Add opt-in for third-party Theme Checks by aswamy · Pull Request #9077 · Shopify/cli

aswamy · 2026-11-05T12:39:14Z

WHY are these changes introduced?

Add explicit opt-in for third-party Theme Checks, matching theme-tools #1378.

WHAT is this pull request doing?

Add custom-check opt-in to check, language-server, and strict push; explicit denial overrides environment opt-in. Push requires --strict when enabling custom checks.
Handle typed diagnostics by code and show skipped-check notices in Theme Check Summary (stderr for JSON output).
Ignore custom-check consent in theme TOML and omit it from environment notices.
Pin @shopify/[email protected] in theme and app, and @shopify/[email protected] in theme, matching release #1369. Update the lockfile and generated command help.
Refresh generated docs/types and add the required write_app_proxy scope to the shared E2E fixture.

How to manually test your changes?

Run pnpm install in the CLI repository. Use the custom check in theme-tools Tophatting.
Run pnpm shopify theme check --path /path/to/theme: built-in checks run and the summary shows the opt-in notice. Add --allow-custom-checks: the custom warning appears.
Run SHOPIFY_FLAG_ALLOW_CUSTOM_CHECKS=1 pnpm shopify theme check --path /path/to/theme --no-allow-custom-checks: custom checks stay disabled.
Connect an LSP client to theme language-server, with and without --allow-custom-checks, and confirm the same behavior.
Run theme push --allow-custom-checks: it errors before authentication. On a test store, theme push --strict --allow-custom-checks with a custom error must block the upload.

Validation

287 focused tests, CLI Kit/theme type checks, lint, and build passed. Regression tests fail with the original TOML loader.
Verified the sandbox command ignores TOML consent without listing it as applicable. Strict-push opt-in validation and generated help are covered.

Checklist

I've considered possible cross-platform impacts (Mac, Linux, Windows)
I've considered possible documentation changes
I've considered analytics changes to measure impact
The change is user-facing — I've identified the correct bump type (minor) and added a changeset

Copilot

🟡 Changes recommended

The exposed --allow-custom-checks flag is not forwarded to the checker during theme push, so custom-check errors cannot block uploads even when --strict is enabled.

1 open issue

theme push ignores --allow-custom-checks when running checks · New

1 file not reviewed

pnpm-lock.yaml: Generated file

What changed in this PR

Adds explicit operator consent for third-party Theme Check JavaScript in the CLI’s theme-check and language-server integrations, while keeping built-in checks enabled by default.

Changes:

Adds command-line and environment-based authorization, independent of theme-controlled configuration.
Handles typed diagnostics and reports skipped custom checks in text summaries or on stderr for JSON output.
Upgrades Theme Tools dependencies, refreshes generated documentation/types, and updates the shared E2E fixture’s app-proxy scope.

File	Description
`pnpm-lock.yaml`	Locks upgraded Theme Tools dependencies.
`packages/theme/src/cli/utilities/custom-checks.ts`	Resolves operator-controlled execution permission.
`packages/theme/src/cli/utilities/custom-checks.test.ts`	Tests authorization inputs and precedence.
`packages/theme/src/cli/services/check/result.ts`	Passes skipped-check status to summaries.
`packages/theme/src/cli/services/check/diagnostics.ts`	Routes typed diagnostics by output mode.
`packages/theme/src/cli/services/check/diagnostics.test.ts`	Tests diagnostic routing and console restoration.
`packages/theme/src/cli/services/check.ts`	Forwards loader options and formats notices.
`packages/theme/src/cli/services/check.test.ts`	Updates configuration-loader expectations.
`packages/theme/src/cli/flags.ts`	Defines the custom-check permission flag.
`packages/theme/src/cli/commands/theme/language-server.ts`	Supplies authorization to the language server.
`packages/theme/src/cli/commands/theme/language-server.test.ts`	Tests permission forwarding.
`packages/theme/src/cli/commands/theme/custom-check-authorization.test.ts`	Tests execution gating and summary notices.
`packages/theme/src/cli/commands/theme/check.ts`	Applies authorization across check modes.
`packages/theme/package.json`	Pins Theme Check and language-server upgrades.
`packages/store/src/cli/api/graphql/business-platform-organizations/generated/types.d.ts`	Refreshes generated GraphQL scalars.
`packages/organizations/src/cli/api/graphql/business-platform-organizations/generated/types.d.ts`	Refreshes generated GraphQL scalars.
`packages/e2e/tests/fixture-toml.spec.ts`	Verifies the fixture’s app-proxy scope.
`packages/e2e/data/valid-app/shopify.app.toml`	Adds `write_app_proxy` permission.
`packages/cli/README.md`	Refreshes generated command help.
`packages/cli/oclif.manifest.json`	Updates generated flag metadata.
`packages/app/src/cli/api/graphql/business-platform-organizations/generated/types.d.ts`	Refreshes generated GraphQL scalars.
`packages/app/package.json`	Pins the Theme Check upgrade.
`docs/cli/custom-theme-checks.md`	Documents authorization and diagnostic behavior.
`docs-shopify.dev/generated/generated_docs_data_v2.json`	Refreshes public command documentation.
`.changeset/custom-check-authorization.md`	Records the user-facing permission change.

