New features

• Added Kerberos ticket management (--kerberos) for Linux and macOS — Px acquires and renews Kerberos tickets automatically using kinit with the configured --username and password from PX_PASSWORD or keyring. No keytab file is created. Addresses #252 and #258. Bug fixes
• Fixed auth failure recovery when a Kerberos ticket becomes available after Px startup — clearing MCURL.failed allows previously-blocked proxies to be retried (#258).
• Fixed --verbose output not appearing in non-TTY environments (e.g. Docker with workers=1) due to Python block-buffering stdout. Docker
• Added BUILDER build arg and local builder stage to Dockerfile to support both CI (pre-built wheel) and local (source tree) builds.
• The full Docker image now requires --cap-add IPC_LOCK — gnome-keyring 48+ (Alpine 3.23+) links libcap-ng which aborts without the IPC_LOCK capability. Improvements
• Replaced synchronous http.server + threading with asyncio + h11. CONNECT tunnels now use zero-thread bidirectional relays: TunnelRelay (FD watchers via add_reader/add_writer) on Linux, and _async_tunnel_relay (asyncio StreamReader/StreamWriter for the client side, IOCP-backed sock_recv/sock_sendall for the upstream libcurl socket) on Windows. Thread count stays bounded at the thread pool size regardless of active tunnel count.
• Changed --workers default from 2 to 1 — the async event loop handles concurrency without multiple processes.
• Reduced per-request overhead: double-checked locking in reload_proxy(), cached get_curl_features() and noproxy_hosts, shallow copy for proxy server lists, tuples for hot-path membership checks.
• Optimized --verbose logging: skipped file I/O overhead and process/thread name lookup when --workers=1. Log output is more compact (timestamp + call tree + message) while retaining diagnostic value.
• Added Winget package support — Px can now be installed on Windows via winget install genotrance.px. Manifests are submitted automatically on release via vedantmgoyal9/winget-releaser. Addresses #115, PR #264.
• Documented WinSW service account and environment variable options for running Px as a Windows service with SSPI or explicit credentials (#259). Internal
• Added h11 runtime dependency, psutil dev dependency.
• Wired --threads to asyncio default executor pool size.
• Dynamic xdist worker count (-n auto) — auto-scales to hardware via a platform-aware pytest_xdist_auto_num_workers hook in conftest.py.
• Switched test fixtures and helpers from --debug (file logging) to --verbose (stdout logging), reducing test suite runtime by ~58%.
• Added concurrency benchmark tests (make benchmark) covering HTTP throughput, CONNECT tunnel throughput, thread pool saturation, active data exchange, thread count bounds, and memory bounds. Benchmarks now test up to 1 000–1 024 concurrent connections with sliding success thresholds for barrier-synchronised active tunnel tests.
• Added large data transfer reliability tests (make test-large-data) with SHA-256 integrity verification for concurrent multi-MB GET/POST over HTTP and HTTPS. CI jobs run these on both Linux and Windows.