zeroclaw-labs/zeroclaw · error · anyhow::Error

Use only one of --network, --domain, or --tool for estop res

Error message

Use only one of --network, --domain, or --tool for estop resume

What it means

`zeroclaw estop resume` resumes exactly one lock scope; `build_resume_selector` counts `--network`, a non-empty `--domain` list, and a non-empty `--tool` list, and bails when more than one selector is present. Supplying none is valid and resumes the full kill-all lock.

Source

Thrown at src/main.rs:6625

            }
            if !domains.is_empty() {
                bail!("--domain is not valid with --level tool-freeze");
            }
            Ok(security::EstopLevel::ToolFreeze(tools))
        }
    }
}

#[cfg(feature = "agent-runtime")]
fn build_resume_selector(
    network: bool,
    domains: Vec<String>,
    tools: Vec<String>,
) -> Result<security::ResumeSelector> {
    let selected =
        usize::from(network) + usize::from(!domains.is_empty()) + usize::from(!tools.is_empty());
    if selected > 1 {
        bail!("Use only one of --network, --domain, or --tool for estop resume");
    }
    if network {
        return Ok(security::ResumeSelector::Network);
    }
    if !domains.is_empty() {
        return Ok(security::ResumeSelector::Domains(domains));
    }
    if !tools.is_empty() {
        return Ok(security::ResumeSelector::Tools(tools));
    }
    Ok(security::ResumeSelector::KillAll)
}

#[cfg(feature = "agent-runtime")]
fn print_estop_status(state: &security::EstopState) {
    println!("{}", t("cli-estop-status", "Estop status:"));
    println!(
        "  engaged:        {}",

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Resume scopes one at a time: `zeroclaw estop resume --network`, then `--domain <d>`, then `--tool <t>`
2. To clear everything, run `zeroclaw estop resume` with no selector (resumes the kill-all lock) and then resume the remaining scopes

Example fix

# before
zeroclaw estop resume --network --domain api.example.com --tool shell
# after
zeroclaw estop resume --network
zeroclaw estop resume --domain api.example.com
zeroclaw estop resume --tool shell

sel=0
[ "$network" = "true" ] && sel=$((sel+1))
[ "${#domains[@]}" -gt 0 ] && sel=$((sel+1))
[ "${#tools[@]}" -gt 0 ] && sel=$((sel+1))
[ "$sel" -le 1 ] || { echo "pick exactly one resume scope"; exit 2; }

When it happens

Trigger: `zeroclaw estop resume --network --domain api.example.com`, `--domain a.com --tool shell`, or all three selectors in one command.

Common situations: Resuming everything after a mixed incident (kill-all plus domain blocks) by passing all flags at once; scripts concatenating the engage-phase flags into the resume call.

Related errors

• --domain/--tool are only valid with --level domain-block/too
• --domain/--tool are not valid with --level network-kill
• --level domain-block requires at least one --domain
• --tool is not valid with --level domain-block
• --level tool-freeze requires at least one --tool

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/392b5df5e6ec3793. Report an issue: GitHub.