Close scope-gate bypass: curl/wget were invisible to the PreToolUse hook

[ankitsingh015]

Summary

User pointed out that my earlier "raw bash bypasses scope/budget/audit enforcement" claim needed verification, not just assertion — specifically asked to make sure bypass isn't possible where it actually matters (scope). Checked the real mechanism (scripts/hooks/scope_gate_hook.py, wired via .claude/settings.json's PreToolUse hook with matcher "*" — it does intercept every Bash call, not just MCP tool calls). Found the actual gap: its TIER2_BASH_TOOLS set only lists the 8 binaries HuntMCP's own MCP servers shell out to. curl was never in it — exactly the tool the recon-skills library (reviewed earlier this session) uses throughout. A raw curl https://out-of-scope-target.com/... was completely invisible to the scope gate.

Fixed by adding curl/wget to the checked set. That surfaced two more real false-positive risks along the way (both verified with actual reproductions before fixing):

1. Ordinary dev curls would now false-block (curl https://raw.githubusercontent.com/...) — added a DEV_INFRA_HOSTS allowlist (GitHub/PyPI/npm/Go-proxy/Debian-Ubuntu mirrors), same pattern as the existing SAFE_TEST_HOSTS exemption.
2. The most common curl shapes would false-block on their own arguments — curl -o results.json https://target.com/... was extracting results.json as if it were a second hostname (the existing hostname regex can't distinguish a domain from a filename by pattern alone). Fixed with real URL parsing (urlsplit) instead of blanket regex, plus a small file-extension denylist for the bare-hostname fallback path. Also added evil.com/attacker.com/malicious.com to the safe-host list, since a CORS PoC's -H "Origin: https://evil.com" names the attacker's own probe origin, not a live target.

One deliberate remaining tradeoff, documented in code comments: the fallback bare-hostname scan (for non-URL args like subfinder -d target.com) is still a blanket regex over the whole command line, not argument-aware. Distinguishing "the real target" from "a quoted header value" by stripping quoted substrings was considered and rejected — it risks also stripping a legitimately-quoted target URL, which fails OPEN instead of just over-blocking. A false-positive block is the safe failure mode here; a false-negative allow is not.

Test plan

• 8 new regression tests: curl/wget now caught, dev-infra exemption, URL-path-not-a-second-host, output-filename-not-a-host (both -o file and -d @file shapes), attacker-origin-placeholder exemption, plus end-to-end main()-level block/allow for a raw curl
• All 19 pre-existing scope_gate_hook tests still pass unchanged
• Full 213-test suite passes
• Manually reproduced every case (bypass, false-positives, fixes) with actual function calls before and after, not just reasoning about it
• ARCHITECTURE.md's scope-enforcement row updated to describe the current binary list and the correction, matching this repo's existing "Correction" documentation convention