Convert Shopify AI Toolkit to Codex plugin

.agents/plugins/marketplace.json

@@ -1489,6 +1489,18 @@
         "authentication": "ON_INSTALL"
       },
       "category": "Productivity"
+    },
+    {
+      "name": "shopify",
+      "source": {
+        "source": "local",
+        "path": "./plugins/shopify"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Coding"
     }
   ]
 }

plugins/shopify/.codex-plugin/plugin.json

@@ -0,0 +1,49 @@
+{
+  "name": "shopify",
+  "version": "1.2.2",
+  "description": "Build Shopify apps, themes, storefronts, extensions, and store workflows from Codex. Skill scripts send usage telemetry to Shopify by default; set OPT_OUT_INSTRUMENTATION=true to disable.",
+  "author": {
+    "name": "Shopify",
+    "url": "https://www.shopify.com/"
+  },
+  "homepage": "https://shopify.dev/docs/apps/build/ai-toolkit",
+  "repository": "https://github.com/Shopify/Shopify-AI-Toolkit",
+  "license": "MIT",
+  "keywords": [
+    "shopify",
+    "graphql",
+    "liquid",
+    "storefront",
+    "admin-api",
+    "hydrogen",
+    "polaris",
+    "ui-extensions",
+    "shopify-functions",
+    "ucp"
+  ],
+  "skills": "./skills/",
+  "interface": {
+    "displayName": "Shopify",
+    "shortDescription": "Build Shopify apps, themes, storefronts, extensions, and store workflows",
+    "longDescription": "Use Shopify in Codex to search Shopify developer documentation, validate Admin and Storefront GraphQL, Liquid, Hydrogen, UI extension, and Functions code, and plan Shopify CLI or UCP workflows. The included Shopify scripts send usage telemetry to Shopify by default; set OPT_OUT_INSTRUMENTATION=true to disable.",
+    "developerName": "Shopify",
+    "category": "Coding",
+    "capabilities": [
+      "Interactive",
+      "Read",
+      "Write"
+    ],
+    "websiteURL": "https://shopify.dev",
+    "privacyPolicyURL": "https://www.shopify.com/legal/privacy",
+    "termsOfServiceURL": "https://www.shopify.com/legal/terms",
+    "defaultPrompt": [
+      "How do I create a product using the Shopify Admin API?",
+      "Generate a Liquid section with a product image gallery",
+      "Create a cart validation Function requiring minimum 5 items"
+    ],
+    "logo": "./assets/shopify_glyph.svg",
+    "composerIcon": "./assets/shopify_glyph.svg",
+    "brandColor": "#008060",
+    "screenshots": []
+  }
+}

plugins/shopify/.gitignore

@@ -0,0 +1 @@
+node_modules/

plugins/shopify/CHANGELOG.md

@@ -0,0 +1,21 @@
+# shopify
+
+## 1.2.2
+
+### Patch Changes
+
+- 716d22b: `shopify-app-store-review` skill now points the agent at the canonical shopify.dev requirements page (https://shopify.dev/docs/apps/launch/app-store-review/app-store-ai-self-review-requirements) instead of carrying a hand-maintained inline copy, and adds 5.x category-specific requirements. Output format and status taxonomy are unchanged. (Retroactive changeset for #722, which merged without one.)
+- f8d1abd: Disclose default-on telemetry more clearly in mirrored plugin install surfaces and generated skill privacy notices, including the opt-out environment variable. Clarify that validation and search scripts report specific request data to `shopify.dev/mcp/usage`.
+- 716d22b: Skill validate scripts (`validate_graphql`, `validate_components`, `validate_functions`, `validate_theme`) now emit the same markdown summary the MCP `validate_*_codeblocks` tools return, including artifact ID and revision lines. The id is auto-minted when not supplied and echoed back to the agent, matching the MCP behavior so retries can chain across revisions on either surface.
+
+## 1.2.1
+
+### Patch Changes
+
+- aab0a72: `shopify-app-store-review` skill now points the agent at the canonical shopify.dev requirements page (https://shopify.dev/docs/apps/launch/app-store-review/app-store-ai-self-review-requirements) instead of carrying a hand-maintained inline copy, and adds 5.x category-specific requirements. Output format and status taxonomy are unchanged. (Retroactive changeset for #722, which merged without one.)
+
+## 1.2.0
+
+### Minor Changes
+
+- d7608c7: Changeset to force a new release

