CLI 4.6/4.7 hardens auth, trims startup, rewrites E2E ergonomics

The two CLI releases, 4.6.0 and 4.7.0, carried a consistent theme: fewer surprises. 4.6.0 added function profiling, served UI extension source maps during `app dev` [1], and warned in `--verbose` help that output may contain sensitive data [2] while also narrowing loadtest header injection domains [3]. 4.6.1 reverted a TypeScript bundling breakage and patched source maps [4]; 4.7.0 followed with developer tools and performance boosts. The CLI also tightened non-interactive flags: required flags are now enforced in non-interactive mode, with infrastructure and documentation landing for both app and theme flags [5].

Startup and latency got real attention. Dropping React from the boot path made CLI startup 30% faster, and teardown got 5x faster by killing the flakiest E2E bottleneck. One daily briefing notes Isaac Roldán led that teardown win; the CLI also fixed HTTP/2 handshake issues in Hydrogen and stopped nuking sessions on transient token refresh errors [6], with better logging for token exchange failures [7]. Hydrogen recovered customer account login from OAuth state mismatches [6] and hardened OAuth. Shopify CLI 4.7.0 landed with dev tools and performance boosts; it also fixed a silent loopback rejection and blocked bad variables before they hit GraphQL [4].

The most visible workflow shift came at month's end: CLI killed the localhost dev flow and lets developers create dev stores directly from `app dev`. Combined with CLI owning E2E store lifecycle, the month effectively moved store provisioning and teardown from external scripts into the CLI's own state machine [4]. After dropping Node 22 legacy code in mid-August, CLI-kit tests also got more realistic, covering path coverage and abort-controller scenarios [8]. The size checks for extensions realigned with Brotli, and config-only extensions now run silent. August also brought two security patches: one in git initialization, one in notification handling.

"Serve UI extension source maps during app dev" captures the developer-facing intent of the month: making it easier to see what you're actually shipping [1]. Polaris, meanwhile, updated its Pages basePath for a repo rename and added an npm deprecation workflow, a quieter thread but a useful one for anyone consuming Polaris packages.