v0.9.0

Changelog

• 6834f92 Merge pull request #96 from khanhkit/feat/config-bootstrap
• f1c9407 feat: bootstrap and upgrade pxgo configuration

v0.8.2

Changelog

• 5731b6f fix: support split DNS policy and PAC bootstrap (#91)
• 9e2b98a release: add manual WinGet synchronization (#90)
• dbb7293 release: require distribution convergence for green status (#89)

v0.8.1

Changelog

• 121f75a Merge pull request #88 from khanhkit/hotfix/dns-cache-ttl
• c7b4e78 build(deps): bump actions/configure-pages from 4.0.0 to 6.0.0 (#77)
• b7ed239 build(deps): bump anchore/sbom-action/download-syft (#76)
• 2b6f929 build(deps): bump golangci/golangci-lint-action from 7.0.1 to 9.3.0 (#75)
• ecd6f4b ci: require single-main green release boundary (#87)
• b163c7b fix: honor DNS response TTL in cache

v0.8.0

pxgo v0.8.0

Feature release adding configurable DNS/DoH resolution, verified self-update behavior, and a windowless Windows background runtime.

Highlights

• Configurable DNS resolution. PxGo can use the system resolver, a custom DNS server, or DNS-over-HTTPS through one centralized resolver contract.
• Provider-aware updates. Package-manager installations delegate updates to their owning manager, while direct/portable installations use verified release assets with checksum/digest validation and downgrade protection.
• Windowless Windows background mode. Windows archives now include pxgow.exe, a GUI-subsystem companion that starts PxGo without a Command Prompt window while preserving pxgo.exe as the normal console CLI.
• Shared configuration and tray lifecycle. Background/startup mode reuses the same pxgo.ini semantics as foreground mode and exposes the canonical PxGo icon in the Windows system tray.
• Background control behavior. --background, startup, quit, and restart use the existing Guardian process tree and bounded readiness/shutdown contracts rather than adding a second supervisor.

Release verification

This release is built from protected main and uses the artifact-first release pipeline. Exact candidate archives are built once, executed/verified natively before publication, then promoted unchanged with checksums, SBOMs, and provenance attestations.

Windows amd64/arm64 release archives contain both pxgo.exe and pxgow.exe, and the release verifier checks their expected subsystem/resource/version contracts before promotion.

v0.7.1

pxgo v0.7.1

Patch release for PAC encoding compatibility.

Fixed

• Add strict ascii / us-ascii PAC decoding.
• Honor HTTP Content-Type: charset=ascii with the same priority semantics as upstream Px v0.12, including over BOM detection.
• Reject non-ASCII bytes when ASCII is explicitly selected instead of silently falling back to another decoder.

All v0.7.0 distribution, Kerberos/SPNEGO, Guardian, RLIMIT_NOFILE, Homebrew, Scoop and release-provenance behavior remains unchanged.

v0.7.0

pxgo v0.7.0

This release brings PxGo in line with the applicable behavior changes from upstream Px v0.12.0 and hardens the release/distribution path introduced in v0.6.0.

Highlights

• PAC encoding now auto-detects by default. HTTP Content-Type charset is honored first, UTF-8/UTF-16/UTF-32 BOMs are recognized, valid UTF-8 is accepted, then legacy Windows-1252/Windows-1251/Latin-1 fallbacks are tried. Explicit --pac-encoding still overrides detection.
• Unix file-descriptor capacity is raised at startup. Linux and macOS best-effort raise the RLIMIT_NOFILE soft limit toward min(hard, 65536), with conservative fallbacks when the requested limit is rejected.
• Real syscall coverage exists on Linux and macOS. Native CI lowers the child soft limit and proves PxGo raises it again using the platform getrlimit/setrlimit path.
• The official Scoop bucket is live. Stable releases publish the exact staged pxgo-scoop.json into khanhkit/scoop-bucket after immutable release promotion.
• Release provenance is stronger. Generated Scoop manifests join the release checksum/provenance set, release-contract checks now run on normal PR CI, and Homebrew checksum selection is exact-filename matched.
• Guardian confidence improved. Native macOS CI now exercises crash/recycle/hang/forced-stop/orphan-cleanup lifecycle behavior.
• Linux keyring diagnostics are clearer. Password-store failures preserve the underlying Secret Service/D-Bus error and point to the explicit plaintext fallback; optional startup lookup remains best-effort.