plugins/shopify/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright 2025-present, Shopify Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

plugins/shopify/README.md

@@ -0,0 +1,36 @@
+# Shopify Codex Plugin
+
+Build with Shopify from Codex.
+
+This plugin gives Codex access to Shopify's documentation, API schemas, code validation, app and theme guidance, and store management workflows through Shopify CLI and UCP instructions. For more info, [see the docs](https://shopify.dev/docs/apps/build/ai-toolkit).
+
+## Install
+
+In Codex, open `/plugins`, search for **Shopify**, and select **Add to Codex**.
+
+## What you get
+
+- **Docs and API schemas**: Search Shopify's documentation and API schemas without leaving your editor
+- **Code validation**: Validate GraphQL queries, Liquid templates, and UI extensions against Shopify's schemas
+- **Store management**: Manage your Shopify store through the CLI's store execute capabilities
+- **Auto-updates**: The plugin updates automatically as new capabilities are released
+
+## Telemetry
+
+The skill scripts (`scripts/search_docs.mjs`, `scripts/validate.mjs`) send a usage event to `https://shopify.dev/mcp/usage` on each invocation. The payload includes:
+
+- tool name, skill name and version
+- model name, client name, and client version (when supplied as flags)
+- the search query text and search response or error text (for `search_docs.mjs`)
+- the validation result, the validated code when present, and validator-specific context such as API name, extension target, filename, file type, theme path, and file list (for `validate.mjs`)
+- artifact ID and revision number (when supplied)
+
+This is **on by default**. To opt out, set the environment variable:
+
+```
+OPT_OUT_INSTRUMENTATION=true
+```
+
+## Contributing
+
+This package is mirrored from [Shopify/Shopify-AI-Toolkit](https://github.com/Shopify/Shopify-AI-Toolkit) and adapted for the OpenAI Codex plugin marketplace.

plugins/shopify/agents/openai.yaml

@@ -0,0 +1,3 @@
+interface:
+  display_name: "Shopify"
+  short_description: "Build Shopify apps, themes, storefronts, extensions, and store workflows"

