Loading…
Shopify
Global commerce platform powering millions of businesses with essential infrastructure and innovative engineering solutions.
- 370 posts summarised
- latest
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
From their blog
Latest articles
ShopGym: Realistic, reproducible sandboxes for shopping agents (2026) - Shopify
ShopGym converts live storefronts into self-contained, resettable sandbox shops for training and evaluating shopping agents, addressing challenges from changing products and bot detection. Its ShopArena layer separates exploration from generation using anonymized specifications and coding agents with execution-verification loops that repair failures without regenerating the whole shop. ShopGuru then synthesizes benchmark tasks across seven skill categories using rule-based and LLM generators grounded in each shop’s catalog, navigation, and policies. Validation over 224 tasks across six shops, three synthetic and three real, showed synthetic shops retain key structural properties and agent performance positively correlates with live storefronts when tested with BrowserGym and an internal system. The framework aims to provide reproducible environments for agents to fail and learn before interacting with live stores, with plans to expand to more retail domains and task types.
Helix: The internal tool powering our Shopify app's native migration (2026) - Shopify
Shopify’s internal tool Helix powers the native migration of its Shopify app, which has over 300 screens. The company previously rebuilt the Shop app in just 12 weeks using similar methods. Helix is a set of tools and skills that help LLMs migrate features and screens from the React Native app while following a highly opinionated architecture. Unlike most tools that gather information, create specs, and implement everything at once, Helix aims for consistent, high-quality, and maintainable results. The approach is now being applied to the larger Shopify App after its success with Shop.
Native is now the future of mobile at Shopify
Shopify is moving its mobile apps from React Native to Swift and Kotlin after reevaluating the assumptions behind its 2020 decision as coding models improved. React Native had reduced duplicated implementation and feature-parity work, but agents now handle much of the cross-platform implementation, translation, testing, and review work. Shopify is choosing greenfield rebuilds, with Helix breaking migrations into reviewed checkpoints that require tests, visual comparison, adversarial code review, and human approval. The Shop app reached the app stores as a fully native rebuild in 12 weeks, while the Shopify app migration is underway. The company will continue selected React Native library support while migrating all its apps, and will judge success by product velocity, app quality, and autonomous agent work.
Migrating Shop app from React Native to native
Shop migrated its React Native app to native iOS and Android implementations in SwiftUI and Jetpack Compose after coding-agent advances changed the economics of a shared mobile codebase. A one-week proof of concept showed that one engineer using agents could recreate screens, interactions, and flows closely enough to make a full migration feasible although the result was not production-ready. Six engineers then built the native foundations and main journeys with feature teams validating edge cases; they preserved sign-in state, push notifications, analytics events, and behavior while simplifying some screens. Compared with React Native, native startup was 23% faster on iOS and 50% on Android, stability rose from 99.5%+ to 99.95%+, Android size dropped 109 MB, release builds fell about 75%, and scrolling reached 120 FPS. The migration’s workflow combined specialized agents, plan approval, Tardis live-app feedback, screenshot and event comparisons, and human review while feature parity remained a release requirement.
How River takes security work from a fix to merge
Shopify’s River is an AI agent in Slack that manages dependency and first-party application vulnerability remediation beyond the patch. It validates ledger entries against repository, pull-request, and vulnerability-tracker state, checks whether findings remain active, and updates code on the repository head when it can do so safely. River regenerates lockfiles with repository tooling, repairs upgrade failures, discards stale CI results after rebases, and avoids overwriting human work. When product or risk judgment is required, it preserves evidence and hands owners a question, then verifies the repository head, dependency graph, tracker, and ledger after merge. In its 11 days, the dependency backlog fell about 70%, while security merges through the freshness-gated queue rose from about 10% to 80%.
