Guard Hydrogen primitives projects from classic CLI commands

[graygilmore]

Hydrogen packages can support Shopify integration commands without also supporting Hydrogen classic's app lifecycle commands. The CLI needs that compatibility decision to come from the installed package rather than inferring it from the package shape.

This PR adds a central command policy to the CLI init hook:

• reads shopify.cli.disabledCommands from the installed @shopify/hydrogen/package.json
• blocks an exact Oclif command ID when the package lists it
• leaves unlisted commands alone, including Shopify integration commands
• shows the same generic error for every disabled command

The disabled command list intentionally lives in the package rather than the CLI. This lets a Hydrogen package change its supported command surface without requiring another command-policy release. The matching metadata for the preview Hydrogen package is in #3847.

Tophatting 🎩

From a checkout of this PR:

pnpm install
pnpm --dir packages/cli run build
pnpm run patch-cli

Until the package metadata lands, patch the installed @shopify/hydrogen/package.json in the project you want to test:

node <<'EOF_NODE'
const {createRequire} = require('node:module');
const {readFileSync, writeFileSync} = require('node:fs');

const requireFromProject = createRequire(`${process.cwd()}/package.json`);
const packageJsonPath = requireFromProject.resolve('@shopify/hydrogen/package.json');
const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf8'));

packageJson.shopify = {
  ...packageJson.shopify,
  cli: {
    ...packageJson.shopify?.cli,
    disabledCommands: ['hydrogen:dev', 'hydrogen:setup:vite'],
  },
};

writeFileSync(packageJsonPath, `${JSON.stringify(packageJson, null, 2)}\n`);
console.log(`Patched ${packageJsonPath}`);
EOF_NODE

This only changes the local node_modules copy. Reinstalling dependencies removes the patch.

Then run the patched CLI from the Hydrogen checkout:

pnpm exec shopify hydrogen dev --path /path/to/project
pnpm exec shopify hydrogen setup vite --path /path/to/project
pnpm exec shopify hydrogen env pull --path /path/to/project --help

The first two commands should stop with the generic unsupported-command error. env pull is not listed in the metadata and should continue to its help output.

Validation

pnpm exec prettier --check packages/cli/src/hooks/init.ts packages/cli/src/lib/hydrogen-command-policy.ts packages/cli/src/lib/hydrogen-command-policy.test.ts .changeset/clever-lemurs-guard.md
pnpm exec eslint --no-error-on-unmatched-pattern packages/cli/src/hooks/init.ts packages/cli/src/lib/hydrogen-command-policy.ts packages/cli/src/lib/hydrogen-command-policy.test.ts
SHOPIFY_UNIT_TEST=1 LANG=en-US.UTF-8 pnpm --dir packages/cli exec vitest run --test-timeout=60000 src/lib/hydrogen-command-policy.test.ts
pnpm --dir packages/cli run build

[shopify]

Oxygen deployed a preview of your gg-hydrogen-primitives-cli-policy branch. Details:

Storefront	Status	Preview link	Deployment details	Last update (UTC)
Skeleton (skeleton.hydrogen.shop)	✅ Successful (Logs)	Preview deployment	Inspect deployment	July 10, 2026 6:16 PM

Learn more about Hydrogen's GitHub integration.

[frandiox]

LGTM!

[frandiox]

Curious, this changed to also check devDeps and peerDeps, was it on purpose or LLM decision?

It also dropped support for --diff, which I think we don't use anymore since we have cookbook/recipes, but perhaps better to double check.

[graygilmore]

It also dropped support for --diff, which I think we don't use anymore since we have cookbook/recipes, but perhaps better to double check.

Correct! I had a very hard time figuring out why that was there 😄

this changed to also check devDeps and peerDeps, was it on purpose or LLM decision?

this was an LLM decision but it made sense to me. I'm not sure why a user would have it as a non-prod dependency but if the package is available it makes sense that we should consider it a repo that a user can run commands in.