fix(docker): real image tags (bifrost/cliproxyapi) + complete OMNIROUTE_BASE_PATH runtime patcher (#10482)

* fix(docker): real image tags + complete OMNIROUTE_BASE_PATH runtime patcher

Three docker issues fixed:

1. Images that do not exist:
   - bifrost: ghcr.io/maximhq/bifrost:1.5.21 never existed (1.5.x tops at
     v1.5.16, all tags carry the v prefix) -> ghcr.io/maximhq/bifrost:v1.6.11
   - cliproxyapi: ghcr.io/router-for-me/* is not publicly pullable (403);
     the official prebuilt image is docker.io/eceasy/cli-proxy-api, where
     the pinned v6.9.7 exists -> docker.io/eceasy/cli-proxy-api:v6.9.7
   - Verified still-current: redis:8.6.5-alpine (already on Redis 8 since
     #9065; ioredis 5.10 is RESP2/3-compatible, no modules used) and
     qdrant:v1.12.4 -- both exist, unchanged.

2. OMNIROUTE_BASE_PATH ignored on prebuilt images (root cause):
   Next 16 (webpack and Turbopack) app-router renders SSR asset URLs from
   assetPrefix ALONE; basePath only affects routing. The runtime patcher
   (ensure-docker-base-path) rewrote basePath literals only, so a prebuilt
   root-path image patched to /omniroute served the page but every
   /_next/static shell reference stayed unprefixed (404 behind a subpath
   proxy), the RSC flight-payload chunk refs came from client-reference
   manifests baked with unprefixed paths, and the Turbopack client process
   shim ships an empty env object so the client never learns the subpath.
   Extended patch-standalone-base-path.mjs to also rewrite:
   - assetPrefix literals (mirrors the subpath for SSR asset URLs)
   - the NEXT_PUBLIC_OMNIROUTE_BASE_PATH env mirror in the inline config
   - the client process.env shim (.env={}) with the two basePath keys
   - every baked "/_next/static URL (manifests, media imports, .html pages)
   next.config.mjs now mirrors basePath into assetPrefix so REBUILT images
   bake prefixed assets too. E2E-verified on the published main-web image:
   HTML under /omniroute now has 16/16 prefixed JS srcs and 82/82 prefixed
   flight refs (was 13/9 + ~150 unprefixed), prefixed assets return 200.

* chore(changelog): fragment for #10482 (docker images + basepath patcher)

* chore(changelog): bullet-form fragment for #10482

* Merge branch 'release/v3.8.50' into fix/docker-compose-images-and-basepath

* test(fix): refresh expired alibaba quota sample validity and onnxruntime pin for v3.8.50 base

- alibaba-free-tier-quota-fetcher.test.ts: sample quotaValidityPeriod
  (2026-08-16 16:00 UTC) is in the past, making every quota entry classify
  as expired/not_capable; bump to 2028-01-01 UTC so the text/merge
  classification tests exercise the intended path again.
- optional-transformers-dependency.test.ts: onnxruntime-node pin assertion
  updated from ~1.24.3 to ~1.27.0 to match package.json (bumped by #10403);
  the regular-not-optional intent is unchanged.

---------

Co-authored-by: Rouzbeh <rqzbeh@users.noreply.github.com>

changelog.d/fixes/10482-docker-images-and-basepath.md

@@ -0,0 +1 @@
+- **fix(docker):** point the bifrost sidecar at the real `ghcr.io/maximhq/bifrost:v1.6.11` tag and the cliproxyapi sidecar at the official `docker.io/eceasy/cli-proxy-api:v6.9.7` image (the previously pinned tags never existed), and complete the runtime `OMNIROUTE_BASE_PATH` subpath patch for Next 16 standalone (assetPrefix + client env + baked asset URLs) so prebuilt images respect the webpath env var ([#10482](https://github.com/diegosouzapw/OmniRoute/pull/10482))

docker-compose.yml

@@ -247,7 +247,7 @@ services:
   # fall back to the chatCore path with zero code changes. See
   # docs/architecture/cluster-decisions.md for the activation plan.
   bifrost:
-    image: ghcr.io/maximhq/bifrost:1.5.21
+    image: ghcr.io/maximhq/bifrost:v1.6.11
     container_name: omniroute-bifrost
     restart: unless-stopped
     ports:
@@ -266,9 +266,12 @@ services:
       - bifrost
 
