Restore hosted Subrouter CLI configuration

[lawrencecchen]

Restores the subrouter block in /api/cli/config alongside the Vercel-native coderouter block. Released sr clients require this block to exchange Stack auth and POST hosted credentials.

Regression coverage was committed before the fix and fails on current main.

Related: manaflow-ai/subrouter#164
Related: manaflow-ai/subrouter#165

Tests:

• SKIP_ENV_VALIDATION=1 bun test tests/cli-config-route.test.ts
• SKIP_ENV_VALIDATION=1 bun run typecheck
• bunx eslint app/api/cli/config/route.ts tests/cli-config-route.test.ts

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Restore the subrouter block in /api/cli/config alongside coderouter to keep released sr clients working for hosted creds POST and Stack auth exchange. Adds URL derivation from SUBROUTER_HOSTED_URL with a safe default and updates tests to cover the contract.

• Bug Fixes
  • Build subrouter.url via hostedSubrouterBaseURL using SUBROUTER_HOSTED_URL or defaultHostedSubrouterURL(); return 503 if invalid.
  • Expose subrouter.exchangeUrl at /api/subrouter/tenant-exchange and extend tests to assert both coderouter and subrouter fields.

^{Written for commit 46ab06b. Summary will update on new commits.}

Summary by CodeRabbit

• New Features
  • CLI configuration responses now include the hosted Subrouter URL and tenant-exchange endpoint.
• Bug Fixes
  • CLI configuration requests now return a clear 503 cli_auth_unavailable response when the hosted Subrouter URL cannot be resolved.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 76e7aad7-bc81-4c0d-8a1a-8b538e91f366

📥 Commits

Reviewing files that changed from the base of the PR and between 40ff1c1 and 46ab06b.

📒 Files selected for processing (2)

• web/app/api/cli/config/route.ts
• web/tests/cli-config-route.test.ts

---

📝 Walkthrough

Walkthrough

The CLI config route now resolves a hosted Subrouter URL from environment configuration or a default. It returns hosted Subrouter and tenant-exchange endpoints and reports 503 cli_auth_unavailable when resolution fails. Tests validate the updated response.

Changes

CLI configuration contract

Layer / File(s)	Summary
Resolve and return hosted Subrouter endpoints web/app/api/cli/config/route.ts	The GET handler resolves the hosted Subrouter URL, handles resolution failures, and adds the hosted URL and tenant-exchange endpoint to the response.
Validate the hosted Subrouter response web/tests/cli-config-route.test.ts	The test fixture defines SUBROUTER_HOSTED_URL, and the primary test checks both hosted Subrouter fields.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• manaflow-ai/cmux#9261: Updates the CLI config route with hosted Subrouter URL and exchange endpoint fields.
• manaflow-ai/cmux#9607: Updates the CLI config contract with hosted Subrouter endpoints.
• manaflow-ai/cmux#9633: Changes the CLI configuration contract and tests for hosted Subrouter and CodeRouter endpoints.

🚥 Pre-merge checks | ✅ 25

✅ Passed checks (25 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the restored hosted Subrouter CLI configuration.
Description check	✅ Passed	The description covers the change, reason, tests, and related pull requests, but omits the template checklist, review trigger, and demo-video field.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Cmux Swift Actor Isolation	✅ Passed	The patch changes only web/app/api/cli/config/route.ts; the first-parent diff contains no Swift production changes.
Cmux Swift Blocking Runtime	✅ Passed	The commit changes only a TypeScript route; it introduces no production Swift changes or Swift blocking synchronization.
Cmux Browser Automation Off-Main	✅ Passed	The PR changes only web/app/api/cli/config/route.ts and adds no browser.* socket command, WebKit wait, worker routing, or cmux policy change.
Cmux Expensive Synchronous Load	✅ Passed	The pull request diff changes only a TypeScript route; it adds no production Swift changes or expensive synchronous Swift load paths.
Cmux Cache Substitution Correctness	✅ Passed	The diff only adds environment-based URL resolution and response fields in a dynamic, no-store config route; it does not replace an authoritative read with a cache in a persistence, history, or sna...
Cmux No Hacky Sleeps	✅ Passed	The PR diff adds URL resolution, response fields, and test fixtures only; it introduces no sleeps, timers, polling, fixed waits, or delay logic.
Cmux Algorithmic Complexity	✅ Passed	The production diff adds only scalar environment resolution, URL parsing, and fixed-field response construction; it introduces no scalable collection scans or nested loops.
Cmux Swift Concurrency	✅ Passed	The pull request diff changes only web/app/api/cli/config/route.ts; it introduces no cmux-owned Swift code or legacy Swift concurrency patterns.
Cmux Swift @Concurrent	✅ Passed	The pull request changes only web/app/api/cli/config/route.ts; it introduces no Swift changes or Swift concurrency call sites.
Cmux Swift Package Boundaries	✅ Passed	The PR changes only TypeScript files; the checked PR range contains zero Swift, Xcode project, or Package.swift changes, so Swift package boundaries are not applicable.
Cmux Swiftpm Lockfiles	✅ Passed	The PR changes only two web TypeScript files and does not modify SwiftPM packages, Package.resolved files, Xcode project references, .gitignore files, workflows, or dependencies.
Cmux Swift Logging	✅ Passed	The pull request changes only a TypeScript route; no Swift files or Swift logging statements are added or materially changed.
Cmux User-Facing Error Privacy	✅ Passed	The production diff reuses the generic cli_auth_unavailable body and adds only CLI routing fields; it exposes no raw messages, environment names, credentials, tokens, or provider diagnostics.
Cmux Full Internationalization	✅ Passed	The production diff adds only CLI protocol/configuration fields, URLs, and the literal error token; comments are developer-only, so no localized user-facing text or locale entries are required.
Cmux Swiftui State Layout	✅ Passed	The PR contains only TypeScript backend changes (web/app/api/cli/config/route.ts and test file). No Swift or SwiftUI files are present, so the SwiftUI state layout rule does not apply.
Cmux Architecture Rethink	✅ Passed	The PR changes only web/app/api/cli/config/route.ts; the Swift architecture rule is not applicable, and the diff contains no Swift lifecycle or synchronization changes.
Cmux Swift Auxiliary Window Close Shortcuts	✅ Passed	The pull request changes only web/app/api/cli/config/route.ts; it introduces no Swift auxiliary window code, so the close-shortcut rule is not applicable.
Cmux Source Artifacts	✅ Passed	The PR changes only web/app/api/cli/config/route.ts and web/tests/cli-config-route.test.ts; both are intentional source and test files, with no artifact paths or generated output.
Cmux No Test Or Debug Seam In Production Source	✅ Passed	The diff changes only web/app/api/cli/config/route.ts; it contains no Swift files under production Sources paths, so this check is not applicable.
Cmux No Ambient Global State	✅ Passed	The pull request changes only TypeScript in web/app/api/cli/config/route.ts; it contains no production Swift changes, so this Swift-only check does not apply.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch task-restore-hosted-subrouter-cli-config

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}