bmottin/claude_mac
1
0
Fork 0
forked from bchanot/claude
Code Pull Requests Activity

fix(seo,geo): dogfood on zenquality.fr — two process anomalies

Browse Source 
Surfaced by pointing /harden at zenquality.fr from the claude-config CWD.

A1 — no CWD/target coherence guard (systemic: /seo, /geo, /harden all
lack it; grep confirms). A URL is supplied, the agent greps whatever CWD
it landed in, nobody checks they are the same site. Demonstrated live:
from claude-config, /harden would curl zenquality.fr while grepping
claude-config, then score "Config hardening" on a codebase that is not the
site. The live half looks right, the code half is fiction, and the report
reads as authoritative.
Fixed in both agents' STEP 2 rather than the 3 dispatchers: the agent does
the grepping, so the guard binds whoever calls — same principle as I3.
/harden inherits it free.

A2 — seo-analyzer had zero origin-vs-edge awareness while geo-analyzer
has the full CDN/WAF-override check (geo-analyzer.md:246-261). seo-analyzer
does the infra detection AND is reused by /harden for its whole
config-hardening axis (20/100). On zenquality — Apache origin behind a
Scaleway nginx front — repo .htaccess + `server: nginx` invites the wrong
call "nginx serves this, .htaccess is dead". I made that exact inference
myself before reading the file. Rule added at STEP 2 infra detection:
`server:` names the edge, not the origin; live-but-not-in-repo = "set
upstream", never "missing".

Verified: live probe of zenquality.fr (read-only, nothing written to the
client repo); make test 35 GREEN / 0 RED.
This commit is contained in:
Bastien Chanot
2026-07-16 16:25:16 +02:00
parent 57c67f2f75
commit 9cd7b51bb8
2 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agents/geo-analyzer.md
+10
View File
@@ -141,6 +141,16 @@ If called standalone via `/geo`, gather:
## STEP 2 — DETECT CONTEXT `[both]`
**FIRST — the CWD must BE the audited site.** You grep the current working
directory; no dispatcher checks that it matches the target domain. If a URL
was supplied and the CWD shows no web project at all (no `package.json` /
`composer.json` / `index.html` / `*.astro` / `*.php` / `.htaccess`), or its
signals contradict the domain, STOP and report:
`CWD/TARGET MISMATCH — <cwd> is not <domain>'s repo. Re-run from it, or
confirm live-only audit (LOCAL findings will be N/A).`
Never grep one codebase while curling another: the live half looks right,
the code half is fiction, and the report reads as authoritative.
```bash
# Framework (reuse detection from seo-analyzer if available)
ls package.json composer.json Gemfile Cargo.toml go.mod 2>/dev/null