Installation

Homebrew

brew tap khanhkit/tap
brew install pxgo

Scoop

scoop bucket add khanhkit https://github.com/khanhkit/scoop-bucket
scoop install khanhkit/pxgo

A bucket-independent Scoop manifest is also attached to the GitHub Release as pxgo-scoop.json.

Direct archives

Release archives are published for:

• Linux amd64 / arm64
• macOS amd64 / arm64
• Windows amd64 / arm64

Verify downloads against checksums.txt and the GitHub artifact attestations.

PAC compatibility

The default pac_encoding is now auto, matching current upstream Px behavior. For HTTP PAC sources, an explicit response charset wins. Local/remote PAC source decoding otherwise follows BOM and validity detection before legacy single-byte fallbacks.

To force an encoding, continue using for example:

pxgo --pac=/path/to/proxy.pac --pac-encoding=utf-8

Unix capacity behavior

On Linux and macOS, Guardian startup attempts to raise the process file-descriptor soft limit without exceeding the hard limit. Failure is non-fatal; PxGo remains startable under restricted environments. Windows behavior is unchanged.

Credential storage on Linux

PxGo uses the Secret Service D-Bus interface for the OS keyring. Headless Linux requires a working session D-Bus and Secret Service provider. If one is unavailable, password-store operations now surface the backend cause. PXGO_KEYRING_PLAINTEXT=1 remains the explicit fallback for environments such as Docker/CI.

Verification

The release path is gated by:

• required Ubuntu and Windows race/full-test jobs;
• native Linux arm64 and macOS arm64 execution;
• live MIT Kerberos KDC/SPNEGO integration;
• native Windows SSPI verification in the release workflow;
• artifact-first GoReleaser staging and native candidate execution;
• checksums, SBOMs, artifact attestations, and fail-closed immutable promotion proof;
• PR-time release/artifact contract validation.

The KhanhKit.PxGo WinGet submission remains externally pending Microsoft CLA/moderator completion and is not advertised as published by this release.

v0.6.0

pxgo v0.6.0

This release closes the largest remaining proxy-parity gaps and publishes the first PxGo release with end-to-end Unix Kerberos/SPNEGO upstream authentication.

Highlights

• Unix Kerberos/SPNEGO is wired end-to-end. On Linux and macOS, --kerberos now uses the manager-owned FILE credential cache to obtain an HTTP/<proxy-host> service ticket and authenticate upstream Negotiate challenges for both ordinary HTTP proxy requests and CONNECT tunnels.
• HTTPS parent proxies are covered. Kerberos/SPNEGO retry behavior is regression-tested when the upstream proxy itself is reached over TLS.
• Live KDC verification no longer skips SPNEGO. CI provisions a real MIT KDC plus HTTP/proxy.pxgo.test, then requires successful SPNEGO service-ticket acquisition.
• Migration from Python px is easier. Legacy PX_* environment variables and px.ini are accepted as fallbacks, while native PXGO_* and pxgo.ini retain precedence.
• More deterministic reliability tests. Replay-body cleanup failure is tested with explicit fault injection rather than filesystem permission behavior that varied under root/container execution.
• Broader CLI/diagnostic confidence. Doctor and quit behavior now have additional live/fallback/error-path tests.
• Distribution is operational. Homebrew is published from khanhkit/homebrew-tap; each release also carries the generated direct-install Scoop manifest. The KhanhKit.PxGo WinGet submission is technically validated upstream but is not advertised as published until Microsoft accepts it.

