web: stop advertising retired hosted subrouter by teamleaderleo · Pull Request #20163 · manaflow-ai/cmux

teamleaderleo · 2026-10-13T04:50:15Z

The CLI config endpoint advertised sr.cmux.com even when the hosted Subrouter URL was unset. That retired origin has no DNS, so new sr login clients attempted a dead exchange path. Make hosted Subrouter opt-in: when SUBROUTER_HOSTED_URL is absent, omit the subrouter block from public CLI config instead of publishing a dead default.

Validation:

heavy --mem 4G bun test web/tests/cli-config-route.test.ts
7 tests passed

The released CLI fallback in subrouter recognizes the omitted block and directs users to the legacy/team-server path.

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by cubic

Stops the CLI config endpoint from advertising the retired hosted Subrouter origin, which has no DNS and previously sent new sr login clients down a dead exchange path. Hosted Subrouter is now opt-in.

When SUBROUTER_HOSTED_URL is unset, the public CLI config omits the subrouter block instead of publishing the dead default.
When the env var is set to an invalid URL, the route returns 503.
The released CLI fallback recognizes the omitted block and directs users to the legacy/team-server path.

Validation: heavy --mem 4G bun test web/tests/cli-config-route.test.ts — 7 tests passed.

^{Written for commit 8814110. Summary will update on new commits.}

Summary by CodeRabbit

Bug Fixes
- CLI configuration now includes Subrouter URLs only when a hosted URL is configured, rather than using a default URL when none is set. When no hosted URL is configured, the Subrouter field is omitted. Invalid hosted URLs, including URLs using HTTP, return an unavailable response.

cursor · 2026-10-13T04:50:26Z

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

coderabbitai · 2026-10-13T04:51:10Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 98e4891e-4f56-4acb-9cf2-d9493061f74c

📥 Commits

Reviewing files that changed from the base of the PR and between fdcf8a4 and 8814110.

📒 Files selected for processing: 1

web/tests/cli-config-route.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

📝 Walkthrough

The CLI config route no longer falls back to a default hosted Subrouter URL. It validates and normalizes SUBROUTER_HOSTED_URL when set, returns the existing unavailable response for invalid values, and includes Subrouter URLs only when a hosted URL is configured.

Changes: CLI Subrouter configuration

Layer / File(s)	Summary
Hosted URL validation and response `web/app/api/cli/config/route.ts`, `web/tests/cli-config-route.test.ts`	The route no longer uses a default hosted origin. It normalizes a configured URL and returns the existing unavailable response if normalization fails. The response includes the `subrouter` field only when a hosted URL is configured. Tests cover an unset URL in production and an HTTP URL returning `cli_auth_unavailable` with status 503.

Priority: ⬆️ High

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 88141

Clients no longer receive the default Subrouter URL when the setting is absent. The reported production override remains unverified, so no current merge-blocking issue is established.

