[ding113]

Why

cchp v0.1.3 is built from the CCHP v1.0.12 control-plane spec. CCHP v1.0.13 is released; this PR syncs the spec to it. It also adds cchp docs, so agents can read and search the CCHP documentation at cch-plus.com through its llms.txt files and full-text search, answer users from it, and find how to configure something before running the matching command. Together they make cchp v0.2.0.

What changed

Spec sync to CCHP v1.0.13

• make sync-spec UPSTREAM=v1.0.13: spec/upstream/control-plane.yaml exported from CCHP v1.0.13 (00684cf0c0), spec/source.lock.json updated, catalog, schemas, engine spec and docs/coverage.md regenerated.
• Coverage: 702 operations, 587 available, 115 excluded with reasons, 0 unsupported (was 681 / 575 / 106 / 0).
• Added (25 operations): each has a group, command name, English summary, English help for its parameters and a policy entry.
  • Available (16): outbound network proxies for the platform (cchp admin network-proxy, set-network-proxy, test-network-proxy), a provider (cchp providers network-proxies, set-network-proxies, test-network-proxies) and a provider key (cchp keys network-proxies, set-network-proxies, test-network-proxies); cchp account bootstrap and sidebar; cchp usage batch; cchp models price-table-sync and price-table-sync-run; cchp org test-storage; cchp admin web-vitals.
  • Excluded with reasons (9): the sign-in handover between an organization's domains (beginSessionTransfer, inspectSessionTransfer, approveSessionTransfer, declineSessionTransfer, redeemSessionTransfer, listSessionTransferTargets, which need a signed-in browser session or the browser's pre-sign-in cookie, and listSessionTransferOrigins, which only the sign-in page uses); reportWebVitals, the browser's page performance beacon; getLLMKeyQuotaStatus, which answers only a read-only LLM token session (checked against v1.0.13: 403 10004 for an administrator management token; cchp billing quota-status --scope-type user_key reads the same figures).
• Removed (4): getMemberOverdraftLimit, updateMemberOverdraftLimit, getTeamOverdraftLimit, updateTeamOverdraftLimit with cchp billing member-overdraft-limit, set-member-overdraft-limit, team-overdraft-limit and set-team-overdraft-limit. CCHP v1.0.13 gives a postpaid organization one monthly credit limit (cap in the billing views), set with cchp admin set-org-billing.
• Changed: syncPricingCatalog now answers 202 with a background run (cchp models sync-price-table, then price-table-sync-run <runId>); getOrgBilling checks billing:read; --exclude-provider-key-ids on cchp requests list, export and filter-options, --provider-key-ids and --field provider_key on filter-options; the org, admin and member billing summaries describe the credit limit.
• Safety classes: replacing a proxy list (global, provider, key) is destructive because proxies left out are removed, with a note that a proxy sent without a password keeps its saved one; proxy tests are writes with the server's rate-limit note; the storage test is a write (it writes and deletes test objects); the bootstrap, sidebar, batch usage, sync runs and web vitals are retried reads. Permissions are taken from the v1.0.13 route registrations.
• Secrets: approveSessionTransfer returns a one-time code (secret_fields: [code], excluded anyway). Proxy passwords and S3 secret access keys only travel in request bodies; the redaction now masks them, and other request-body credentials it missed, in dry runs, traces and error bodies: s3_secret_access_key, secretAccessKey, secretKey, langfuseSecretKey, new_password, temporaryPassword, invitation_token, invitationToken, new_api_management_token, token.

cchp docs

Command	Reads	Gives
cchp docs index	/<lang>/llms.txt	pages by section: title, slug, URL, .md URL, description
cchp docs read <slug|url>	/<lang>/docs/<slug>.md	one page as Markdown; takes a slug, a docs URL or a .md URL
cchp docs search <words>	/api/docs/search	sections ranked by the site: title, section, slug, URL, snippet, score; --limit 1-50, --read-top N adds the Markdown of the N best pages
cchp docs full	/<lang>/llms-full.txt	every page of the language

