Add non-interactive app dev prompt bypasses

[gonzaloriestra]

WHY are these changes introduced?

Related to https://github.com/shop/issues-develop/issues/22868

The interactivity audit found several app dev paths that still required prompts or manual recovery in automation:

• URL update confirmation for linked dev-session apps.
• mkcert installation when running with localhost certificates.
• Storefront password entry for theme app extension preview on password-protected storefronts.

The transfer-disabled store conversion prompt is removed since the CLI only allows using dev stores now that should already be transfer-disabled.

WHAT is this pull request doing?

• Adds explicit app dev flags for non-interactive flows:
  • --install-mkcert / SHOPIFY_FLAG_INSTALL_MKCERT controls localhost certificate installation.
  • --store-password / SHOPIFY_FLAG_STORE_PASSWORD supplies the storefront password needed by theme app extensions.
• Defaults linked dev-session apps to automatically_update_urls_on_dev = true, avoiding the app dev URL prompt for that flow.
• Removes the transfer-disabled store conversion prompt from app dev; transfer-enabled dev stores now fail with an actionable error instead of prompting to mutate the store.
• Redacts --store-password and SHOPIFY_FLAG_STORE_PASSWORD values from analytics payloads.

How to test your changes?

• shopify app dev --use-localhost --install-mkcert
• Add a theme app extension and run: shopify app dev --store-password yourpassword

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing, so I've added a changelog entry with pnpm changeset add

[gonzaloriestra]

• Add non-interactive app dev prompt bypasses #7632 : 2 dependent PRs (#7633 , #7634 ) 👈 (View in Graphite)
• Allow app config validate to target config by client ID #7631
• Add flags to avoid prompts in app config link #7630
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[gonzaloriestra]

/snapit

[github-actions]

🫰✨ Thanks @gonzaloriestra! Your snapshot has been published to npm.

Test the snapshot by installing your package globally:

pnpm i -g --@shopify:registry=https://registry.npmjs.org @shopify/cli@0.0.0-snapshot-20260709114447

Caution

After installing, validate the version by running shopify version in your terminal.
If the versions don't match, you might have multiple global instances installed.
Use which shopify to find out which one you are running and uninstall it.

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/public/common/version.d.ts

@@ -1 +1 @@
-export declare const CLI_KIT_VERSION = "4.5.0";
\ No newline at end of file
+export declare const CLI_KIT_VERSION = "4.4.0";
\ No newline at end of file