Reuse preview store sessions in every theme command by dmerand · Pull Request #8546 · Shopify/cli

dmerand · 2026-09-14T20:47:09Z

WHY are these changes introduced?

A preview store from shopify store create preview stores an Admin API token in the store-auth cache. A preview store cannot complete a device login and has no password, so that token is its only credential.

#8183 made store auth session reuse opt-in per theme command, to stop commands from adopting standard store auth sessions with insufficient scopes. Its opt-out default also stopped every theme command except theme pull and theme push from reusing the cached preview token. Commands such as theme list fell through to device authentication, which the user cannot complete. The command is then a dead end.

Regression from 4.6.0. Reported in Slack.

WHAT is this pull request doing?

Reuse a stored kind: 'preview' session in every theme command, whatever storeAuthScopes() returns.
Keep the declared-scope requirement for standard sessions, so Make store auth session reuse opt-in per theme command #8183's fix still holds.
Make multi-environment configs work on preview stores. validateEnvironments dropped them for the same reason.

theme pull and theme push keep their declared scopes, so they also reuse standard sessions.

How to manually test your changes?

Seed a session with kind: 'preview' and scopes: [], then run a command that does not opt in to store auth reuse:

shopify theme list --store <preview-store>.myshopify.com --json --verbose

Result with this branch:

Using stored store auth session for <preview-store>.myshopify.com (scopes: )

Result on main: Ensuring that the user is authenticated with the Theme API followed by You are not authorized to use the CLI to develop in the provided store.

theme pull and theme push against a preview store still reuse the stored session.

Checklist

I've considered possible cross-platform impacts (Mac, Linux, Windows)
I've considered possible documentation changes
I've considered analytics changes to measure impact
The change is user-facing — I've identified the correct bump type (patch) and added a changeset

Follow-up: #8547 adds the skipped-session reason to authentication errors.

#8183 made store auth session reuse opt-in per theme command to stop commands adopting standard store auth sessions with insufficient scopes. The default (no declared scopes) also stopped theme commands from reusing CLI-minted preview store sessions, so commands like `theme list` fell through to device authentication. A preview store cannot complete that flow and has no other credential. Reuse preview sessions regardless of the declared scopes. Keep the scope requirement for standard sessions, so #8183's fix still holds. Assisted-By: devx/e5be4a75-315f-44ac-9b24-78944589ddd8

Copilot

🟢 Approval recommended

No unresolved blocking issues were identified.

Pull request overview

This pull request reuses cached preview-store sessions across theme commands while preserving scope checks for standard sessions.

Changes:

Adds preview-session reuse for single- and multi-environment commands.
Preserves standard-session scope validation.
Adds regression tests and a patch changeset.

File summaries

File	Description
`packages/theme/src/cli/utilities/theme-command.ts`	Implements preview-session reuse and standard-session filtering.
`packages/theme/src/cli/utilities/theme-command.test.ts`	Adds preview and standard session coverage.
`.changeset/tidy-preview-store-sessions.md`	Documents the user-facing fix.

Review details

Files reviewed: 3/3 changed files
Comments generated: 0
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

dmerand · 2026-09-14T20:52:17Z

/snapit

dmerand · 2026-09-14T20:52:29Z

/snapit

github-actions · 2026-09-14T20:55:38Z

🫰✨ Thanks @dmerand! Your snapshot has been published to npm.

Test the snapshot by installing your package globally:

pnpm i -g --@shopify:registry=https://registry.npmjs.org @shopify/cli@0.0.0-snapshot-20260914205340

Caution

After installing, validate the version by running shopify version in your terminal.
If the versions don't match, you might have multiple global instances installed.
Use which shopify to find out which one you are running and uninstall it.

github-actions · 2026-09-14T20:55:52Z

🫰✨ Thanks @dmerand! Your snapshot has been published to npm.

