Changelog

Current catalog

The seeded catalog is 87 distinct seeded merchant tools, including bulk_update_inventory. The 2026-09-24 entry records 86 tools as of that change. list_themes and the other direct Shopify theme tools are retired, and the server rejects them. publish_product_to_channel is a live tool. A dry-run is optional, does not publish, and is not required before a live call. A live call always requires confirmation. github_create_theme_pr is the same: a dry-run previews and does not open a pull request, and a live call requires confirmation. Shopigent never merges, deploys, or publishes theme code.

2026-10-05

• Files scope pair made explicit. upload_product_media needs three prerequisites verified against the live OAuth grant: write_products, read_files and write_files. read_files is now declared as a required scope alongside write_files rather than inferred from the write scope, and the runtime scope set on the deployed app was corrected — it previously omitted the file scopes entirely, which is why an already-installed store could still hit MISSING_SCOPE on media upload after reauthorizing. This supersedes the single-scope wording in the SH-017 entry below.

2026-09-29

• SH-017 — file-scope authorization for media upload. upload_product_media now requires a verified live OAuth grant containing both write_products and write_files. The server fails closed before decoding payloads or issuing confirmation tokens when a prerequisite scope is missing. Error normalization now reports exact scope handles (missingScopes[]) instead of the vague "requiredScope" field, and handles the case where Shopify does not disclose the scope (null with knownPrerequisites[]). The confirmation response carries resendRequired: "full_identical_payload" — a token alone does not resume after expiry.
• write_files is declared as a required scope. The embedded app surfaces four distinct states: tool enabled, scope requested, scope granted (verified), and executable. An enabled toggle is never proof of Shopify authorization. The Scopes & Permissions page now includes a Files / Media upload category with the exact scope handle shown in the missing-scopes banner when the store has not yet granted it.
• The media upload workflow now emits structured observability logs at every pipeline stage with secret-safe rules — no tokens, headers, confirmation tokens, or base64 payloads are logged.

2026-09-24

• SH-015 publication workflow — as recorded on this date, implementation prepared, not deployed. Added the catalog contracts for list_publications and publish_product_to_channel, bringing the deduplicated seed catalog to 86 distinct merchant tools across nine categories. Runtime-only connection identity and capability utilities remain excluded from this count.
• write_publications is declared as an optional permission. Merchants explicitly enable or revoke it from the embedded Scopes & Permissions page; all other tools continue to work without it. Declaring the scope does not grant it, and no live merchant grant was performed as part of this change.
• Publication targets come from list_publications and are selected explicitly by ID. A live publish requires verified writeProducts and writePublications capabilities and non-disableable human confirmation. A dry-run is optional and does not publish. The live workflow includes idempotency protection, a final readback, and compensation that does not remove a publication edge that was already present.
• As recorded on 2026-09-24, this entry described a pending implementation: no app-version release, deployment, production data change, or live product publication was claimed then, and SH-015 was not yet resolved. See the current-catalog note above.
• Theme Pull Requests replace direct Shopify theme access. The four github_* tools read explicit repository files. A live call creates a branch, commits, and a pull request only after human confirmation. A dry-run is optional and does not open the pull request. Shopigent never merges, deploys, publishes, or directly edits Shopify theme code through the Admin Theme API.
• After the merchant reviews and merges, Shopify's native GitHub theme integration synchronizes the connected branch to the merchant-selected theme. Reviewer demonstrations use an unpublished connected theme so the live storefront remains unchanged.

2026-09-23

• Added update_product_variant_weight, a focused weight-only mutation for product variants.
• The tool supports grams, kilograms, ounces, and pounds; validates product/variant IDs and weight values before Shopify is called; and always requires an args-bound human confirmation token.
• search_products and get_product_by_id now return each variant's current shipping weight for safe readback and verification.

2026-09-03

• Added the four-tool repository workflow now named Theme Pull Requests: github_theme_connection, github_list_theme_branches, github_theme_file, and github_create_theme_pr.

2026-09-03 (earlier)

• fix(object-arg payloads) — object-payload tools (create/update_metafield_definition, create/update_metaobject_definition, create/update_metaobject) now send the full payload to Shopify (previously sent {} due to Zod STRIP-mode). (PR #5)
• fix(scopes) — the Metaobjects & Custom Data category now shows "Granted" after reauthorize (added to scope-granted sync). (PR #6)
• fix(MCP metafield-read + HTTP):
  • list_product_metafield_definitions & get_metafield_definition — correct nested type { name } selections (previously GraphQL error).
  • get_metafield_definition accepts only id (no longer sends ownerType).
  • HTTP JSON body limit raised 100KB → 50MB — media uploads (upload_product_media) with large base64 now work (previously HTTP 413). Plus structured JSON errors instead of HTML. (PR #7)
• UI polish — uniform scopes badges + aligned; dashboard quick-stats in one row; responsive mobile pages; tool cards with clear Enable/confirmation.

2026-09-03 (earlier)

• Added the Metaobjects & Custom Data category with 15 tools.
• Product media (SH-002, SH-007) — new upload_product_media (staged-upload), get_product_media, and get_product_publications.
• Custom Data (SH-003) — 15 metaobject & metafield-definition tools. Requires a dedicated Custom Data scope category; many are destructive and require confirmation.
• Template suffix (SH-004) — update_product now supports templateSuffix / clearTemplateSuffix.
• Customers — create_customer added (Customers now 5 tools).
• API version 2026-07, new read_publications scope + metaobjects scopes.

2026-09-01

• Added read tools for collections, blogs, articles, and pages. Inventory was merged into Products.
• search_products — new full-text search tool that finds products by keyword across titles, descriptions, and tags with relevance scoring.
• Content read tools — list_pages, get_page_by_id, list_blogs, get_blog_by_id, list_articles, get_article_by_id make every content category fully readable.
• Collection read tools — list_collections, get_collection_by_id let you browse collections before writing.
• Hero terminal slider — homepage demo now cycles through 5 interactive prompt examples with prev/next controls and clickable dots.

2026-07-20

• Connect guides — added setup guides for Claude, Cursor, and Hermes agents.
• Plans & Billing doc — clarified plan limits and upgrade flow.

2026-07-12

• Security & Trust doc — published our access model, key handling, and data practices.
• Scopes reference — mapped every tool category to its Shopify OAuth scopes.

2026-06-30

• Confirmation gate ships to all paid plans — confirmation-gated actions are approved in the merchant's AI client.
• Audit log — records tool name, input, result, and latency for every call.

2026-06-15

• Dry-run preview — write tools support dryRun: true to see what they would send before they send it. The preview is not executed.

2026-05-01

• Public launch — Shopigent launched with scope-based access control.