   # ── Profile: cliproxyapi (CLIProxyAPI as sidecar) ─────────────────
+  # Official pre-built image lives on Docker Hub (eceasy/cli-proxy-api);
+  # ghcr.io/router-for-me/* is not publicly pullable. v6.9.7 is the pinned
+  # version the sidecar integration (port 8317, /v1/models healthcheck) targets.
   cliproxyapi:
     container_name: cliproxyapi
-    image: ghcr.io/router-for-me/cliproxyapi:v6.9.7
+    image: docker.io/eceasy/cli-proxy-api:v6.9.7
     restart: unless-stopped
     ports:
       - "${CLIPROXYAPI_PORT:-8317}:${CLIPROXYAPI_PORT:-8317}"

docs/architecture/cluster-decisions.md

@@ -55,9 +55,9 @@ The two profiles here are **scale-out options for deployments that hit the SQLit
 
 **What it adds:**
 
-| Service   | Image                            | Ports  | Notes                                                                   |
-| --------- | -------------------------------- | ------ | ----------------------------------------------------------------------- |
-| `bifrost` | `ghcr.io/maximhq/bifrost:1.5.21` | `8080` | Go-based Tier-1 router; persistent logs volume `omniroute_bifrost_logs` |
+| Service   | Image                             | Ports  | Notes                                                                   |
+| --------- | --------------------------------- | ------ | ----------------------------------------------------------------------- |
+| `bifrost` | `ghcr.io/maximhq/bifrost:v1.6.11` | `8080` | Go-based Tier-1 router; persistent logs volume `omniroute_bifrost_logs` |
 
 **Activation:** set `BIFROST_BASE_URL=http://bifrost:8080` in `.env.example`. The existing sidecar proxy route at [`src/app/api/v1/relay/chat/completions/bifrost/route.ts`](../../src/app/api/v1/relay/chat/completions/bifrost/route.ts) (added in PR #4381) will pick this up automatically.
 

docs/guides/DOCKER_GUIDE.md

@@ -285,8 +285,12 @@ Next.js `basePath` is compiled into the standalone bundle. OmniRoute records the
 value in a sentinel file at the app root (written during `npm run build`; read by
 `scripts/docker/ensure-docker-base-path.mjs`) and compares it with
 `OMNIROUTE_BASE_PATH` when the container starts. When they differ and the image was
-built for the domain root, the entrypoint rewrites the standalone manifests and embedded
-`basePath` literals before `node dev/run-standalone.mjs` runs.
+built for the domain root, the entrypoint rewrites the standalone manifests, the
+embedded `basePath`/`assetPrefix` literals (Next 16 renders SSR asset URLs from
+`assetPrefix` alone — the patcher mirrors the subpath into it), the baked
+`/_next/static` asset URLs (client-reference manifests, media imports, prerendered
+error pages) and the client `process.env` shim before `node dev/run-standalone.mjs`
+runs.
 
 ### Compose build (recommended)
 

next.config.mjs

@@ -113,6 +113,12 @@ const nextConfig = {
   // keeps operating on un-prefixed paths — see src/server/authz/pipeline.ts for
   // the two redirect call sites that re-add it via `request.nextUrl.basePath`.
   basePath: normalizeBasePath(process.env.OMNIROUTE_BASE_PATH),
+  // Next 16 (both webpack and Turbopack) app-router renders SSR asset URLs from
+  // `assetPrefix` ALONE — basePath only affects routing/links. Without mirroring
+  // it here, a subpath build emits /_next/static shell references that 404
+  // behind a reverse proxy. The Docker runtime patcher (ensure-docker-base-path)
+  // rewrites the same knob for prebuilt root-path images.
+  assetPrefix: normalizeBasePath(process.env.OMNIROUTE_BASE_PATH) || undefined,
   // Client-visible mirror of basePath for fetch/EventSource rewriting under reverse
   // proxies (installBasePathFetch), and for client display helpers (useDisplayBaseUrl)
   // that append the subpath to window.location.origin when building curl/endpoint

scripts/docker/patch-standalone-base-path.mjs

@@ -67,21 +67,76 @@ export function patchJsonManifestFile(filePath, basePath) {
 }
 
 const BASE_PATH_LITERAL_RE =
-  /basePath\s*:\s*(?:""|''|`{2})|basePath\s*:\s*void 0|"basePath"\s*:\s*""/g;
+  /(?:basePath|assetPrefix)\s*:\s*(?:""|''|``)|(?:basePath|assetPrefix)\s*:\s*void 0|"(?:basePath|assetPrefix)"\s*:\s*""|"NEXT_PUBLIC_OMNIROUTE_BASE_PATH"\s*:\s*""|NEXT_PUBLIC_OMNIROUTE_BASE_PATH\s*:\s*""/g;
 