Authentication behavior

Linux and macOS

With --kerberos enabled, PxGo manages the Kerberos ticket lifecycle and uses that credential cache for upstream SPNEGO authentication. The service principal is derived as HTTP/<proxy-host>.

Windows

Windows transparent authentication remains a separate current-user SSPI path. Do not use --kerberos as a Windows SSPI selector; omit explicit upstream credentials when current-user NTLM/Negotiate SSO is desired.

Real domain-backed AD/SPN verification remains tracked separately because it requires a protected domain-joined Windows runner. Hosted Windows native SSPI roundtrip and handle-soak tests remain green, but they are not represented as a substitute for real AD evidence.

Migration compatibility

Existing PxGo configuration remains compatible. For users migrating from Python px:

• PXGO_* overrides the corresponding legacy PX_* variable.
• pxgo.ini is preferred over legacy px.ini.
• Legacy px.ini is read as a compatibility fallback; --save continues to write native pxgo.ini.

The effective precedence remains:

command line > PXGO_ environment > PX_ environment > explicit dotenv > pxgo.ini/px.ini > defaults

Installation

Release archives are available for Linux, macOS, and Windows on amd64 and arm64. Verify downloads against checksums.txt.

Homebrew:

brew tap khanhkit/tap
brew install pxgo

Windows Scoop direct install:

scoop install https://github.com/khanhkit/pxgo/releases/latest/download/pxgo-scoop.json

WinGet package KhanhKit.PxGo is still pending publication in the external Microsoft catalog and should not yet be treated as an official install path.

Verification

This release line is gated by:

• Ubuntu and Windows full test/race coverage required by branch protection.
• Native Linux arm64 and macOS arm64 CI.
• CodeQL and repository security scans.
• Live MIT Kerberos KDC integration including non-skipping TestKerberosIntegrationSPNEGOToken.
• Native Windows SSPI roundtrip and handle-soak verification in the release workflow.
• Artifact-first GoReleaser staging and execution of the exact candidate archives before immutable promotion.
• SBOMs, checksums, and GitHub artifact attestations.

v0.5.1

pxgo v0.5.1

This is a maintenance release focused on distribution correctness, release usability, and clean fork-owned packaging.

Highlights

• Verified release artifacts before publication. Release candidates are built once, checksum/SBOM metadata is generated once, and the exact staged archives are verified on the native release matrix before promotion.
• Fork-owned distribution identity. User-facing package, release, Homebrew, documentation, and module metadata now consistently use khanhkit/pxgo; inherited WinGet install instructions are not advertised.
• Cleaner release publication. Draft assets are promoted atomically and release notes are curated instead of exposing a raw commit dump.
• Fixed tagged-commit dry-run verification. Verifying an already-tagged release SHA now expects the existing release version instead of the temporary dry-run tag version; this removes the false Linux amd64/arm64, Windows, and macOS verifier failures seen when rechecking v0.5.0.
• Better portable setup docs. The README now includes a hand-written pxgo.ini example for users who do not want to use --save.
• Support information included with downloads. Release archives include this repository README, including the GitHub Sponsors link and support section.

Installation

Download the archive for your platform from this release:

• Linux x86_64: pxgo_linux_amd64.tar.gz
• Linux ARM64: pxgo_linux_arm64.tar.gz
• Windows x86_64: pxgo_windows_amd64.zip
• Windows ARM64: pxgo_windows_arm64.zip
• macOS Intel: pxgo_darwin_amd64.tar.gz
• macOS Apple Silicon: pxgo_darwin_arm64.tar.gz

Verify the downloaded file with checksums.txt before installing.

Configuration

You can generate a starter config:

pxgo --save --config=./pxgo.ini --proxy=proxy.company.com:8080

or write pxgo.ini manually. See the README packaged inside every archive and docs/configuration.md for the complete configuration reference.

