{"record":{"id":"9275ddadbced0644","repo":"zeroclaw-labs/zeroclaw","slug":"domain-tool-are-not-valid-with-level-network","errorCode":null,"errorMessage":"--domain/--tool are not valid with --level network-kill","messagePattern":"--domain/--tool are not valid with --level network-kill","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/main.rs","lineNumber":6591,"sourceCode":"}\n\n#[cfg(feature = \"agent-runtime\")]\nfn build_engage_level(\n    level: Option<EstopLevelArg>,\n    domains: Vec<String>,\n    tools: Vec<String>,\n) -> Result<security::EstopLevel> {\n    let requested = level.unwrap_or(EstopLevelArg::KillAll);\n    match requested {\n        EstopLevelArg::KillAll => {\n            if !domains.is_empty() || !tools.is_empty() {\n                bail!(\"--domain/--tool are only valid with --level domain-block/tool-freeze\");\n            }\n            Ok(security::EstopLevel::KillAll)\n        }\n        EstopLevelArg::NetworkKill => {\n            if !domains.is_empty() || !tools.is_empty() {\n                bail!(\"--domain/--tool are not valid with --level network-kill\");\n            }\n            Ok(security::EstopLevel::NetworkKill)\n        }\n        EstopLevelArg::DomainBlock => {\n            if domains.is_empty() {\n                bail!(\"--level domain-block requires at least one --domain\");\n            }\n            if !tools.is_empty() {\n                bail!(\"--tool is not valid with --level domain-block\");\n            }\n            Ok(security::EstopLevel::DomainBlock(domains))\n        }\n        EstopLevelArg::ToolFreeze => {\n            if tools.is_empty() {\n                bail!(\"--level tool-freeze requires at least one --tool\");\n            }\n            if !domains.is_empty() {\n                bail!(\"--domain is not valid with --level tool-freeze\");","sourceCodeStart":6573,"sourceCodeEnd":6609,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/src/main.rs#L6573-L6609","documentation":"The network-kill level is a global network cut with no per-scope selectors; `build_engage_level` rejects `--domain` and `--tool` values whenever `--level network-kill` is requested.","triggerScenarios":"`zeroclaw estop --level network-kill --domain <d>` or `--level network-kill --tool <t>`.","commonSituations":"Editing a domain-block playbook line to 'network-kill' and leaving the old flags in place; concatenating flags from two different runbook commands.","solutions":["Remove `--domain`/`--tool` to engage the network kill","Use `--level domain-block --domain <d>` if per-domain blocking was actually intended"],"exampleFix":"# before\nzeroclaw estop --level network-kill --domain api.example.com\n# after\nzeroclaw estop --level network-kill","handlingStrategy":"validation","validationCode":"if [ \"$level\" = \"network-kill\" ] && { [ \"${#domains[@]}\" -gt 0 ] || [ \"${#tools[@]}\" -gt 0 ]; }; then\n  echo \"network-kill takes no --domain/--tool\"; exit 2\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep one runbook line per estop level; never merge flag sets between levels","Generate estop commands from a small library of named scenarios instead of hand-editing"],"tags":["cli","estop","arguments","zeroclaw"],"backgroundTag":"invalid-flag-combination","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}