 /**
+ * Rewrite the bare config literals Next bakes into the standalone output:
+ *   - `basePath` (routing + server-rendered links) — the original scope;
+ *   - `assetPrefix` (Next 16 app-router renders SSR asset URLs from
+ *     `assetPrefix` ALONE — basePath only affects routing, so a subpath
+ *     deploy must mirror it or every `/_next/static` shell reference 404s);
+ *   - the `NEXT_PUBLIC_OMNIROUTE_BASE_PATH` env mirror in the inline
+ *     nextConfig (server.js) so server-side env reads stay consistent.
+ *
  * @param {string} content
  * @param {string} basePath
  */
 export function patchBasePathLiterals(content, basePath) {
   const escaped = basePath.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
   return content.replace(BASE_PATH_LITERAL_RE, (match) => {
-    if (match.startsWith('"basePath"')) return `"basePath":"${escaped}"`;
-    if (match.includes("void 0")) return `basePath:"${escaped}"`;
-    return `basePath:"${escaped}"`;
+    if (match.startsWith('"NEXT_PUBLIC_OMNIROUTE_BASE_PATH"')) {
+      return `"NEXT_PUBLIC_OMNIROUTE_BASE_PATH":"${escaped}"`;
+    }
+    if (match.startsWith("NEXT_PUBLIC_OMNIROUTE_BASE_PATH")) {
+      return `NEXT_PUBLIC_OMNIROUTE_BASE_PATH:"${escaped}"`;
+    }
+    if (match.startsWith('"')) {
+      // `"basePath":""` / `"assetPrefix":""` (JSON-ish inline config)
+      const key = match.slice(1, match.indexOf('"', 1));
+      return `"${key}":"${escaped}"`;
+    }
+    // `basePath:""` / `basePath:void 0` / `assetPrefix:""` (minified code)
+    const key = match.slice(0, match.indexOf(":")).trim();
+    return `${key}:"${escaped}"`;
   });
 }
 
+/**
+ * Turbopack's client `process` shim ships an empty env object (`.env={}`).
+ * Next 16's client code reads NEXT_PUBLIC_* / OMNIROUTE_BASE_PATH from it at
+ * runtime, so without this the client never learns the subpath and the
+ * dashboard's fetch/EventSource rewriting (basePathFetch) silently stays on
+ * the root path. Populate the two keys the app reads.
+ *
+ * @param {string} content
+ * @param {string} basePath
+ */
+export function patchProcessEnvShim(content, basePath) {
+  const escaped = basePath.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+  return content.replace(/\.env=\{\}/g, () => {
+    const keys = `OMNIROUTE_BASE_PATH:"${escaped}",NEXT_PUBLIC_OMNIROUTE_BASE_PATH:"${escaped}"`;
+    return `.env={${keys}}`;
+  });
+}
+
+/**
+ * Rewrite baked absolute asset URLs (`"/_next/static/..."`) to the subpath.
+ * Covers the client-reference-manifest chunk lists (they are serialized into
+ * the RSC flight payload verbatim) and the client/server chunk media imports
+ * — every `/ _next/static` reference must be prefixed because the standalone
+ * server only serves assets under basePath.
+ *
+ * @param {string} content
+ * @param {string} basePath
+ */
+export function patchBakedAssetUrls(content, basePath) {
+  const escaped = basePath.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+  return content.replace(
+    /(["'`])\/_next\/static/g,
+    (_match, quote) => `${quote}${escaped}/_next/static`
+  );
+}
+
 /**
  * @param {string} rootDir
  * @param {string} basePath
@@ -98,9 +153,12 @@ function walkAndPatchTextFiles(rootDir, basePath) {
         stack.push(full);
         continue;
       }
-      if (!/\.(?:js|json|cjs|mjs)$/.test(entry.name)) continue;
+      if (!/\.(?:js|json|cjs|mjs|html)$/.test(entry.name)) continue;
       const before = fs.readFileSync(full, "utf8");
-      const after = patchBasePathLiterals(before, basePath);
+      const after = [patchBasePathLiterals, patchProcessEnvShim, patchBakedAssetUrls].reduce(
+        (content, patch) => patch(content, basePath),
+        before
+      );
       if (after !== before) {
         fs.writeFileSync(full, after);
         patchedFiles += 1;

tests/unit/docker-base-path-patch.test.ts

@@ -7,6 +7,8 @@ import {
   patchBasePathLiterals,
   patchJsonManifestFile,
   patchStandaloneBasePath,
+  patchProcessEnvShim,
+  patchBakedAssetUrls,
 } from "../../scripts/docker/patch-standalone-base-path.mjs";
 
