ruvnet/ruflo · error · ValidationError

WILDCARD_NETWORK

WILDCARD_NETWORK

Error message

Wildcard "${entry}" in network allowlist requires privileged access (Bash tool)

What it means

validateToolPolicy() found a '*' or '*.'-prefixed wildcard entry in networkAllowlist while toolsAllowed does not include 'Bash' (i.e. the cell is not privileged). Unrestricted network egress is only permitted for Bash-capable privileged cells; unprivileged manifests must list explicit hosts.

Source

Thrown at v3/@claude-flow/guidance/src/manifest-validator.ts:510

      errors.push({
        code: 'INVALID_TYPE',
        field: 'toolPolicy.networkAllowlist',
        message: 'networkAllowlist must be an array',
        severity: 'error',
      });
    }

    // Check for wildcards in network allowlist
    const isPrivileged = Array.isArray(toolPolicy.toolsAllowed) &&
      toolPolicy.toolsAllowed.includes('Bash');

    if (Array.isArray(toolPolicy.networkAllowlist)) {
      for (let i = 0; i < toolPolicy.networkAllowlist.length; i++) {
        const entry = toolPolicy.networkAllowlist[i];
        if (entry === '*' || entry.startsWith('*.')) {
          if (!isPrivileged) {
            errors.push({
              code: 'WILDCARD_NETWORK',
              field: `toolPolicy.networkAllowlist[${i}]`,
              message: `Wildcard "${entry}" in network allowlist requires privileged access (Bash tool)`,
              severity: 'error',
            });
          }
        }
      }
    }

    return errors;
  }

  /**
   * Validate data policy fields.
   */
  validateDataPolicy(dataPolicy: AgentCellManifest['dataPolicy']): ValidationError[] {
    const errors: ValidationError[] = [];

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Replace the wildcard with explicit host entries, or run with the privileged access the wildcard requires.
2. Scope the allowlist to concrete domains to avoid the privileged-access requirement.

When it happens

Trigger: Thrown at v3/@claude-flow/guidance/src/manifest-validator.ts:510 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/6d9a8ed9a4a1cbc9. Report an issue: GitHub.