{"record":{"id":"f29ee9f39b025874","repo":"zeroclaw-labs/zeroclaw","slug":"domain-is-not-valid-with-level-tool-freeze","errorCode":null,"errorMessage":"--domain is not valid with --level tool-freeze","messagePattern":"--domain is not valid with --level tool-freeze","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/main.rs","lineNumber":6609,"sourceCode":"                bail!(\"--domain/--tool are not valid with --level network-kill\");\n            }\n            Ok(security::EstopLevel::NetworkKill)\n        }\n        EstopLevelArg::DomainBlock => {\n            if domains.is_empty() {\n                bail!(\"--level domain-block requires at least one --domain\");\n            }\n            if !tools.is_empty() {\n                bail!(\"--tool is not valid with --level domain-block\");\n            }\n            Ok(security::EstopLevel::DomainBlock(domains))\n        }\n        EstopLevelArg::ToolFreeze => {\n            if tools.is_empty() {\n                bail!(\"--level tool-freeze requires at least one --tool\");\n            }\n            if !domains.is_empty() {\n                bail!(\"--domain is not valid with --level tool-freeze\");\n            }\n            Ok(security::EstopLevel::ToolFreeze(tools))\n        }\n    }\n}\n\n#[cfg(feature = \"agent-runtime\")]\nfn build_resume_selector(\n    network: bool,\n    domains: Vec<String>,\n    tools: Vec<String>,\n) -> Result<security::ResumeSelector> {\n    let selected =\n        usize::from(network) + usize::from(!domains.is_empty()) + usize::from(!tools.is_empty());\n    if selected > 1 {\n        bail!(\"Use only one of --network, --domain, or --tool for estop resume\");\n    }\n    if network {","sourceCodeStart":6591,"sourceCodeEnd":6627,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/src/main.rs#L6591-L6627","documentation":"With `--level tool-freeze`, `--domain` values are meaningless and rejected; tools are the only selector for that level, and each engagement takes exactly one selector kind.","triggerScenarios":"`zeroclaw estop --level tool-freeze --tool shell --domain a.com` — any domain list supplied alongside a tool-freeze engage.","commonSituations":"Combining flags from a domain-block runbook line into a tool-freeze invocation; assuming multiple lock scopes can be engaged in one command.","solutions":["Drop `--domain` for the tool freeze","Engage domain-block as a separate command: `zeroclaw estop --level domain-block --domain <d>`"],"exampleFix":"# before\nzeroclaw estop --level tool-freeze --tool shell --domain a.com\n# after\nzeroclaw estop --level tool-freeze --tool shell\nzeroclaw estop --level domain-block --domain a.com","handlingStrategy":"validation","validationCode":"if [ \"$level\" = \"tool-freeze\" ] && [ \"${#domains[@]}\" -gt 0 ]; then\n  echo \"--domain is invalid with tool-freeze; engage domain-block separately\"; exit 2\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never concatenate selector lists from different scenarios into one command","Script estop as discrete single-purpose invocations and verify state after each"],"tags":["cli","estop","arguments","zeroclaw"],"backgroundTag":"invalid-flag-combination","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}