feat!: expand media controls and simplify App connections

.github/workflows/gitee-mirror.yml

@@ -0,0 +1,83 @@
+name: Gitee mirror
+
+on:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      run_id:
+        description: Original CI run that published the current GitHub release
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: gitee-mirror
+  cancel-in-progress: false
+  queue: max
+
+jobs:
+  mirror:
+    if: >-
+      github.repository == 'TNTcraftHIM/Piik' && github.ref == 'refs/heads/main' &&
+      (github.event_name == 'workflow_dispatch' ||
+       (github.event.workflow_run.event == 'push' &&
+        github.event.workflow_run.head_branch == 'main' &&
+        github.event.workflow_run.conclusion == 'success'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      # Execute trusted main tooling; upstream artifacts are data, never code.
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: .node-version
+          cache: npm
+      - run: npm ci --ignore-scripts
+      - name: Resolve the published source
+        id: source
+        run: node scripts/release-mirror-source.mjs "$PIIK_SOURCE_RUN_ID"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PIIK_SOURCE_RUN_ID: ${{ inputs.run_id || github.event.workflow_run.id }}
+      - name: Download original Server artifacts
+        if: steps.source.outputs.mirror == 'true'
+        uses: actions/download-artifact@v8
+        with:
+          github-token: ${{ github.token }}
+          run-id: ${{ steps.source.outputs.run_id }}
+          pattern: piik-server*-${{ steps.source.outputs.revision }}
+          path: ${{ runner.temp }}/mirror-release
+          merge-multiple: true
+      - name: Download original App artifacts
+        if: steps.source.outputs.mirror == 'true'
+        uses: actions/download-artifact@v8
+        with:
+          github-token: ${{ github.token }}
+          run-id: ${{ steps.source.outputs.run_id }}
+          pattern: piik-app-*-${{ steps.source.outputs.revision }}
+          path: ${{ runner.temp }}/mirror-release
+          merge-multiple: true
+      - name: Mirror and verify original packages
+        if: steps.source.outputs.mirror == 'true'
+        run: >-
+          node scripts/mirror-release.mjs
+          "$RUNNER_TEMP/mirror-release" "$PIIK_RELEASE_VERSION" "$PIIK_RELEASE_REVISION"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITEE_TOKEN: ${{ secrets.GITEE_TOKEN }}
+          PIIK_RELEASE_VERSION: ${{ steps.source.outputs.version }}
+          PIIK_RELEASE_REVISION: ${{ steps.source.outputs.revision }}
+      - name: Explain recovery
+        if: failure() && steps.source.outputs.mirror == 'true'
+        run: |
+          printf 'Mirror failed; GitHub publication and Website are independent. Retry this workflow with original CI run %s. If artifacts expired, recover the retained original build output; do not rebuild this version. See docs/operations/github.md.\n' "$PIIK_SOURCE_RUN_ID" >> "$GITHUB_STEP_SUMMARY"
+        env:
+          PIIK_SOURCE_RUN_ID: ${{ steps.source.outputs.run_id }}

.github/workflows/repository-hygiene.yml

@@ -17,6 +17,27 @@ on:
         description: Optional candidate version (vMAJOR.MINOR.PATCH); never publishes
         required: false
         type: string
+      network_lab:
+        description: Run the isolated Linux network laboratory (never publishes)
+        required: false
+        default: none
+        type: choice
+        options: [none, verify, smoke, full]
+      network_cases:
+        description: Optional comma-separated laboratory cases (empty runs the selected suite)
+        required: false
+        type: string
+      network_prediction:
+        description: NAT enhancement setting (compare runs paired on/off trials)
+        required: false
+        default: 'on'
+        type: choice
+        options: ['on', 'off', compare]
+      network_repeat:
+        description: Repetitions per laboratory case (1..20)
+        required: false
+        default: '1'
+        type: string
 
