[zpzjzj]

Summary

Resolve the current dependency and code-scanning findings without changing
evaluation configuration, credential resolution, file operations, or kwargs
precedence.

• Override VitePress's Vite dependency with the patched 6.x line (locked to
  Vite 6.4.5 and esbuild 0.25.12), addressing all nine open Dependabot alerts.
• Redact credentials in custom-engine output-file diagnostics, including
  embedded paths in errors. Log credential presence without key fragments and
  name the environment-variable identifier according to its actual content.
• Remove summed map-capacity arithmetic while preserving eval-over-user
  kwargs precedence and input-map independence.
• Install the existing Linux live-model CLI versions with npm ci and integrity
  locks. Export their local bin directory for subsequent steps; retain the
  separate Windows tool manifest.

Validation

• Full Go race suite, targeted secret-redaction regressions, make verify,
  make build, make test-action, and quick make e2e passed.
• Documentation production build and dev-server HTTP probe passed.
• Public npm audit: zero vulnerabilities for the docs and Linux CLI manifests.
• Zizmor 1.28.0: no findings in the modified workflow.
• A first full race run hit the existing 300ms SIGTERM trap test under compile
  load. Three isolated repetitions and the subsequent full race run passed.
• GitHub checks at 178062f: all 17 checks passed, including Build & Test,
  Linux/Windows/Docker quick E2E, docs, lint, and GoReleaser checks.
• PR merge-ref CodeQL analyses for Go, Python and Actions, and Zizmor each
  report zero results. No open code-scanning alerts remain on the PR merge ref.
• Live-model calls, the manual Linux live-model CLI installation job, and
  OpenSandbox were not exercised. Default-branch alerts close after merge/rescan.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T03:39:22.488481Z	178062f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.