Recovery & safety

Common errors, in plain English

Every error the CLI emits, what it actually means, and the 30-second fix.

“no project linked in this directory”

When

Running unlock / lock / share / ci-token / escrow inside a repo that has no .sealrepo/link.json.

Fix

Either you're in the wrong folder, or you skipped the linking step. Run:

Terminal

$sealrepo link prj_xxxxxxxxxxxx

See Link a project for where to get the project ID.

“Access revoked by project owner”

When

Trying to unlock with an access code that was revoked from the dashboard.

Fix

The code is dead. Ask whoever shared it with you to generate a new one (Project page → Create access code). Any files that were already decrypted in your shell are wiped within seconds.

“CI token sct_… was revoked”

When

A CI build that was working last night is now failing.

Fix

An admin revoked the token. Create a new one (CI tokens → New token), copy it once, update the SEALREPO_TOKEN secret in your CI provider, re-run the build.

“incorrect passphrase”

When

sealrepo unlock claims your passphrase is wrong, but you're sure it isn't.

Fix

Caps lock? International keyboard layout?
Did anyone sealrepo rotate recently? Ask in your team chat.
Out of options: sealrepo unlock --recovery with your recovery code, then sealrepo rotate to a new passphrase.

“escrow blob signature mismatch”

When

sealrepo escrow recover bails right before decryption.

Fix

The blob was uploaded with a different passphrase than what you just typed (i.e. someone rotated since you backed up). The fix is to recover from your recovery code on the new machine instead:

Terminal

$sealrepo unlock --recovery

Then re-enable escrow with the current passphrase:

Terminal

$sealrepo escrow enable

“tmpfs not available” (Strict Mode on Linux)

When

Trying to use --strict on a system without tmpfs / sufficient RAM.

Fix

Strict Mode mounts decrypted files in RAM only. If you're on a constrained CI runner or an old kernel, fall back to standard unlock — it's still encrypted on disk between sessions, just not RAM-only during the session:

Terminal

$sealrepo unlock --no-strict

“Cloudflare bot challenge” when CLI talks to the API

When

Rare — usually after running thousands of API calls from one IP.

Fix

The CLI honors SEALREPO_APIif you want to bypass Cloudflare during local testing (don't ship this to production). For the normal case, just wait a minute and retry — Cloudflare clears the challenge automatically.

Email never arrived (verification, invitations, password reset)

When

Signed up, accepted an invite, or hit password reset — nothing in inbox.

Fix

Check spam, including the "Promotions" tab on Gmail.
Hit Resend on the verification banner — it rate-limits to once per minute.
If your domain has aggressive filtering, allow @sealrepo.dev in your MX rules.

Still stuck?

Open an issue on GitHub with the exact command you ran and the exact error. We respond in business hours, US Eastern.