T5DE's local proxy for IMVU Classic

The client sends it every HTTP request and its IMQ connection; it makes them with current TLS and
certificates, upgrades IMVU's plain-HTTP hosts to HTTPS, and refuses IMVU's reporting endpoints. CI
tests it and publishes t5de-proxy.exe as nightlies and tagged releases.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

README.md

@@ -0,0 +1,41 @@
+# t5de-proxy
+
+T5DE's local proxy for IMVU Classic. With T5DE's `t5de-proxy` patch, the client starts `t5de-proxy.exe` and
+connects to IMVU through it:
+
+- **Every HTTP request**, the embedded browser's included (IMVU's browser hands its requests to the client's
+  Python). The proxy makes them with current TLS and root certificates (the client has only IMVU's bundled
+  certificates and TLS 1.2), pooled connections and HTTP/2.
+- **HTTPS for IMVU hosts the client reaches over plain HTTP** (its XML-RPC API, images, CSS), so its account
+  headers don't cross the network in the clear ([docs/hosts.md](docs/hosts.md)).
+- **IMQ**, IMVU's chat and presence connection: the client speaks plaintext to the proxy, which connects to the
+  gateway over TLS.
+- **IMVU's reporting endpoints refused**, as T5DE's patches already do in the client.
+
+If the proxy isn't there or stops, the client connects directly, as before.
+
+Unofficial: not made by or affiliated with IMVU.
+
+## How it works
+
+The proxy listens on a free port of 127.0.0.1 and accepts only requests carrying the token it gave the client
+(`Proxy-Authorization: Basic t5de:<token>`), so other programs and web pages can't use it.
+
+- HTTP: requests in absolute form (`GET https://api.imvu.com/... HTTP/1.1`) over plain HTTP on loopback, for
+  http and https URLs alike. Responses come back as the server sent them: redirects aren't followed, bodies
+  aren't decompressed. When the proxy can't reach a server it answers 502 with `X-T5de-Proxy-Error`, which the
+  client raises as the network error it would have had connecting directly.
+- `CONNECT host:port`: the client then speaks plaintext and the proxy connects to `host:port` over TLS. The
+  proxy reads IMQ's framing (message type and size, not contents) to log it.
+
+The client starts it as `t5de-proxy -parent <pid> -ready <file> -log %TEMP%\t5de-proxy.log`; it writes its
+address and token to the ready file once listening, and exits with the client. Setting `T5DE_PROXY_TRACE=1`
+before starting the client adds full URLs (with queries) and every IMQ frame to the log.
+
+## Building
+
+    go test ./...
+    GOOS=windows GOARCH=amd64 go build -trimpath -ldflags "-H=windowsgui" -o dist/t5de-proxy.exe ./cmd/t5de-proxy
+
+CI publishes `t5de-proxy.exe`: pushes to main replace the `nightly` pre-release, `vX.Y.Z` tags make releases.
+To ship a release in T5DE, copy its url and sha256 into t5de's `t5de.toml` (`[[programs]]`, patch `t5de-proxy`).