[yummybomb]

Summary

Adds search_apps and get_app page tools for the public Shopify App Store, matched only to https://apps.shopify.com/*. Search uses the observed Turbo-Frame: search_page request with works-with/category filters and pagination. Listing reads return allowlisted developer, pricing, rating and listing fields. Both work signed out, settle without navigating and never install apps or start trials.

Both tools honor caller cancellation and bound text/warnings. Developer links omit query/fragment and reject embedded credentials. Listing ratings validate numeric metadata and complete visible count tokens before returning data. Malformed input is rejected before site interaction; wrong-page, rate-limit, challenge, missing-listing, changed-layout, timeout and cancellation outcomes are explicit. No automatic retries.

Store-admin scope and safety

App Store reads do not provide store-admin coverage. Product/order reads, product-draft preparation and reversible draft operations require an authorized store and observed mechanisms; these are not implemented. No store, trial or partner-account creation, installs or terms acceptance are included. Publishing, refunds, order edits and billing are omitted; future execution tools require a supported trusted human approval path for the exact store/action/parameters, not a model-supplied confirmation flag.

Tests

Rebased on current main 03616f7; only domain source/docs, fabricated site fixtures/tests and two sorted registry entries differ. Unrelated registry entries preserved exactly.

• node scripts/validate-registry.mjs: 81 tools valid.
• node --test "tests/*.test.mjs": 1609 passed, 0 failed; 32 site-specific tests.
• go test ./...: passed.
• node --test extension/sidepanel.test.mjs: passed (1 test).
• Full diff and worktree reviewed for scope, privacy, style and safe failure modes.

Independent QA and live evidence

Same independent reviewer completed one initial restart review plus two fix/rechecks. Initial review found an invalid JSON-LD count fallback; recheck 1 found partial regex matches in malformed visible counts. Both were reproduced and fixed with regression tests. Final recheck PASS on source 2c96853be1212569615c27983c80047ea708fca6, no remaining minor-or-higher defects, 438 scratch assertions. Later changes only update README/registry evidence/status, not tool source or tests.

• Kernel, 2026-09-30: native tools empty on inspected pages. Entire namespace registered/replaced atomically, preserving both tools. Current search source returned eight apps from another listing page. Final listing source returned three plans with no warnings from a different listing page at 02:34 UTC. Valid schemas, one GET per call, unchanged URL/tab count. Author search was rate-limited; no automatic retry or bypass.
• Local extension, 2026-09-30: reviewer used a fresh isolated profile and the real permission prompt, with no extension source edits. Final listing source returned three plans at 02:37 UTC, fields matching Kernel except timestamp, one GET and unchanged URL/storage. Whole-namespace replacement preserved both tools. Earlier extension search returned typed 429 and further public traffic stopped.
• Author extension deviation: headless validation used a temporary manifest with App Store access statically granted; repository extension files untouched. Reviewer real-prompt verification is separate evidence.

Registry statuses are verified, supported by dated live success on current tool source from a non-entry page. PR remains draft; do not merge automatically.

Limitations

English label parsing; no signed-in/store-specific state, permissions or individual reviews. Built-in feature cards are skipped with a warning. Sponsored-card layouts remain fixture-only. Site rate limits are uncharacterised. Missing known markup produces explicit failures, but arbitrary redesigns can still require parser updates. Cancellation propagation and malformed-site/oversized/credential-bearing fields are fixture-tested, not live mutation evidence. No mutation tool or mutation success is claimed.