Gisting: Compressing LLM Agent context to ↑ throughput and ↓ cost
Long system prompts improve agent behavior but increase inference time, cost, and the GPU capacity needed to serve a given traffic level. Shopify compresses the Sidekick GraphQL agent’s roughly 6,000-token system prompt into about 1,500 gist tokens, using special vocabulary tokens whose embeddings are learned by knowledge distillation while the model weights remain frozen. Training compares teacher logits from the full prompt with student logits from the gist-token prompt using KL divergence; at inference, the prompt is replaced with the gist-token string, requiring no custom serving path. In load tests at 350 requests per minute, compression reduced median time to first token from 438ms to 354ms and end-to-end latency from 6.8s to 4.2s, while raising throughput from 20.2 to 23.4 QPS and enabling 14% fewer GPUs in production without losing prediction quality.
How we raised mobile end-to-end test stability to 98%
Shopify’s largest mobile app had become blocked by flaky end-to-end tests, which failed when screens took longer to render and had been removed from pull-request checks. Since 2023, tests used Appium through WebdriverIO and React Native Test IDs, allowing timing shortcuts and assertions about component-tree presence rather than what merchants could see or use. The rebuild hides Appium behind a strict builder-style wrapper that requires an assertion after every action; computer vision uses screenshots, PaddleOCR for text, and OpenCV for icons, with Test IDs as an opt-in fallback. After promotion into blocking CI, stability reached 98% of individual test successes over total runs, up from 50% with the old API, on two platforms. A pre-promotion flakiness gate rejects tests that exceed a failure threshold across repeated runs, while remaining failures largely involve network problems or simulator boot failures.
Sidekick's continual learning loop
Frontier models can accelerate an AI product launch, but their serving cost and latency can become impractical as usage grows, while their weights do not learn from production failures. Shopify’s proposed flywheel captures low-quality conversations, defines quality with a rubric and calibrated judges, improves the surrounding harness through autoresearch, and then converts repaired trajectories into supervised fine-tuning and GRPO training signal. A panel of frontier reasoning models critiques failures, an arbiter produces repair instructions, and unresolved cases go to expert annotators; gist compression then shortens the agent’s static prompt without measured judge-quality loss. In production, the GraphQL agent serves up to 2,000 requests per minute and reportedly achieves a 96% serving-cost reduction versus an estimated frontier-model cost, with lower latency and higher throughput. The approach is presented as a continual-learning system that turns production experience into model-weight updates.
Building an agentic harness that outlasts the model
Shopify’s Application Security team built an agentic harness that scans software for vulnerabilities, proves candidates with real tests, and opens Shopify-specific remediation pull requests. Its Dispatch orchestrator partitions repositories, runs category-specific Hunting agents in parallel, verifies findings sequentially with a different model, and persists architecture artifacts for later diff-based scans. Test oracles require realistic integration or functional coverage, including cross-tenant fixtures for IDOR checks, while unproven candidates are rejected or downgraded. Across more than 80 applications and thousands of scans, the workflow produced over 300 findings, including two rated Critical by Shopify’s severity calculator, with full scans costing $50–$300 and incremental scans $5–$50. The post concludes that durable value lies in the harness’s verification, partitioning, cross-model review, and deterministic infrastructure rather than in any single model.
Upgrading Checkout Blocks app to Polaris web components
Checkout Blocks upgraded all five UI extensions from React and Shopify’s legacy Remote UI bridge to remote-dom with Preact and Polaris web components, while moving from JavaScript to TypeScript and API version 2026-01. The migration addressed checkout’s performance sensitivity and Shopify’s requirement that deployments move off versions earlier than 2026-01. A parallel core-next library allowed extensions to transition incrementally, with shared providers, telemetry, hooks, helpers, and rules adapted before legacy core was removed. To meet the remote-dom CLI’s 64KB gzip limit, the team dropped react-reconciler, replaced liquidjs with a smaller parser validated against more than 42,000 lines of merchant configurations, replaced dayjs, and retained markdown-to-jsx through Preact compatibility. Transferred bundles fell 40% to 85%, while weighted ELT improved 8% at P50 and 7% at P90.
