{"record":{"id":"392b5df5e6ec3793","repo":"zeroclaw-labs/zeroclaw","slug":"use-only-one-of-network-domain-or-tool-for","errorCode":null,"errorMessage":"Use only one of --network, --domain, or --tool for estop resume","messagePattern":"Use only one of --network, --domain, or --tool for estop resume","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/main.rs","lineNumber":6625,"sourceCode":"            }\n            if !domains.is_empty() {\n                bail!(\"--domain is not valid with --level tool-freeze\");\n            }\n            Ok(security::EstopLevel::ToolFreeze(tools))\n        }\n    }\n}\n\n#[cfg(feature = \"agent-runtime\")]\nfn build_resume_selector(\n    network: bool,\n    domains: Vec<String>,\n    tools: Vec<String>,\n) -> Result<security::ResumeSelector> {\n    let selected =\n        usize::from(network) + usize::from(!domains.is_empty()) + usize::from(!tools.is_empty());\n    if selected > 1 {\n        bail!(\"Use only one of --network, --domain, or --tool for estop resume\");\n    }\n    if network {\n        return Ok(security::ResumeSelector::Network);\n    }\n    if !domains.is_empty() {\n        return Ok(security::ResumeSelector::Domains(domains));\n    }\n    if !tools.is_empty() {\n        return Ok(security::ResumeSelector::Tools(tools));\n    }\n    Ok(security::ResumeSelector::KillAll)\n}\n\n#[cfg(feature = \"agent-runtime\")]\nfn print_estop_status(state: &security::EstopState) {\n    println!(\"{}\", t(\"cli-estop-status\", \"Estop status:\"));\n    println!(\n        \"  engaged:        {}\",","sourceCodeStart":6607,"sourceCodeEnd":6643,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/src/main.rs#L6607-L6643","documentation":"`zeroclaw estop resume` resumes exactly one lock scope; `build_resume_selector` counts `--network`, a non-empty `--domain` list, and a non-empty `--tool` list, and bails when more than one selector is present. Supplying none is valid and resumes the full kill-all lock.","triggerScenarios":"`zeroclaw estop resume --network --domain api.example.com`, `--domain a.com --tool shell`, or all three selectors in one command.","commonSituations":"Resuming everything after a mixed incident (kill-all plus domain blocks) by passing all flags at once; scripts concatenating the engage-phase flags into the resume call.","solutions":["Resume scopes one at a time: `zeroclaw estop resume --network`, then `--domain <d>`, then `--tool <t>`","To clear everything, run `zeroclaw estop resume` with no selector (resumes the kill-all lock) and then resume the remaining scopes"],"exampleFix":"# before\nzeroclaw estop resume --network --domain api.example.com --tool shell\n# after\nzeroclaw estop resume --network\nzeroclaw estop resume --domain api.example.com\nzeroclaw estop resume --tool shell","handlingStrategy":"validation","validationCode":"sel=0\n[ \"$network\" = \"true\" ] && sel=$((sel+1))\n[ \"${#domains[@]}\" -gt 0 ] && sel=$((sel+1))\n[ \"${#tools[@]}\" -gt 0 ] && sel=$((sel+1))\n[ \"$sel\" -le 1 ] || { echo \"pick exactly one resume scope\"; exit 2; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Loop over resume scopes sequentially instead of batching flags","Derive resume selectors from the live `estop status` output rather than incident memory"],"tags":["cli","estop","resume","arguments","zeroclaw"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}