_{Review effort: Balanced}

EvilGenius13

Ran a lengthy 🎩. I ran into a bug earlier with theme push --strict ignoring --allow-custom-checks, but your latest commit fixed it.

The only thing I'm seeing: if I set allow-custom-checks = true in shopify.theme.toml, custom checks don't run. I think that part's intentional, but the output is confusing. The environment banner says it's using the flag, then the green success summary says custom checks are still disabled.

Can we find a way to be more clear that we won't allow it in the toml file but will allow it as a direct flag?

aswamy · 2026-11-09T23:26:54Z

@EvilGenius13 That's actually a really good find!

I intentionally don't let the toml file override the consent since a person sharing a zip can just drop that consent IN the theme. But that info message can be confusing - will fix! Thank you!

github-actions · 2026-11-09T23:56:46Z

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

Some seemingly private modules might be re-exported through public modules.
If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/public/node/base-command.d.ts

@@ -39,6 +39,8 @@ declare abstract class BaseCommand extends Command {
     }>;
     protected runWithParsedOutput<T>(flags: FlagOutput, execute: () => T): T;
     protected environmentsFilename(): string | undefined;
+    /** Filters configuration flags before they are applied, validated, or reported. */
+    protected filterEnvironmentFlags(environment: FlagOutput): FlagOutput;
     protected parseEnvironmentFlags<TFlags extends FlagOutput, TGlobalFlags extends FlagOutput, TArgs extends ArgOutput>(environment: JsonMap, options: Input<TFlags, TGlobalFlags, TArgs>, explicitFlags: FlagOutput): Promise<FlagOutput>;
     protected validateNonTTYFlags(flags: FlagOutput): void;
     protected failMissingNonTTYFlags(flags: FlagOutput, requiredFlags: string[]): void;

Require explicit permission for custom Theme Checks in CLI

09eef05

github-actions Bot added the Area: @shopify/cli @shopify/cli package issues label Nov 5, 2026

aswamy mentioned this pull request Nov 5, 2026

Ask for consent before running third-party Theme Checks Shopify/theme-tools#1378

Merged

aswamy added 5 commits November 6, 2026 11:11

Handle custom Theme Check notices through typed diagnostics

db6805a

Pin upcoming Theme Check and language server releases

ed08599

Update lockfile for published Theme Check releases

a5535fe

Refresh generated command docs and GraphQL types

dc99684

Include required app proxy scope in E2E fixture

8f98c62

aswamy marked this pull request as ready for review November 6, 2026 20:35

aswamy requested review from a team as code owners November 6, 2026 20:35

Copilot AI balanced review requested due to automatic review settings November 6, 2026 20:35

Copilot started reviewing on behalf of aswamy November 6, 2026 20:35

View session

Copilot AI reviewed Nov 6, 2026

View reviewed changes

Comment thread packages/theme/src/cli/flags.ts Resolved

Honor custom check consent during strict theme push

311d086

EvilGenius13 approved these changes Nov 9, 2026

View reviewed changes

Ignore custom check consent in theme TOML environments

0d9117c

aswamy enabled auto-merge November 10, 2026 00:29

Navigation Menu

Repository navigation

Add opt-in for third-party Theme Checks - #9077

Add opt-in for third-party Theme Checks#9077
aswamy wants to merge 8 commits into
mainfrom
codex/custom-check-authorization

aswamy commented Nov 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

EvilGenius13 left a comment

Uh oh!

aswamy commented Nov 9, 2026

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

aswamy commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

WHY are these changes introduced?

WHAT is this pull request doing?

How to manually test your changes?

Validation

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

EvilGenius13 left a comment

Choose a reason for hiding this comment

Uh oh!

aswamy commented Nov 9, 2026

Uh oh!

github-actions Bot commented Nov 9, 2026

Differences in type declarations

New type declarations

Existing type declarations

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aswamy commented Nov 5, 2026 •

edited

Loading