What causes "%w: selected Vault path is sensitive" in siyuan-note/siyuan?

Choose a vault directory outside all sensitive/system locations (a plain Documents folder is fine)

siyuan-note/siyuan · error · errObsidianVaultUnsafePath

%w: selected Vault path is sensitive

Error message

%w: selected Vault path is sensitive

What it means

Security guard: util.IsSensitivePath flagged the chosen vault path as sensitive (e.g. it overlaps OS/system directories, the SiYuan installation, or similar protected locations). The kernel wraps errObsidianVaultUnsafePath with 'selected Vault path is sensitive' to prevent destructive imports into critical directories.

Source

Thrown at kernel/model/import_obsidian.go:577

	if strings.TrimSpace(localPath) == "" {
		return "", fmt.Errorf("%w: path is empty", errObsidianVaultUnreadable)
	}
	abs, err := filepath.Abs(filepath.Clean(localPath))
	if err != nil {
		return "", fmt.Errorf("%w: normalize Vault path: %v", errObsidianVaultUnreadable, err)
	}
	info, err := os.Lstat(abs)
	if err != nil {
		return "", fmt.Errorf("%w: read Vault root: %v", errObsidianVaultUnreadable, err)
	}
	if !info.IsDir() {
		return "", errObsidianVaultNotDirectory
	}
	if info.Mode()&os.ModeSymlink != 0 || isObsidianResolvedLink(abs) {
		return "", fmt.Errorf("%w: Vault root is a symbolic link or reparse point", errObsidianVaultUnsafePath)
	}
	if util.IsSensitivePath(abs) {
		return "", fmt.Errorf("%w: selected Vault path is sensitive", errObsidianVaultUnsafePath)
	}
	workspace, _ := filepath.Abs(filepath.Clean(util.WorkspaceDir))
	if sameObsidianPath(abs, workspace) || gulu.File.IsSubPath(workspace, abs) || gulu.File.IsSubPath(abs, workspace) {
		return "", fmt.Errorf("%w: Vault root and SiYuan workspace contain each other", errObsidianVaultUnsafePath)
	}
	configPath := filepath.Join(abs, ".obsidian")
	configInfo, statErr := os.Lstat(configPath)
	if statErr != nil {
		if os.IsNotExist(statErr) {
			return "", errObsidianVaultConfigMissing
		}
		return "", fmt.Errorf("%w: read Vault config directory: %v", errObsidianVaultUnreadable, statErr)
	}
	if !configInfo.IsDir() || configInfo.Mode()&os.ModeSymlink != 0 || isObsidianResolvedLink(configPath) {
		return "", errObsidianVaultConfigMissing
	}
	return abs, nil
}

View on GitHub (pinned to 8641553a1f)

Solutions

Choose a vault directory outside all sensitive/system locations (a plain Documents folder is fine)
Do not select the SiYuan workspace, installation directory, or OS system folders as the vault
Move the vault to a neutral location if it currently lives in a protected directory
Review util.IsSensitivePath rules to understand which prefixes are rejected

Example fix

// before
analyzeObsidianVault(workspaceDir + "/vault") // inside workspace
// after
analyzeObsidianVault("/Users/me/Documents/obsidian-vault")

Defensive patterns

Strategy: validation

Validate before calling

abs, _ := filepath.Abs(vaultPath)
if util.IsSensitivePath(abs) {
    return errors.New("choose a vault outside protected/system directories")
}

Type guard

null

Try / catch

_, err := AnalyzeObsidianVault(vaultPath)
if err != nil && strings.Contains(err.Error(), "path is sensitive") {
    promptUserToChooseAnotherFolder()
}

Prevention

Store vaults in neutral user directories (Documents, etc.)
Never point imports at the SiYuan workspace or install directory
Review IsSensitivePath rules when automating vault selection

When it happens

Trigger: validateObsidianVaultRoot at kernel/model/import_obsidian.go:577 when the selected vault path matches util.IsSensitivePath — e.g. the workspace dir, kernel binary location, home-level system folders, or other protected paths.

Common situations: User picks the SiYuan data folder itself as the vault; vault placed inside the application install directory; automation pointing at system directories like /etc or C:\Windows.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

AI-assisted analysis of siyuan-note/siyuan@8641553a1f (2026-09-11). Data as JSON: /api/errors/44f3d8b7401bb372. Report an issue: GitHub.