fix(docker): real image tags (bifrost/cliproxyapi) + complete OMNIROUTE_BASE_PATH runtime patcher (#10482)

* fix(docker): real image tags + complete OMNIROUTE_BASE_PATH runtime patcher

Three docker issues fixed:

1. Images that do not exist:
   - bifrost: ghcr.io/maximhq/bifrost:1.5.21 never existed (1.5.x tops at
     v1.5.16, all tags carry the v prefix) -> ghcr.io/maximhq/bifrost:v1.6.11
   - cliproxyapi: ghcr.io/router-for-me/* is not publicly pullable (403);
     the official prebuilt image is docker.io/eceasy/cli-proxy-api, where
     the pinned v6.9.7 exists -> docker.io/eceasy/cli-proxy-api:v6.9.7
   - Verified still-current: redis:8.6.5-alpine (already on Redis 8 since
     #9065; ioredis 5.10 is RESP2/3-compatible, no modules used) and
     qdrant:v1.12.4 -- both exist, unchanged.

2. OMNIROUTE_BASE_PATH ignored on prebuilt images (root cause):
   Next 16 (webpack and Turbopack) app-router renders SSR asset URLs from
   assetPrefix ALONE; basePath only affects routing. The runtime patcher
   (ensure-docker-base-path) rewrote basePath literals only, so a prebuilt
   root-path image patched to /omniroute served the page but every
   /_next/static shell reference stayed unprefixed (404 behind a subpath
   proxy), the RSC flight-payload chunk refs came from client-reference
   manifests baked with unprefixed paths, and the Turbopack client process
   shim ships an empty env object so the client never learns the subpath.
   Extended patch-standalone-base-path.mjs to also rewrite:
   - assetPrefix literals (mirrors the subpath for SSR asset URLs)
   - the NEXT_PUBLIC_OMNIROUTE_BASE_PATH env mirror in the inline config
   - the client process.env shim (.env={}) with the two basePath keys
   - every baked "/_next/static URL (manifests, media imports, .html pages)
   next.config.mjs now mirrors basePath into assetPrefix so REBUILT images
   bake prefixed assets too. E2E-verified on the published main-web image:
   HTML under /omniroute now has 16/16 prefixed JS srcs and 82/82 prefixed
   flight refs (was 13/9 + ~150 unprefixed), prefixed assets return 200.

* chore(changelog): fragment for #10482 (docker images + basepath patcher)

* chore(changelog): bullet-form fragment for #10482

* Merge branch 'release/v3.8.50' into fix/docker-compose-images-and-basepath

* test(fix): refresh expired alibaba quota sample validity and onnxruntime pin for v3.8.50 base

- alibaba-free-tier-quota-fetcher.test.ts: sample quotaValidityPeriod
  (2026-08-16 16:00 UTC) is in the past, making every quota entry classify
  as expired/not_capable; bump to 2028-01-01 UTC so the text/merge
  classification tests exercise the intended path again.
- optional-transformers-dependency.test.ts: onnxruntime-node pin assertion
  updated from ~1.24.3 to ~1.27.0 to match package.json (bumped by #10403);
  the regular-not-optional intent is unchanged.

---------

Co-authored-by: Rouzbeh <rqzbeh@users.noreply.github.com>

scripts/docker/patch-standalone-base-path.mjs

@@ -67,21 +67,76 @@ export function patchJsonManifestFile(filePath, basePath) {
 }
 
 const BASE_PATH_LITERAL_RE =
-  /basePath\s*:\s*(?:""|''|`{2})|basePath\s*:\s*void 0|"basePath"\s*:\s*""/g;
+  /(?:basePath|assetPrefix)\s*:\s*(?:""|''|``)|(?:basePath|assetPrefix)\s*:\s*void 0|"(?:basePath|assetPrefix)"\s*:\s*""|"NEXT_PUBLIC_OMNIROUTE_BASE_PATH"\s*:\s*""|NEXT_PUBLIC_OMNIROUTE_BASE_PATH\s*:\s*""/g;
 
