{"record":{"id":"d662a95e2aee0d37","repo":"zeroclaw-labs/zeroclaw","slug":"grok-cli-extra-args-option-flag-must-use-fl","errorCode":null,"errorMessage":"grok_cli extra_args option `{flag}` must use `--flag=value` when its value starts with `-`","messagePattern":"grok_cli extra_args option `(.+?)` must use `--flag=value` when its value starts with `-`","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-providers/src/grok_cli.rs","lineNumber":579,"sourceCode":"                .map_or((arg.as_str(), false), |(flag, _)| (flag, true));\n            if RESERVED_EXTRA_ARG_FLAGS.contains(&flag) {\n                anyhow::bail!(\n                    \"grok_cli extra_args must not include reserved flag `{flag}`. \\\n                     ACP transport, prompt, model, session, cwd, and update policy are owned by ZeroClaw.\"\n                );\n            }\n            if has_inline_value || VALUELESS_EXTRA_ARG_FLAGS.contains(&flag) {\n                index += 1;\n                continue;\n            }\n            if VALUE_TAKING_EXTRA_ARG_FLAGS.contains(&flag) {\n                let Some(value) = extra_args.get(index + 1) else {\n                    anyhow::bail!(\n                        \"grok_cli extra_args option `{flag}` is missing its value and could consume the provider-owned ACP command\"\n                    );\n                };\n                if value.starts_with('-') {\n                    anyhow::bail!(\n                        \"grok_cli extra_args option `{flag}` must use `--flag=value` when its value starts with `-`\"\n                    );\n                }\n                index += 2;\n                continue;\n            }\n            anyhow::bail!(\n                \"grok_cli extra_args option `{flag}` must use `--flag=value` because its argument shape is not known\"\n            );\n        }\n        Ok(extra_args)\n    }\n\n    fn extra_args_set_any(extra_args: &[String], flags: &[&str]) -> bool {\n        extra_args.iter().any(|arg| {\n            let flag = arg.split('=').next().unwrap_or(arg);\n            flags.contains(&flag)\n        })","sourceCodeStart":561,"sourceCodeEnd":597,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-providers/src/grok_cli.rs#L561-L597","documentation":"The grok_cli provider builds the Grok CLI argv itself and appends your extra_args before the provider-owned trailing `agent stdio` tokens. For flags it knows take one value (VALUE_TAKING_EXTRA_ARG_FLAGS: `--tools`, `--sandbox`, `--permission-mode`, `--rules`, `--effort`, etc.) it allows the two-token form `[\"--flag\", \"value\"]`, but it rejects a value token that itself starts with `-` because a leading-dash value is indistinguishable from another flag and makes the argv ambiguous. Rewrite the pair as the inline form `--flag=value` so the boundary is explicit.","triggerScenarios":"Provider construction validates extra_args in normalize_and_validate_extra_args: a two-token pair whose second token starts with `-`, e.g. extra_args = [\"--tools\", \"-web_search\"] or [\"--permission-mode\", \"-bypass\"]. Fires before any CLI process is spawned.","commonSituations":"Forwarding deny-list entries or names that start with `-` (e.g. `--deny -read_only`); copying a working shell invocation (`grok --rules -foo`) into the alias's extra_args verbatim; negative numbers as values.","solutions":["Rewrite the pair inline: replace [\"--flag\", \"-value\"] with [\"--flag=-value\"] in the grok_cli alias's extra_args","If the value is a path that legitimately starts with `-`, make it explicit (`./-file` or an absolute path)","Check for a typo: a stray `-value` token often means the preceding flag was misspelled and fell out of the known-flags list"],"exampleFix":"# before\n[providers.models.grok_cli.local]\nextra_args = [\"--tools\", \"-web_search\"]\n\n# after\n[providers.models.grok_cli.local]\nextra_args = [\"--tools=-web_search\"]","handlingStrategy":"validation","validationCode":"fn grok_extra_args_ok(args: &[String]) -> Result<(), String> {\n    const VALUE_TAKING: &[&str] = &[\"--agent\",\"--agents\",\"--allow\",\"--allowedTools\",\"--best-of-n\",\"--deny\",\"--disallowed-tools\",\"--disallowedTools\",\"--effort\",\"--max-turns\",\"--permission-mode\",\"--reasoning-effort\",\"--rules\",\"--sandbox\",\"--tools\"];\n    let mut i = 0;\n    while i < args.len() {\n        if args[i].contains('=') { i += 1; continue; }\n        if VALUE_TAKING.contains(&args[i].as_str()) {\n            match args.get(i + 1) {\n                None => return Err(format!(\"{}: missing value\", args[i])),\n                Some(v) if v.starts_with('-') =>\n                    return Err(format!(\"use inline form `{}={}`\", args[i], v)),\n                _ => i += 2,\n            }\n        } else { i += 1; }\n    }\n    Ok(())\n}","typeGuard":null,"tryCatchPattern":"match GrokCliModelProvider::builder(alias).extra_args(args).build_to_provider() {\n    Ok(p) => p,\n    Err(e) if e.to_string().contains(\"must use `--flag=value`\") => {\n        // config bug: rewrite the flagged pair inline and reload config\n        return ConfigFix::queue(\"grok_cli extra_args\", e);\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Author every grok_cli extra_args entry in inline `--flag=value` form","Never paste a raw shell grok command into extra_args; translate flags first","Avoid values that begin with `-` (use ./-file or absolute paths)","Run a config lint at deploy time that applies the pair-shape check above"],"tags":["grok-cli","extra-args","cli-flags","argv","validation"],"backgroundTag":"cli-argument-validation","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}