xping v1.4.5

[1.4.5] - 2026-09-26

Added

• xping doctor [host] — answers "why is my internet not working?".
  It checks, in order: network interface (and DHCP), default gateway,
  internet by IP (no DNS), DNS (your resolvers vs. a public one),
  connection quality, captive portal, HTTPS (interception and system
  clock), IPv6 and, optionally, a host (--port, default 443). It ends
  with one plain-language diagnosis and what to do. Exit code 1 when a
  step fails; --json, --csv (one row per step) and --markdown
  work as usual.

• xping http: per-phase timing waterfall and security headers.

  • The TLS handshake is now timed separately from the TCP connect. The
    time to download the body and the time spent following redirects
    are timed too.
  • The phases are drawn as a waterfall, like a browser's network tab.
  • The TLS version and cipher are shown.
  • A security-header audit covers HTTPS / http→https upgrade, HSTS
    (max-age ≥ 180 days), CSP, X-Content-Type-Options,
    X-Frame-Options (or CSP frame-ancestors), Referrer-Policy,
    Permissions-Policy, and version-revealing Server /
    X-Powered-By headers. It is informational only.
  • New JSON fields: tls_ms, transfer_ms, redirect_ms,
    tls_version, tls_cipher, security, security_missing. CSV /
    Markdown gain a "Security headers" table.

• xping trace --tcp / --port N — traceroute with TCP SYN probes
  to a real service port (443 by default; --port implies --tcp).
  It gets through firewalls that drop ICMP, where a normal traceroute
  ends in * * *. No root needed: Linux reads the router from the TCP
  socket's error queue (IP_RECVERR), macOS from an unprivileged ICMP
  socket. IPv4 and IPv6; not available on Windows.

• Alerts in watch mode: --notify and --webhook URL on
  ping --watch and on --watch / --until-up for tcp, http and
  health.

  • An event fires on every DOWN / UP change, and the UP message includes
    how long the outage lasted.
  • --notify uses Notification Center (macOS) or notify-send (Linux),
    and the terminal bell elsewhere.
  • --webhook POSTs a JSON event with text / content fields that
    Slack, Discord, Mattermost and Google Chat display directly. It is
    sent in the background, and a failure is reported only once.
  • ping --watch treats three consecutive lost pings as an outage.

Changed

• xping http: tcp_ms is now the TCP connect time alone. It used to
  include the TLS handshake, which is now reported as tls_ms.

Fixed

• The progress spinner (used by doctor, http, trace, net, …)
  printed its message on one line per animation frame when the message
  was wider than the terminal. It is now cut to fit, with "…".
• Misaligned columns in http (timing, connection, security and
  response headers), trace (host column after the RTT) and all
  (summary). Padding counted the invisible colour codes, so columns
  drifted, especially with colour off (NO_COLOR, piped output).
  Coloured text is now padded by its visible width.
• Summary tables (trace, ping, watch, speedtest, …) had a misaligned
  value column and uneven borders whenever a cell was coloured; the
  table renderer measured cells including their colour codes.
• xping trace: the rule under the hop list was shorter than the rules
  around the column header; all rules now have the same width.
• xping trace printed the separator line twice before its summary.
• xping http: the last line of the redirect chain always showed
  status 200, even when the final response was an error.
• Project links pointed to github.com/mehdiaskari/xping, which does not
  exist. The correct repository, github.com/mehaskari/xping, is now used
  in the PyPI metadata (pyproject.toml, setup.cfg), xping about, the
  man page, the snap and Debian metadata, README and CONTRIBUTING.
• The WHOIS/RDAP bootstrap download (data.iana.org) now uses the same
  TLS context as every other HTTPS request (certifi, TLS 1.2+), so it
  also works on Python builds without a usable system CA store.

Docs

• New user guide, docs/guide.md. It covers every
  command with all options and defaults, what the output means, and how
  scores are computed (health, dnscheck, speedtest, osdetect).
  It also has the check-file reference, recipes, files/privacy, platform
  notes and a FAQ. It is linked from the README and the PyPI project
  links. A test fails if a command or long option is missing from it.
• Man page: --proto udp in the listen description rendered as
  --protoudp.
• README: current install options (PPA for Ubuntu 24.04 and derivatives,
  Snap with stable/edge channels, PyPI with the completion step). The
  non-existent AUR package is removed. New sections for listening
  ports, OS fingerprint and "Files & privacy" (what is stored, which
  commands contact third parties), plus completion environment
  variables.
• CONTRIBUTING: PR workflow with branch protection, an up-to-date
  "add a new command" checklist (verdicts, CSV tables; completion is
  automatic), and notes on the real-shell completion tests.
• RELEASE: the PR-based release flow, macOS-compatible sed, the
  current CI matrix, snap edge → stable promotion, and a correct
  rollback (PyPI yanking happens on the website; twine yank does not
  exist).
• SECURITY: 1.4.x supported; the design section describes unprivileged
  ICMP, strict TLS, which files are written, third-party contacts, and
  shell-free subprocesses. The obsolete --output mention is removed.
• PACKAGING: completion packaging, snap channels, six-file version
  checklist, and the corrected PPA series (noble).
• Man page: PRIVACY section, accurate DEPENDENCIES, completions in FILES.
• Debian: a real README.Debian instead of the template placeholder,
  and the unused xping-docs.docs is dropped. The bug report template
  asks for the install method and shell.

---