forked from bchanot/claude
Bastien Chanot
9cd7b51bb8
Surfaced by pointing /harden at zenquality.fr from the claude-config CWD. A1 — no CWD/target coherence guard (systemic: /seo, /geo, /harden all lack it; grep confirms). A URL is supplied, the agent greps whatever CWD it landed in, nobody checks they are the same site. Demonstrated live: from claude-config, /harden would curl zenquality.fr while grepping claude-config, then score "Config hardening" on a codebase that is not the site. The live half looks right, the code half is fiction, and the report reads as authoritative. Fixed in both agents' STEP 2 rather than the 3 dispatchers: the agent does the grepping, so the guard binds whoever calls — same principle as I3. /harden inherits it free. A2 — seo-analyzer had zero origin-vs-edge awareness while geo-analyzer has the full CDN/WAF-override check (geo-analyzer.md:246-261). seo-analyzer does the infra detection AND is reused by /harden for its whole config-hardening axis (20/100). On zenquality — Apache origin behind a Scaleway nginx front — repo .htaccess + `server: nginx` invites the wrong call "nginx serves this, .htaccess is dead". I made that exact inference myself before reading the file. Rule added at STEP 2 infra detection: `server:` names the edge, not the origin; live-but-not-in-repo = "set upstream", never "missing". Verified: live probe of zenquality.fr (read-only, nothing written to the client repo); make test 35 GREEN / 0 RED.