v1.1.2-stable

v1.1.2-stable

First stable release, superseding the v1.1.0-alpha.1 pre-release.

Fixed

• windows-side test collection no longer aborts entirely when linux-side isn't on the import path. test_e2e_integration.py reached across to linux-side/mt5_client via a sibling-directory path that only resolves when both sides are checked out together under one repo root. In the deployment this project actually expects — MT5 on native Windows, mt5_client run from WSL/Linux, commonly on two separate machines with no shared filesystem path at all — that import raised ModuleNotFoundError at collection time, which aborted the entire pytest run on a fresh clone, not just that one file.
• pytest.importorskip() now turns the missing import into a clean, visible skip. The suite itself is unchanged and still runs — and still catches real client/server drift — whenever both sides are reachable (a combined checkout, CI, or pip install -e ../linux-side into the windows-side venv).

Test suite

• windows-side: 96 passed, 1 skipped (the e2e suite, skipped by design when linux-side isn't reachable — see above)
• linux-side: 24 passed
• 121 tests total across both sides

⚠️ Corrects the "126 tests" figure quoted in v1.1.0-alpha.1's notes, which didn't match an actual clean run.

Upgrading from v1.1.0-alpha.1

⚠️ Note on scope: this release is cut from main, which may include commits beyond the test-collection fix above (not independently reviewed at release time). If you're tracking exact changes, check the diff link below rather than relying on this section alone.

Full diff: v1.1.0-alpha.1...v1.1.2-stable

v1.1.0-alpha.1

This release closes the last of the four security pillars from the README — demo-only by default — and rounds out rate limiting with a lockout on repeated bad auth attempts.

Added

• MT5_REQUIRE_DEMO_ACCOUNT (default true): execute now refuses to open a new position unless the connected MT5 account is a demo account. A freshly cloned copy of this project can no longer trade a live account by accident. Deliberately does not affect close — an already-open live position always stays closeable. Opt out with MT5_REQUIRE_DEMO_ACCOUNT=false only once you've verified your own agent's behavior.
• AuthAttemptLimiter: repeated failed x-api-key attempts within a 60-second window now trigger a temporary 30-second lockout, with a Retry-After header on the 429 response.
• Full automated test suite for windows-side — 126 tests total across both sides, run against a fake MT5 terminal and a local stub HTTP server (no real broker or network access needed). trading.py, the only module in this codebase that can move real money, previously had none.
• CONTRIBUTING.md — dev setup for both sides, the testing bar for new guardrails, and what a good PR looks like here.

Changed

• windows-side: is_connected no longer re-verifies against the MT5 terminal on every single call — it's now a TTL-gated staleness check (MT5_CONNECTION_CHECK_INTERVAL, default 5s), cutting a redundant native round-trip off every request.
• linux-side: replaced requests with the standard library's urllib.request. The CLI spawns a fresh process per call, so requests' connection-pooling advantage never applied here — only its import cost did. Import time dropped ~52% (~170ms → ~88ms).
• Default order comment tag is now mt5-guardrail.

Fixed

• Documented two real onboarding failures in the README's Troubleshooting section: Windows venvs breaking after the project folder moves (venvs aren't relocatable), and pip install failing under antivirus HTTPS scanning.

Security

See SECURITY.md for the full "already hardened" table — now covering all four pillars: authentication, rate limiting, audit trail, and demo-only-by-default.

Full diff: v1.0.0-beta.1...v1.1.0-alpha.1

v1.0.0-beta.1

Added

• Beta Release: Feature-complete public beta of the mt5-guardrail REST API bridge. Ready for community testing and feedback.
• Core cross-OS communication allowing Linux/WSL clients to securely execute commands on MetaTrader 5 (Windows).
• FastAPI server implementation for high-speed HTTP request processing.
• API Key Authentication system to secure endpoints from unauthorized access.
• Environment variable management setup (via .env) to prevent hardcoded secrets.
• Comprehensive README.md with cross-OS installation instructions and usage examples.
• Standardized open-source structure with Apache License 2.0.

Security

• Integrated Security Headers Middleware to protect against common web vulnerabilities (e.g., CSRF, XSS).
• Mitigated CSV/Formula Injection (CWE-1236) vulnerability by properly sanitizing data inputs/outputs.
• Sanitized entire codebase to ensure no personal logic, private account numbers, or hardcoded API keys are exposed.

Full Changelog: https://github.com/beaststudi0/mt5-guardrail/commits/v1.0.0-beta.1