soia-env-network-diagnose

First use low-risk, reproducible probes to divide "there is a network problem" into specific categories, then decide whether to hand it off to the installation skill. By default, do not modify proxy, DNS, certificates, firewall, or hosts.

Customer-readable description

What this skill can do

What the customer wants	What the skill will do	What the customer can see
Installation download failed	Probe official HTTPS, DNS, certificates, and latency	Reachable/unreachable, error category, and next steps
npm/pip timeout	Distinguish network, proxy, package source, and command parameters	Diagnostic summary that does not leak tokens
Do not know whether there is internet access	Perform minimal read-only checks	Number of sources checked and conclusion

How the customer uses it

Describe the failed tool, error message, and system type in natural language; running commands first is not required.
The Agent first checks the current network and official sources, and does not read browser cookies or private proxy passwords.
After diagnosis is complete, adjust proxy, DNS, or certificates only with the customer's explicit authorization; prioritize providing the official graphical interface path.
After repair, re-probe the same sources; "the browser can open a certain website" cannot replace package manager source verification.

Dependencies and installation

No required external dependencies. The script uses the Python standard library and can perform a single probe in the following way:

python3 scripts/probe_endpoints.py --url https://nodejs.org/en --url https://www.python.org/downloads/ --json

Do not pass URLs containing usernames, passwords, or tokens to the prober. See the official site list at providers.md。

Read-only diagnostic process

Record OS, architecture, time, network type, and the original error; do not save the full command environment.
Probe by comparing three groups in the order "baseline group → target group → mirror group": first probe domestic baseline sources to determine whether the local network is normal, then probe the target official entry point, and finally probe domestic mirror sources; see the source list at providers.md。
Classify layer by layer:dns_failed、tls_failed、timeout、http_error、proxy_required or reachable。
The baseline group includes at least 2 independent sources; if any one is reachable, the baseline passes; do not assert that "the network is completely unavailable" because of a single probe failure.
Compare the three groups of results against providers.md to reach a conclusion and next steps using the decision matrix.
Deliver a structured summary for consumption by environment orchestration skills or installation skills.

Customer status list (mandatory)

Skill	Current status	Current version	Latest version	Running status	Update time	Handling result
Network diagnosis	<checked/blocked>	Not applicable	Not applicable	<normal/degraded/abnormal>		<can continue installation/needs handling: error category>

Network diagnosis has no software version; the two version columns are always written as "Not applicable".
更新时间 Record the time when the last probe was completed and a conclusion was formed.
When the user only asks about the network problem of a certain tool,处理结果 Whether the target can continue installation is written here, without adding status lines for other tools.
After the table, only the necessary error categories, affected official sources, and next steps are retained; agent credentials or full probe logs are not output.

What it is not responsible for

Does not modify proxy, DNS, certificate, hosts, or package manager source configurations—the source-switching commands given in the decision matrix are only suggestions, and execution and recovery are left to the user.
Does not diagnose the runtime reachability of AI model services—API connectivity for DeepSeek, Zhipu, etc. belongs to another scenario and is outside the boundary of "network issues during tool installation".
Does not replace the installation action itself—the diagnostic conclusion is "whether installation can continue", and the installation action is left to the corresponding installation skill.
Does not use "the browser can open a certain website" as a substitute for package manager source verification—the main text already requires reusing the same source probe; this is restated here as a boundary.

Security boundaries

Do not execute curl | bash, unknown scripts, temporarily disable TLS verification, or bypass system security policies.
Do not write proxy URLs, Authorization headers, cookies, or package manager credentials into logs.
Do not automatically replace npm/pip sources; if the user explicitly requests it, first show the current value, target value, and recovery command.
Network probe scripts return only status codes, error categories, and elapsed time, and do not save response bodies.

Private information and intermediate data

This skill is read-only and does not persist to disk by default; probe results are output directly, and a redacted report is saved only when requested by the client.
Proxy credentials, Authorization, cookies, and certificate private keys remain only in the provider/system credential store and are not written to SOIA configuration, logs, or receipts.
Short-term probe files can only enter a system temporary directory independent for each run and must be cleaned up promptly; only reconstructable probe metadata may enter the cache.
Do not save response bodies, complete proxy URLs, account identifiers, or client-private absolute paths.

Logs and completion receipts

| 技能 | 当前状态 | 当前版本 | 最新版本 | 运行状态 | 更新时间 | 处理结果 |
|---|---|---|---|---|---|---|
| 网络诊断 | <状态> | 不适用 | 不适用 | <运行状态> | <RFC3339-with-timezone> | <处理结果> |

Output example

The following is an example (values are taken from one real probe: all 4 domestic sources in the baseline group were reachable, and the official entry in the target group and all 4 mirrors in the mirror group were reachable):

Skill	Current status	Current version	Latest version	Running status	Update time	Processing result
Network diagnosis	Checked	Not applicable	Not applicable	Normal	2026-08-06T11:37:42+08:00	Can continue installation: the network is normal, and the problem is not the network

Decision explanation: the baseline group was all reachable, the target group's official entry was reachable except that the Codex help page returned 403 to HEAD probes (method-level rejection, not a link failure), and the mirror group was all reachable. According to the decision matrix, this is judged as "network normal"; the next step should be to check command parameters, disk, and permissions rather than continue troubleshooting the network.

Forward testing

scripts/probe_endpoints.py Local fixtures must be used to cover success, HTTP errors, timeouts, and invalid schemes; at real runtime, only official sources are used as input and the terminal status is verified.

Install the entire domain (Claude Code and Codex share the same domain plugin):

claude plugin marketplace add soia-team/soia-open-skills
claude plugin install soia-env@soia

Install only this one skill:

npx skills add soia-team/soia-open-env-skills -g -a '*' -s soia-env-network-diagnose -y

WorkBuddy The loading unit for is role-based experts rather than plugins,npx skills add -a '*' cannot cover it, and it needs to be installed separately; see docs/install/workbuddy.md。