TradingView offline

This is a work-in-progress macOS CLI and proxy prototype. It explores whether a local, reversible proxy can replay a small, approved subset of TradingView traffic without sending the target WebSocket request upstream.

It is not ready for normal use. The Electron trust test has not passed yet, so the real install path remains experimental. Treat the code as a lab project, not as a supported way to run TradingView offline.

What is here

• A Node CLI that keeps the npx tradingview-offline <command> interface.
• A Python installer with an isolated --test-home mode.
• A loopback proxy that handles one exact WebSocket host and replays a synthetic public fixture.
• Reversible staging for two exact-host leaf certificates, a mode-600 proxy credential, an app-state backup, and a LaunchAgent.

The package has no npm dependencies and no postinstall hook. It is marked private while the WIP is reviewed, so this release is not an npm publication. npm pack and the local npx --no-install flow still exercise the CLI. Installing the package does not change macOS, the Keychain, or TradingView. The command you invoke is what can make changes.

Safe first run

Use a temporary home. This skips Keychain and LaunchAgent operations and does not touch your TradingView settings:

HOME_DIR=$(mktemp -d)
npx --yes tradingview-offline install --dry-run --test-home "$HOME_DIR"
npx --yes tradingview-offline install --test-home "$HOME_DIR"
npx --yes tradingview-offline status --json --test-home "$HOME_DIR"
npx --yes tradingview-offline upgrade --test-home "$HOME_DIR"
npx --yes tradingview-offline uninstall --test-home "$HOME_DIR"
rm -rf "$HOME_DIR"

Add --dry-run when you only want to see the plan. The isolated commands create temporary certificates, credentials, and files under the temporary home, then remove the owned entries during uninstall. They do not call security or launchctl.

Experimental real install

Do not use this on a machine that matters until the Electron trust test passes. A real install can:

• change TradingView's appState.json after saving an exact recovery copy;
• stage self-signed leaves for prodata.tradingview.com and s3-symbol-logo.tradingview.com, plus a LaunchAgent;
• ask for explicit login-Keychain trust for those hosts and provision one owned proxy credential;
• route selected local traffic to the loopback helper.

The installer refuses to change app state while TradingView is running, checks the backup before upgrades and removal, keeps certificates and credentials during upgrades, and prints both certificate fingerprints before a Keychain change. Use a mode-600 JSON file with --proxy-credentials-file, or let the installer generate the proxy credential. Passwords are not accepted as command-line values. --no-keychain stages files without importing trust or credentials, but it does not turn the real path into a supported feature.

The command names are kept stable while this work continues:

npx tradingview-offline install
npx tradingview-offline status
npx tradingview-offline upgrade
npx tradingview-offline uninstall

Use --test-home for development and bug reports. Do not paste private keys, certificates, app state, proxy logs, or captures into an issue.

Development

Requirements are macOS, Node.js 14 or newer, Python 3, and openssl. The tests use only local sockets and temporary directories. They do not contact TradingView.

npm pack --dry-run
python3 -m unittest poc.test_npx_cli -v
python3 -m unittest poc.test_wss_interceptor poc.test_wss_bar_replay -v

The public replay fixture uses the fictional EXAMPLE:DEMO series and hand-authored values. The included SVG is a hand-authored placeholder, not a downloaded logo. These files exercise protocol handling. They are not TradingView captures and are not evidence that the real Electron client works.

Data and legal notes

The repository ignores captures, generated certificates, private keys, credentials, downloaded logos, and real market-data caches. The package allowlist contains source code and synthetic fixtures only. Runtime-generated certificates and credentials stay outside the package. Run npm pack --dry-run before sharing a package; review the file list rather than trusting an old tarball.

TradingView, its product names, endpoints, and trademarks belong to their respective owners. This project is not affiliated with or endorsed by TradingView. Check the current TradingView terms and any data-provider terms before testing. Use data that you are allowed to store and replay. Nothing here grants permission to evade authentication, rate limits, access controls, or a provider's license.

The certificate and proxy changes are security-sensitive. A broad trust import would be unsafe. The prototype limits the staged trust policy to one hostname, but that constraint still needs testing in the Electron client before real installation can be considered.

Project status

This is an early public WIP. Protocol details may change without notice. The current fixture covers one chart shape and one replay path. It does not promise compatibility with current TradingView releases, arbitrary symbols, multiple charts, or non-macOS systems.

See CONTRIBUTING.md for the fixture and test rules, and SECURITY.md for reporting security problems.