• llms.txt: parsed with goldmark into the structure llmstxt.org defines: optional BOM, H1 title, blockquote summary, details, H2 sections of [title](url): notes links, the Optional section flagged; anything else is an invalid llms.txt failure that says where the file departs from the format.
• Languages: zh-CN, zh-TW, en, ja, ru, ko. --lang, then CCHP_DOCS_LANG, then the system locale (LC_ALL, LC_MESSAGES, LANG, matched with golang.org/x/text/language: zh_CN → zh-CN, zh_TW/zh_HK/zh_MO → zh-TW), then en. An unsupported --lang or CCHP_DOCS_LANG is a usage error that lists the six. A page missing in the chosen language fails with not_found and names the languages whose llms.txt lists it. Results report lang and lang_source.
• Site: https://cch-plus.com, or --docs-url / CCHP_DOCS_URL for previews (plain http only for this computer). Links on cch-plus.com are read from the site in use, so a preview's own llms.txt works.
• Output contract: one result object in agent mode; read and full print raw Markdown without --json (like skill show) and render it on a terminal; index and search print lists for people. HTTP errors, timeouts and invalid answers map to the contract's kinds and exit codes (not_found, validation, rate_limited, server_error, not_sent, unknown_outcome, usage). --dry-run prints the request and sends nothing.
• Safety: public reads only; no sign-in, never a token. Requests carry only Accept and User-Agent; the transport refuses Authorization, Cookie, Proxy-Authorization and URL users. Documented in the safety model.
• Retries and cache: reads are retried twice on network failures and 408/429/500/502/503/504 (go-retryablehttp), as Restish retries reads. Documents are kept in cchp's cache directory (sandrolain/httpcache over diskv, the cache library Restish embeds) for the site's lifetime and at most 5 minutes, then revalidated with ETag/Last-Modified (pquerna/cachecontrol reads the headers); stale copies are never served; search is not cached; --no-cache fetches again.
• Docs: docs/docs-commands.md for agents with Chinese and English examples (answering a question; finding how to configure network proxies or a spending limit, then running the matching command), a README section, the agent and human guides, cchp guide agents, the skill and its workflows, the AGENTS.md snippet, the safety model, output contract and architecture. CHANGELOG v0.2.0.

Tests

• make check-generated, go build ./..., go vet ./..., go vet -tags e2e ./..., go test -race ./..., make lint (golangci-lint v2.14.0, 0 issues), cross builds for windows/amd64, darwin/arm64 and linux/arm64: pass.
• make e2e against a local CCHP v1.0.13 built from the tag (fresh Postgres and Dragonfly on 10.213.113.0/24, ports 63130-63135, torn down afterwards): up, bootstrap and all 19 e2e tests pass.
  • The bootstrap sends billingMode and monthlyOverdraftLimitUnits, which v1.0.13's installation requires.
  • New TestNetworkProxiesReplaceTheListAndNeverShowPasswords: provider and key proxy lists, the --confirm gate, the password masked in a dry run and never echoed, an empty list following the provider again, the global proxy read.
  • New TestStorageTestDryRunMasksTheSecretKey and TestReadsAddedInV1013 (bootstrap, sidebar, usage batch, org billing cap, web vitals, price table sync run).
  • The discovery test checks the v1.0.13 tag.
• Smoke runs against the same server: cchp account bootstrap and sidebar, cchp usage batch, cchp admin network-proxy and web-vitals, cchp models price-table-sync, cchp billing org-billing and cchp admin org-billing (cap), provider and key proxy reads and replacements with the --allow-write and --confirm gates, and the key and global proxy tests, which reach the server's own validation (422 for a password without a user name). Direct requests with a management token to the excluded operations: 403 10004 for the LLM token quota status and the handover targets and inspect.
• Unit tests for cchp docs:
  • the llms.txt parser: the llmstxt.org FastHTML example (BOM, summary, details, sections, Optional), setext titles, relative links, multi-line notes, Markdown escapes, and every malformed shape;
  • language resolution (flag, CCHP_DOCS_LANG, LC_ALL > LC_MESSAGES > LANG, zh_HK/zh_MO/zh_SG, C, unsupported values), site URLs and page references;
  • the client against a local server serving answers recorded from U108's OpenNext preview (scripts/record-docs-fixtures.sh, gzipped in internal/sitedocs/testdata/site): all six llms.txt (46 pages each), pages, llms-full.txt, ranked searches with --read-top, a search with no results, the 400 for a long query, a missing page named in five other languages, links kept on the preview, no credentials on any request;
  • the cache (hit across processes, --no-cache, search never cached, max-age capped at 5 minutes, ETag revalidation with 304, no-store), retries (503, 429, 502 retried twice, 403 not retried), invalid answers, unreachable site and timeout;
  • CLI dry runs and usage errors.
• make e2e-docs (the built binary in every language: index, read of every listed page by slug, URL and .md URL, raw output, full, five searches per language with --read-top 1, language selection from the environment, missing pages, no credentials through a recording proxy, the cache) against U108's preview: pass.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-28T16:28:22.631760Z We couldn’t complete this review. Comment @codex review to try again.	3409a54	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.