{"record":{"id":"8d2826460811c2d8","repo":"siyuan-note/siyuan","slug":"cli-does-not-support-files-in-encrypted-notebooks","errorCode":null,"errorMessage":"CLI does not support files in encrypted notebooks","messagePattern":"CLI does not support files in encrypted notebooks","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/cli/cmd/root.go","lineNumber":176,"sourceCode":"\t\tif flag == nil {\n\t\t\tcontinue\n\t\t}\n\t\tvalues := []string{flag.Value.String()}\n\t\tif flag.Value.Type() == \"stringArray\" {\n\t\t\tvalues, _ = cmd.Flags().GetStringArray(flagName)\n\t\t}\n\t\tfor _, value := range values {\n\t\t\tfor id := range strings.SplitSeq(value, \",\") {\n\t\t\t\tif checkID(strings.TrimSpace(id)) {\n\t\t\t\t\treturn fmt.Errorf(\"CLI does not support encrypted notebook [%s]\", encryptedTarget)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tif cmd.Parent() == fileCmd {\n\t\tif slices.ContainsFunc(args, isEncryptedNotebookWorkspacePath) {\n\t\t\treturn fmt.Errorf(\"CLI does not support files in encrypted notebooks\")\n\t\t}\n\t\tif pathFlag := cmd.Flags().Lookup(\"path\"); pathFlag != nil && pathFlag.Value.String() != \"\" && isEncryptedNotebookWorkspacePath(pathFlag.Value.String()) {\n\t\t\treturn fmt.Errorf(\"CLI does not support files in encrypted notebooks\")\n\t\t}\n\t}\n\tif cmd.Parent() == assetCmd {\n\t\tif pathFlag := cmd.Flags().Lookup(\"path\"); pathFlag != nil && pathFlag.Value.String() != \"\" {\n\t\t\tassetPath := pathFlag.Value.String()\n\t\t\tif !filepath.IsAbs(assetPath) {\n\t\t\t\tassetPath = filepath.Join(\"data\", assetPath)\n\t\t\t}\n\t\t\tif isEncryptedNotebookWorkspacePath(assetPath) {\n\t\t\t\treturn fmt.Errorf(\"CLI does not support files in encrypted notebooks\")\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/cli/cmd/root.go#L158-L194","documentation":"Thrown by `rejectEncryptedNotebookCLI` when the command's parent is `fileCmd` and one of the positional `args` is a workspace path that resolves inside an encrypted notebook directory (`isEncryptedNotebookWorkspacePath`). This blocks raw file-path access (`file` subcommands) to encrypted notebook folders, preventing the CLI from reading or writing ciphertext/Plaintext files outside the in-app unlock flow.","triggerScenarios":"Running a `siyuan file <subcommand> <path>` where `<path>` (passed as a positional arg) lives under `data/<encryptedBoxID>/...`. The path is resolved relative to the workspace/data dir and its first segment is checked against encrypted notebook IDs.","commonSituations":"Passing an absolute or relative path to a `.sy` file inside an encrypted notebook; automating file reads against the workspace `data/` tree that includes encrypted notebooks; tab-completing into an encrypted notebook's folder.","solutions":["Only pass file paths that live under non-encrypted notebooks.","Decrypt the notebook in the GUI app first if you legitimately need file-level CLI access.","Identify encrypted notebook IDs via `siyuan notebook list` and avoid their directories."],"exampleFix":"// before\nsiyuan file cat 20240101000000encryptedBox/20240101abc.sy\n// after\nsiyuan file cat 20240101000000openBox/20240101abc.sy","handlingStrategy":"validation","validationCode":"// For `file` subcommands, check each positional path arg.\nfor _, p := range args {\n    if isEncryptedNotebookWorkspacePath(p) {\n        return errors.New(\"path is inside an encrypted notebook: \" + p)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never pass positional file paths that live under encrypted notebook directories.","Resolve and inspect the first data-dir segment of any path before passing it."],"tags":["cli","security","encryption","notebook","access-control","file-path"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}