zeroclaw-labs/zeroclaw · error · anyhow::Error

--tool is not valid with --level domain-block

Error message

--tool is not valid with --level domain-block

What it means

With `--level domain-block`, `--tool` values are meaningless and rejected; domains are the only selector for that level, and each engagement takes exactly one selector kind.

Source

Thrown at src/main.rs:6600

    match requested {
        EstopLevelArg::KillAll => {
            if !domains.is_empty() || !tools.is_empty() {
                bail!("--domain/--tool are only valid with --level domain-block/tool-freeze");
            }
            Ok(security::EstopLevel::KillAll)
        }
        EstopLevelArg::NetworkKill => {
            if !domains.is_empty() || !tools.is_empty() {
                bail!("--domain/--tool are not valid with --level network-kill");
            }
            Ok(security::EstopLevel::NetworkKill)
        }
        EstopLevelArg::DomainBlock => {
            if domains.is_empty() {
                bail!("--level domain-block requires at least one --domain");
            }
            if !tools.is_empty() {
                bail!("--tool is not valid with --level domain-block");
            }
            Ok(security::EstopLevel::DomainBlock(domains))
        }
        EstopLevelArg::ToolFreeze => {
            if tools.is_empty() {
                bail!("--level tool-freeze requires at least one --tool");
            }
            if !domains.is_empty() {
                bail!("--domain is not valid with --level tool-freeze");
            }
            Ok(security::EstopLevel::ToolFreeze(tools))
        }
    }
}

#[cfg(feature = "agent-runtime")]
fn build_resume_selector(
    network: bool,

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Drop `--tool` for the domain block
2. Engage tool-freeze as a separate command: `zeroclaw estop --level tool-freeze --tool <t>`

Example fix

# before
zeroclaw estop --level domain-block --domain a.com --tool shell
# after
zeroclaw estop --level domain-block --domain a.com
zeroclaw estop --level tool-freeze --tool shell

if [ "$level" = "domain-block" ] && [ "${#tools[@]}" -gt 0 ]; then
  echo "--tool is invalid with domain-block; engage tool-freeze separately"; exit 2
fi

When it happens

Trigger: `zeroclaw estop --level domain-block --domain a.com --tool shell` — any tool list supplied alongside a domain-block engage.

Common situations: Merging two runbook commands (one domain-block, one tool-freeze) into a single invocation; assuming estop levels can be combined in one command.

Related errors

• --domain/--tool are only valid with --level domain-block/too
• --domain/--tool are not valid with --level network-kill
• --level domain-block requires at least one --domain
• --level tool-freeze requires at least one --tool
• --domain is not valid with --level tool-freeze

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/2fa1763b0269c6ab. Report an issue: GitHub.