Pre-merge checks: 23 · 2

Failed checks: 2 warnings

Check name	Status	Explanation	Resolution
Description check		The description explains the problem, resulting behavior, fallback behavior, and test command. However, it does not follow the repository template because it omits the Summary, Testing, Changelog, Pro…	Restructure the description using the required template. Add explicit Summary, Testing, Changelog, Proof, and Checklist sections. Include a release-note line, state why proof is not applicable if needed, and complete or explain each checkli…
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 23 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: stopping the CLI from advertising the retired hosted Subrouter.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Cmux Cloud Persistent Session And Early Input		PASS. The pull request changes only the web CLI config route and its tests. It removes the default hosted Subrouter URL fallback, conditionally omits `subrouter`, and rejects invalid hosted URLs. The …
Cmux Swift Actor Isolation		The pull request changes only `web/app/api/cli/config/route.ts` and `web/tests/cli-config-route.test.ts`. It introduces no Swift or Swift project changes, so it cannot introduce or worsen Swift 6 acto…
Cmux Swift Blocking Runtime		The pull request changes only `web/app/api/cli/config/route.ts` and `web/tests/cli-config-route.test.ts`. It contains no Swift or production Swift changes, so the Swift blocking-runtime condition does…
Cmux Browser Automation Off-Main		The pull request changes only `web/app/api/cli/config/route.ts` and `web/tests/cli-config-route.test.ts`. It does not change browser socket automation, `Sources/TerminalController.swift`, `ControlComm…
Cmux Expensive Synchronous Load		The pull request changes only `web/app/api/cli/config/route.ts` and `web/tests/cli-config-route.test.ts`. The diff contains no Swift files and no agent-history, transcript, JSONL, directory-scan, or s…
Cmux Cache Substitution Correctness		PASS. The changed production TypeScript route reads `process.env.SUBROUTER_HOSTED_URL` directly and conditionally builds the response. The diff does not replace an authoritative read with a cache, and…
Cmux No Hacky Sleeps		The pull request changes only the CLI config route and its tests. The diff adds URL validation and conditional response construction. It introduces no sleeps, timers, polling, fixed delays, or wall-cl…
Cmux Algorithmic Complexity		PASS. The production change in `web/app/api/cli/config/route.ts` adds only scalar environment checks, URL validation, object construction, and a conditional object spread. It does not iterate over sca…
Cmux Swift Concurrency		The pull request changes only `web/app/api/cli/config/route.ts` and `web/tests/cli-config-route.test.ts`. The reviewed diff contains no Swift files, so it does not introduce or expand any Swift concur…
Cmux Swift `@Concurrent`		The pull request changes only `web/app/api/cli/config/route.ts` and `web/tests/cli-config-route.test.ts`. The diff contains no Swift files or Swift async functions, actor isolation, or `@concurrent` u…
Cmux Swift Package Boundaries		The pull request changes only `web/app/api/cli/config/route.ts` and `web/tests/cli-config-route.test.ts`. The diff contains no Swift production changes, so the Swift package-boundary rule does not app…
Cmux Swiftpm Lockfiles		The pull request changes only web route and test files. It does not modify a SwiftPM package, Package.swift dependency, Package.resolved, Xcode project/workspace, .gitignore, workflow, or dependency c…
Cmux Swift Logging		The pull request changes only TypeScript files: `web/app/api/cli/config/route.ts` and its tests. It adds no Swift logging or other Swift runtime code. The Swift logging failure conditions do not apply…
Cmux User-Facing Error Privacy		PASS. The changed public path is `GET /api/cli/config`, which the product CLI loads in `coderouter/src/control_plane.rs:276-289`. The new failure path returns only the existing generic `{"error":"cli_…
Cmux Full Internationalization		PASS. The production diff changes CLI configuration protocol data only: it conditionally omits the `subrouter` URL block and validates `SUBROUTER_HOSTED_URL`. It adds no user-facing copy, Swift text, …
Cmux Swiftui State Layout		PASS: The pull request changes only `web/app/api/cli/config/route.ts` and `web/tests/cli-config-route.test.ts`. It contains no SwiftUI or Swift changes, so the SwiftUI state-layout rules do not apply.
Cmux Architecture Rethink		PASS: The pull request changes only TypeScript web code and TypeScript tests (`web/app/api/cli/config/route.ts` and `web/tests/cli-config-route.test.ts`). It introduces no Swift architecture changes a…
Cmux Swift Auxiliary Window Close Shortcuts		PASS. The pull request changes only `web/app/api/cli/config/route.ts` and `web/tests/cli-config-route.test.ts`. It introduces no Swift or standalone cmux window code, so the auxiliary-window close-sho…
Cmux Source Artifacts		The PR changes only `web/app/api/cli/config/route.ts` and `web/tests/cli-config-route.test.ts`. The diff contains hand-written application code and tests. It adds no logs, screenshots, recordings, tem…
Cmux No Test Or Debug Seam In Production Source		The pull request changes only `web/app/api/cli/config/route.ts` and `web/tests/cli-config-route.test.ts`. It changes no Swift file under a production `Sources/` path, so this check is not applicable.

Full details: Cmux Cloud Persistent Session And Early Input

Explanation

PASS. The pull request changes only the web CLI config route and its tests. It removes the default hosted Subrouter URL fallback, conditionally omits subrouter, and rejects invalid hosted URLs. The diff does not change Cloud terminal creation, cmux-tui clients, physical transports, readiness gates, input ownership, snapshots, auth, idempotency, revision, or lease fences.

Full details: Cmux Swift Actor Isolation

Explanation

The pull request changes only web/app/api/cli/config/route.ts and web/tests/cli-config-route.test.ts. It introduces no Swift or Swift project changes, so it cannot introduce or worsen Swift 6 actor isolation mistakes.

Full details: Cmux Swift Blocking Runtime

Explanation

The pull request changes only web/app/api/cli/config/route.ts and web/tests/cli-config-route.test.ts. It contains no Swift or production Swift changes, so the Swift blocking-runtime condition does not apply.

