feat(project): fall back to org-scoped endpoint for member project creation

[betegon]

Problem

sentry project create and sentry init both failed with 403 for org members. The team-scoped endpoint (POST /teams/{org}/{team}/projects/) requires project:write, which the member role doesn't have. Trying to auto-create a team first also 403s since that requires team:write.

Solution

Fall back to POST /organizations/{org}/projects/ on 403. This endpoint:

• only requires project:read (members have this)
• auto-creates a personal team (team-{username}) for the caller
• is what the Sentry onboarding UI uses for members

The fallback is skipped when --team is passed explicitly — in that case the 403 is meaningful feedback, not a permissions gap.

Before:

$ sentry project create chisme/my-project javascript-nextjs
Error: Failed to create project 'my-project' in chisme (HTTP 403).
  You do not have permission to perform this action.

After:

$ sentry project create chisme/my-project javascript-nextjs
Created project 'my-project' in chisme
  Team: team-miguelbetegon (auto-created)
  DSN: https://...

Changes

• src/lib/api/projects.ts — createProjectWithAutoTeam() + ProjectWithAutoTeam type, calls POST /organizations/{org}/projects/
• src/lib/resolve-team.ts — re-throw ApiError 403 from autoCreateTeam (instead of wrapping in CliError) so callers can detect and fall back
• src/commands/project/create.ts — createProjectWithAutoTeamFallback() helper; main func calls it on 403
• src/lib/init/tools/create-sentry-project.ts — resolveProjectCreation() helper with the same fallback for sentry init

Both helpers are extracted to keep parent functions under biome's complexity limit (max 15).

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://cli.sentry.dev/_preview/pr-1030/
Built to branch gh-pages at 2026-05-29 11:48 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[betegon]

Self-review — 4 findings

🔴 test/lib/init/tools/create-sentry-project.test.ts:265 — test broken by new fallback logic

The test mocks createProjectWithDsnSpy to throw ApiError(403, "disabled this feature"). With the new resolveProjectCreation, that 403 now triggers the createProjectWithAutoTeam fallback — but createProjectWithAutoTeam is never mocked in this test file. The auto-mock preserves the real implementation, which makes a live HTTP call. The intended assertion (result.error contains "disabled for members") is never reached.

Fix: add createProjectWithAutoTeamSpy to this test file and mock it to also throw ApiError(403, "Your organization has disabled this feature for members.") — same pattern as create.test.ts's beforeEach.

---

🔴 test/commands/project/create.test.ts:673 — test will fail after handleListTeamsError change

handleListTeamsError now re-throws ApiError(403) raw instead of wrapping in ResolutionError. The raw 403 hits the outer catch in create.ts, triggers the auto-team fallback, and the test ends up with ApiError about "disabled project creation" — not the CliError containing "could not be accessed (403)" it expects.

Fix: update the test to reflect the new behavior: assert the fallback is triggered and the fallback result surfaces (success or policy-error), not the old ResolutionError.

---

🟡 src/lib/api/projects.ts:259 — createProjectWithAutoTeam skips cache seeding

createProjectWithDsn seeds cacheProjectsForOrg and setCachedProjectByDsnKey after creation. createProjectWithAutoTeam does neither. After a fallback-path creation, the project is invisible to shell completions and DSN-based lookup until the cache refills.

Fix: add the same cache-seeding block that createProjectWithDsn has.

---

🟡 create.ts:259 + create-sentry-project.ts:164 — "disabled this feature" string duplicated

Two independent error.detail?.includes("disabled this feature") checks with no shared constant. If the API error message changes, both fail silently.

Fix: extract to a shared named constant.

[github-actions]

Codecov Results 📊

✅ Patch coverage is 81.71%. Project has 4297 uncovered lines.
❌ Project coverage is 82%. Comparing base (base) to head (head).

Files with missing lines (5)

File	Patch %	Lines
src/commands/project/create.ts	72.73%	⚠️ 9 Missing and 3 partials
src/lib/resolve-team.ts	60.00%	⚠️ 4 Missing and 2 partials
src/lib/init/tools/create-sentry-project.ts	90.00%	⚠️ 2 Missing and 1 partials
src/lib/api/projects.ts	100.00%	⚠️ 1 partials
src/lib/init/preflight.ts	100.00%	⚠️ 1 partials

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
- Coverage    82.01%    82.00%    -0.01%
==========================================
  Files          329       329         —
  Lines        23806     23870       +64
  Branches     15543     15595       +52
==========================================
+ Hits         19522     19573       +51
- Misses        4284      4297       +13
- Partials      1643      1648        +5

---

Generated by Codecov Action

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f4d0188. Configure here.}