fix(chat): resolve the landing route without blocking on the database

Server-resolving the first workflow meant a session lookup, an access check and
a query had to finish before anything rendered. A slow or unreachable database
left the user on a blank page under a populated sidebar — worse than the
instant redirect it replaced, and with no signal that anything was wrong.

Redirect straight to `/w` instead and let it pick from the workflow list the
layout already prefetches, so the choice costs no round trip and cannot hang.

Repoints the sidebar's primary action rather than hiding it: the slot that
offered "New chat" now offers "New workflow" and creates one, since with Chat
off there is no composer to open but the intent is the same.

Sends the CLI key handoff to signup rather than login. It is reached from a
terminal — usually the setup wizard standing up a fresh self-host — where the
visitor has no account yet. Both auth pages cross-link carrying the callback,
so a returning user is one click from login with their destination intact.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ErcRgvi7VQBeKDQ3MBMha

Author: TheodoreSpeaks

apps/sim/app/cli/auth/page.tsx

@@ -19,11 +19,17 @@ export const dynamic = 'force-dynamic'
 /**
  * Browser half of the CLI key handoff.
  *
- * Signed-out visitors bounce through login carrying a *re-serialized*
+ * Signed-out visitors bounce through signup carrying a *re-serialized*
  * `callbackUrl` — only the params the handoff understands survive, so the round
  * trip cannot be used to smuggle anything else back into this page. The request
  * is validated before that bounce: a bogus callback is rejected here rather
  * than after making the user sign in for nothing.
+ *
+ * Signup rather than login because this page is reached from a terminal: the
+ * setup wizard sends people here while standing up a self-host, and someone
+ * configuring Sim for the first time has no account yet. Both auth pages
+ * cross-link carrying the same `callbackUrl`, so a returning user is one click
+ * from login with their destination intact.
  */
 export default async function CliAuthPage({
   searchParams,
@@ -43,7 +49,7 @@ export default async function CliAuthPage({
       challenge: resolution.request.challenge,
       pairing: resolution.request.pairing,
     })
-    redirect(`/login?callbackUrl=${encodeURIComponent(`/cli/auth?${query}`)}`)
+    redirect(`/signup?callbackUrl=${encodeURIComponent(`/cli/auth?${query}`)}`)
   }
 
   return (

apps/sim/app/workspace/[workspaceId]/page.tsx

@@ -1,43 +1,21 @@
 import { redirect } from 'next/navigation'
-import { getSession } from '@/lib/auth'
 import { isChatEnabled } from '@/lib/core/config/env-flags'
-import { getFirstWorkflowIdForWorkspace } from '@/lib/workflows/queries'
-import { getWorkspaceHostContextForViewer } from '@/lib/workspaces/host-context'
 
 /**
  * Resolves the workspace landing route. With Chat enabled that is the chat
- * composer; otherwise it is the workspace's first workflow, resolved here so the
- * browser makes a single server redirect instead of bouncing through `/w`, which
- * would mount a client component and flash a spinner before redirecting again.
+ * composer; otherwise `/w`, which selects the first workflow from the workflow
+ * list the layout already prefetched.
  *
- * Access is checked before resolving: this page and the layout render
- * concurrently, so redirecting first would put a real workflow id in a
- * non-member's URL bar and history before the layout denies them. `getSession`
- * and `getWorkspaceHostContextForViewer` are both request-memoized, so the
- * checks are shared with the layout rather than duplicated.
+ * Deliberately does no work of its own. Resolving the workflow here would mean
+ * a session lookup, an access check, and a query before anything renders — and
+ * a slow database would leave the user on a blank page instead of a redirect,
+ * since there is nothing to show until all three finish.
  */
 export default async function WorkspacePage({
   params,
 }: {
   params: Promise<{ workspaceId: string }>
 }) {
   const { workspaceId } = await params
-
-  if (isChatEnabled) {
-    redirect(`/workspace/${workspaceId}/home`)
-  }
-
-  const session = await getSession()
-  if (!session?.user) {
-    redirect('/login')
-  }
-
-  const hostContext = await getWorkspaceHostContextForViewer(workspaceId, session.user.id)
-  if (!hostContext) {
-    // The layout renders WorkspaceAccessDenied for this case.
-    return null
-  }
-
-  const workflowId = await getFirstWorkflowIdForWorkspace(workspaceId)
-  redirect(workflowId ? `/workspace/${workspaceId}/w/${workflowId}` : `/workspace/${workspaceId}/w`)
+  redirect(`/workspace/${workspaceId}/${isChatEnabled ? 'home' : 'w'}`)
 }

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx

@@ -733,12 +733,14 @@ export const Sidebar = memo(function Sidebar({
   const topNavItems = useMemo(
     () =>
       [
+        // Same slot either way: the primary "start something new" action. With
+        // Chat off that is a workflow, since there is no composer to open.
         {
           id: 'home',
-          label: 'New chat',
-          icon: Home,
-          href: `/workspace/${workspaceId}/home`,
-          hidden: !isChatEnabled,
+          label: isChatEnabled ? 'New chat' : 'New workflow',
+          icon: isChatEnabled ? Home : Plus,
+          href: isChatEnabled ? `/workspace/${workspaceId}/home` : undefined,
+          onClick: isChatEnabled ? undefined : createWorkflow,
         },
         {
           id: 'search',
@@ -755,7 +757,7 @@ export const Sidebar = memo(function Sidebar({
           hidden: permissionConfig.hideIntegrationsTab,
         },
       ].filter((item) => !item.hidden),
-    [workspaceId, openSearchModal, permissionConfig.hideIntegrationsTab]
+    [workspaceId, openSearchModal, createWorkflow, permissionConfig.hideIntegrationsTab]
   )
 
   const workspaceNavItems = useMemo(

apps/sim/lib/workflows/queries.ts

@@ -64,23 +64,6 @@ function scopeCondition(
   return and(base, isNull(workflow.archivedAt))
 }
 
-/**
- * The workspace's first active workflow in list order, or `null` when it has
- * none. Shares {@link orderByClause} with {@link listWorkflowsForUser} so the
- * workspace landing route resolves to the same workflow the sidebar lists
- * first. Performs no auth checks — callers enforce workspace access before
- * invoking.
- */
-export async function getFirstWorkflowIdForWorkspace(workspaceId: string): Promise<string | null> {
-  const [row] = await db
-    .select({ id: workflow.id })
-    .from(workflow)
-    .where(and(eq(workflow.workspaceId, workspaceId), isNull(workflow.archivedAt)))
-    .orderBy(...orderByClause)
-    .limit(1)
-  return row?.id ?? null
-}
-
 /**
  * Lists workflows visible to a user as the contract wire shape, shared by the
  * `GET /api/workflows` route and the workspace sidebar prefetch. Performs no auth

scripts/setup/cli-auth.ts

@@ -76,7 +76,7 @@ export async function browserKeyFlow(origin: string): Promise<string | null> {
     'Confirm this code in your browser'
   )
   p.log.info(
-    `Opening your browser — sign in and approve; the key comes back automatically.\n   If it doesn't open: ${link(authUrl, authUrl)}`
+    `Opening your browser — create your account (or sign in) and approve; the key comes back automatically.\n   If it doesn't open: ${link(authUrl, authUrl)}`
   )
   openBrowser(authUrl)