repeater raw_send/send reject in-scope hosts as out of scope (wildcard include)

[Andrei-Dodu]

Summary

hugin_repeater (action=raw_send and action=send) rejects in-scope hosts as "Out of scope" when the target is covered by a wildcard include pattern in the active project's scope. hugin_vurl_http and hugin_scope action=effective resolve the same host as in-scope. The two scope evaluators disagree.

Environment

• Hugin 0.2.22, macOS aarch64
• Project with a wildcard include pattern (e.g. *.personio.com), active
• hugin_scope action=effective → login.personio.com is in_scope
• hugin_repeater action=raw_send target=https://login.personio.com (correct project_id) → Out of scope: host 'login.personio.com' is not in the project scope
• hugin_vurl_http against the same URL → succeeds (200/302)

Root cause

The repeater scope gate and the vurl/scope gate resolve the effective scope differently:

• hugin_repeater (hugin-mcp/src/tools/repeater.rs):
  • raw_send calls ensure_raw_target_in_scope(state.service.scope_snapshot, …) — the global live scope snapshot.
  • send → send_and_store_flow → execute_request → ensure_repeater_scope (hugin-service/src/repeater/mod.rs:1298) — also reads service.scope_snapshot (the global snapshot).
• hugin_vurl_http (hugin-mcp/src/tools/vurl/http.rs:37) and hugin_scope action=effective (hugin-mcp/src/tools/scope.rs:143) both use state.active_scope_config() — the session/project-aware resolver.

active_scope_config() (hugin-state/src/lib.rs:1264) resolves the calling peer's bound project scope when session isolation is on. When a project is activated with session_scoped (hugin-mcp/src/tools/project.rs:354-366), the peer is bound to the project without rewriting the global scope_config/scope_snapshot. So the wildcard include lives only in the bound project's scope, and the global snapshot (which repeater reads) still reflects the previous/global project — the wildcard is invisible to repeater.

Repro

1. Create a project with include pattern *.personio.com, activate it (session-scoped).
2. hugin_scope action=effective → login.personio.com is in_scope.
3. hugin_repeater action=raw_send target=https://login.personio.com with the correct project_id → Out of scope.
4. hugin_vurl_http same URL → works.

Expected fix

hugin_repeater raw_send/send should resolve the effective scope the same way vurl_http does — via state.active_scope_config() (project_id-aware, session-aware) — instead of the global service.scope_snapshot. This makes repeater's scope gate agree with hugin_scope action=effective and hugin_vurl_http.

Workaround

Use hugin_vurl_http for ad-hoc requests to wildcard-covered subdomains, or pass scope_override=true to repeater.