siyuan-note/siyuan · error

CLI does not support files in encrypted notebooks

Error message

CLI does not support files in encrypted notebooks

What it means

Thrown by `rejectEncryptedNotebookCLI` when the command's parent is `fileCmd` and one of the positional `args` is a workspace path that resolves inside an encrypted notebook directory (`isEncryptedNotebookWorkspacePath`). This blocks raw file-path access (`file` subcommands) to encrypted notebook folders, preventing the CLI from reading or writing ciphertext/Plaintext files outside the in-app unlock flow.

Source

Thrown at kernel/cli/cmd/root.go:176

		if flag == nil {
			continue
		}
		values := []string{flag.Value.String()}
		if flag.Value.Type() == "stringArray" {
			values, _ = cmd.Flags().GetStringArray(flagName)
		}
		for _, value := range values {
			for id := range strings.SplitSeq(value, ",") {
				if checkID(strings.TrimSpace(id)) {
					return fmt.Errorf("CLI does not support encrypted notebook [%s]", encryptedTarget)
				}
			}
		}
	}

	if cmd.Parent() == fileCmd {
		if slices.ContainsFunc(args, isEncryptedNotebookWorkspacePath) {
			return fmt.Errorf("CLI does not support files in encrypted notebooks")
		}
		if pathFlag := cmd.Flags().Lookup("path"); pathFlag != nil && pathFlag.Value.String() != "" && isEncryptedNotebookWorkspacePath(pathFlag.Value.String()) {
			return fmt.Errorf("CLI does not support files in encrypted notebooks")
		}
	}
	if cmd.Parent() == assetCmd {
		if pathFlag := cmd.Flags().Lookup("path"); pathFlag != nil && pathFlag.Value.String() != "" {
			assetPath := pathFlag.Value.String()
			if !filepath.IsAbs(assetPath) {
				assetPath = filepath.Join("data", assetPath)
			}
			if isEncryptedNotebookWorkspacePath(assetPath) {
				return fmt.Errorf("CLI does not support files in encrypted notebooks")
			}
		}
	}
	return nil
}

View on GitHub (pinned to 251596fc0d)

Solutions

1. Only pass file paths that live under non-encrypted notebooks.
2. Decrypt the notebook in the GUI app first if you legitimately need file-level CLI access.
3. Identify encrypted notebook IDs via `siyuan notebook list` and avoid their directories.

Example fix

// before
siyuan file cat 20240101000000encryptedBox/20240101abc.sy
// after
siyuan file cat 20240101000000openBox/20240101abc.sy

// For `file` subcommands, check each positional path arg.
for _, p := range args {
    if isEncryptedNotebookWorkspacePath(p) {
        return errors.New("path is inside an encrypted notebook: " + p)
    }
}

When it happens

Trigger: Running a `siyuan file <subcommand> <path>` where `<path>` (passed as a positional arg) lives under `data/<encryptedBoxID>/...`. The path is resolved relative to the workspace/data dir and its first segment is checked against encrypted notebook IDs.

Common situations: Passing an absolute or relative path to a `.sy` file inside an encrypted notebook; automating file reads against the workspace `data/` tree that includes encrypted notebooks; tab-completing into an encrypted notebook's folder.

Related errors

• CLI does not support encrypted notebook [%s]
• encrypted notebook is locked, please unlock it first
• path belongs to encrypted notebook [%s]: %s
• path belongs to encrypted notebook [%s]: %s
• accessing assets in encrypted notebook [%s] is not supported

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/8d2826460811c2d8. Report an issue: GitHub.