Inside Shopify Hack Days: Building a prototype for music-playing pages
During Shopify Hack Days 39, a 13-person team addressed why artists selling music on Shopify product pages lacked a built-in way to hear digital albums before buying. The team pursued two paths in parallel: a first-class Audio media type across Core, Admin API, admin-web, and storefront, and a standalone Shop Sounds app for release management. The app orchestrated product and variant creation, audio and artwork metafields, storefront access, and Online Store publication, while a theme extension provided track-level purchasing and a shared audio instance that continued across navigation. It also included six GLSL fragment shaders driven by bass, mid-range, treble, and overall energy, plus synced lyrics and a geolocated tour dates block. After three days, the team had a working prototype, but Shop Sounds was not a live product; the project demonstrated that native audio support and Shopify metaobjects and metafields could support a music toolkit without custom infrastructure.
Clustering billions of products for agentic commerce with Catalog API
Shopify’s Catalog must reconcile billions of listings whose merchants use different product and variant structures, so AI shopping agents can identify the same real-world product. Product clustering groups related listings under a Universal Product Identifier, with precision prioritized over recall because wrong products can lead to incorrect purchases while missed variants remain findable. The intra-store system starts with rules-based singleton detection, then uses ANN and sparse average linkage for pre-chunking, and applies a two-stage LLM process that proposes clusters and critiques them using the core value proposition framework. Dynamic per-chunk strict JSON schemas enforce complete product coverage, support arbitrary chunking, and improved recall by 8% on the Toloka evaluation dataset in one schema change. The resulting pipeline is presented as a scalable intra-store foundation, while cross-store clustering into global UPIs is identified as the next step.
Teaching Sidekick to say no: automated data curation with LLM judge consensus
Sidekick’s customer-segmentation skill was fine-tuned on tens of thousands of successful, de-identified production queries, so it generated zero-result queries instead of refusing impossible requests such as finding customers by occupation. A small Toloka dataset of roughly 600 standard queries and 602 refusal annotations became a seed for four frontier LLM judges, which were calibrated against human-labeled examples and required to agree on both verdict and reasoning. The pipeline used mutually exclusive categories to resolve conflicting labels, filtered disagreements for human review, and fed accepted examples from later production traffic back into fine-tuning. With automated curation, the segmentation pass rate rose from 0.762 to 0.798 versus naive merging, while manual validation measured 86.3% refusal accuracy and a 4.6% false-positive rate. The resulting flywheel is being applied to other Sidekick skill models and data-quality problems.
Quick: An internal hosting platform for the AI era
Shopify built Quick to make internally created prototypes, dashboards, tools, and games easier to share than deploy, giving employees a secure URL for a folder of HTML and assets. Launched internally in July 2025, it places sites behind Identity-Aware Proxy, serves bucket content through NGINX and gcsfuse, and deploys with a wrapper around gcloud rsync. A service in front of CloudSQL provides database and realtime APIs, while server-held credentials support calls to Shopify’s AI proxy; file uploads, BigQuery access, WebSockets, and employee identity are also available. Quick now hosts more than 50,000 sites, has been used by over half of Shopify employees, and runs on one $200-per-month VM, with constraints, rate limiting, and a migration from Node to Go supporting its operation.
Under the River
Shopify describes how its AI agent, River, grew from an infrastructure bet aimed at making a large, fragmented codebase usable by AI. In early 2024, the company adopted a monorepo called World and Nix as a reproducible substrate for development, CI, and production, despite substantial migration costs. River operates in public Slack channels, where it reads code, runs tests, queries data, inspects production traces, and opens pull requests; in a recent 30-day period it handled 59,918 sessions and contributed to 3,536 merged pull requests. Underneath it, Aquifer provides durable sessions, sandboxes, gateways, event logs, credentials handling, and observability, allowing agent profiles to share one platform across interactive, automated, and batch modes. The central design principle is that the session must survive process and machine failure, while public transcripts create a compounding knowledge corpus.