 /**
+ * Rewrite the bare config literals Next bakes into the standalone output:
+ *   - `basePath` (routing + server-rendered links) — the original scope;
+ *   - `assetPrefix` (Next 16 app-router renders SSR asset URLs from
+ *     `assetPrefix` ALONE — basePath only affects routing, so a subpath
+ *     deploy must mirror it or every `/_next/static` shell reference 404s);
+ *   - the `NEXT_PUBLIC_OMNIROUTE_BASE_PATH` env mirror in the inline
+ *     nextConfig (server.js) so server-side env reads stay consistent.
+ *
  * @param {string} content
  * @param {string} basePath
  */
 export function patchBasePathLiterals(content, basePath) {
   const escaped = basePath.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
   return content.replace(BASE_PATH_LITERAL_RE, (match) => {
-    if (match.startsWith('"basePath"')) return `"basePath":"${escaped}"`;
-    if (match.includes("void 0")) return `basePath:"${escaped}"`;
-    return `basePath:"${escaped}"`;
+    if (match.startsWith('"NEXT_PUBLIC_OMNIROUTE_BASE_PATH"')) {
+      return `"NEXT_PUBLIC_OMNIROUTE_BASE_PATH":"${escaped}"`;
+    }
+    if (match.startsWith("NEXT_PUBLIC_OMNIROUTE_BASE_PATH")) {
+      return `NEXT_PUBLIC_OMNIROUTE_BASE_PATH:"${escaped}"`;
+    }
+    if (match.startsWith('"')) {
+      // `"basePath":""` / `"assetPrefix":""` (JSON-ish inline config)
+      const key = match.slice(1, match.indexOf('"', 1));
+      return `"${key}":"${escaped}"`;
+    }
+    // `basePath:""` / `basePath:void 0` / `assetPrefix:""` (minified code)
+    const key = match.slice(0, match.indexOf(":")).trim();
+    return `${key}:"${escaped}"`;
   });
 }
 
+/**
+ * Turbopack's client `process` shim ships an empty env object (`.env={}`).
+ * Next 16's client code reads NEXT_PUBLIC_* / OMNIROUTE_BASE_PATH from it at
+ * runtime, so without this the client never learns the subpath and the
+ * dashboard's fetch/EventSource rewriting (basePathFetch) silently stays on
+ * the root path. Populate the two keys the app reads.
+ *
+ * @param {string} content
+ * @param {string} basePath
+ */
+export function patchProcessEnvShim(content, basePath) {
+  const escaped = basePath.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+  return content.replace(/\.env=\{\}/g, () => {
+    const keys = `OMNIROUTE_BASE_PATH:"${escaped}",NEXT_PUBLIC_OMNIROUTE_BASE_PATH:"${escaped}"`;
+    return `.env={${keys}}`;
+  });
+}
+
+/**
+ * Rewrite baked absolute asset URLs (`"/_next/static/..."`) to the subpath.
+ * Covers the client-reference-manifest chunk lists (they are serialized into
+ * the RSC flight payload verbatim) and the client/server chunk media imports
+ * — every `/ _next/static` reference must be prefixed because the standalone
+ * server only serves assets under basePath.
+ *
+ * @param {string} content
+ * @param {string} basePath
+ */
+export function patchBakedAssetUrls(content, basePath) {
+  const escaped = basePath.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+  return content.replace(
+    /(["'`])\/_next\/static/g,
+    (_match, quote) => `${quote}${escaped}/_next/static`
+  );
+}
+
 /**
  * @param {string} rootDir
  * @param {string} basePath
@@ -98,9 +153,12 @@ function walkAndPatchTextFiles(rootDir, basePath) {
         stack.push(full);
         continue;
       }
-      if (!/\.(?:js|json|cjs|mjs)$/.test(entry.name)) continue;
+      if (!/\.(?:js|json|cjs|mjs|html)$/.test(entry.name)) continue;
       const before = fs.readFileSync(full, "utf8");
-      const after = patchBasePathLiterals(before, basePath);
+      const after = [patchBasePathLiterals, patchProcessEnvShim, patchBakedAssetUrls].reduce(
+        (content, patch) => patch(content, basePath),
+        before
+      );
       if (after !== before) {
         fs.writeFileSync(full, after);
         patchedFiles += 1;