{"record":{"id":"6d9a8ed9a4a1cbc9","repo":"ruvnet/ruflo","slug":"wildcard-network","errorCode":"WILDCARD_NETWORK","errorMessage":"Wildcard \"${entry}\" in network allowlist requires privileged access (Bash tool)","messagePattern":"Wildcard \"(.+?)\" in network allowlist requires privileged access \\(Bash tool\\)","errorType":"validation","errorClass":"ValidationError","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/guidance/src/manifest-validator.ts","lineNumber":510,"sourceCode":"      errors.push({\n        code: 'INVALID_TYPE',\n        field: 'toolPolicy.networkAllowlist',\n        message: 'networkAllowlist must be an array',\n        severity: 'error',\n      });\n    }\n\n    // Check for wildcards in network allowlist\n    const isPrivileged = Array.isArray(toolPolicy.toolsAllowed) &&\n      toolPolicy.toolsAllowed.includes('Bash');\n\n    if (Array.isArray(toolPolicy.networkAllowlist)) {\n      for (let i = 0; i < toolPolicy.networkAllowlist.length; i++) {\n        const entry = toolPolicy.networkAllowlist[i];\n        if (entry === '*' || entry.startsWith('*.')) {\n          if (!isPrivileged) {\n            errors.push({\n              code: 'WILDCARD_NETWORK',\n              field: `toolPolicy.networkAllowlist[${i}]`,\n              message: `Wildcard \"${entry}\" in network allowlist requires privileged access (Bash tool)`,\n              severity: 'error',\n            });\n          }\n        }\n      }\n    }\n\n    return errors;\n  }\n\n  /**\n   * Validate data policy fields.\n   */\n  validateDataPolicy(dataPolicy: AgentCellManifest['dataPolicy']): ValidationError[] {\n    const errors: ValidationError[] = [];\n","sourceCodeStart":492,"sourceCodeEnd":528,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/guidance/src/manifest-validator.ts#L492-L528","documentation":"validateToolPolicy() found a '*' or '*.'-prefixed wildcard entry in networkAllowlist while toolsAllowed does not include 'Bash' (i.e. the cell is not privileged). Unrestricted network egress is only permitted for Bash-capable privileged cells; unprivileged manifests must list explicit hosts.","triggerScenarios":"Thrown at v3/@claude-flow/guidance/src/manifest-validator.ts:510 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Replace the wildcard with explicit host entries, or run with the privileged access the wildcard requires.","Scope the allowlist to concrete domains to avoid the privileged-access requirement."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}