Windows authentication

On domain-joined Windows systems, pxgo can use the logged-in user's current SSPI credentials for NTLM/Negotiate upstream proxy authentication. No inherited WinGet package ID is required or advertised by this release.

Upgrade notes

This release does not require a configuration migration from v0.5.0. Existing valid pxgo.ini, environment variables, and CLI flags continue to work with the documented precedence rules.

Support

If pxgo saves you time, you can support development through GitHub Sponsors. Additional support options are listed in the README included in each release archive.

v0.5.0

Changelog

• fff3f6c Merge pull request #11 from khanhkit/chore/solo-branch-protection-policy
• 2c9f9db Merge pull request #12 from khanhkit/kitdev1/ap-iss-0028
• c0b888c Merge pull request #13 from khanhkit/kitdev3/ap-iss-0029
• a77f196 Merge pull request #14 from khanhkit/kitdev3/ap-iss-0030
• 7edf568 Merge pull request #15 from khanhkit/kitdev3/actions-clean-failure-history
• ded32f9 Merge pull request #16 from khanhkit/kitdev3/identity-v050
• 56f0518 Merge pull request #4 from khanhkit/kitdev3/ap-iss-0026
• 96a76cd Merge pull request #5 from khanhkit/kitdev3/ap-iss-0021
• 85582a7 Merge pull request #8 from khanhkit/green/integration-20260919
• 64ab62f Merge remote-tracking branch 'origin/main' into kitdev3/ap-iss-0029
• 99fb25d build(container): harden reproducible non-root runtime
• 201fc4e build: raise Go security floor to 1.25.13
• 2417597 chore(config): remove obsolete plaintext helper
• 5260f5a chore(config): reuse install option key
• 5a9a26c chore(guardian): document shell-free child execution
• cd45866 chore(proxy): clean intermediary verification defects
• 5d0dc3f ci: add hosted release candidate dry run
• 94ea63d ci: automate protected AD verification fixture
• 174d9a8 ci: constrain verified release promotion assets
• 90ba59f ci: defer external AD validation to manual TODO
• 73e8e3c ci: expose exact-ref verification dispatch
• e0540e9 ci: fix Windows fixture preflight
• fa3e90b ci: fix Windows fixture preflight matching
• 1b94bdf ci: gate fuzz and Windows auth verification
• 5321e65 ci: harden exact-SHA release supply chain
• 7f92c10 ci: isolate native SSPI dispatch job
• 26c40ec ci: isolate native Windows SSPI verification
• 8679ce1 ci: keep dry-run failure proof green
• c1519c5 ci: make fork distribution ownership authoritative
• bae3fc0 ci: prove immutable draft promotion
• 7655274 ci: register fork workflows
• 52f3a28 ci: require native runtime verification
• 24622d4 ci: restore native WinHTTP verification gate
• 1a4c7f6 ci: retrigger Windows SSPI verification
• 2a8d695 ci: verify release candidates before promotion
• c42e3e9 docs(auth): clarify downstream negotiate scope
• e452ecc docs(auth): make upstream Basic fallback explicit
• d132510 docs(cli): mark kerberos mode fail-closed
• 1c9fbaf docs(guardian): document process failure boundary
• 795b688 docs(proxy): define HTTP intermediary contract
• eecd8ad docs(proxy): document fail-closed gateway policy
• 954cfb9 docs(proxy): document managed tunnel lifecycle
• 2526b7f docs(routing): document proxy source precedence
• d83d182 docs(routing): document proxy source precedence
• 96e8055 feat(diagnostic): track upstream auth mechanism
• 049db23 feat(dns): add network-epoch cache invalidation
• fd90044 feat(guardian): add authenticated process-liveness core
• 6d8d1ff feat(guardian): add parent lifecycle orchestrator
• 787283f feat(guardian): add worker readiness and progress bridge
