cnb: troubleshooting doc for c-n-b.space fetch interception (#214)

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.5.96-dev (unreleased)
+
+### Documentation
+
+- **c-n-b.space fetch troubleshooting (#214)** — Added `docs/dev/troubleshooting-fetch.md` documenting the local-proxy + Aliyun ICP interception that prevents `curl` / `requests` from reaching the public sites, the `bin/fetch-site` workaround, and the two blockers (apex 80→443 redirect missing; multi-SAN cert needed) that currently prevent submitting the apex to the Chromium HSTS preload list. Linked from CLAUDE.md so tongxue see it before they reach for `curl`.
+
 ## 0.5.78-dev (unreleased)
 
 ### Features

CLAUDE.md

@@ -165,6 +165,7 @@ cnb board --as <name> scan                 # scan issues/CI, route to owners
 - **Daily report**: before clocking off, run `board --as <your-name> daily`. Never hand-write timestamps — the command generates them from system time. If you need to add context, pass it as an argument: `board --as <name> daily "补充说明"`.
 - **近期不要用 `/ultraplan`。** 一次消耗 ~33% Pro 日配额（5 小时上限），性价比极低。复杂规划用本地 `/plan` + issue 讨论。以后 Anthropic 调整定价再重新评估。
 - **Shared rules go in CLAUDE.md, not memory.** If a rule applies to all tongxue, it must be written here. Personal memory is per-session — other tongxue cannot see it.
+- **Fetching c-n-b.space sites:** `curl` / `requests` get blocked by local proxies and the Aliyun "Beaver" ICP filter (#214). Use `bin/fetch-site <url>` for `platform.c-n-b.space`, `blog.c-n-b.space`, `docs.c-n-b.space`, `c-n-b.space`. It goes straight to the origin IP via `openssl s_client`. See `docs/dev/troubleshooting-fetch.md` for the full story.
 
 ### Sessions
 

VERSION

@@ -1 +1 @@
-0.5.81-dev
+0.5.96-dev

docs/dev/troubleshooting-fetch.md

@@ -0,0 +1,55 @@
+# Troubleshooting: fetching c-n-b.space
+
+## Symptom
+
+`curl https://platform.c-n-b.space/...` or `python -m urllib3 ...` hangs, times out, or returns an Aliyun "Beaver" 403 ICP page. Same for `blog.c-n-b.space`, `docs.c-n-b.space`, and the apex `c-n-b.space`.
+
+## Cause
+
+The server side is healthy — HSTS is on (`Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`) and HTTPS responds 200/302 normally.
+
+What goes wrong is the local network path:
+
+1. The user's HTTP client picks up a system / corp / school proxy (MacPacket on `127.0.0.1:1082`, Aliyun, etc.).
+2. That proxy intercepts the request. For HTTPS it usually either fails the TLS handshake (no MITM cert installed) or rewrites DNS to a sinkhole (`198.18.x.x`).
+3. For plain HTTP, an upstream ICP scanner returns a fixed 403 ("Beaver") because `c-n-b.space` is hosted in mainland China.
+
+## Workaround for tongxue: `bin/fetch-site`
+
+The repo ships a small script that bypasses every locally-installed proxy by going straight to the origin IP over a raw TLS socket via `openssl s_client`.
+
+```bash
+bin/fetch-site https://platform.c-n-b.space/docs/zh
+bin/fetch-site https://blog.c-n-b.space/posts/123
+bin/fetch-site --head https://c-n-b.space/
+```
+
+Allowed hosts are pinned (`platform.c-n-b.space`, `blog.c-n-b.space`, `docs.c-n-b.space`, `c-n-b.space`). Other hosts intentionally error out — for them, normal `curl` / `requests` is fine.
+
+## Workaround by hand
+
+If you can't run `bin/fetch-site`:
+
+```bash
+# HEAD
+printf 'HEAD / HTTP/1.1\r\nHost: platform.c-n-b.space\r\nConnection: close\r\n\r\n' \
+  | openssl s_client -connect platform.c-n-b.space:443 \
+      -servername platform.c-n-b.space -quiet 2>/dev/null
+```
+
+Replace path and `Host:` to fetch a body. `-quiet` suppresses the certificate dump so the response starts with `HTTP/1.1`.
+
+## What does **not** work
+
+- `curl --noproxy '*'` — only bypasses `$http_proxy`/`$https_proxy`; system-wide pf / PAC redirects still hijack the connection.
+- Switching to `requests` / `urllib3` / `httpx` — they all honour the same OS proxy settings.
+- `curl --insecure` — doesn't help; the issue is interception, not certificate validation.
+
+## Long-term fix
+
+`Strict-Transport-Security: max-age=...; preload` is already served. We can't submit `c-n-b.space` to the Chromium HSTS preload list yet because:
+
+- `http://c-n-b.space` returns a 403 from the upstream Beaver instead of a 301/302 to `https://`. Preload requires an HTTP → HTTPS redirect at the apex.
+- `platform.c-n-b.space` currently serves a certificate whose CN is `docs.c-n-b.space`, so [hstspreload.org](https://hstspreload.org/?domain=c-n-b.space) rejects the chain as invalid.
+
+Fix both (apex 80→443 redirect, multi-SAN cert), then submit. Until then, use `bin/fetch-site`.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-nb",
-  "version": "0.5.78-dev",
+  "version": "0.5.96-dev",
   "description": "Multi-agent coordination framework for Claude Code sessions",
   "engines": {
     "node": ">=18"

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "claude-nb"
-version = "0.5.78.dev0"
+version = "0.5.96.dev0"
 description = "Multi-agent coordination framework for Claude Code sessions"
 requires-python = ">=3.11"
 license = "MIT"