fix: respect BASE_URL for runtime asset paths + swap gitleaks

- Hardcoded `/icons/icon.svg`, `/icons/avatar.svg`, `/wasm` only worked at
  root. On GH Pages subpath (`/browser-llm-demo/`) the BrandMark icon and
  MediaPipe WASM-loader 404'd. New `assetPath()` helper prepends
  `import.meta.env.BASE_URL`.

- Gitleaks' proprietary action requires a paid license for GitHub orgs.
  Swapped to TruffleHog (OSS, MIT, free for orgs).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: lx-0

.github/workflows/ci.yml

@@ -37,13 +37,13 @@ jobs:
       - name: Build
         run: pnpm build
 
-  gitleaks:
+  secrets-scan:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - uses: gitleaks/gitleaks-action@v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: trufflesecurity/trufflehog@main
+        with:
+          extra_args: --results=verified,unknown

src/components/atoms/Avatar.tsx

@@ -1,6 +1,9 @@
+import { assetPath } from "@/lib/asset-path.ts";
 import { cn } from "@/lib/cn.ts";
 import { type VariantProps, cva } from "class-variance-authority";
 
+const DEFAULT_AVATAR = assetPath("icons/avatar.svg");
+
 const avatarVariants = cva("overflow-hidden rounded-full bg-neutral-900 object-cover", {
   variants: {
     size: {
@@ -18,7 +21,7 @@ export type AvatarProps = VariantProps<typeof avatarVariants> & {
   className?: string;
 };
 
-export function Avatar({ src = "/icons/avatar.svg", alt, size, className }: AvatarProps) {
+export function Avatar({ src = DEFAULT_AVATAR, alt, size, className }: AvatarProps) {
   return (
     <img
       src={src}

src/components/atoms/BrandMark.tsx

@@ -1,6 +1,9 @@
+import { assetPath } from "@/lib/asset-path.ts";
 import { cn } from "@/lib/cn.ts";
 import { type VariantProps, cva } from "class-variance-authority";
 
+const ASSET_ICON = assetPath("icons/icon.svg");
+
 const brandVariants = cva("flex-none select-none", {
   variants: {
     size: {
@@ -19,7 +22,7 @@ export type BrandMarkProps = VariantProps<typeof brandVariants> & {
 export function BrandMark({ size, className }: BrandMarkProps) {
   return (
     <img
-      src="/icons/icon.svg"
+      src={ASSET_ICON}
       alt=""
       aria-hidden="true"
       draggable={false}

src/lib/asset-path.ts

@@ -0,0 +1,7 @@
+// Prepend Vite's runtime base URL (dev = "/", prod = PROJECT.basePath e.g.
+// "/browser-llm-demo/") to a relative asset path. Needed for JS-land refs
+// to public/ assets since Vite only rewrites absolute paths in index.html.
+export function assetPath(relative: string): string {
+  const base = import.meta.env.BASE_URL;
+  return base + relative.replace(/^\/+/, "");
+}

src/lib/mediapipe-llm.ts

@@ -1,4 +1,5 @@
 import { FilesetResolver, LlmInference } from "@mediapipe/tasks-genai";
+import { assetPath } from "./asset-path.ts";
 import type { ModelId } from "./model-catalog.ts";
 import { MODEL_CATALOG, getCacheKey, getModelUrl } from "./model-catalog.ts";
 import { type DownloadProgress, loadModelWithCache } from "./opfs-cache.ts";
@@ -27,7 +28,7 @@ function nextSeed(): number {
   return Math.floor(Math.random() * 2 ** 31);
 }
 
-const WASM_PATH = "/wasm";
+const WASM_PATH = assetPath("wasm");
 
 // Gemma's decoder emits stop tokens as literal strings rather than halting.
 // Match Gemma turn-markers plus Unicode replacement + private-use-area glyphs.