Add non-interactive app dev prompt bypasses

[gonzaloriestra]

WHY are these changes introduced?

Related to https://github.com/shop/issues-develop/issues/22868

The interactivity audit found several app dev paths that still required prompts or manual recovery in automation:

• URL update confirmation for linked dev-session apps.
• mkcert installation when running with localhost certificates.
• Storefront password entry for theme app extension preview on password-protected storefronts.

The transfer-disabled store conversion prompt is removed since the CLI only allows using dev stores now that should already be transfer-disabled.

WHAT is this pull request doing?

• Adds explicit app dev flags for non-interactive flows:
  • --install-mkcert / SHOPIFY_FLAG_INSTALL_MKCERT controls localhost certificate installation.
  • --store-password / SHOPIFY_FLAG_STORE_PASSWORD supplies the storefront password needed by theme app extensions.
• Defaults linked dev-session apps to automatically_update_urls_on_dev = true, avoiding the app dev URL prompt for that flow.
• Removes the transfer-disabled store conversion prompt from app dev; transfer-enabled dev stores now fail with an actionable error instead of prompting to mutate the store.
• Redacts --store-password and SHOPIFY_FLAG_STORE_PASSWORD values from analytics payloads.

How to test your changes?

• shopify app dev --use-localhost --install-mkcert
• Add a theme app extension and run: shopify app dev --store-password yourpassword

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing, so I've added a changelog entry with pnpm changeset add

[gonzaloriestra]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Add non-interactive app dev prompt bypasses #7632 : 2 dependent PRs (#7633 , #7634 ) 👈 (View in Graphite)
• Allow app config validate to target config by client ID #7631
• Add flags to avoid prompts in app config link #7630
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/private/node/constants.d.ts

@@ -6,6 +6,7 @@ export declare const environmentVariables: {
     doctor: string;
     enableCliRedirect: string;
     env: string;
+    firstPartyDev: string;
     noAnalytics: string;
     optOutInstrumentation: string;
     appAutomationToken: string;

packages/cli-kit/dist/public/node/context/local.d.ts

@@ -63,6 +63,13 @@ export declare function alwaysLogAnalytics(env?: NodeJS.ProcessEnv): boolean;
  * @returns True if SHOPIFY_CLI_ALWAYS_LOG_METRICS is truthy.
  */
 export declare function alwaysLogMetrics(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Returns true if the CLI User is 1P.
+ *
+ * @param env - The environment variables from the environment of the current process.
+ * @returns True if SHOPIFY_CLI_1P is truthy.
+ */
+export declare function firstPartyDev(env?: NodeJS.ProcessEnv): boolean;
 /**
  * Returns true if the CLI can run the "doctor-release" command.
  *

[gonzaloriestra]

/snapit

[github-actions]

🫰✨ Thanks @gonzaloriestra! Your snapshot has been published to npm.

Test the snapshot by installing your package globally:

pnpm i -g --@shopify:registry=https://registry.npmjs.org @shopify/cli@0.0.0-snapshot-20260709114447

Caution

After installing, validate the version by running shopify version in your terminal.
If the versions don't match, you might have multiple global instances installed.
Use which shopify to find out which one you are running and uninstall it.

[isaacroldan]

We probably need to evaluate if we even need this, for dev dash dev stores if the store is a valid dev store, that's all we need no?

[gonzaloriestra]

New dev stores are always transfer disabled. But I found there are a few old cases where they are development and also transfer enabled. I'm leaving this for them to show a better error.