Full details: Cmux Browser Automation Off-Main

Explanation

The pull request changes only web/app/api/cli/config/route.ts and web/tests/cli-config-route.test.ts. It does not change browser socket automation, Sources/TerminalController.swift, ControlCommandExecutionPolicy.swift, worker routing, WebKit/AppKit access, or policy tests. The custom check is therefore not applicable.

Full details: Cmux Expensive Synchronous Load

Explanation

The pull request changes only web/app/api/cli/config/route.ts and web/tests/cli-config-route.test.ts. The diff contains no Swift files and no agent-history, transcript, JSONL, directory-scan, or synchronous load changes. The custom check is therefore not triggered.

Full details: Cmux Cache Substitution Correctness

Explanation

PASS. The changed production TypeScript route reads process.env.SUBROUTER_HOSTED_URL directly and conditionally builds the response. The diff does not replace an authoritative read with a cache, and the route has no persistence, history, undo, or snapshot consumer. Its only cache-related behavior is cache-control: no-store on the HTTP response. Therefore cold-cache and stale-cache handling do not apply.

Full details: Cmux No Hacky Sleeps

Explanation

The pull request changes only the CLI config route and its tests. The diff adds URL validation and conditional response construction. It introduces no sleeps, timers, polling, fixed delays, or wall-clock synchronization. The added tests use awaited request handling only.

Full details: Cmux Algorithmic Complexity

Explanation

PASS. The production change in web/app/api/cli/config/route.ts adds only scalar environment checks, URL validation, object construction, and a conditional object spread. It does not iterate over scalable collections or add sorting, filtering, rescans, joins, or slower batch logic. The changed tests are test-only code.

Full details: Cmux Swift Concurrency

Explanation

The pull request changes only web/app/api/cli/config/route.ts and web/tests/cli-config-route.test.ts. The reviewed diff contains no Swift files, so it does not introduce or expand any Swift concurrency pattern.

Full details: Cmux Swift `@Concurrent`

Explanation

The pull request changes only web/app/api/cli/config/route.ts and web/tests/cli-config-route.test.ts. The diff contains no Swift files or Swift async functions, actor isolation, or @concurrent usage. The Swift-specific check is not applicable.

Full details: Cmux Swift Package Boundaries

Explanation

The pull request changes only web/app/api/cli/config/route.ts and web/tests/cli-config-route.test.ts. The diff contains no Swift production changes, so the Swift package-boundary rule does not apply.

Full details: Cmux Swiftpm Lockfiles

Explanation

The pull request changes only web route and test files. It does not modify a SwiftPM package, Package.swift dependency, Package.resolved, Xcode project/workspace, .gitignore, workflow, or dependency configuration. The SwiftPM lockfile policy is therefore not triggered.

Full details: Cmux Swift Logging

Explanation

The pull request changes only TypeScript files: web/app/api/cli/config/route.ts and its tests. It adds no Swift logging or other Swift runtime code. The Swift logging failure conditions do not apply.

Full details: Cmux User-Facing Error Privacy

Explanation

PASS. The changed public path is GET /api/cli/config, which the product CLI loads in coderouter/src/control_plane.rs:276-289. The new failure path returns only the existing generic {"error":"cli_auth_unavailable"} body and HTTP 503. The normal response omits subrouter when no URL is configured. The diff adds no vendor names, environment details, raw upstream messages, credentials, or payloads to user-facing output. Comments and tests are allowed by the rule.

Full details: Cmux Full Internationalization

Explanation

PASS. The production diff changes CLI configuration protocol data only: it conditionally omits the subrouter URL block and validates SUBROUTER_HOSTED_URL. It adds no user-facing copy, Swift text, message key, metadata, or locale-dependent web data. The changed comments are developer-only, and the tests contain no production UI text requiring localization.

Full details: Cmux Architecture Rethink

Explanation

PASS: The pull request changes only TypeScript web code and TypeScript tests (web/app/api/cli/config/route.ts and web/tests/cli-config-route.test.ts). It introduces no Swift architecture changes and none of the Swift-specific failure patterns in .github/review-bot-rules/swift-architectural-rethink.md apply.

Full details: Cmux Swift Auxiliary Window Close Shortcuts

Explanation

PASS. The pull request changes only web/app/api/cli/config/route.ts and web/tests/cli-config-route.test.ts. It introduces no Swift or standalone cmux window code, so the auxiliary-window close-shortcut rule does not apply.

