[BUG] Persistent ECONNRESET on macOS — works in curl, fails in CLI and VS Code extension; root cause appears to be ProtonVPN WireGuard system extension leaving 12 utun interfaces + conflicting IPv6 routes

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Code CLI consistently fails to connect to api.anthropic.com with ECONNRESET, despite the network being fully functional for other tools.

Key facts:

• curl -v https://api.anthropic.com succeeds reliably and returns HTTP 404 as expected (TLS handshake fine, connection clean)
• Claude Code CLI fails immediately on startup with "Failed to connect to api.anthropic.com: ECONNRESET"
• Claude Code VS Code extension also fails with the same connection error
• Error message includes the country-restriction note, but I am in the USA (a supported country)
• Disabling IPv6 on Wi-Fi (sudo networksetup -setv6off Wi-Fi) did NOT resolve the issue in my case, even after toggling WiFi off/on
• ANTHROPIC_LOG=debug claude 2> debug.log produces an empty log file, suggesting the connection is killed before any application-level logging occurs

Root cause appears to be related to ProtonVPN residue:

• ifconfig | grep -c "utun" reports 12 utun interfaces (normal is 2-3)
• netstat -rn | grep "default.*utun" shows 6 conflicting IPv6 default routes (utun0 through utun5)
• systemextensionsctl list shows ch.protonvpn.mac.WireGuard-Extension still active and enabled
• The ProtonVPN app has been removed; the network service has been removed via System Settings → Network; the system extension cannot be uninstalled because systemextensionsctl uninstall requires SIP to be disabled, and the current ProtonVPN app no longer ships an in-app uninstaller

This matches the pattern described by other users in related ECONNRESET reports where VPN-related utun residue causes mid-stream route changes that kill long-lived HTTPS connections, while short curl requests survive.

What Should Happen?

Claude Code should establish a stable connection to api.anthropic.com when the underlying network is reachable (as proven by curl). If it cannot, it should provide a more specific error than ECONNRESET — ideally detecting VPN residue or conflicting routes and suggesting remediation, since this is clearly a recurring class of issue on macOS.

Error Messages/Logs

Unable to connect to Anthropic services

Failed to connect to api.anthropic.com: ECONNRESET

Please check your internet connection and network settings.

Note: Claude Code might not be available in your country. Check supported
countries at https://anthropic.com/supported-countries

Steps to Reproduce

1. Have ProtonVPN installed at any point, then attempt to remove it without using the (now-missing) in-app uninstaller — leaving the WireGuard system extension active.
2. Verify residue with:

• ifconfig | grep -c "utun" → 12
• netstat -rn | grep "default.*utun" → 6 conflicting routes
• systemextensionsctl list → ProtonVPN WireGuard extension [activated enabled]

1. Verify network itself works: curl -v https://api.anthropic.com returns 404 (success).
2. Run claude → immediate ECONNRESET on first connection attempt.
3. Reinstalling Claude Code, switching Node versions (via nvm to Node 20), removing env vars, and using the VS Code extension all fail identically.

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Last Working Version

N/A

Claude Code Version

2.1.152

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Diagnostics performed:

• Reinstalled Claude Code on fresh Node 20 (via nvm) — same error
• Confirmed env vars empty: ANTHROPIC_API_KEY and ANTHROPIC_BASE_URL both unset
• /etc/hosts has no anthropic.com overrides
• curl works repeatedly from the same machine, same network
• Disabling IPv6 on Wi-Fi did not resolve in my case (this fix has worked for others with similar symptoms)
• VS Code extension fails with same connection error
• ANTHROPIC_LOG=debug produces empty log file
• ProtonVPN WireGuard system extension cannot be uninstalled without disabling SIP

Suggestion: Claude Code could detect this pattern (many utun interfaces, conflicting IPv6 default routes) and either warn the user or fall back to IPv4-only connections automatically.