https-localhost is a developer tool that runs an HTTPS server on localhost using locally-trusted SSL certificates. It downloads the mkcert binary appropriate for the host OS/architecture, executes it to install a local CA into system/browser trust stores, and generates per-host certificates. The resulting HTTPS server can either serve static files from a directory or act as a reverse proxy to an existing HTTP/HTTPS server, with optional HTTP-to-HTTPS redirection. It ships as both a global CLI (the `serve` binary) and a programmatic API (`createServer()`, `getCerts()`). Architecturally it is a small, well-separated set of ES modules built directly on Node's built-in http/https servers with no framework dependency. The router dispatches between a static file handler and a proxy handler; CORS headers are applied globally; environment/CLI configuration is validated through a zod schema where CLI flags take precedence over environment variables. External runtime dependencies are deliberately minimal: only `mrmime` for MIME lookup and `zod` for config validation, plus the downloaded mkcert binary. The static handler is the strongest piece: it implements path-traversal sanitization, ETag/Last-Modified conditional requests, byte-range responses (206/416), HEAD/OPTIONS support, directory index serving with query-preserving trailing-slash redirects, and custom 404.html lookup. The proxy handler strips hop-by-hop headers, injects X-Forwarded-* headers, tunnels WebSocket upgrades, and cleanly returns 502 when upstreams fail or die mid-response. Test coverage is comprehensive and genuinely exercises real sockets: unit tests for env parsing and certificate lifecycle, integration tests for static serving and proxying, CLI spawn tests, and edge-case tests for malformed percent-encoding, CORS preflight without upstream contact, and client hang prevention. CI runs a matrix across Ubuntu/macOS and Node 24/26 with strict type-aware linting, dead-code detection (knip), and formatting checks. Minor weaknesses: synchronous fs calls in the static handler (fine for a dev tool), a `process.exit()` call inside library code for unsupported platforms, minimal error handling in the mkcert download routine (only follows 302s, ignores non-2xx statuses), and no Windows CI coverage despite Windows-specific code paths.