Shopify CLI 4.8.0 ships store create, pnpm install recovery, and honest upgrade messaging

The CLI shipped 4.8.0 with a new `shopify store create` command as its lone minor change [1]. It arrives alongside a fix for `shopify app generate extension`, which failed outright under recent pnpm versions: pnpm refuses to run build scripts for newly installed dependencies until approved, and when it cannot prompt it exits with `ERR_PNPM_IGNORED_BUILDS`. Since extension generation installs dependencies from a non-interactive task UI, the approval prompt never appears, so the install always failed. Generation now recovers gracefully from the blocked-builds case [2].

Self-upgrade had a worse failure mode. On a private npm registry that 401'd against upstream, the registry resolved a stale `latest` tag and `npm install -g @shopify/cli@latest` downgraded a user from 4.7.0 to 3.94.3 with a zero exit code, while the CLI printed "Shopify CLI upgraded. You're now on version 4.7.1." [3] The cause was `runCLIUpgrade` building its success banner from the cached version check against the public registry while trusting the install's exit code. The banner now reflects what was actually installed rather than what was expected [3].

App Doctor gained three new agent checks: `SESSION_LIFECYCLE_AND_REPLAY`, `DEPENDENCY_REACHABILITY`, and `ACTIVE_UPLOADS_AND_PRIVILEGED_PREVIEWS`, covering lifecycle and replay failures, dependency reachability, and the upload-to-active-preview execution path [4]. A separate prompt pass tightens the same engine, requiring concrete trust-boundary evidence before findings are reported and broadening the tenant-selector, authorization, content-execution, and dependency prompts [5].

On the Polaris side, a manual GitHub Pages deploy workflow now builds the archived Polaris React Storybook from `@shopify/polaris` and publishes `polaris-react/build-internal/storybook/static` to https://storybook.polaris.shopify.dev/, with `.nojekyll` and a `CNAME` in place and a filtered pnpm install to avoid pulling unrelated root dev dependencies [6]. It lands on the archived `polaris-react-archive` repo [7].