Detect dev session takeover #6799

dmerand · 2026-01-28T21:06:20Z

Summary

Implements client-side detection and handling for multi-user dev session conflicts, building on backend changes in https://github.com/shop/world/pull/383392.

When multiple developers run shopify app dev on the same app/shop combination, the CLI now provides clear feedback to both users about the session takeover and gracefully handles the conflict.

Changes

GraphQL Query Updates

dev-session-create.graphql: Now requests devSession, warnings, and userErrors fields
dev-session-update.graphql: Now requests devSession with user and websocket information

Schema Updates

Updated local schema file (app_dev_schema.graphql) to match backend changes:

Added devSession field to DevSessionCreatePayload
Added warnings array to DevSessionCreatePayload
Added devSession field to DevSessionUpdatePayload
Added new types: DevSessionWarning and DevSessionWarningCode enum

Implementation (dev-session.ts)

Session State Tracking:

Added DevSessionState interface to track websocket URL and user information
Added currentSessionState instance variable to maintain session metadata

Create-Time Warning Display:

Stores initial session state when dev session is created
Displays warnings from backend (e.g., SESSION_TAKEOVER)
Warnings are non-blocking - session creation succeeds even with warnings

Update-Time Takeover Detection:

Compares returned websocketUrl against expected local websocket URL on every update
If mismatch detected → another developer has taken over the session
Displays clear error message including the new user's email
Throws AbortError to gracefully terminate the dev session with actionable next steps

User Experience

Scenario: User B Takes Over User A's Session

User A starts dev:

$ shopify app dev
✅ Ready, watching for changes in your app

User B starts dev (same app/shop):

$ shopify app dev
⚠️  Another user is already running a dev preview for this app on example.myshopify.com.
✅ Ready, watching for changes in your app

User A makes a code change:

[app-extension] Extension updated

❌ Error
└  
⚠️  Another developer (user-b@shopify.com) has taken over this dev session.
Your preview is no longer active. Terminating dev session...

Dev session has been taken over by another user.
You can restart by running \`shopify app dev\` again.

Benefits

✅ Immediate feedback for aggressor: User B knows they displaced someone
✅ Quick discovery for victim: User A learns about takeover on next code change (typically seconds)
✅ Clean separation: Warnings (non-blocking) vs errors (blocking)
✅ Graceful termination: Clear messaging with actionable next steps
✅ No false positives: Only checks during actual mutations, not on normal disconnects
✅ Future-proof: Uses structured warning codes for extensibility

Dependencies

This PR depends on backend changes:

https://github.com/shop/world/pull/383392 - Adds session takeover warning on create

Testing Plan

Once the backend PR is merged:

Test session takeover warning appears when User B starts dev
Test User A's session terminates gracefully on next update after takeover
Verify error messages are clear and actionable
Test edge cases:
- Same user, multiple machines
- Same user, same machine (should show no warning)
- Rapid takeover scenarios

Addresses https://github.com/shop/issues-develop/issues/21606

Measuring impact

n/a - this doesn't need measurement, e.g. a linting rule or a bug-fix

Checklist

I've considered possible cross-platform impacts (Mac, Linux, Windows)
I've considered possible documentation changes

dmerand · 2026-01-28T21:06:43Z

Detect dev session takeover #6799 👈 (View in Graphite)
main

This stack of pull requests is managed by Graphite. Learn more about stacking.

packages/app/src/cli/services/dev/processes/dev-session/dev-session.ts

github-actions · 2026-02-06T16:04:34Z

Coverage report

St.^❔	Category	Percentage	Covered / Total
🟡	Statements	79.65%	14494/18196
🟡	Branches	73.94%	7196/9732
🟡	Functions	79.81%	3691/4625
🟢	Lines	80.01%	13704/17128

Test suite run success

3721 tests passing in 1438 suites.

Report generated by 🧪jest coverage report action from e448893

.eslintrc.cjs

github-actions · 2026-02-09T20:17:15Z

We detected some changes at packages/*/src and there are no updates in the .changeset.
If the changes are user-facing, run pnpm changeset add to track your changes and include them in the next release CHANGELOG.

Caution

DO NOT create changesets for features which you do not wish to be included in the public changelog of the next CLI release.

craigmichaelmartin · 2026-02-09T20:20:55Z

I left a comment in slack that I'm surprised were doing this validation logic regarding dev preview takeover for updates in the CLI (vs the DevApi)? I expected the latter (server validation vs client validation reasons; + it would make tuning this logic/copy easier in the future since CLI is versioned) but stuck with how it was for now.

gonzaloriestra · 2026-02-10T13:10:15Z

/snapit

github-actions · 2026-02-10T13:13:14Z

🫰✨ Thanks @gonzaloriestra! Your snapshot has been published to npm.

