Add Claude Code network diagnostics

.editorconfig

@@ -0,0 +1,14 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{sh,yml,yaml,json}]
+indent_style = space
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false

.gitattributes

@@ -0,0 +1,3 @@
+* text=auto eol=lf
+bin/ipcheck text eol=lf
+*.sh text eol=lf

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,66 @@
+name: Bug report
+description: Report incorrect detection, output, or client behavior.
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not include API keys, tokens, proxy passwords, cookies, or private hostnames.
+  - type: input
+    id: version
+    attributes:
+      label: ipcheck version
+      placeholder: ipcheck 0.3.0
+    validations:
+      required: true
+  - type: dropdown
+    id: client
+    attributes:
+      label: Client
+      options:
+        - Codex
+        - Claude Code
+        - Custom endpoint
+        - Multiple clients
+    validations:
+      required: true
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform
+      options:
+        - macOS
+        - Linux
+        - WSL
+        - Git Bash
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: Include expected and actual behavior.
+    validations:
+      required: true
+  - type: textarea
+    id: report
+    attributes:
+      label: Redacted quick report
+      description: Paste `ipcheck --quick --markdown` after removing private hostnames.
+      render: markdown
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction steps
+    validations:
+      required: true
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Safety check
+      options:
+        - label: I removed credentials and private data from this report.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Private security report
+    url: https://github.com/jacklv-coder/ipcheck/security/advisories/new
+    about: Report credential exposure or other vulnerabilities privately.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,29 @@
+name: Feature request
+description: Suggest a client, gateway, metric, or workflow improvement.
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What diagnostic problem cannot be solved today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+    validations:
+      required: true
+  - type: input
+    id: documentation
+    attributes:
+      label: Official client or API documentation
+      description: Link to the documented endpoint, proxy, or configuration behavior.
+  - type: textarea
+    id: privacy
+    attributes:
+      label: Privacy and billing considerations
+      description: Explain how the probe can avoid credentials and billable inference.

.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies

.github/pull_request_template.md

@@ -0,0 +1,15 @@
+## Summary
+
+<!-- What changed and which client/network behavior does it match? -->
+
+## Verification
+
+- [ ] `bash -n bin/ipcheck`
+- [ ] `bash test/smoke.sh`
+- [ ] `shellcheck bin/ipcheck test/smoke.sh`
+- [ ] User-facing changes are documented in English and Chinese
+- [ ] No API key, token, cookie, or proxy credential is extracted or forwarded
+
+## Evidence
+
+<!-- Link official behavior documentation and include redacted output if useful. -->

.github/workflows/release.yml

@@ -0,0 +1,36 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  github-release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - name: Verify version and tests
+        run: |
+          test "v$(bin/ipcheck --version | awk '{print $2}')" = "$GITHUB_REF_NAME"
+          bash test/smoke.sh
+      - name: Build source archive
+        run: |
+          git archive --format=tar.gz --prefix="ipcheck-${GITHUB_REF_NAME#v}/" \
+            --output="ipcheck-${GITHUB_REF_NAME#v}.tar.gz" "$GITHUB_REF_NAME"
+          sha256sum "ipcheck-${GITHUB_REF_NAME#v}.tar.gz" > "ipcheck-${GITHUB_REF_NAME#v}.tar.gz.sha256"
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" \
+            "ipcheck-${GITHUB_REF_NAME#v}.tar.gz" \
+            "ipcheck-${GITHUB_REF_NAME#v}.tar.gz.sha256" \
+            --generate-notes \
+            --title "ipcheck $GITHUB_REF_NAME"

.github/workflows/test.yml

@@ -4,28 +4,30 @@ on:
   push:
   pull_request:
 
+concurrency:
+  group: test-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Lint shell scripts
+        run: shellcheck bin/ipcheck test/smoke.sh
+
   smoke:
     strategy:
+      fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Run smoke tests
         run: bash test/smoke.sh
-
-  npm-package:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-      - name: Validate npm package
-        run: |
-          npm test
-          npm pack --dry-run

