[tsoposki]

Add a standalone runner for HTTP Toolkit rule exports and an optional Windows app that routes MetaTrader 5 TCP traffic on ports 80/443 through it. Both tools live under minimal-mock-proxy/, with their own dependencies, tests, and build instructions.

The proxy validates supported matchers, actions, priorities, and completion rules; preserves scoped passthrough behavior; and adds an unmatched HTTP fallback only when requested and absent. It also supports WebSockets, reusable local CA certificates, bounded body handling, redacted logging, and a standalone Node.js bundle. The included rules use portable example endpoints.

The MT5 Router uses an exact executable/PID policy and a restricted native WinDivert redirector. It tunnels HTTP and HTTPS bytes through CONNECT, preserves TLS/SNI and half-close behavior, and leaves other ports and UDP outside capture. The portable distribution includes the native helper, driver dependencies, notices, and source archives.

Login startup uses the current Windows account, keeps the elevated router window visible, and runs the proxy in the background. CONNECT readiness waits through proxy retries until ready or Stop. A Windows Job Object prevents orphaned Node processes after launcher termination, log output drains in bounded batches, and installation rollback continues after cleanup failures while preserving the original error. Config replacement also handles Windows PowerShell 5's null-string conversion correctly.

Validation:

• Fresh checkout: npm ci, npm test (89 checks), and npm run test:bundle (1 check), including the portable example rules and an explicit @types/env-paths dependency required for independent builds.
• powershell.exe -NoProfile -File mt5-router/build.ps1: 39 Python tests, 13 Rust tests, and 10 relay/startup/portable-package checks; rebuilt the Windows x64 ZIP.
• Regression checks cover forced launcher termination with a running owned Node process, stdout/stderr bursts, injected rollback failures, invalid proxy listeners, late readiness, cancellation, HTTP/HTTPS forwarding, and packaged UI construction without starting capture.
• git diff --cached --check passed before committing.

Live WinDivert capture and actual scheduled-login execution were not exercised on this ARM64 development host. Those checks require an Intel/AMD x64 Windows machine; the application rejects unsupported native architectures before loading the driver. Generated binaries and machine-specific rules/certificates are not included in the commit.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​env-paths@​1.0.0
	pypi/​pyinstaller@​6.22.3
	pypi/​pyinstaller-hooks-contrib@​2026.9
	pypi/​setuptools@​84.2.1
	pypi/​mitmproxy-windows@​0.12.11
	npm/​esbuild@​0.28.2
	npm/​@​types/​node@​20.19.43
	npm/​tsx@​4.23.15
	npm/​mockttp@​4.6.4
	npm/​typescript@​5.9.3
	pypi/​altgraph@​0.17.5
	pypi/​packaging@​26.3
	pypi/​pefile@​2024.8.26
	pypi/​pywin32-ctypes@​0.2.3
	pypi/​mitmproxy-rs@​0.12.11

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm typescript License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: minimal-mock-proxy/package-lock.json → npm/typescript@5.9.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@5.9.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report