Merge release/v3.8.8 into refactor/pages-v3-21 (Memory engine redesign — sqlite-vec + RRF + Studio)

Conflicts: migration 073_memory_vec->083; localDb/.env/REPOSITORY_MAP union; request.ts->base; i18n auto-merged; .source regenerated (+3 docs).

openapi: --theirs base + surgically inserted 14 memory paths + 4 schemas + Memory tag via js-yaml extract (union-blind broke YAML structure). +938 lines, base formatting preserved, gen-openapi validates.

deps: @huggingface/transformers + sqlite-vec added (package.json); npm install ran, lock regenerated. chatCore auto-merged (memory + quota hooks coexist, transform OK). typecheck:core 0 errors.

next.config.mjs

@@ -62,6 +62,22 @@ function isNextIntlExtractorDynamicImportWarning(warning) {
   );
 }
 
+// OMNIROUTE_BUILD_PROFILE=minimal physically removes four optional privileged
+// modules (MITM cert install, Zed keychain import, Cloud Sync, 9router
+// installer) from the built bundle by aliasing them to feature-disabled stubs.
+// The resulting artifact is intended to be published as `omniroute-secure`
+// for security-sensitive environments. See docs/security/SOCKET_DEV_FINDINGS.md.
+const isMinimalBuild = process.env.OMNIROUTE_BUILD_PROFILE === "minimal";
+
+const minimalBuildAliases = isMinimalBuild
+  ? {
+      "@/mitm/cert/install": "./src/mitm/cert/install.stub.ts",
+      "@/lib/zed-oauth/keychain-reader": "./src/lib/zed-oauth/keychain-reader.stub.ts",
+      "@/lib/cloudSync": "./src/lib/cloudSync.stub.ts",
+      "@/lib/services/installers/ninerouter": "./src/lib/services/installers/ninerouter.stub.ts",
+    }
+  : {};
+
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   distDir,
@@ -71,6 +87,7 @@ const nextConfig = {
     resolveAlias: {
       // Point mitm/manager to a stub during build (native child_process/fs can't be bundled)
       "@/mitm/manager": "./src/mitm/manager.stub.ts",
+      ...minimalBuildAliases,
     },
   },
   output: "standalone",
@@ -124,7 +141,6 @@ const nextConfig = {
     "thread-stream",
     "pino-abstract-transport",
     "better-sqlite3",
-    "sql.js",
     "node-machine-id",
     "keytar",
     "wreq-js",
@@ -154,11 +170,72 @@ const nextConfig = {
     // TODO: Re-enable after fixing all sub-component useTranslations scope issues
     ignoreBuildErrors: true,
   },
-  webpack(config) {
+  webpack(config, { webpack }) {
     config.ignoreWarnings = [
       ...(config.ignoreWarnings || []),
       isNextIntlExtractorDynamicImportWarning,
     ];
+    config.optimization = config.optimization || {};
+    config.optimization.splitChunks = {
+      ...config.optimization.splitChunks,
+      cacheGroups: {
+        ...(config.optimization.splitChunks?.cacheGroups || {}),
+        recharts: {
+          test: /[\\/]node_modules[\\/]recharts[\\/]/,
+          name: "vendor-recharts",
+          chunks: "all",
+          priority: 20,
+        },
+        lobeIcons: {
+          test: /[\\/]node_modules[\\/]@lobehub[\\/]icons[\\/]/,
+          name: "vendor-lobe-icons",
+          chunks: "all",
+          priority: 20,
+        },
+        monaco: {
+          test: /[\\/]node_modules[\\/]monaco-editor[\\/]/,
+          name: "vendor-monaco",
+          chunks: "all",
+          priority: 20,
+        },
+        xyflow: {
+          test: /[\\/]node_modules[\\/]@xyflow[\\/]/,
+          name: "vendor-xyflow",
+          chunks: "all",
+          priority: 20,
+        },
+        mermaid: {
+          test: /[\\/]node_modules[\\/]mermaid[\\/]/,
+          name: "vendor-mermaid",
+          chunks: "all",
+          priority: 20,
+        },
+      },
+    };
+
+    if (isMinimalBuild) {
+      // Mirror the turbopack.resolveAlias entries for webpack-built artifacts.
+      // NormalModuleReplacementPlugin swaps the real module for a stub before
+      // webpack resolves it, so the privileged source files are never compiled
+      // into the standalone output.
+      const replacements = [
+        [/^@\/mitm\/cert\/install$/, "./src/mitm/cert/install.stub.ts"],
+        [/^@\/lib\/zed-oauth\/keychain-reader$/, "./src/lib/zed-oauth/keychain-reader.stub.ts"],
+        [/^@\/lib\/cloudSync$/, "./src/lib/cloudSync.stub.ts"],
+        [
+          /^@\/lib\/services\/installers\/ninerouter$/,
+          "./src/lib/services/installers/ninerouter.stub.ts",
+        ],
+      ];
+      for (const [pattern, stubPath] of replacements) {
+        config.plugins.push(
+          new webpack.NormalModuleReplacementPlugin(pattern, (resource) => {
+            resource.request = stubPath;
+          })
+        );
+      }
+    }
+
     return config;
   },
   images: {
@@ -183,6 +260,12 @@ const nextConfig = {
 
   async redirects() {
     return [
+      // Dashboard routes
+      {
+        source: "/dashboard/skills",
+        destination: "/dashboard/omni-skills",
+        permanent: true,
+      },
       // Architecture
       {
         source: "/docs/architecture",
@@ -345,6 +428,19 @@ const nextConfig = {
         destination: "/docs/ops/vm-deployment-guide",
         permanent: true,
       },
+      // CLI Pages — Plano 14 (F9)
+      { source: "/dashboard/cli-tools", destination: "/dashboard/cli-code", permanent: true },
+      {
+        source: "/dashboard/cli-tools/:path*",
+        destination: "/dashboard/cli-code/:path*",
+        permanent: true,
+      },
+      { source: "/dashboard/agents", destination: "/dashboard/acp-agents", permanent: true },
+      {
+        source: "/dashboard/agents/:path*",
+        destination: "/dashboard/acp-agents/:path*",
+        permanent: true,
+      },
     ];
   },