• bf3509a feat(guardian): integrate parent and worker entrypoints
• 97d456c feat(kerberos): define fail-closed proxy auth contract
• 73922b2 feat(observability): add local doctor and fatal diagnostics
• c52a086 feat(observability): harden logger and bounded event history
• 4004b20 feat(proxy): classify negotiated auth mechanism
• 8e69c45 feat(proxy): enforce kerberos contract and expose mechanism
• 3f8ba26 feat(supervisor): add bounded runtime recovery core
• 393bcb2 feat(supervisor): integrate runtime recovery with proxy paths
• 6059fdf fix(auth): enforce downstream verifier invariants
• acf08fb fix(auth): make parser bounds 32-bit obvious
• 389aa21 fix(auth): make upstream credentials challenge strict
• 5a96359 fix(config): make ingestion strict and source aware
• c7fea61 fix(config): make persistence atomic and serialized
• cf2269a fix(config): preserve UNC file URLs
• ac83de5 fix(config): preserve documented ini comments
• 2e69258 fix(config): report corrupt plaintext keyring
• d518f3f fix(deps): consume Go security floor
• 60ea955 fix(deps): consume Go security floor
• d00c21a fix(deps): update x/text past GO-2026-5970
• d0f5a97 fix(deps): update x/text past GO-2026-5970
• f82ee72 fix(deps): update x/text past GO-2026-5970
• 73237cb fix(deps): update x/text past GO-2026-5970
• c3aa110 fix(dns): coalesce immutable bounded cache entries
• f82e3e2 fix(guardian): distinguish worker-requested normal stop
• da28b18 fix(kerberos): decouple refresh lifecycle from callers
• 2df407a fix(kerberos): make cleanup terminal across refresh
• a6b04c3 fix(kerberos): publish refresh completion after cleanup
• 64c509a fix(pac): bound and preload PAC generations
• 55b6849 fix(pac): bound and preload PAC generations
• 629fa34 fix(pac): canonicalize bounded deterministic semantics
• e016ddf fix(pac): canonicalize bounded deterministic semantics
• 8831264 fix(proxy): bound replayable request bodies
• e43d68e fix(proxy): bound upstream connection lifecycle
• 7f6d9b3 fix(proxy): classify only selected SPNEGO mechanism
• 740588b fix(proxy): enforce HTTP intermediary boundary
• 2246c74 fix(proxy): narrow resolver helper result
• eb4ffe6 fix(proxy): narrow resolver helper result
• 1b06c24 fix(proxy): own Windows SSPI auth sessions
• 50fbb34 fix(proxy): own hijacked tunnel lifecycle
• 70886d8 fix(proxy): own system resolver lifecycle
• c22fbdf fix(proxy): own system resolver lifecycle
• 0e58dbe fix(proxy): preserve authoritative route membership
• d3ada08 fix(proxy): recognize wrapped NTLM negotiation
• c1309af fix(proxy): retain authenticated upstream transports
• b105054 fix(proxy): secure gateway admission and control
• cb3820b fix(proxy): simplify SSPI failure return
• 2cae267 fix(routing): canonicalize proxy and bypass parsing
• 28179f4 fix(routing): canonicalize proxy and bypass parsing
• 644d8e1 fix(routing): make env regression portable
• 3a2a872 fix(routing): make env regression portable
• ab35996 fix(routing): make env regression portable
• 38ed427 fix(routing): make proxy source precedence explicit
• bf85efd fix(routing): make proxy source precedence explicit
• 4720010 fix(server): avoid self-test readiness probe sockets
• 4f81c94 fix(server): bound control lifecycle shutdown
• 730f5a4 fix(startup): create missing Windows Run key
• 385ef55 fix(startup): harden Windows run contract
• ce30051 fix(startup): persist config before Windows install
• 2c50ba9 fix(systemproxy): bound WinHTTP proxy resolution
• 4eba170 fix(systemproxy): bound WinHTTP proxy reso...