[Feature] Protect theme push and dev with Theme Airlock

[Codercise]

WHY are these changes introduced?

theme push and theme dev can target the globally remembered store when a project omits --store. A developer moving between client projects can create a theme or upload files to the wrong store before noticing.

Theme Airlock makes project trust a required precondition for those workflows.

This is PR 3 of the Theme Airlock safety stack and depends on #8148 and #8149.

Incremental review

Please review only the changes introduced by this PR:

Codercise/cli@nh/theme-airlock-trust-core...nh/theme-airlock-push-dev

WHAT is this pull request doing?

• Protects theme push and theme dev before authentication, theme selection, creation, checksums, services, or uploads.
• Prevents protected commands from changing the globally remembered store.
• Runs single and batch operations inside the approved store context.
• Validates and authenticates every batch target before any environment starts.
• Reuses approved sessions through push, dev, and metafield pulling.
• Displays the environment, store, selection source, explicit or implicit status, and operation before execution.
• Adds authenticated shopify theme airlock add <store> --environment <name> setup.
• Supports an interactive first-run bootstrap while keeping non-interactive execution fail closed.
• Adds a focused coordinator for protected command execution.
• Propagates protected batch failures after scheduled rendering completes.
• Registers the new command and refreshes generated help and manifests.
• Adds a minor @shopify/theme changeset.

--force and --yes cannot add trust or bypass a trust decision. The Airlock add command exposes no force, yes, or bypass flag.

The coordinator is intentionally limited to the Push and Dev safety slice. Other remote theme commands and Black Box history remain follow-up work.

Review map

• Protected lifecycle coordination: theme-airlock/coordinator.ts
• Shared command delegation and batch scheduling: theme-command.ts
• Push and Dev integration: commands/theme/push.ts and commands/theme/dev.ts
• Session reuse: services/metafields-pull.ts
• Target preflight: theme-airlock/preflight.ts
• Explicit trust command: commands/theme/airlock/add.ts and services/theme-airlock-add.ts
• Generated command documentation: manifest, CLI README, and Shopify.dev generated data
• End-to-end command wiring: push.test.ts and dev.test.ts

Migration

Existing non-interactive scripts need a one-time project trust configuration. Add a named environment to the nearest shopify.theme.toml:

[environments.production]
store = "example.myshopify.com"

Then select it in the script:

shopify theme push --environment production

Future runs remain non-interactive. Passing --store and valid credentials does not establish project trust.

The upgrade guide and built Push and Dev help document this requirement. The minor bump remains pending confirmation from the Developer Platform team.

How to test your changes?

pnpm --filter @shopify/theme vitest run
pnpm --filter @shopify/theme type-check
pnpm --filter @shopify/theme lint
pnpm changeset status

node packages/cli/bin/run.js theme push --help
node packages/cli/bin/run.js theme dev --help
node packages/cli/bin/run.js theme airlock add --help

Verified locally:

• 75 test files passed
• 865 tests passed
• Type-check and lint passed
• Changesets passed
• Generated documentation passed
• Command discovery and built help passed
• The Airlock add command exposes no force, yes, or bypass flags

Manual reviewer flow:

1. Check out this branch and choose a theme directory without shopify.theme.toml trust.
2. Run pnpm shopify:run theme dev --path <theme-directory>.
3. Confirm Airlock identifies the candidate store as untrusted. Cancel and confirm no development theme starts.
4. Run pnpm shopify:run theme airlock add <store> --environment review --path <theme-directory>.
5. Run pnpm shopify:run theme dev --path <theme-directory> again.
6. Confirm the preflight shows environment review, the expected store, shopify.theme.toml as the source, and operation theme dev.
7. Stop Dev with Ctrl+C and confirm the globally remembered store was not changed.

Manual proof was completed against the-bilko-store.myshopify.com:

• Unconfigured push and dev failed with No files were uploaded. and made zero network connections.
• Authenticated trust creation succeeded without changing remembered-store state.
• Trusted unpublished push displayed the expected Airlock preflight and completed.
• Trusted dev displayed the expected Airlock preflight and started successfully.
• The disposable theme was deleted.
• The previous development theme and CLI state were restored.
• The original remote theme inventory matched after cleanup.

Post-release steps

None.

Stack

1. #8148 Atomic TOML writes.
2. #8149 Project-scoped Theme Airlock trust.
3. #8150 Push and dev protection. This PR.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing: a minor bump and changeset are proposed, pending Developer Platform confirmation