CHANGELOG.md

@@ -0,0 +1,41 @@
+# Changelog
+
+All notable changes to ipcheck are documented here. The project follows
+[Semantic Versioning](https://semver.org/).
+
+## [0.3.0] - 2026-07-22
+
+### Added
+
+- Claude Code auto-detection through `ANTHROPIC_BASE_URL`, `ANTHROPIC_MODEL`,
+  `CLAUDE_CONFIG_DIR`, and `~/.claude/settings.json`.
+- Safe Anthropic-compatible `/v1/messages` protocol probes with no credentials,
+  prompt, or billable inference request.
+- Codex custom-provider and `openai_base_url` route detection.
+- Per-client results, route validation, privacy metadata, warnings, and a
+  versioned JSON schema.
+- `codex`, `claude`, and `all` selectors plus `--service`, `--quick`, and
+  `--version`.
+- Warnings for Claude Code SOCKS and macOS system-proxy differences.
+- Release automation, ShellCheck, pinned GitHub Actions, Dependabot, and project
+  community files.
+
+### Changed
+
+- Generalized the report from Codex-only diagnostics to AI coding CLI
+  diagnostics.
+- HTTP 404 on a configured protocol route is now reported as `POOR`; HTTP 429
+  and 5xx responses are reported as `FAIR` service conditions.
+- Expanded privacy and configuration-redaction tests.
+
+## [0.2.0] - 2026-07-22
+
+### Added
+
+- Initial Codex/OpenAI path diagnostics.
+- Human, Markdown, and JSON reports.
+- Homebrew and direct-download packaging.
+- Median/P95 TTFB, jitter, reference bandwidth, and macOS `networkQuality`.
+
+[0.3.0]: https://github.com/jacklv-coder/ipcheck/compare/v0.2.0...v0.3.0
+[0.2.0]: https://github.com/jacklv-coder/ipcheck/releases/tag/v0.2.0

CODE_OF_CONDUCT.md

@@ -0,0 +1,30 @@
+# Code of Conduct
+
+## Our pledge
+
+We pledge to make participation in this project a harassment-free experience
+for everyone, regardless of age, body size, disability, ethnicity, sex
+characteristics, gender identity and expression, level of experience,
+education, socio-economic status, nationality, personal appearance, race,
+religion, or sexual identity and orientation.
+
+## Expected behavior
+
+- Be respectful, constructive, and empathetic.
+- Focus criticism on ideas and code, not people.
+- Respect privacy, especially when reports involve credentials or company
+  network configuration.
+- Accept responsibility, apologize, and learn from mistakes.
+
+Harassment, discriminatory language, threats, doxxing, sexualized conduct, and
+deliberate disclosure of private information are not acceptable.
+
+## Enforcement
+
+Report unacceptable behavior privately through the repository owner's GitHub
+profile. Maintainers may edit, remove, or reject comments, commits, issues, and
+other contributions that violate this policy, and may temporarily or
+permanently ban contributors for repeated or severe violations.
+
+This policy is adapted from the
+[Contributor Covenant 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct.html).

CONTRIBUTING.md

@@ -0,0 +1,56 @@
+# Contributing to ipcheck
+
+Thanks for helping make AI coding network diagnostics more reliable.
+
+## Before opening an issue
+
+1. Run `ipcheck --version` and include the version.
+2. Run `ipcheck --quick --markdown` and attach the redacted report.
+3. Remove any organization-private hostnames you do not want to disclose.
+4. Search existing issues for the same client, gateway, or proxy behavior.
+
+Do not post API keys, auth tokens, proxy passwords, cookies, or unredacted
+credential files. Use GitHub's private vulnerability reporting for security
+issues.
+
+## Development
+
+ipcheck supports Bash 3.2, including the Bash version bundled with older macOS
+releases. Avoid associative arrays and newer Bash-only syntax.
+
+Run the local checks:
+
+```bash
+bash -n bin/ipcheck
+bash test/smoke.sh
+shellcheck bin/ipcheck test/smoke.sh
+```
+
+The smoke suite uses stubbed network commands and must not require internet
+access or real credentials.
+
+## Pull requests
+
+- Keep each pull request focused.
+- Add tests for behavior changes and failure modes.
+- Update both English and Chinese documentation for user-facing changes.
+- Preserve backward-compatible flags and JSON fields when practical.
+- Never add code that extracts, stores, prints, or forwards client
+  authentication credentials.
+- Explain which real client behavior or official documentation the change
+  matches.
+
+All CI jobs must pass before merge. Maintainers may request a real, redacted
+report for a new provider or gateway.
+
+## Adding a client or gateway
+
+A new built-in probe should:
+
+1. Derive its route only from documented, non-secret configuration.
+2. Avoid credentials, query parameters, redirects, and billable inference.
+3. Use the same proxy behavior as the client as closely as possible.
+4. Distinguish network reachability from an invalid protocol route.
+5. Add stub tests for success, timeout, proxy authentication, and redaction.
+
+By contributing, you agree that your contribution is licensed under Apache-2.0.