fix(init): prompt for team selection when user belongs to multiple teams (#621)

## Summary

`sentry init` failed for most new users — people who just signed up on
sentry.io and ran the wizard. The root causes:

1. The CLI's OAuth token lacked `team:write` scope, so even org Owners
couldn't create teams
2. Team resolution only happened deep in the workflow (after minutes of
AI analysis), not upfront
3. The 0-teams case failed with a cryptic 403 error

Now all team scenarios are resolved early in
`resolvePreSpinnerOptions()`, right after org selection and before the
spinner starts. Also added `team:write` to the OAuth scopes.

## All team scenarios handled

| Scenario | Behavior |
|---|---|
| **0 teams** | Auto-creates a team called "default". On failure (e.g.
missing permissions), shows friendly error with link to create a team in
the UI |
| **1 team** | Auto-selects it silently |
| **Multiple teams, user is member of 1** | Auto-selects the member team
|
| **Multiple teams, user is member of several** | Shows interactive
prompt to pick one |
| **Multiple teams, user is member of several + `--yes`** | Auto-selects
the first member team |
| **Multiple teams, user is member of none** (new user) | Shows
interactive prompt with all org teams |
| **Multiple teams, user is member of none + `--yes`** | Auto-selects
the first org team |
| **`--team` flag provided** | Uses it directly, skips all resolution |
| **API error fetching teams** | Silently falls through to existing
`resolveOrCreateTeam` as fallback |

## Test plan

- [ ] `sentry login` then `sentry init` on org with 0 teams →
auto-creates "default" team, proceeds
- [ ] `sentry init` on org with 1 team → no prompt, auto-selects
- [ ] `sentry init` on org with multiple teams → shows team selection
prompt
- [ ] `sentry init --team <slug>` → skips prompt
- [ ] `sentry init --yes` on org with multiple teams → auto-selects
first member team
- [ ] Cancel team prompt (Ctrl+C) → clean exit
- [ ] Existing users need `sentry login` again to get the new
`team:write` scope

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: betegon

src/lib/init/wizard-runner.ts

@@ -18,10 +18,13 @@ import {
 } from "@clack/prompts";
 import { MastraClient } from "@mastra/client-js";
 import { captureException, getTraceData } from "@sentry/node-core/light";
+import type { SentryTeam } from "../../types/index.js";
+import { createTeam, listTeams } from "../api-client.js";
 import { formatBanner } from "../banner.js";
 import { CLI_VERSION } from "../constants.js";
 import { getAuthToken } from "../db/auth.js";
 import { terminalLink } from "../formatters/colors.js";
+import { getSentryBaseUrl } from "../sentry-urls.js";
 import { slugify } from "../utils.js";
 import {
   abortIfCancelled,
@@ -274,6 +277,13 @@ async function preamble(
   return true;
 }
 
+/**
+ * Derive a team slug for auto-creation when the org has no teams.
+ */
+function deriveTeamSlug(): string {
+  return "default";
+}
+
 /**
  * Resolve org and detect an existing Sentry project before the spinner starts.
  *
@@ -401,6 +411,65 @@ async function resolvePreSpinnerOptions(
     }
   }
 
+  // Resolve team upfront so failures surface before the AI workflow starts.
+  if (!opts.team && opts.org) {
+    try {
+      const teams = await listTeams(opts.org);
+
+      if (teams.length === 0) {
+        // New org with no teams — auto-create one
+        const teamSlug = deriveTeamSlug();
+        try {
+          const created = await createTeam(opts.org, teamSlug);
+          opts = { ...opts, team: created.slug };
+        } catch (err) {
+          captureException(err, {
+            extra: { orgSlug: opts.org, teamSlug, context: "auto-create team" },
+          });
+          const teamsUrl = `${getSentryBaseUrl()}/settings/${opts.org}/teams/`;
+          log.error(
+            "No teams in your organization.\n" +
+              `Create one at ${terminalLink(teamsUrl)} and run sentry init again.`
+          );
+          cancel("Setup failed.");
+          process.exitCode = 1;
+          return null;
+        }
+      } else if (teams.length === 1) {
+        opts = { ...opts, team: (teams[0] as SentryTeam).slug };
+      } else {
+        // Multiple teams — prefer teams the user belongs to
+        const memberTeams = teams.filter((t) => t.isMember === true);
+        const candidates = memberTeams.length > 0 ? memberTeams : teams;
+
+        if (candidates.length === 1) {
+          opts = { ...opts, team: (candidates[0] as SentryTeam).slug };
+        } else if (yes) {
+          opts = { ...opts, team: (candidates[0] as SentryTeam).slug };
+        } else {
+          const selected = await select({
+            message: "Which team should own this project?",
+            options: candidates.map((t) => ({
+              value: t.slug,
+              label: t.slug,
+              hint: t.name !== t.slug ? t.name : undefined,
+            })),
+          });
+          if (isCancel(selected)) {
+            cancel("Setup cancelled.");
+            process.exitCode = 0;
+            return null;
+          }
+          opts = { ...opts, team: selected };
+        }
+      }
+    } catch (err) {
+      captureException(err, {
+        extra: { orgSlug: opts.org, context: "early team resolution" },
+      });
+    }
+  }
+
   return opts;
 }
 

