Fix reauthentication after a preview store is claimed

[dmerand]

WHY are these changes introduced?

#7986 detects a claimed preview store and tells the user to run shopify store auth. It retains the stale kind: 'preview' session, but store auth stops in throwIfPreviewStore before it can replace that session. The recovery command therefore cannot run.

The old behavior retained the session so later store info calls repeated the claimed-preview error instead of starting normal login. After claim, normal OAuth is the required recovery. This change clears a session only after 401/404 proves that its preview credential is invalid.

This is intentionally split from #8190. This PR repairs the existing store recovery contract. The follow-up PR will handle theme commands and its required shared transport/recovery changes.

WHAT is this pull request doing?

Clear a preview session after a 401/404 proves that its token is no longer valid, then keep the existing claimed-preview reauthentication error and scope placeholder. The change covers both Preview Stores lookup and Admin API paths used by store info and store execute.

A real-local-storage regression test proves that the suggested store auth command gets past the preview-store guard after recovery.

Manual testing

Use a throwaway preview store. Claiming revokes its preview credential. Use the same local CLI profile for all steps.

This snapshot tests store info and store execute. Theme-command recovery is separate.

(Pre-PR behavior)

1. Create a preview store:

   shopify store create preview

2. Get and open its claim URL:

   shopify store info --store <preview-store>.myshopify.com --json

   Open saveUrl from the JSON output. Complete the browser claim as the new store owner.

3. With the released CLI still installed, reproduce the bug:

   shopify store info --store <claimed-store>.myshopify.com
   
   shopify store auth \
     --store <claimed-store>.myshopify.com \
     --scopes read_products

   The first command reports a likely claim. The second command fails with ``store auth is unavailable for preview stores because the stale preview session blocks recovery.

(Post-PR behavior)

1. Install the snapshot and confirm the executable version:

   pnpm i -g --@shopify:registry=https://registry.npmjs.org \
     @shopify/cli@0.0.0-snapshot-20260819161547
   
   shopify version

   Expect 0.0.0-snapshot-20260819161547. If the version differs, run which shopify to find the executable in use.

2. Trigger recovery again, then authenticate:

   shopify store info --store <claimed-store>.myshopify.com
   
   shopify store auth \
     --store <claimed-store>.myshopify.com \
     --scopes read_products

   The first command gives the same claimed-preview recovery message and clears the stale session. The second command gets past the preview guard and starts browser OAuth. Complete OAuth as the claimed store owner or another authorized user.

3. Verify the new stored session:

   shopify store execute \
     --store <claimed-store>.myshopify.com \
     --query 'query { shop { name } }'

   Expect the claimed store name.

To test the store execute invalidation path directly, repeat the flow with a new preview store. Use the store execute command above instead of store info in steps 3 and 5. The next store auth command must start OAuth rather than fail because the store is still classified as a preview store.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

[dmerand]

/snapit

[Copilot]

Pull request overview

This PR fixes a recovery dead-end where a claimed preview store leaves behind a stale kind: 'preview' session that prevents the suggested recovery command (shopify store auth) from running. It updates the store info / admin transport recovery behavior to clear preview sessions once a 401/404 confirms the preview credential is invalid, so reauthentication can proceed.

Changes:

• Clear stored preview sessions on 401/404 from both the preview-store lookup path and Admin API paths, then surface the existing claimed-preview reauth guidance.
• Update unit tests to assert preview-session clearing behavior for store info and store execute.
• Add a local-storage regression test demonstrating that clearing the preview session unblocks store auth, plus a patch changeset.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
packages/store/src/cli/services/store/info/index.ts	Clears preview sessions on 401/404 from preview-store lookup so store auth can run.
packages/store/src/cli/services/store/info/index.test.ts	Updates expectations to assert preview-session clearing on preview-store lookup and Admin 401.
packages/store/src/cli/services/store/execute/admin-transport.test.ts	Updates expectations to assert preview-session clearing on Admin 401 in execute paths.
packages/store/src/cli/services/store/auth/preview-claim-recovery.test.ts	Adds real LocalStorage regression coverage showing clearing unblocks the store auth flow.
packages/store/src/cli/services/store/admin-errors.ts	Clears stored sessions (including preview) on Admin 401/404 before throwing the reauth error.
.changeset/claimed-preview-store-auth-recovery.md	Patch changeset documenting the user-facing recovery fix.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🫰✨ Thanks @dmerand! Your snapshot has been published to npm.

Test the snapshot by installing your package globally:

pnpm i -g --@shopify:registry=https://registry.npmjs.org @shopify/cli@0.0.0-snapshot-20260819161547

Caution

After installing, validate the version by running shopify version in your terminal.
If the versions don't match, you might have multiple global instances installed.
Use which shopify to find out which one you are running and uninstall it.