{"record":{"id":"370a40ee24de8756","repo":"zeroclaw-labs/zeroclaw","slug":"domain-tool-are-only-valid-with-level-domain","errorCode":null,"errorMessage":"--domain/--tool are only valid with --level domain-block/tool-freeze","messagePattern":"--domain/--tool are only valid with --level domain-block/tool-freeze","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/main.rs","lineNumber":6585,"sourceCode":"            manager.engage(engage_level)?;\n            println!(\"{}\", t(\"cli-estop-engaged\", \"Estop engaged.\"));\n            print_estop_status(&manager.status());\n            Ok(())\n        }\n    }\n}\n\n#[cfg(feature = \"agent-runtime\")]\nfn build_engage_level(\n    level: Option<EstopLevelArg>,\n    domains: Vec<String>,\n    tools: Vec<String>,\n) -> Result<security::EstopLevel> {\n    let requested = level.unwrap_or(EstopLevelArg::KillAll);\n    match requested {\n        EstopLevelArg::KillAll => {\n            if !domains.is_empty() || !tools.is_empty() {\n                bail!(\"--domain/--tool are only valid with --level domain-block/tool-freeze\");\n            }\n            Ok(security::EstopLevel::KillAll)\n        }\n        EstopLevelArg::NetworkKill => {\n            if !domains.is_empty() || !tools.is_empty() {\n                bail!(\"--domain/--tool are not valid with --level network-kill\");\n            }\n            Ok(security::EstopLevel::NetworkKill)\n        }\n        EstopLevelArg::DomainBlock => {\n            if domains.is_empty() {\n                bail!(\"--level domain-block requires at least one --domain\");\n            }\n            if !tools.is_empty() {\n                bail!(\"--tool is not valid with --level domain-block\");\n            }\n            Ok(security::EstopLevel::DomainBlock(domains))\n        }","sourceCodeStart":6567,"sourceCodeEnd":6603,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/src/main.rs#L6567-L6603","documentation":"`zeroclaw estop` (engage, the default when no subcommand is given) defaults to the kill-all level, which is global and accepts no selectors. `build_engage_level` rejects any `--domain`/`--tool` values when the effective level is kill-all.","triggerScenarios":"`zeroclaw estop --domain api.example.com` or `zeroclaw estop --tool shell --level kill-all` — selector flags supplied without `--level domain-block`/`--level tool-freeze`, or with kill-all chosen explicitly/defaulted.","commonSituations":"Assuming the CLI infers the level from the provided flags; copy-pasting a domain-block command and deleting the `--level` part; scripts written against an older estop CLI shape.","solutions":["Pick the matching level: `zeroclaw estop --level domain-block --domain <d>` or `--level tool-freeze --tool <t>`","Or drop the `--domain`/`--tool` flags to engage a plain global kill-all"],"exampleFix":"# before\nzeroclaw estop --domain api.example.com\n# after\nzeroclaw estop --level domain-block --domain api.example.com","handlingStrategy":"validation","validationCode":"estop_args_ok() { # $1=level $2=#domains $3=#tools\n  case \"$1\" in\n    kill-all|\"\")          [ \"$2\" -eq 0 ] && [ \"$3\" -eq 0 ] ;;\n    domain-block)          [ \"$2\" -gt 0 ] && [ \"$3\" -eq 0 ] ;;\n    tool-freeze)           [ \"$3\" -gt 0 ] && [ \"$2\" -eq 0 ] ;;\n    *) return 2 ;;\n  esac\n}\nestop_args_ok \"$level\" \"${#domains[@]}\" \"${#tools[@]}\" || { echo \"level/selector mismatch\"; exit 2; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass `--level` explicitly in scripts instead of relying on the kill-all default","Encapsulate estop invocations in one wrapper that owns the level/selector matrix","Dry-run new estop commands with `zeroclaw estop status` afterwards to confirm the intended state"],"tags":["cli","estop","arguments","zeroclaw"],"backgroundTag":"invalid-flag-combination","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}