Prepare Hydrogen commands for typed JSON output

[gonzaloriestra]

WHY are these changes introduced?

Finite Hydrogen commands need shared schema and error support before exposing reliable JSON results.

WHAT is this pull request doing?

Pin Shopify CLI and CLI Kit to the matching stable release (4.9.0), add shared contracts and real-stream capture, and validate project and disabled-command rules in the command lifecycle so CLI Kit emits standard fatal errors. Expose --no-input through shared flags so prompt and browser-authentication policy remains independent from --json. Use CLI Kit UI helpers directly, keep VM startup in the init hook, and keep JSON diagnostics on stderr.

HOW to test your changes?

pnpm --filter @shopify/cli-hydrogen build
pnpm --filter @shopify/cli-hydrogen typecheck
pnpm --filter @shopify/cli-hydrogen test

Verified CLI 4.9.0 loads the Cloudflare tunnel_provider and tunnel_start hooks from its root plugin. Hydrogen must not register the separate plugin again, which would duplicate tunnels. CPU startup profiling was checked against a built storefront and repeated runs with isolated globals. Built-in imports are restricted to an explicit allowlist without filesystem, network or process access. Like the Vite build that precedes it, this Node profiler runs trusted project code; its fresh VM context is not a security sandbox.

Verified timer behavior with MiniOxygen's actual workerd runtime and Oxygen compatibility date 2025-04-01: both setTimeout and setInterval at module scope fail with "Disallowed operation called within global scope". The profiler intentionally preserves that startup restriction; timers remain valid inside request handlers. Regression tests cover this and denied static/dynamic imports of host I/O built-ins.

Checklist

• I have read the contributing guidelines
• I have considered cross-platform impacts
• I have added a changeset for user-facing changes
• I have added tests
• I have updated the documentation

[shopify]

Oxygen deployed a preview of your gonzalo/hydrogen-json-support branch. Details:

Storefront	Status	Preview link	Deployment details	Last update (UTC)
Skeleton (skeleton.hydrogen.shop)	✅ Successful (Logs)	Preview deployment	Inspect deployment	October 9, 2026 2:03 PM

Learn more about Hydrogen's GitHub integration.

[fredericoo]

nice groundwork for the stack - the init hook tests covering --, --path=, help/schema and the env flag are really thorough, and good to see the task adapter gone now the nightly has cli#8672. One small comment on how alerts get flattened in JSON mode, nothing blocking.

[fredericoo]

a couple of follow-up questions I forgot to include earlier, neither blocking the approval

[kdaviduik]

Hydrogen 2 is now on the 2026-04 branch, please change the base branch for this stack to merge into 2026-04 instead :)