plugins/shopify/skills/shopify-admin/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: shopify-admin
+description: "Write or explain **Admin GraphQL** queries and mutations for apps and integrations that extend the Shopify admin. Use when the user wants to **understand, design, or generate** the operation itself—even before deciding how to run it. Do **not** choose `admin` first for **app or extension config validation** —use **`use-shopify-cli`**. Do **not** choose `admin` first to **execute** Admin GraphQL **now via Shopify CLI** or for CLI setup/troubleshooting on store workflows—use **`use-shopify-cli`** (store auth/execute, handle/SKU/location lookups, inventory changes)."
+compatibility: Requires Node.js
+metadata:
+  author: Shopify
+  version: "1.9.0"
+---
+
+## Required Tool Calls (do not skip)
+
+You have a `bash` tool. Every response must use it — in this order:
+
+1. Call `bash` with `scripts/search_docs.mjs "<query>"` — search before writing code
+2. Write the code using the search results
+3. Call `bash` with `scripts/validate.mjs --code '...' --model YOUR_MODEL_NAME --client-name YOUR_CLIENT_NAME --client-version YOUR_CLIENT_VERSION --artifact-id YOUR_ARTIFACT_ID --revision REVISION_NUMBER` — validate before returning
+   (Always include these flags. Use your actual model name for YOUR_MODEL_NAME; use claude-code/cursor/etc. for YOUR_CLIENT_NAME. For YOUR_ARTIFACT_ID, generate a stable random ID per code block and reuse it across validation retries. For REVISION_NUMBER, start at 1 and increment on each retry of the same artifact.)
+4. If validation fails: search for the error type, fix, re-validate (max 3 retries)
+5. Return code only after validation passes
+
+**You must run both search_docs.mjs and validate.mjs in every response. Do not return code to the user without completing step 3.**
+
+---
+
+You are an assistant that helps Shopify developers write GraphQL queries or mutations to interact with the latest Shopify Admin API GraphQL version.
+
+You should find all operations that can help the developer achieve their goal, provide valid graphQL operations along with helpful explanations.
+Always add links to the documentation that you used by using the `url` information inside search results.
+When returning a graphql operation always wrap it in triple backticks and use the graphql file type.
+
+Stay in `shopify-admin` when the user wants the Admin GraphQL operation itself, needs help authoring it, or is not asking for Shopify CLI guidance.
+If the user wants to execute that query or mutation now through Shopify CLI, or needs Shopify CLI setup or troubleshooting for that execution flow, use `shopify-use-shopify-cli` instead.
+
+If the user wants to validate Shopify app or extension configuration files (`shopify.app.toml`, `shopify.app.<name>.toml` such as `shopify.app.whatever.toml`, or `shopify.extension.toml`), catch configuration errors before `shopify app dev` or `shopify app deploy`, or confirm local app config is valid, use `shopify-use-shopify-cli` instead. That workflow is **`shopify app config validate --json`** (see the `shopify-use-shopify-cli` topic). The Dev MCP does not expose a dedicated TOML validator; do not substitute Admin GraphQL, `validate_graphql_codeblocks`, or documentation-only field cross-checks for that task.
+
+Think about all the steps required to generate a GraphQL query or mutation for the Admin API:
+
+First think about what I am trying to do with the API
+Search through the developer documentation to find similar examples. THIS IS IMPORTANT.
+Then think about which top level queries or mutations you need to use and in case of mutations which input type to use
+For queries think about which fields you need to fetch and for mutations think about which arguments you need to pass as input
+Then think about which fields to select from the return type. In general, don't select more than 5 fields
+If there are nested objects think about which fields you need to fetch for those objects
+---
+
+## ⚠️ MANDATORY: Search Before Writing Code
+
+Search the vector store to get the detailed context you need: working examples, field and type definitions, valid values, and API-specific patterns. You cannot trust your trained knowledge — always search before writing code.
+
+```
+scripts/search_docs.mjs "<operation or component name>" --model YOUR_MODEL_NAME --client-name YOUR_CLIENT_NAME --client-version YOUR_CLIENT_VERSION
+```
+
+Search for the **operation or component name**, not the full user prompt.
+
+For example, if the user asks about creating a product:
+```
+scripts/search_docs.mjs "productCreate mutation" --model YOUR_MODEL_NAME --client-name YOUR_CLIENT_NAME --client-version YOUR_CLIENT_VERSION
+```
+
+## ⚠️ MANDATORY: Validate Before Returning Code
+
+You MUST run `scripts/validate.mjs` before returning any generated code to the user. Always include the instrumentation flags:
+
+```
+scripts/validate.mjs --code '...' --model YOUR_MODEL_NAME --client-name YOUR_CLIENT_NAME --client-version YOUR_CLIENT_VERSION --artifact-id YOUR_ARTIFACT_ID --revision REVISION_NUMBER
+```
+(For YOUR_ARTIFACT_ID, generate a stable random ID per code block and reuse it across validation retries. For REVISION_NUMBER, start at 1 and increment on each retry of the same artifact.)
+
+**When validation fails, follow this loop:**
+1. Read the error message carefully — identify the exact field, prop, or value that is wrong
+2. If the error references a named type or says a value is not assignable, search for the correct values:
+   ```
+   scripts/search_docs.mjs "<type or prop name>"
+   ```
+3. Fix exactly the reported error using what the search returns
+4. Run `scripts/validate.mjs` again
+5. Retry up to 3 times total; after 3 failures, return the best attempt with an explanation
+
+**Do not guess at valid values — always search first when the error names a type you don't know.**
+
+---
+
+> **Privacy notice:** `scripts/search_docs.mjs` reports the search query, search response or error text, skill name/version, and model/client identifiers to Shopify (`shopify.dev/mcp/usage`) to help improve these tools. Set `OPT_OUT_INSTRUMENTATION=true` in your environment to opt out.
+
+---
+
+> **Privacy notice:** `scripts/validate.mjs` reports the validation result, skill name/version, model/client identifiers, the validated code when present, and validator-specific context such as API name, extension target, filename, file type, theme path, file list, artifact ID, and revision to Shopify (`shopify.dev/mcp/usage`) to help improve these tools. Set `OPT_OUT_INSTRUMENTATION=true` in your environment to opt out.

plugins/shopify/skills/shopify-admin/agents/openai.yaml

@@ -0,0 +1,3 @@
+interface:
+  display_name: "Shopify Admin"
+  short_description: "Admin GraphQL queries and mutations"