zeroclaw-labs/zeroclaw · error · anyhow::Error

--domain/--tool are not valid with --level network-kill

Error message

--domain/--tool are not valid with --level network-kill

What it means

The network-kill level is a global network cut with no per-scope selectors; `build_engage_level` rejects `--domain` and `--tool` values whenever `--level network-kill` is requested.

Source

Thrown at src/main.rs:6591

}

#[cfg(feature = "agent-runtime")]
fn build_engage_level(
    level: Option<EstopLevelArg>,
    domains: Vec<String>,
    tools: Vec<String>,
) -> Result<security::EstopLevel> {
    let requested = level.unwrap_or(EstopLevelArg::KillAll);
    match requested {
        EstopLevelArg::KillAll => {
            if !domains.is_empty() || !tools.is_empty() {
                bail!("--domain/--tool are only valid with --level domain-block/tool-freeze");
            }
            Ok(security::EstopLevel::KillAll)
        }
        EstopLevelArg::NetworkKill => {
            if !domains.is_empty() || !tools.is_empty() {
                bail!("--domain/--tool are not valid with --level network-kill");
            }
            Ok(security::EstopLevel::NetworkKill)
        }
        EstopLevelArg::DomainBlock => {
            if domains.is_empty() {
                bail!("--level domain-block requires at least one --domain");
            }
            if !tools.is_empty() {
                bail!("--tool is not valid with --level domain-block");
            }
            Ok(security::EstopLevel::DomainBlock(domains))
        }
        EstopLevelArg::ToolFreeze => {
            if tools.is_empty() {
                bail!("--level tool-freeze requires at least one --tool");
            }
            if !domains.is_empty() {
                bail!("--domain is not valid with --level tool-freeze");

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Remove `--domain`/`--tool` to engage the network kill
2. Use `--level domain-block --domain <d>` if per-domain blocking was actually intended

Example fix

# before
zeroclaw estop --level network-kill --domain api.example.com
# after
zeroclaw estop --level network-kill

if [ "$level" = "network-kill" ] && { [ "${#domains[@]}" -gt 0 ] || [ "${#tools[@]}" -gt 0 ]; }; then
  echo "network-kill takes no --domain/--tool"; exit 2
fi

When it happens

Trigger: `zeroclaw estop --level network-kill --domain <d>` or `--level network-kill --tool <t>`.

Common situations: Editing a domain-block playbook line to 'network-kill' and leaving the old flags in place; concatenating flags from two different runbook commands.

Related errors

• --domain/--tool are only valid with --level domain-block/too
• --level domain-block requires at least one --domain
• --tool is not valid with --level domain-block
• --level tool-freeze requires at least one --tool
• --domain is not valid with --level tool-freeze

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/9275ddadbced0644. Report an issue: GitHub.