Add non-interactive app dev prompt bypasses

[gonzaloriestra]

WHY are these changes introduced?

Related to https://github.com/shop/issues-develop/issues/22868

The interactivity audit found several app dev paths that still required prompts or manual recovery in automation:

• URL update confirmation for linked dev-session apps.
• mkcert installation when running with localhost certificates.
• Storefront password entry for theme app extension preview on password-protected storefronts.

The transfer-disabled store conversion prompt is removed since the CLI only allows using dev stores now that should already be transfer-disabled.

WHAT is this pull request doing?

• Adds explicit app dev flags for non-interactive flows:
  • --install-mkcert / SHOPIFY_FLAG_INSTALL_MKCERT controls localhost certificate installation.
  • --store-password / SHOPIFY_FLAG_STORE_PASSWORD supplies the storefront password needed by theme app extensions.
• Defaults linked dev-session apps to automatically_update_urls_on_dev = true, avoiding the app dev URL prompt for that flow.
• Removes the transfer-disabled store conversion prompt from app dev; transfer-enabled dev stores now fail with an actionable error instead of prompting to mutate the store.
• Redacts --store-password and SHOPIFY_FLAG_STORE_PASSWORD values from analytics payloads.

How to test your changes?

• shopify app dev --use-localhost --install-mkcert
• Add a theme app extension and run: shopify app dev --store-password yourpassword

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing, so I've added a changelog entry with pnpm changeset add

[gonzaloriestra]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Add non-interactive app dev prompt bypasses #7632 : 2 dependent PRs (#7633 , #7634 ) 👈 (View in Graphite)
• Allow app config validate to target config by client ID #7631
• Add flags to avoid prompts in app config link #7630
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/private/node/constants.d.ts

@@ -7,6 +7,7 @@ export declare const environmentVariables: {
     enableCliRedirect: string;
     env: string;
     firstPartyDev: string;
+    hostedApps: string;
     noAnalytics: string;
     optOutInstrumentation: string;
     appAutomationToken: string;

packages/cli-kit/dist/public/common/version.d.ts

@@ -1 +1 @@
-export declare const CLI_KIT_VERSION = "4.1.0";
\ No newline at end of file
+export declare const CLI_KIT_VERSION = "4.0.0";
\ No newline at end of file

packages/cli-kit/dist/public/node/context/local.d.ts

@@ -42,6 +42,13 @@ export declare function isShopify(env?: NodeJS.ProcessEnv): Promise<boolean>;
  * @returns True if the SHOPIFY_UNIT_TEST environment variable is truthy.
  */
 export declare function isUnitTest(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Returns true if the CLI is running in hosted apps mode.
+ *
+ * @param env - The environment variables from the environment of the current process.
+ * @returns True if the HOSTED_APPS environment variable is truthy.
+ */
+export declare function isHostedAppsMode(env?: NodeJS.ProcessEnv): boolean;
 /**
  * Returns true if reporting analytics is enabled.
  *

[isaacroldan]

this should probably have a dependsOn: localhost
Doesn't do anything on its own

[isaacroldan]

since this has a default, it might happen the same thing as in the other PR and assume it is always present and require localhost