siyuan-note/siyuan · error

CLI does not support encrypted notebook

Error message

CLI does not support encrypted notebook [%s]

What it means

The CLI blocks operations that would act on encrypted notebooks, since encrypted notebook content can only be unlocked via the in-app flow and the CLI must not become a bypass for ciphertext/plaintext. For `notebook random-icon` without an explicit --id, or for `export data`, the guard enumerates all notebooks; if any encrypted notebook exists in the workspace, it refuses with the offending box ID.

Solutions

1. For `notebook random-icon`, pass an explicit --id of a non-encrypted notebook so the guard does not scan all notebooks.
2. Unlock or open the encrypted notebook in the SiYuan app, or temporarily move the encrypted notebook out of the workspace before running the CLI command.
3. Use the in-app export flow for data export instead of the CLI when encrypted notebooks are present.
4. Skip/filter encrypted notebook IDs in any automation that drives the CLI.

Example fix

// before
SiYuan-Kernel notebook random-icon -w ~/SiYuan
// after
SiYuan-Kernel notebook random-icon -w ~/SiYuan --id 20240101120000-abcd123

// Go: pre-check for encrypted notebooks before calling notebook/export CLI commands
for _, box := range listNotebookIDs() {
    if isEncryptedBox(box) { skipCommand = true }
}

if err := runKernelCLI(args); err != nil && strings.Contains(err.Error(), "CLI does not support encrypted notebook") {
    // fall back to the in-app flow or skip the encrypted notebook
}

When it happens

Trigger: Running `SiYuan-Kernel notebook random-icon` (no --id flag) or `SiYuan-Kernel export data` in a workspace that contains at least one encrypted notebook (firstEncryptedNotebookID returns non-empty).

Common situations: Workspace mixes encrypted and normal notebooks; scripting bulk export on a machine whose notebooks were converted to encrypted notebooks; CI jobs operating on workspaces containing encrypted notebooks.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• path belongs to encrypted notebook
• cannot replay block swap across encrypted notebook…
• cannot swap blocks across encrypted notebook boundaries
• CLI does not support encrypted notebook history
• CLI does not support files in encrypted notebooks

AI-assisted analysis of siyuan-note/siyuan@9f775e8a12 (2026-09-19). Data as JSON: /api/errors/564a650b00862cc4. Report an issue: GitHub.

Appendix: source

Thrown at kernel/cli/cmd/root.go:136

			return err
		}
		return nil
	},
}

// rejectEncryptedNotebookCLI 拒绝 CLI 对加密笔记本及其块的操作。
// 加密笔记本只能通过应用内专用流程解锁和操作，避免 CLI 进程成为明文或密文文件的旁路入口。
func rejectEncryptedNotebookCLI(cmd *cobra.Command, args []string) error {
	if cmd == serveCmd {
		return nil
	}
	if (cmd == notebookRandomIconCmd && !cmd.Flags().Changed("id")) || cmd == exportDataCmd {
		boxID, err := firstEncryptedNotebookID()
		if err != nil {
			return err
		}
		if boxID != "" {
			return fmt.Errorf("CLI does not support encrypted notebook [%s]", boxID)
		}
	}

	var encryptedTarget string
	checkID := func(id string) bool {
		if id == "" {
			return false
		}
		if model.IsEncryptedBox(id) {
			encryptedTarget = id
			return true
		}
		if bt := treenode.GetBlockTree(id); bt != nil && model.IsEncryptedBox(bt.BoxID) {
			encryptedTarget = bt.BoxID
			return true
		}
		return false
	}

View on GitHub (pinned to 9f775e8a12)