zeroclaw-labs/zeroclaw · error · anyhow::Error

Browser tool enabled but no allowed_domains configured. Add

Error message

Browser tool enabled but no allowed_domains configured. Add [browser].allowed_domains in config.toml

What it means

Error "Browser tool enabled but no allowed_domains configured. Add [browser].allowed_domains in config.toml" thrown in zeroclaw-labs/zeroclaw.

Source

Thrown at crates/zeroclaw-tools/src/browser.rs:463

        // Block file:// URLs — browser file access bypasses all SSRF and
        // domain-allowlist controls and can exfiltrate arbitrary local files.
        if url.starts_with("file://") {
            anyhow::bail!("file:// URLs are not allowed in browser automation");
        }

        if !url.starts_with("https://") && !url.starts_with("http://") {
            anyhow::bail!("Only http:// and https:// URLs are allowed");
        }

        let parsed = reqwest::Url::parse(url)
            .map_err(|e| anyhow::Error::msg(format!("Invalid URL format: {e}")))?;

        if !parsed.username().is_empty() || parsed.password().is_some() {
            anyhow::bail!("URL userinfo is not allowed");
        }

        if self.allowed_domains.is_empty() && self.allowed_private_hosts.is_empty() {
            anyhow::bail!(
                "Browser tool enabled but no allowed_domains configured. \
                Add [browser].allowed_domains in config.toml"
            );
        }

        let host_str = parsed
            .host_str()
            .ok_or_else(|| anyhow::Error::msg("URL must include a host"))?;

        let is_ipv6 = host_str.parse::<std::net::Ipv6Addr>().is_ok();
        let host = if is_ipv6 {
            format!("[{host_str}]")
        } else {
            host_str.to_lowercase()
        };

        let private_host = domain_guard::is_private_or_local_host(&host);
        let private_host_allowed = private_host

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Add [browser].allowed_domains in config.toml listing permitted hosts.

When it happens

Trigger: Thrown at crates/zeroclaw-tools/src/browser.rs:463 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/3ce1f0e2594daca1. Report an issue: GitHub.