 permissions:
   contents: read
@@ -75,7 +96,7 @@ jobs:
           ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.PIIK_RELEASES_ENABLED == 'true' && 'plan' || 'build' }}
           --github-output
       - name: Preview release notes
-        if: steps.release.outputs.publish == 'true' || inputs.candidate_version != ''
+        if: steps.release.outputs.publish == 'true'
         run: node scripts/release-notes.mjs "$PIIK_RELEASE_VERSION" "$GITHUB_SHA" --github-summary
         env:
           PIIK_RELEASE_VERSION: ${{ steps.release.outputs.version }}
@@ -89,18 +110,70 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: 1.26.6
+          go-version-file: go.mod
           cache-dependency-path: go.sum
       - name: Check Go core
         run: npm run check:go-core
-      - name: Check NAT and media ownership with the race detector
+      - name: Check reachable Go vulnerabilities
+        run: npm run check:go-vuln
+      - name: Check concurrent resource ownership with the race detector
         run: npm run check:go-race
       - name: Type-check and test
         run: npm run typecheck && npm test
         env:
           PIIK_BUILD_VERSION: ${{ steps.release.outputs.version }}
           VITE_PIIK_VERSION: ${{ steps.release.outputs.version }}
           VITE_PIIK_REVISION: ${{ github.sha }}
+      - name: Prepare isolated network laboratory
+        if: github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y nftables iproute2 tcpdump conntrack bison flex libmnl-dev libcap-dev
+          mkdir -p build/network-lab/bin
+          CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/piik-server ./cmd/piik-server
+          CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/piik-app ./cmd/piik-app
+          CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/stun ./scripts/network-lab/stun
+      # The runner's iproute2 6.1 lacks netem's seed parameter. Keep this tool
+      # local to the opt-in lab; do not replace system networking utilities.
+      - name: Check out laboratory traffic-control tool
+        if: github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
+        uses: actions/checkout@v6
+        with:
+          repository: iproute2/iproute2
+          ref: d2a8ffe85ac64f91ee2aa7679a5046f321b54127 # v6.17.0
+          path: build/network-lab/iproute2
+          persist-credentials: false
+      - name: Build laboratory traffic-control tool
+        if: github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
+        run: |
+          make -C build/network-lab/iproute2 -j2 SUBDIRS='lib tc netem' TC_CONFIG_NO_XT=y
+          echo "$GITHUB_WORKSPACE/build/network-lab/iproute2/tc" >> "$GITHUB_PATH"
+      - name: Run isolated network laboratory
+        id: network_lab
+        if: github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
+        timeout-minutes: 45
+        env:
+          CHROME_PATH: /usr/bin/google-chrome
+          TC_LIB_DIR: ${{ github.workspace }}/build/network-lab/iproute2/netem
+          PIIK_NETWORK_LAB_SUITE: ${{ inputs.network_lab }}
+          PIIK_NETWORK_LAB_CASES: ${{ inputs.network_cases }}
+          PIIK_NETWORK_LAB_PREDICTION: ${{ inputs.network_prediction }}
+          PIIK_NETWORK_LAB_REPEAT: ${{ inputs.network_repeat }}
+        run: |
+          if [ "$PIIK_NETWORK_LAB_SUITE" = verify ] || [ "$PIIK_NETWORK_LAB_SUITE" = full ]; then
+            sudo --preserve-env=PATH,CHROME_PATH,TC_LIB_DIR "$(command -v node)" --import tsx scripts/network-lab.ts --verify
+          fi
+          if [ "$PIIK_NETWORK_LAB_SUITE" != verify ]; then
+            sudo --preserve-env=PATH,CHROME_PATH,TC_LIB_DIR "$(command -v node)" --import tsx scripts/network-lab.ts --suite "$PIIK_NETWORK_LAB_SUITE" --cases "$PIIK_NETWORK_LAB_CASES" --prediction "$PIIK_NETWORK_LAB_PREDICTION" --repeat "$PIIK_NETWORK_LAB_REPEAT"
+          fi
+      - name: Save network laboratory evidence
+        if: always() && steps.network_lab.outcome != 'skipped' && github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
+        uses: actions/upload-artifact@v7
+        with:
+          name: network-lab-${{ github.sha }}
+          path: build/network-lab/results/
+          if-no-files-found: error
+          retention-days: 7
 
   release-server:
     needs: validate
@@ -132,7 +205,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: 1.26.6
+          go-version-file: go.mod
           cache-dependency-path: go.sum
       - name: Install dependencies
         run: npm ci
@@ -173,8 +246,10 @@ jobs:
         include:
           - target: windows-amd64
             runner: windows-latest
+          # Native Linux capture links system libraries; keep both architectures
+          # on the same explicit build baseline instead of following latest.
           - target: linux-amd64
-            runner: ubuntu-latest
+            runner: ubuntu-24.04
           - target: linux-arm64
             runner: ubuntu-24.04-arm
           - target: darwin-arm64
@@ -196,7 +271,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: 1.26.6
+          go-version-file: go.mod
           cache-dependency-path: go.sum
       # scripts/assemble-app.mjs runs `npm run build:web` for the Web
       # assets the App binary embeds, so Vite and the license inputs must be
@@ -290,7 +365,6 @@ jobs:
       # Local descriptors/manifests/checksums are validated before publishing.
       # Release assets contain packages only; checksums appear in the release body.
       - name: Publish packages with release notes and checksums
-        id: github_release
         run: >-
           node scripts/publish-release.mjs
           "$RUNNER_TEMP/publish-release" "$PIIK_RELEASE_VERSION" "$GITHUB_SHA"
@@ -304,12 +378,3 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           PIIK_RELEASE_VERSION: ${{ needs.validate.outputs.version }}
-      - name: Mirror verified release to Gitee
-        if: ${{ !cancelled() && steps.github_release.outcome == 'success' }}
-        run: >-
-          node scripts/mirror-release.mjs
-          "$RUNNER_TEMP/publish-release" "$PIIK_RELEASE_VERSION" "$GITHUB_SHA"
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GITEE_TOKEN: ${{ secrets.GITEE_TOKEN }}
-          PIIK_RELEASE_VERSION: ${{ needs.validate.outputs.version }}