Test the snapshot by installing your package globally:

pnpm i -g --@shopify:registry=https://registry.npmjs.org @shopify/cli@0.0.0-snapshot-20260914205309

Caution

After installing, validate the version by running shopify version in your terminal.
If the versions don't match, you might have multiple global instances installed.
Use which shopify to find out which one you are running and uninstall it.

tizmagik

Went through this against the history. The preview-session bypass is the right shape, and better than opting each command in one at a time, which is what I'd suggested in the Slack thread. #7783 says the store-auth cache was built for preview stores in the first place, and #8183's gate was aimed at standard sessions. Splitting the two paths restores that intent, and it won't drift when someone adds a new theme command.

Checked the back-compat case too: kind: 'preview' has been written since 4.3.0, the first release with store create preview, so no stored session reads back as standard by accident.

Two inline notes below. Neither blocks the fix landing if you'd rather file them as follow-ups.

tizmagik · 2026-09-15T15:52:17Z

-        )}; needs: ${requiredScopes.join(', ')}).`,
-      )
-      return undefined
+    const isPreviewSession = storedSession.kind === 'preview'


Worth thinking about what this does to a stale preview session, the one from a store that's since been claimed. Before this PR it broke theme pull and theme push. After it, every theme command.

There's no way for a user to clear it. shopify auth logout is just sessionStore.remove() (packages/cli-kit/src/public/node/session.ts:327) and never touches the shopify-cli-store storage, and there's no store auth logout. The only clear that exists today is the side effect in shopify store info (packages/store/src/cli/services/store/info/index.ts:166), which fires on a 401/404 from the preview-store API. Nobody is going to find that.

That's the failure mode #8183's commit message called out, 401s that can't be fixed with auth logout. #8390 is one answer, but the concern raised in the thread about clear-on-401 being unrecoverable for an unclaimed store still stands. A shopify store auth logout --store <store> would cover it without that risk.

Deferring this from #8546. #8390 already clears the stored preview session on a 401 and points to store auth, so it covers the main path. Two notes: (1) #8390 is still a draft, so landing order matters — if #8546 lands first there is a window with no manual clear; (2) the residual concern stands: clear-on-401 is unrecoverable for an unclaimed store, and store auth logout --store would cover it without that risk. Keeping both as follow-ups.

gonzaloriestra

Works as expected 👌

dmerand requested a review from a team as a code owner September 14, 2026 20:47

Copilot AI lite review requested due to automatic review settings September 14, 2026 20:47

dmerand mentioned this pull request Sep 14, 2026

Name the skipped store auth session in theme auth errors #8547

Open

4 tasks

github-actions Bot added the Area: @shopify/theme @shopify/theme package issues label Sep 14, 2026

Copilot started reviewing on behalf of dmerand September 14, 2026 20:47 View session

Copilot AI reviewed Sep 14, 2026

View reviewed changes

dmerand added this pull request to stack #8548 September 14, 2026 20:50

tizmagik reviewed Sep 15, 2026

View reviewed changes

Comment thread packages/theme/src/cli/utilities/theme-command.ts

gonzaloriestra approved these changes Sep 17, 2026

View reviewed changes

Navigation Menu

Uh oh!

Reuse preview store sessions in every theme command - #8546

Reuse preview store sessions in every theme command#8546
dmerand wants to merge 1 commit into
mainfrom
donald/theme-preview-session-reuse

dmerand commented Sep 14, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

dmerand commented Sep 14, 2026

Uh oh!

dmerand commented Sep 14, 2026

Uh oh!

github-actions Bot commented Sep 14, 2026

Uh oh!

github-actions Bot commented Sep 14, 2026

Uh oh!

tizmagik left a comment •

edited

Loading

Uh oh!

tizmagik Sep 15, 2026

Uh oh!

dmerand Sep 15, 2026

Uh oh!

Uh oh!

gonzaloriestra left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

dmerand commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

WHY are these changes introduced?

WHAT is this pull request doing?

How to manually test your changes?

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

dmerand commented Sep 14, 2026

Uh oh!

dmerand commented Sep 14, 2026

Uh oh!

github-actions Bot commented Sep 14, 2026

Uh oh!

github-actions Bot commented Sep 14, 2026

Uh oh!

tizmagik left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tizmagik Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

dmerand Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gonzaloriestra left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

dmerand commented Sep 14, 2026 •

edited

Loading

tizmagik left a comment •

edited

Loading