Crawl CLI leaves the seed domain by default despite same-domain library default

[tg12]

Severity: Medium-High

Evidence:

• scripts/crawl.py:49-67 defines crawl(..., stay_on_domain: bool = True) and documents same-host crawling as the default.
• scripts/opentor.py:486 reads args.stay_on_domain from argparse.
• scripts/opentor.py:610 defines --stay as action="store_true", which means the CLI default is False.
• scripts/crawl.py:138-150 follows every discovered .onion link when stay_on_domain is false.
• scripts/opentor.py:608-609 defaults to depth 3 and 100 pages.

Deterministic reproduction:

python3 - <<'PY'
import sys
sys.path.insert(0, 'scripts')
import opentor
parser = opentor._build_parser()
args = parser.parse_args(['crawl', 'http://seed.onion'])
print({'stay_on_domain': args.stay_on_domain, 'depth': args.depth, 'max_pages': args.max_pages})
PY

Actual output:

{'stay_on_domain': False, 'depth': 3, 'max_pages': 100}

Impact:
A normal opentor.py crawl URL can leave the intended target and crawl unrelated onion services up to the default 100-page cap. That is surprising relative to the function contract and risky for legal/safety scope control.

Smallest credible fix:

• Make same-domain crawling the CLI default.
• Replace --stay with an explicit opt-out such as --allow-external-onion or --no-stay.
• Consider requiring confirmation or a warning before cross-domain crawling.
• Add an argparse-level test that default crawl URL keeps stay_on_domain=True.