you have to delete data.json to log back in.

[DocMAX]

+1

[KnightTim]

I use the portable app as well and am getting this error.

I have some familiarity with software dev, and was able to trace the error being thrown to the JSON load function,

bitwarden-autotype/Lib/JSON.ahk

Lines 163 to 165 in e55cca1

	throw Exception("Failed to parse JSON (" r "," ErrorLevel ")", -1
	, Format("Unexpected character at position {}: '{}'"
	, (NumGet(pJson)-&_json)//2, Chr(NumGet(NumGet(pJson), "short"))))

My debug log also has the exact same info about "A_Error"

"A_Error": {
  "Extra": "Unexpected character at position 1: 'm'",
  "File": "bw-at.exe",
  "Line": 832,
  "Message": "Failed to parse JSON (-1,0)",
  "What": "-1"
}

I'm not sure what is causing this issue or how to fix it. I still get errors with older CLI clients, so this might be a server side change.

The error is similar to the one in #44, it makes me wonder if the pull request ( #61 ) by @toamz would also fix this issue. I'm not familiar enough with AutoHotKey, but maybe I should try to build my own version based on that pull request.

Also looking at the creator's github activity, there has been almost nothing in the last 6 months, and it looks like around 18 months since his last interaction on this repo. I wonder if this needs to be forked to be updated. (I don't have the familiarity with AHK, I have thought about writing my own version in C#)

[toamz]

I am also not familiar with AHK and that pull request was basically my only experience with it. From what I remember I ended up debugging the issue by trying to run the Bitwarden CLI manually from command line and that's when I noticed there were some warnings (in stderr) which were parsed by this script as the "expected" output. Maybe it will give you a hint about what's wrong too. If it gives you any warnings, that's probably where the issue lies.
Or maybe debugging the AHK script might be a better start, but I don't remember how that went for me.

I don't use this anymore, so I have no idea if it still works with the newer versions or not. Good luck with fixing it. I hope this helps at least a bit.

[Damariobros]

I was able to hot-swap the CLI to the latest version as downloaded from Bitwarden's official website (the latest GitHub release does not work, it HAS to be from Bitwarden). As in, I started up the program, and I don't remember whether it was before or after attempting to login, but I swapped the CLI files without closing AutoType, and then login with my API key. Then sync, then restart the program and immediately perform a manual sync again.

It seems to get it into a working state, however, it will often 'forget' my entire vault for absolutely no reason, and thereafter syncing errors out, and I have to restart the program and immediately sync and then it works. And then after a while it forgets my vault, rinse and repeat.

The past few days have been a little more stable, but it still forgets my vault from time to time.

Next time it happens I'll post the new error log.

[FrozenGhostx]

Fixed it, you can download the new version from my fork, until this user accepts my pull request.

[Damariobros]

Fixed it, you can download the new version from my fork, until this user accepts my pull request.

OH MY GOD THANK YOOOOUUUUU!!! I love this program so much thank you for fixing it! Will download at once!

[KnightTim]

Fixed it, you can download the new version from my fork, until this user accepts my pull request.

OH MY GOD THANK YOOOOUUUUU!!! I love this program so much thank you for fixing it! Will download at once!

Please make sure you review the fork and scan all downloads!

(I'll try to make an edit once I have reviewed and scanned it.)

Edit, I reviewed the code and ran the EXEs through a scanner, see below

[Damariobros]

Fixed it, you can download the new version from my fork, until this user accepts my pull request.

OH MY GOD THANK YOOOOUUUUU!!! I love this program so much thank you for fixing it! Will download at once!

Please make sure you review the fork and scan all downloads!

(I'll try to make an edit once I have reviewed and scanned it.)

VirusTotal came back totally clean. I don't know how to manually review the code. Or rather, I won't understand the code.

Have you reviewed it yet KnightTim?

[FrozenGhostx]

FYI, it's the "hotfix-bw-at" branch on my fork. Actually the review shouldn't take much time, it's just one line difference in the main bw-at.ahk

Just changed a single string.

[KnightTim]

Fixed it, you can download the new version from my fork, until this user accepts my pull request.

OH MY GOD THANK YOOOOUUUUU!!! I love this program so much thank you for fixing it! Will download at once!

Please make sure you review the fork and scan all downloads!
(I'll try to make an edit once I have reviewed and scanned it.)

VirusTotal came back totally clean. I don't know how to manually review the code. Or rather, I won't understand the code.

Have you reviewed it yet KnightTim?

Based on the code review things line up with @FrozenGhostx 's statement that he only changed one line.

It looks like it makes sense, though I have one comment.
Why delete StrLen(BwStatus.activeUserId)? Why not add StrLen(BwStatus.global_account_activeAccountId) as an additional OR condition?

On virus scans for the actual .exe not the zip download I have mixed results, I scanned both the fixed version and the original version. I found the following.

For the "original" version from anonymous1184:

• 1/69 at VirusTotal
• 1/24 at hybrid-analysis

For the patched version from FrozenGhostx:

• 2/73 at VirusTotal
• 1/24 at hybird-analysis

My take away is, it seems likely as safe as the original. And the "malicious" behavior detected is likely due to the fact it has the ability to "type" things, so it appears as a keyboard to programs.

It seems like hybird-analysis was flagging the same thing, and on VirusTotal, it seemed like some AI detection and likely a false positive.

TLDR: Likely safe, but it's the internet, always be careful.