We replaced Redis with MySQL for inventory reservations—and it scaled
Shopify replaced its Redis-based inventory reservation system with MySQL to unify reservations with the inventory ledger and provide ACID coordination between payment and inventory updates. The new design stores one row per sellable unit in a bounded pool of up to 1,000 rows per item/location combination, uses MySQL 8's SKIP LOCKED to avoid waiting on locked units, and replenishes depleted pools. Composite primary keys reduced row locks, READ COMMITTED avoided gap locks that interfered with replenishment, and consistent lock ordering prevented deadlocks. The investigation found connection-pool usage elsewhere in checkout, rather than reservation query speed alone, was the immediate ceiling; cleanup removed 50% of primary-database reads and 33% of transactions, while configuration changes added headroom. Shopify validated the design in shadow mode, then rolled it out gradually with a Redis rollback path, meeting high-throughput targets during peak 2025 traffic.
Flow generation through natural language: An agentic modeling approach
Shopify built a tool-calling agent for Sidekick that converts natural-language requests into Shopify Flow workflows, addressing the cold-start problem by working backward from thousands of anonymized production workflows. The team generated synthetic queries and tool trajectories, fine-tuned Qwen3-32B, and changed Flow’s nested JSON DSL into an equivalent Python representation connected by a round-trip transpiler. Using Python improved syntactic correctness by 22 points and semantic correctness by 13 points on a 300-example benchmark, while matching production tool names, ordering, responses, and prompts proved essential to avoid degradation. Production evaluation exposed a 35% gap masked by benchmark parity, so Shopify built a weekly feedback loop that scores conversations, filters training data, identifies slice gaps, retrains, and deploys. The resulting agent serves most production traffic, runs 2.2 times faster at 68% lower cost, and outperforms closed models.
Autoresearch isn’t just for training models
Repeated visual-regression failures made Polaris CI feedback cycles take about 30 minutes, prompting an attempt to optimize build time rather than fix individual tasks. The approach uses Pi to create an Autoresearch extension that repeatedly forms a hypothesis, measures the build against a 19.1-second baseline, and keeps only changes that improve the metric, discarding crashes and slower runs. The loop identified wasted VRT work: the full component pipeline ran before Storybook recompilation, while TypeScript transformed all 580 component files although 105 needed it. Removing those inefficiencies made the build 65% faster, although the system also produced unacceptable hacks that were discarded. The extension later gained multi-metric support, consistent iteration scripts, auto commits, and open-source adoption, with reported internal improvements including unit tests running 300 times faster and Playwright tests becoming faster.
Building a Magic Mirror: AI retail experiences with Remix
Shopify’s “magic mirror” is an AI-powered retail installation that uses a display and hidden webcam to deliver personalized messages, animations, and product interactions in under a minute. A Remix route handles the browser and server boundary: a button-triggered POST captures an image, sends it with a curated prompt to a vision-capable language model, and renders a compliment plus a makeup recommendation; server-sent events optionally let a remote device trigger or reset the experience. The prompt combines persona and safety constraints, a plain-text product and inventory table, and a required JSON schema, while strict product-ID lookup provides graceful degradation. The interface uses explicit states, delayed capture, timed response and reset screens, and animated transitions. The production setup keeps brand configuration, shared components, actions, and SSE infrastructure reusable across mirror modes.
Shopify’s journey to faster breadth-first GraphQL execution
Shopify describes how high-cardinality, deeply nested GraphQL queries exposed execution overhead beyond data loading, with field resolvers assembling responses consuming much of request time. Its GraphQL Cardinal engine replaces conventional depth-first traversal with breadth-first execution, resolving each selected field once across an aggregated set of objects and reducing repeated field-level work. For large list queries, Shopify reports up to 15x faster execution, 90% less memory use, and reductions of many seconds in P50 latency. The migration included a tuned interpreter, cheaper tracer behavior, shadow verification, benchmarks, and ongoing conversion of tens of thousands of legacy resolvers, while future work includes asynchronous patterns and lower-level C bindings.
Topics they write about
All topics →Weekly digest
The best engineering reads, once a week.