Fix multiple tunnel plugins error

[gonzaloriestra]

WHY are these changes introduced?

Fixes https://github.com/shop/issues-develop/issues/21321

WHAT is this pull request doing?

Ignores the plugins @shopify/app or @shopify/plugin-cloudflare because they are already included in the bundle.

That way, the multiple tunnel plugins error won't appear when for some reason the cloudflare plugin is duplicated.

Also, it shows a warning so the users can remove those plugins that may cause conflicts:

How to test your changes?

• npm i -g --@shopify:registry=https://registry.npmjs.org @shopify/cli@0.0.0-snapshot-20251030155921
• shopify plugins add @shopify/app
• shopify app dev

Measuring impact

How do we know this change was effective? Please choose one:

• n/a - this doesn't need measurement, e.g. a linting rule or a bug-fix
• Existing analytics will cater for this addition
• PR includes analytics changes to measure impact

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes

[github-actions]

Coverage report

St.❔	Category	Percentage	Covered / Total
🟡	Statements	79.22% (+0.15% 🔼)	13495/17034
🟡	Branches	73.07% (+0.19% 🔼)	6581/9007
🟡	Functions	79.27% (+0.08% 🔼)	3472/4380
🟡	Lines	79.59% (+0.15% 🔼)	12750/16020

Show files with reduced coverage 🔻

St.❔	File	Statements	Branches	Functions	Lines
🟢	... / device-authorization.ts	85.71% (-3.35% 🔻)	70.83% (-8.58% 🔻)	100%	85.71% (-3.35% 🔻)

Test suite run success

3322 tests passing in 1360 suites.

Report generated by 🧪jest coverage report action from 29bd2f3

[amcaplan]

Checking my understanding: This new logic means that if I have pinned @shopify/app in my package.json, while it might previously have preferred that as the source of command implementations, now it will prefer the version that comes bundled in @shopify/cli?

If so, that seems like a good idea, but I wanted to be sure I understood correctly.

[gonzaloriestra]

@amcaplan this is not related to the package.json dependencies. If you include @shopify/app there, it's not added as a plugin.

I'm not sure about how some people are getting into this situation. The only way I found to reproduce it is to install the plugin with shopify plugins add as mentioned in the description.

[gonzaloriestra]

@isaacroldan where exactly would you add it? I think we don't have the config in prerun, which is what we need to update.

[isaacroldan]

@gonzaloriestra you do have config in prerun options.config, although I just tested it and the plugins list in that object is read-only so you can't edit it. My question is, at this point the commands have been loaded already, so does removing the plugin actually removes the commands from it?

[gonzaloriestra]

Already discussed it with Isaac and this should be safe because:

• This doesn't affect plugins adding new commands
• When there are multiple plugins, the bundle ones are used

But we are hiding a weird situation: the users shouldn't have those plugins. I think I prefer to keep raising an error, but handled and explaining how to solve it: #6555

@amcaplan what do you prefer?

[amcaplan]

I think we can start by rescuing the situation (because it's not known to be unsafe) but starting to warn users, and eventually we drop support for this entirely and leave it as a handled error.

[gonzaloriestra]

/snapit

[github-actions]

🫰✨ Thanks @gonzaloriestra! Your snapshot has been published to npm.

Test the snapshot by installing your package globally:

npm i -g --@shopify:registry=https://registry.npmjs.org @shopify/cli@0.0.0-snapshot-20251030155921

Caution

After installing, validate the version by running just shopify in your terminal.
If the versions don't match, you might have multiple global instances installed.
Use which shopify to find out which one you are running and uninstall it.

[dmerand]

I'm aligned with this approach.

and eventually we drop support for this entirely and leave it as a handled error.

How do we ensure this happens?

[gonzaloriestra]

How do we ensure this happens?

We don't have a set process for this. I added a reminder to our Slack channel for two months from now.