{"record":{"id":"93586f6c0c3b8f3f","repo":"zeroclaw-labs/zeroclaw","slug":"invalid-label","errorCode":null,"errorMessage":"Invalid {label}: {}","messagePattern":"Invalid (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-infra/src/net_guard.rs","lineNumber":309,"sourceCode":"/// Validate and canonicalize a whole egress allowlist, sorted and deduplicated.\n///\n/// `label` names the surface in the error so an operator can find the offending\n/// entry (for example `plugins.entries[github].egress_hosts`).\n///\n/// # Errors\n///\n/// Returns an error naming every rejected entry and why.\npub fn normalize_egress_patterns(patterns: &[String], label: &str) -> anyhow::Result<Vec<String>> {\n    let mut rejected = Vec::new();\n    let mut out = Vec::with_capacity(patterns.len());\n    for raw in patterns {\n        match normalize_egress_pattern(raw) {\n            Ok(pattern) => out.push(pattern),\n            Err(reason) => rejected.push(reason),\n        }\n    }\n    if !rejected.is_empty() {\n        anyhow::bail!(\"Invalid {label}: {}\", rejected.join(\"; \"));\n    }\n    out.sort_unstable();\n    out.dedup();\n    Ok(out)\n}\n\n/// Strict egress matching: the deny-by-default sibling of\n/// [`host_matches_allowlist`].\n///\n/// `allowed` is expected to hold entries already canonicalized by\n/// [`normalize_egress_pattern`]. Matching is:\n/// - exact host equality, or\n/// - `*.example.com` matching a **strict subdomain** of `example.com`.\n///\n/// An apex host never matches through a bare-domain entry's subdomains, a\n/// suffix pattern never matches the apex, and there is no wildcard that matches\n/// everything: an entry of `*` (which validation refuses) would only ever match\n/// a literal host named `*`, so even an unvalidated list fails closed.","sourceCodeStart":291,"sourceCodeEnd":327,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-infra/src/net_guard.rs#L291-L327","documentation":"Error \"Invalid {label}: {}\" thrown in zeroclaw-labs/zeroclaw.","triggerScenarios":"Thrown at crates/zeroclaw-infra/src/net_guard.rs:309 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Correct the invalid value described in the error detail."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}