fix: address CodeRabbit review on latest commits

- memory gate: stop logging the raw content preview (content[:60]) in the
  routing-flagged debug log — a declined/blocked write could otherwise leak
  secrets/PII; log only target + signals (CodeRabbit, major).
- cli: drop the redundant local `logger` import in the exception-path cleanup;
  the enclosing function already binds `logger` in scope (CodeRabbit).
- docs/build: the react bump moved web/vis to Vite 8, but build_vis.py, web/
  AGENTS.md, and architecture.md still said "Vite 7". Update the labels (the
  Node engine constraint ^20.19.0 || >=22.12.0 is unchanged in Vite 8).

Author: elkaix

docs/en/customization/architecture.md

@@ -219,7 +219,7 @@ is load-bearing for approval gating of persistent-backdoor vectors (`AGENTS.md`,
 | --- | --- | --- |
 | `src/pythinker_code/web/` | FastAPI backend (port 5494) managing CLI sessions via subprocess workers; bearer-token auth; `/api/*`; sensitive-path restriction. | `create_app`, `run_web_server`, `PythinkerCLIRunner`, `SessionProcess`, `AuthMiddleware` |
 | `src/pythinker_code/vis/` | FastAPI read-only tracing/statistics backend (port 5495) for the visualizer. | `create_app`, `run_vis_server` |
-| `web/` | React 19 + Vite 7 + TypeScript SPA chat UI; bundled into the package. See `web/AGENTS.md`. | `main.tsx`, `App`, `apiClient`, generated client `src/lib/api/`, `useSessionStream` |
+| `web/` | React 19 + Vite 8 + TypeScript SPA chat UI; bundled into the package. See `web/AGENTS.md`. | `main.tsx`, `App`, `apiClient`, generated client `src/lib/api/`, `useSessionStream` |
 | `vis/` | React 19 + Vite session-tracing visualizer. See `vis/AGENTS.md`. | `main.tsx`, `App`, hand-written `src/lib/api.ts` (`WireEvent`, `ContextMessage`, `SessionInfo`), feature panels under `src/features/` |
 
 Both frontends build with `tsc -b && vite build` and are synced into the Python package by

scripts/build_vis.py

@@ -35,7 +35,7 @@ def resolve_npm() -> str | None:
 
 
 def check_node_version() -> bool:
-    """Vite 7 requires Node.js ^20.19.0 || >=22.12.0."""
+    """Vite 8 requires Node.js ^20.19.0 || >=22.12.0."""
     node = shutil.which("node")
     if not node:
         return False
@@ -47,7 +47,7 @@ def check_node_version() -> bool:
         ok = (major == 20 and minor >= 19) or (major >= 22 and (major > 22 or minor >= 12))
         if not ok:
             print(
-                f"Node.js ^20.19.0 or >=22.12.0 required (Vite 7), found v{version}",
+                f"Node.js ^20.19.0 or >=22.12.0 required (Vite 8), found v{version}",
                 file=sys.stderr,
             )
             return False

src/pythinker_code/cli/__init__.py

@@ -1203,8 +1203,6 @@ async def _reload_loop(session_id: str | None) -> tuple[str | None, int]:
             # the most recent _run() call, which may have failed before returning.
             # last_session is from a *previous* iteration and must not be touched.
             if _latest_created_session is not None:
-                from pythinker_code.utils.logging import logger
-
                 try:
                     from pythinker_code.scratchpad import cleanup_session_scratch
 

src/pythinker_code/tools/memory/__init__.py

@@ -113,8 +113,10 @@ async def _confirm_flagged_write(
         signals = routing_signals(content)
         if not signals:
             return None
+        # Log only structural metadata — never the entry content, which can carry
+        # secrets/PII and may not be stored at all if the user declines the gate.
         logger.bind(event="memory_guard_gate", target=target, signals=signals).debug(
-            "memory write flagged for confirmation: {preview}", preview=content[:60]
+            "memory write flagged for confirmation"
         )
 
         store_label = "project" if target == "memory" else "user"

web/AGENTS.md

@@ -1,6 +1,6 @@
 # Pythinker Web UI (web/)
 
-React 19 + Vite 7 + TypeScript SPA chat UI, bundled into the `pythinker-code` package. Run all
+React 19 + Vite 8 + TypeScript SPA chat UI, bundled into the `pythinker-code` package. Run all
 `npm` commands from this directory.
 
 ## Critical invariants