 test("patchBasePathLiterals rewrites empty basePath literals", () => {
@@ -19,10 +21,7 @@ test("patchBasePathLiterals rewrites empty basePath literals", () => {
 test("patchJsonManifestFile updates nested basePath fields", () => {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-basepath-"));
   const filePath = path.join(dir, "routes-manifest.json");
-  fs.writeFileSync(
-    filePath,
-    JSON.stringify({ basePath: "", nested: { basePath: "" } }, null, 2)
-  );
+  fs.writeFileSync(filePath, JSON.stringify({ basePath: "", nested: { basePath: "" } }, null, 2));
   assert.equal(patchJsonManifestFile(filePath, "/omniroute"), true);
   const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
   assert.equal(parsed.basePath, "/omniroute");
@@ -33,14 +32,8 @@ test("patchStandaloneBasePath rewrites a root-path standalone tree", () => {
   const appRoot = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-standalone-"));
   const distRoot = path.join(appRoot, ".build", "next");
   fs.mkdirSync(path.join(distRoot, "server"), { recursive: true });
-  fs.writeFileSync(
-    path.join(distRoot, "routes-manifest.json"),
-    JSON.stringify({ basePath: "" })
-  );
-  fs.writeFileSync(
-    path.join(distRoot, "server", "chunk.js"),
-    'export const config={basePath:""};'
-  );
+  fs.writeFileSync(path.join(distRoot, "routes-manifest.json"), JSON.stringify({ basePath: "" }));
+  fs.writeFileSync(path.join(distRoot, "server", "chunk.js"), 'export const config={basePath:""};');
   fs.writeFileSync(path.join(appRoot, "BUILD_OMNIROUTE_BASE_PATH"), "\n");
 
   const result = patchStandaloneBasePath({
@@ -68,3 +61,56 @@ test("patchStandaloneBasePath rejects mismatched non-root builds", () => {
     /does not match the image build/
   );
 });
+
+test("patchBasePathLiterals rewrites assetPrefix literals (Next 16 SSR asset URLs)", () => {
+  // Next 16 app-router renders SSR asset URLs from assetPrefix ALONE.
+  assert.equal(
+    patchBasePathLiterals('{"assetPrefix":""}', "/omniroute"),
+    '{"assetPrefix":"/omniroute"}'
+  );
+  assert.equal(patchBasePathLiterals('assetPrefix:""', "/omniroute"), 'assetPrefix:"/omniroute"');
+  assert.equal(
+    patchBasePathLiterals("assetPrefix:void 0", "/omniroute"),
+    'assetPrefix:"/omniroute"'
+  );
+  // Asset prefix must mirror the basePath so both routing and assets align.
+  const mixed = patchBasePathLiterals('{"basePath":"","assetPrefix":""}', "/omniroute");
+  assert.match(mixed, /"basePath":"\/omniroute"/);
+  assert.match(mixed, /"assetPrefix":"\/omniroute"/);
+});
+
+test("patchBasePathLiterals rewrites the NEXT_PUBLIC env mirror", () => {
+  assert.equal(
+    patchBasePathLiterals('{"env":{"NEXT_PUBLIC_OMNIROUTE_BASE_PATH":""}}', "/omniroute"),
+    '{"env":{"NEXT_PUBLIC_OMNIROUTE_BASE_PATH":"/omniroute"}}'
+  );
+  assert.equal(
+    patchBasePathLiterals('NEXT_PUBLIC_OMNIROUTE_BASE_PATH:""', "/omniroute"),
+    'NEXT_PUBLIC_OMNIROUTE_BASE_PATH:"/omniroute"'
+  );
+});
+
+test("patchProcessEnvShim populates the Turbopack client process env", () => {
+  assert.equal(
+    patchProcessEnvShim("o.env={},o.argv=[]", "/omniroute"),
+    'o.env={OMNIROUTE_BASE_PATH:"/omniroute",NEXT_PUBLIC_OMNIROUTE_BASE_PATH:"/omniroute"},o.argv=[]'
+  );
+  // Non-empty env objects are left untouched (never clobber baked values).
+  assert.equal(patchProcessEnvShim("o.env={A:1}", "/omniroute"), "o.env={A:1}");
+});
+
+test("patchBakedAssetUrls prefixes absolute _next/static URLs", () => {
+  assert.equal(
+    patchBakedAssetUrls('"/_next/static/chunks/a.js"', "/omniroute"),
+    '"/omniroute/_next/static/chunks/a.js"'
+  );
+  assert.equal(
+    patchBakedAssetUrls("'/_next/static/media/m.png'", "/omniroute"),
+    "'/omniroute/_next/static/media/m.png'"
+  );
+  // Already-prefixed URLs are stable.
+  assert.equal(
+    patchBakedAssetUrls('"/omniroute/_next/static/a.js"', "/omniroute"),
+    '"/omniroute/_next/static/a.js"'
+  );
+});