Merge release/v3.8.8 into refactor/pages-v3-14 (CLI pages redesign)

Conflicts: CLAUDE.md base; i18n deep-merge (costsSection=Custos); .source regenerated (fumadocs-mdx, +1 doc); openapi regenerated.

CLIToolsPageClient.tsx: accepted #2839 deletion (redesign replaced cli-tools/ with cli-code/cli-agents/acp-agents; base #2858 only removed obsolete MITM cards; AgentBridge reachable via sidebar; 0 orphan refs). sidebar-visibility test passes (cli items + agent-bridge merged).

next.config.mjs

@@ -62,6 +62,22 @@ function isNextIntlExtractorDynamicImportWarning(warning) {
   );
 }
 
+// OMNIROUTE_BUILD_PROFILE=minimal physically removes four optional privileged
+// modules (MITM cert install, Zed keychain import, Cloud Sync, 9router
+// installer) from the built bundle by aliasing them to feature-disabled stubs.
+// The resulting artifact is intended to be published as `omniroute-secure`
+// for security-sensitive environments. See docs/security/SOCKET_DEV_FINDINGS.md.
+const isMinimalBuild = process.env.OMNIROUTE_BUILD_PROFILE === "minimal";
+
+const minimalBuildAliases = isMinimalBuild
+  ? {
+      "@/mitm/cert/install": "./src/mitm/cert/install.stub.ts",
+      "@/lib/zed-oauth/keychain-reader": "./src/lib/zed-oauth/keychain-reader.stub.ts",
+      "@/lib/cloudSync": "./src/lib/cloudSync.stub.ts",
+      "@/lib/services/installers/ninerouter": "./src/lib/services/installers/ninerouter.stub.ts",
+    }
+  : {};
+
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   distDir,
@@ -71,6 +87,7 @@ const nextConfig = {
     resolveAlias: {
       // Point mitm/manager to a stub during build (native child_process/fs can't be bundled)
       "@/mitm/manager": "./src/mitm/manager.stub.ts",
+      ...minimalBuildAliases,
     },
   },
   output: "standalone",
@@ -124,7 +141,6 @@ const nextConfig = {
     "thread-stream",
     "pino-abstract-transport",
     "better-sqlite3",
-    "sql.js",
     "node-machine-id",
     "keytar",
     "wreq-js",
@@ -153,11 +169,72 @@ const nextConfig = {
     // TODO: Re-enable after fixing all sub-component useTranslations scope issues
     ignoreBuildErrors: true,
   },
-  webpack(config) {
+  webpack(config, { webpack }) {
     config.ignoreWarnings = [
       ...(config.ignoreWarnings || []),
       isNextIntlExtractorDynamicImportWarning,
     ];
+    config.optimization = config.optimization || {};
+    config.optimization.splitChunks = {
+      ...config.optimization.splitChunks,
+      cacheGroups: {
+        ...(config.optimization.splitChunks?.cacheGroups || {}),
+        recharts: {
+          test: /[\\/]node_modules[\\/]recharts[\\/]/,
+          name: "vendor-recharts",
+          chunks: "all",
+          priority: 20,
+        },
+        lobeIcons: {
+          test: /[\\/]node_modules[\\/]@lobehub[\\/]icons[\\/]/,
+          name: "vendor-lobe-icons",
+          chunks: "all",
+          priority: 20,
+        },
+        monaco: {
+          test: /[\\/]node_modules[\\/]monaco-editor[\\/]/,
+          name: "vendor-monaco",
+          chunks: "all",
+          priority: 20,
+        },
+        xyflow: {
+          test: /[\\/]node_modules[\\/]@xyflow[\\/]/,
+          name: "vendor-xyflow",
+          chunks: "all",
+          priority: 20,
+        },
+        mermaid: {
+          test: /[\\/]node_modules[\\/]mermaid[\\/]/,
+          name: "vendor-mermaid",
+          chunks: "all",
+          priority: 20,
+        },
+      },
+    };
+
+    if (isMinimalBuild) {
+      // Mirror the turbopack.resolveAlias entries for webpack-built artifacts.
+      // NormalModuleReplacementPlugin swaps the real module for a stub before
+      // webpack resolves it, so the privileged source files are never compiled
+      // into the standalone output.
+      const replacements = [
+        [/^@\/mitm\/cert\/install$/, "./src/mitm/cert/install.stub.ts"],
+        [/^@\/lib\/zed-oauth\/keychain-reader$/, "./src/lib/zed-oauth/keychain-reader.stub.ts"],
+        [/^@\/lib\/cloudSync$/, "./src/lib/cloudSync.stub.ts"],
+        [
+          /^@\/lib\/services\/installers\/ninerouter$/,
+          "./src/lib/services/installers/ninerouter.stub.ts",
+        ],
+      ];
+      for (const [pattern, stubPath] of replacements) {
+        config.plugins.push(
+          new webpack.NormalModuleReplacementPlugin(pattern, (resource) => {
+            resource.request = stubPath;
+          })
+        );
+      }
+    }
+
     return config;
   },
   images: {