Test the snapshot by installing your package globally:

npm i -g --@shopify:registry=https://registry.npmjs.org @shopify/cli@0.0.0-snapshot-20260210131100

Caution

After installing, validate the version by running just shopify in your terminal.
If the versions don't match, you might have multiple global instances installed.
Use which shopify to find out which one you are running and uninstall it.

gonzaloriestra

Working great! Comments are not blocking

gonzaloriestra · 2026-02-10T12:10:18Z

packages/app/src/cli/services/dev/processes/dev-session/dev-session.ts

+        await this.logger.error(
+          `Another developer ${newUserEmail ? `(${newUserEmail}) ` : ''}has taken ownership of this dev preview.`,
+        )


Why showing the error twice? I'd get rid of this if we are going to abort.

I think it's nice to see something in the log, even if we end up saying the same thing in the final error message. I asked about copy for these messages here and while I didn't explicitly ask if both were warranted, there wasn't push back against having both.

gonzaloriestra · 2026-02-10T12:13:03Z

packages/app/src/cli/services/dev/processes/dev-session/dev-session.ts

+        const message = `Another user${
+          newUserEmail ? ` (${newUserEmail})` : ''
+        } has taken ownership of this dev preview. Your preview is no longer active.`


Not a big deal, but the issue I mentioned here is not fixed.

If the only change is the websocket URL, we are saying Another user, but showing the same email.

gonzaloriestra · 2026-02-10T12:15:33Z

packages/app/src/cli/services/dev/processes/dev-session/dev-session.ts

+    if (warnings.length > 0) {
+      await Promise.all(
+        warnings.map((warning) => {
+          const message = warning.code === 'SESSION_TAKEOVER' ? `⚠️  ${warning.message}` : warning.message


Why not just adding the emoji to all the warnings?

Suggested change

const message = warning.code === 'SESSION_TAKEOVER' ? `⚠️ ${warning.message}` : warning.message

const message = `⚠️ ${warning.message}`

gonzaloriestra reviewed Feb 2, 2026

View reviewed changes

packages/app/src/cli/services/dev/processes/dev-session/dev-session.ts Outdated Show resolved Hide resolved

packages/app/src/cli/services/dev/processes/dev-session/dev-session.ts Outdated Show resolved Hide resolved

craigmichaelmartin force-pushed the dlm-session-takeover branch from d7e0917 to f2eb296 Compare February 6, 2026 15:57

craigmichaelmartin force-pushed the dlm-session-takeover branch 8 times, most recently from d1954be to 3389ecf Compare February 9, 2026 19:15

craigmichaelmartin reviewed Feb 9, 2026

View reviewed changes

.eslintrc.cjs Outdated Show resolved Hide resolved

craigmichaelmartin force-pushed the dlm-session-takeover branch from 3389ecf to 9ab5b37 Compare February 9, 2026 19:26

craigmichaelmartin marked this pull request as ready for review February 9, 2026 20:17

craigmichaelmartin requested a review from a team as a code owner February 9, 2026 20:17

craigmichaelmartin force-pushed the dlm-session-takeover branch 3 times, most recently from ea7bd9d to fa92fff Compare February 9, 2026 21:04

Detect dev session takeover

e448893

craigmichaelmartin force-pushed the dlm-session-takeover branch from fa92fff to e448893 Compare February 9, 2026 21:10

gonzaloriestra approved these changes Feb 10, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Detect dev session takeover #6799

Detect dev session takeover #6799

dmerand commented Jan 28, 2026 •

edited by gonzaloriestra

Loading

Uh oh!

dmerand commented Jan 28, 2026

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Feb 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions bot commented Feb 9, 2026

Uh oh!

craigmichaelmartin commented Feb 9, 2026

Uh oh!

gonzaloriestra commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

gonzaloriestra left a comment

Uh oh!

gonzaloriestra Feb 10, 2026

Uh oh!

craigmichaelmartin Feb 10, 2026

Uh oh!

gonzaloriestra Feb 10, 2026

Uh oh!

gonzaloriestra Feb 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	const message = warning.code === 'SESSION_TAKEOVER' ? `⚠️ ${warning.message}` : warning.message
	const message = `⚠️ ${warning.message}`

Detect dev session takeover #6799

Are you sure you want to change the base?

Detect dev session takeover #6799

Conversation

dmerand commented Jan 28, 2026 • edited by gonzaloriestra Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

GraphQL Query Updates

Schema Updates

Implementation (dev-session.ts)

User Experience

Scenario: User B Takes Over User A's Session

Benefits

Dependencies

Testing Plan

Measuring impact

Checklist

Uh oh!

dmerand commented Jan 28, 2026

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage report

Test suite run success

Uh oh!

Uh oh!

github-actions bot commented Feb 9, 2026

Uh oh!

craigmichaelmartin commented Feb 9, 2026

Uh oh!

gonzaloriestra commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

gonzaloriestra left a comment

Choose a reason for hiding this comment

Uh oh!

gonzaloriestra Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

craigmichaelmartin Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

gonzaloriestra Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

gonzaloriestra Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dmerand commented Jan 28, 2026 •

edited by gonzaloriestra

Loading

github-actions bot commented Feb 6, 2026 •

edited

Loading