{"record":{"id":"2fa1763b0269c6ab","repo":"zeroclaw-labs/zeroclaw","slug":"tool-is-not-valid-with-level-domain-block","errorCode":null,"errorMessage":"--tool is not valid with --level domain-block","messagePattern":"--tool is not valid with --level domain-block","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/main.rs","lineNumber":6600,"sourceCode":"    match requested {\n        EstopLevelArg::KillAll => {\n            if !domains.is_empty() || !tools.is_empty() {\n                bail!(\"--domain/--tool are only valid with --level domain-block/tool-freeze\");\n            }\n            Ok(security::EstopLevel::KillAll)\n        }\n        EstopLevelArg::NetworkKill => {\n            if !domains.is_empty() || !tools.is_empty() {\n                bail!(\"--domain/--tool are not valid with --level network-kill\");\n            }\n            Ok(security::EstopLevel::NetworkKill)\n        }\n        EstopLevelArg::DomainBlock => {\n            if domains.is_empty() {\n                bail!(\"--level domain-block requires at least one --domain\");\n            }\n            if !tools.is_empty() {\n                bail!(\"--tool is not valid with --level domain-block\");\n            }\n            Ok(security::EstopLevel::DomainBlock(domains))\n        }\n        EstopLevelArg::ToolFreeze => {\n            if tools.is_empty() {\n                bail!(\"--level tool-freeze requires at least one --tool\");\n            }\n            if !domains.is_empty() {\n                bail!(\"--domain is not valid with --level tool-freeze\");\n            }\n            Ok(security::EstopLevel::ToolFreeze(tools))\n        }\n    }\n}\n\n#[cfg(feature = \"agent-runtime\")]\nfn build_resume_selector(\n    network: bool,","sourceCodeStart":6582,"sourceCodeEnd":6618,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/src/main.rs#L6582-L6618","documentation":"With `--level domain-block`, `--tool` values are meaningless and rejected; domains are the only selector for that level, and each engagement takes exactly one selector kind.","triggerScenarios":"`zeroclaw estop --level domain-block --domain a.com --tool shell` — any tool list supplied alongside a domain-block engage.","commonSituations":"Merging two runbook commands (one domain-block, one tool-freeze) into a single invocation; assuming estop levels can be combined in one command.","solutions":["Drop `--tool` for the domain block","Engage tool-freeze as a separate command: `zeroclaw estop --level tool-freeze --tool <t>`"],"exampleFix":"# before\nzeroclaw estop --level domain-block --domain a.com --tool shell\n# after\nzeroclaw estop --level domain-block --domain a.com\nzeroclaw estop --level tool-freeze --tool shell","handlingStrategy":"validation","validationCode":"if [ \"$level\" = \"domain-block\" ] && [ \"${#tools[@]}\" -gt 0 ]; then\n  echo \"--tool is invalid with domain-block; engage tool-freeze separately\"; exit 2\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Model each estop engagement as exactly one (level, selector-kind) pair in wrappers","Review runbook diffs for flag spillover between domain-block and tool-freeze commands"],"tags":["cli","estop","arguments","zeroclaw"],"backgroundTag":"invalid-flag-combination","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}