CONTRIBUTING.md

@@ -21,6 +21,16 @@ PR; maintainers can help identify what still needs verification.
 讨论时请结合实际场景提出建议，尊重不同意见；分享截图或日志前移除隐私内容。
 无法运行的检查请如实说明，便于维护者协助验证。
 
+Review contributions by their practical value, evidence and fit with the product,
+not their line count. A small fix that identifies and resolves a real defect is
+valuable. Duplicate work already independently resolved, personal preferences or
+low-value changes may be declined; merging is not an attribution mechanism.
+Retain authorship for accepted contributions and credit substantive discoveries
+accurately, without attributing independently written code to a PR author.
+评审看实际价值、证据和产品定位，不看代码行数。发现并解决真实问题的小修复同样值得接纳；
+已经独立解决的重复工作、个人偏好或收益很低的改动可以不合并，不为增加贡献者名单而合并。
+保留已接纳贡献的作者信息，如实说明有价值的问题发现；独立编写的代码不应冒记为他人共同编写。
+
 ## Lean Workflow
 
 This is the default for an ordinary scoped implementation or bug fix.
@@ -101,9 +111,12 @@ does not establish coverage.
   The server core is Go, so its acceptance runs here. It builds the Web UI first when
   that output is missing, because both binaries embed it. CI invokes these same
   package commands rather than rebuilding their steps in YAML.
-- `npm run check:go-race` checks port mapping, media-edge ownership and their
-  scoped NAT dependencies with Go's race detector. It requires a supported cgo
-  toolchain; CI runs it on Linux.
+- `npm run check:go-race` checks port mapping, media-edge and native-control
+  ownership, loopback delivery, service storage shutdown and scoped NAT dependencies with Go's race detector. It
+  requires a supported cgo toolchain; CI runs it on Linux.
+- `npm run check:go-vuln` checks the App and Server entry points and their
+  dependencies against the Go vulnerability database. CI uses the Go version
+  declared in `go.mod`; update that owner for required toolchain security fixes.
 - `npm run check:native` runs only the current platform's capture compile/probe
   and deterministic native regressions. The Linux App packaging job includes
   its headless GStreamer output-profile and retirement test; this does not
@@ -121,6 +134,10 @@ does not establish coverage.
   result. A manual diagnostic may locate a failure, but is not retained as pass
   evidence. Existing `PIIK_CLIENT_*` gate environment names retain their current
   contract; renaming the tools does not change those overrides.
+- `gate:network-lab` runs the opt-in [controlled network laboratory](./docs/research/network-lab.md).
+  It requires a disposable Linux runner with namespace administration. Its own
+  routers contain all firewall and traffic-shaping changes; do not run it on a
+  production service or treat its model results as a public success rate.
 - On Windows, execute App/Server and Go test binaries only from stable
   project build paths. Go's temporary compiler/cache files are not firewall
   identities; do not run network tests with a changing temporary executable

README.md

@@ -71,8 +71,8 @@ device and adjust your voice volume.
 
 Piik follows your system language: Chinese or English, with English as the fallback.
 Use **中 / EN / ✦** in the header to switch language or try the visual mode.
-The App offers a local room, a temporary public link, or a connection to your own
-site. Keep the App running while sharing through it.
+The App can create a local room or temporary public invitation, and stays
+available to supply capture for an approved site. Keep it running while sharing.
 
 Download a ZIP beginning with **`piik-app`**. The filename also identifies the platform:
 

README.zh-CN.md

@@ -66,7 +66,7 @@ Piik 是一个免费开源的私密屏幕共享工具，适合游戏直播、一
 
 Piik 默认跟随系统语言，中文系统显示简体中文，其他语言显示英文。
 顶部的 **中 / EN / ✦** 可切换中英文或体验纯视觉模式。
-Piik App 提供本地房间、临时公网邀请和连接已有站点三种模式，分享期间需保持 App 运行。
+Piik App 可创建本地房间或临时公网邀请，也能在后台为已授权站点提供采集能力。分享期间需保持 App 运行。
 
 下载以 **`piik-app`** 开头的 ZIP 压缩包，再按文件名中的平台标识选择：