[ragnorc]

While a server asks for a sign-in nobody holds, every read is refused. Each pane showed the raw 401 ("one bearer credential is required") with a Refresh or Try again that would be refused too. Only the status chip said "Sign in needed", and nothing in the window said where to sign in. It was first seen on a managed cluster after its sign-in was enabled.

What the window shows now

• A tab that reads the graph: "Sign in to <server>", then the Open dialog's sentence with the server named ("<server> asks you to sign in at <issuer host>."), and Sign in. While the browser is open, it says "Finish signing in at <issuer host> in your browser." and offers Cancel.
• The types sidebar: "Sign in to <server> to see its types." in place of its 401 and Try again.
• A tab that reads nothing from the server (settings, the design gallery, an agent conversation): drawn as it is (Item::reads_graph, true by default).
• Once a sign-in is held: the tabs are drawn again and read. The pane read the connection when it drew, so the connection's change redraws it with no extra subscription.

Connection::sign_in_prompt (graph_store) decides the sentence and the action, and studio_workspace::sign_in_prompt draws it. The pane and the sidebar both use them.

Tests

• graph_store sign_in::tests::a_server_that_offers_sign_in_is_signed_in_through_the_browser is extended: the prompt while sign-in is offered, while the browser is open, and none once signed in.
• studio_workspace tests::a_tab_that_reads_the_graph_shows_the_sign_in_its_server_asks_for is new: a graph tab shows the prompt, a settings-like tab doesn't, and the tab comes back when the server stops asking. It fails without the pane's prompt (checked).

The full local gate passes: fmt, layers, design tokens, brand, clippy -D warnings and cargo test --workspace.

---

Note

Low Risk
Presentation-layer gating on existing connection sign-in state; auth/token logic is largely unchanged aside from new prompt derivation.

Overview
When the graph server is unauthorized and no sign-in flow is already held, graph-backed tabs no longer surface useless 401 errors with Refresh / Try again. They show a dedicated sign-in empty state instead.

Connection::sign_in_prompt (with SignInPrompt / PromptAction) maps connection sign-in state to the message and optional Sign in or Cancel action, aligned with the Open dialog copy. studio_workspace::sign_in_prompt renders that as UI and wires buttons to sign_in / cancel_sign_in.

Workspace pane rendering checks Item::reads_graph (default true; settings, design gallery, and agent tabs opt out) and replaces tab body content with the prompt when needed. The types sidebar shows a short “Sign in to … to see its types.” note in the same situation. After sign-in completes, panes redraw from the existing connection observation path.

Tests cover prompt text through the browser flow in graph_store and tab vs non-tab behavior in studio_workspace; spec 016 documents the UX.

^{Reviewed by Cursor Bugbot for commit 050090d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: b3273bbc-9d1a-406d-a7d1-9ebb60ff0f3f)