src/lib/oauth.ts

@@ -59,6 +59,7 @@ const SCOPES = [
   "event:write",
   "member:read",
   "team:read",
+  "team:write",
 ].join(" ");
 
 type DeviceFlowCallbacks = {

test/lib/init/wizard-runner.test.ts

@@ -20,10 +20,14 @@ import {
 import * as clack from "@clack/prompts";
 import { MastraClient } from "@mastra/client-js";
 // biome-ignore lint/performance/noNamespaceImport: spyOn requires object reference
+import * as apiClient from "../../../src/lib/api-client.js";
+// biome-ignore lint/performance/noNamespaceImport: spyOn requires object reference
 import * as banner from "../../../src/lib/banner.js";
 // biome-ignore lint/performance/noNamespaceImport: spyOn requires object reference
 import * as auth from "../../../src/lib/db/auth.js";
 // biome-ignore lint/performance/noNamespaceImport: spyOn requires object reference
+import * as userDb from "../../../src/lib/db/user.js";
+// biome-ignore lint/performance/noNamespaceImport: spyOn requires object reference
 import * as fmt from "../../../src/lib/init/formatters.js";
 // biome-ignore lint/performance/noNamespaceImport: spyOn requires object reference
 import * as git from "../../../src/lib/init/git.js";
@@ -36,6 +40,8 @@ import type {
   WorkflowRunResult,
 } from "../../../src/lib/init/types.js";
 import { runWizard } from "../../../src/lib/init/wizard-runner.js";
+// biome-ignore lint/performance/noNamespaceImport: spyOn requires object reference
+import * as sentryUrls from "../../../src/lib/sentry-urls.js";
 
 // ── Helpers ─────────────────────────────────────────────────────────────────
 
@@ -63,6 +69,7 @@ let logInfoSpy: ReturnType<typeof spyOn>;
 let logWarnSpy: ReturnType<typeof spyOn>;
 let logErrorSpy: ReturnType<typeof spyOn>;
 let cancelSpy: ReturnType<typeof spyOn>;
+let selectSpy: ReturnType<typeof spyOn>;
 let spinnerSpy: ReturnType<typeof spyOn>;
 
 // git
@@ -78,6 +85,10 @@ let formatErrorSpy: ReturnType<typeof spyOn>;
 let handleLocalOpSpy: ReturnType<typeof spyOn>;
 let precomputeDirListingSpy: ReturnType<typeof spyOn>;
 let handleInteractiveSpy: ReturnType<typeof spyOn>;
+let listTeamsSpy: ReturnType<typeof spyOn>;
+let createTeamSpy: ReturnType<typeof spyOn>;
+let getUserInfoSpy: ReturnType<typeof spyOn>;
+let getSentryBaseUrlSpy: ReturnType<typeof spyOn>;
 
 // MastraClient
 let getWorkflowSpy: ReturnType<typeof spyOn>;
@@ -153,6 +164,7 @@ beforeEach(() => {
   logWarnSpy = spyOn(clack.log, "warn").mockImplementation(noop);
   logErrorSpy = spyOn(clack.log, "error").mockImplementation(noop);
   cancelSpy = spyOn(clack, "cancel").mockImplementation(noop);
+  selectSpy = spyOn(clack, "select").mockResolvedValue("test-team");
   spinnerSpy = spyOn(clack, "spinner").mockReturnValue(spinnerMock as any);
 
   // Reset spinner mock call counts
@@ -183,6 +195,21 @@ beforeEach(() => {
   handleInteractiveSpy = spyOn(inter, "handleInteractive").mockResolvedValue({
     action: "continue",
   });
+  listTeamsSpy = spyOn(apiClient, "listTeams").mockResolvedValue([]);
+  createTeamSpy = spyOn(apiClient, "createTeam").mockResolvedValue({
+    id: "1",
+    slug: "test-team",
+    name: "test-team",
+    isMember: true,
+  });
+  getUserInfoSpy = spyOn(userDb, "getUserInfo").mockReturnValue({
+    userId: "1",
+    username: "testuser",
+    name: "Test User",
+  });
+  getSentryBaseUrlSpy = spyOn(sentryUrls, "getSentryBaseUrl").mockReturnValue(
+    "https://sentry.io"
+  );
 
   // stderr spy (suppress banner output)
   stderrSpy = spyOn(process.stderr, "write").mockImplementation(
@@ -201,6 +228,7 @@ afterEach(() => {
   logWarnSpy.mockRestore();
   logErrorSpy.mockRestore();
   cancelSpy.mockRestore();
+  selectSpy.mockRestore();
   spinnerSpy.mockRestore();
 
   checkGitStatusSpy.mockRestore();
@@ -213,6 +241,10 @@ afterEach(() => {
   handleLocalOpSpy.mockRestore();
   precomputeDirListingSpy.mockRestore();
   handleInteractiveSpy.mockRestore();
+  listTeamsSpy.mockRestore();
+  createTeamSpy.mockRestore();
+  getUserInfoSpy.mockRestore();
+  getSentryBaseUrlSpy.mockRestore();
 
   stderrSpy.mockRestore();
   getWorkflowSpy.mockRestore();