eleven / messenger Public

deploy: bw unlock gets the same never-a-hang watchdog as the bw reads (#1338)

release-server.sh wrapped every 'bw get' in perl's alarm after the 14-minute
stall of 2026-07-21, but the unlock call stayed bare — and a promote hung in
it tonight, right after publish's unlock had worked. 90s alarm (KDF is
seconds; first server round-trip gets headroom), empty-session treated as
failure, and the failure hint now includes the manual sync/unlock/export path.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Paul Campbell 3 months ago 7a3694881bcf0fc1330ba6e6fa7f5f11f3daa892 parent 54433da

1 file changed, +7 −3

deploy/release-server.sh +7 −3

diff --git a/deploy/release-server.sh b/deploy/release-server.sh

index abb36a2..72fe3ee 100755

--- a/deploy/release-server.sh

+++ b/deploy/release-server.sh

@@ -122,10 +122,14 @@ case "${1:-}" in publish|promote)

IFS= read -rs LCHAT_BW_PASSWORD </dev/tty || { # set -e: die with a hint, not silently

echo >&2; echo "release-server: no tty to prompt on — run 'bw unlock' first or set LCHAT_RELEASE_KEY" >&2; exit 1; }

echo >&2

- BW_SESSION="$(LCHAT_BW_PASSWORD="$LCHAT_BW_PASSWORD" bw unlock --raw --passwordenv LCHAT_BW_PASSWORD)" \

- && export BW_SESSION || {

+ # The unlock gets the same never-a-hang watchdog as the reads — bw can

+ # stall indefinitely here too (observed 2026-07-24: a promote hung in

+ # `bw unlock` after publish's unlock had just worked). 90s: the KDF is

+ # seconds, but a slow first server round-trip deserves headroom.

+ BW_SESSION="$(LCHAT_BW_PASSWORD="$LCHAT_BW_PASSWORD" perl -e 'alarm 90; exec @ARGV' bw unlock --raw --passwordenv LCHAT_BW_PASSWORD)" \

+ && [ -n "$BW_SESSION" ] && export BW_SESSION || {

unset LCHAT_BW_PASSWORD

- echo "release-server: Bitwarden unlock failed — unlock it (or set LCHAT_RELEASE_KEY), then retry" >&2; exit 1; }

+ echo "release-server: Bitwarden unlock failed or stalled — run 'bw sync', then 'bw unlock' and export the BW_SESSION line it prints (or set LCHAT_RELEASE_KEY), and retry" >&2; exit 1; }

unset LCHAT_BW_PASSWORD

_t0="$(date +%s)"

LCHAT_RELEASE_KEY="$(bw_key)"