Full details: Cmux Source Artifacts

Explanation

The PR changes only web/app/api/cli/config/route.ts and web/tests/cli-config-route.test.ts. The diff contains hand-written application code and tests. It adds no logs, screenshots, recordings, temporary or cache directories, build output, dependency checkouts, or other source-control artifacts.

Full details: Description check

Explanation

The description explains the problem, resulting behavior, fallback behavior, and test command. However, it does not follow the repository template because it omits the Summary, Testing, Changelog, Proof, and Checklist sections, and it does not provide a changelog entry or proof statement.

Resolution

Restructure the description using the required template. Add explicit Summary, Testing, Changelog, Proof, and Checklist sections. Include a release-note line, state why proof is not applicable if needed, and complete or explain each checklist item.

Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

cursor · 2026-10-13T04:52:36Z

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

github-actions · 2026-10-13T04:52:45Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

github-actions · 2026-10-13T04:55:17Z

Passes: CI passes on 8814110ff2.

CI passes on 8814110ff2 (run 39136605332 attempt 1).

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

github-actions · 2026-10-13T04:55:50Z

CI fast guards passes on 8814110ff2 (https://github.com/manaflow-ai/cmux/actions/runs/39136605332). This covers only the fast guards, not CI: CI's result is the ci-status check, and the CI failure attribution comment names any failing test.

lawrencecchen · 2026-10-14T09:38:31Z

DNS/monitoring finding (2026-10-14): this change alone does not stop production from advertising https://sr.cmux.com. The Vercel project cmux has SUBROUTER_HOSTED_URL set for production (value = https://sr.cmux.com, last updated 2026-07-26), so the opt-in branch still emits the dead origin. After merge, production also needs that env var removed and a redeploy.

Evidence that the retirement was deliberate: GCP audit log shows compute.instances.delete of subrouter-team (manaflow-437420/us-south1-a) by lawrence@manaflow.ai at 2026-09-09T03:12Z; Cloudflare audit log shows the sr.cmux.com and staging.sr.cmux.com A records (34.128.137.230) deleted at 2026-09-09T22:23Z. The DNS record should therefore not be restored.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…n invalid one Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions · 2026-10-18T14:43:10Z

Merge receipt for 8814110ff2: every check was green at merge (20 verified; 18 skipped by policy). Full suite runs on main after merge.

#20163 made the hosted Subrouter opt-in, so nothing calls defaultHostedSubrouterURL and the sr.cmux.com constants it returned. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

teamleaderleo requested a review from lawrencecchen as a code owner October 13, 2026 04:50

web: stop advertising retired hosted subrouter

a72b0cc

teamleaderleo force-pushed the fix/hosted-config-opt-in branch from 41867ec to a72b0cc Compare October 13, 2026 04:52

This comment has been minimized.

Sign in to view

teamleaderleo and others added 2 commits October 18, 2026 14:28

Merge main (7a70def) into fix/hosted-config-opt-in

fdcf8a4

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test(web): cover the CLI config without a hosted Subrouter and with a…

8814110

…n invalid one Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

teamleaderleo merged commit 2e75a00 into main Oct 18, 2026
76 checks passed

teamleaderleo deleted the fix/hosted-config-opt-in branch October 18, 2026 14:43

teamleaderleo mentioned this pull request Oct 19, 2026

web: delete the retired hosted Subrouter default #21942

Merged

Navigation Menu

Repository navigation

web: stop advertising retired hosted subrouter - #20163

web: stop advertising retired hosted subrouter#20163
teamleaderleo merged 3 commits into
mainfrom
fix/hosted-config-opt-in

teamleaderleo commented Oct 13, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

cursor Bot commented Oct 13, 2026

Uh oh!

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Oct 13, 2026

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

This comment has been minimized.

github-actions Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

lawrencecchen commented Oct 14, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

teamleaderleo commented Oct 13, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Summary by CodeRabbit

Uh oh!

cursor Bot commented Oct 13, 2026

Bugbot is paused — on-demand spend limit reached

Uh oh!

coderabbitai Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Oct 13, 2026

Bugbot is paused — on-demand spend limit reached

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

This comment has been minimized.

github-actions Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lawrencecchen commented Oct 14, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

teamleaderleo commented Oct 13, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading

github-actions Bot commented Oct 13, 2026 •

edited

Loading

github-actions Bot commented Oct 13, 2026 •

edited

Loading