lvndr help: Changelog

2026-11-14 (evening): LVNDR by Toolfora, steadier for agents

lvndr is now LVNDR by Toolfora. The app lives at lvndr.toolfora.com and these pages at toolfora.com/lvndr; the old address keeps working.
An undo made in LVNDR is recognised the moment Shopify reports it, so it never joins an agent's run or batch and undoing that run can never put the bad edit back.
Undoing a run, batch or restore point starts right away instead of waiting up to a minute, and every preview shows each field's current value and what it will be set to.
Dismissing an alert needs a key that may undo, so a read-only agent cannot silence the alert about itself. Messages say what actually happened: already undone, expired key, a plan that was never previewed.
CLI: lvndr login works and hides the key, --yes asks before writing, and lvndr guard shows progress while it waits.

Every page names things the way the Shopify admin does: field names, variant and option names, collection titles and stock locations instead of ids. Undo results say what was put back, not which API call ran.
Put one record back: from a record's history or any change, undo that change and everything after it on that record, previewed first.
Undo by filter: filter the change log (for example by who made it and the date) and undo every matching change, previewed and confirmed first.
Every write to the live store from a run, batch, selection or rollback asks to confirm once more after the preview. Name a restore point when you mark it; burst alerts link the rollback to just before them.
Previews follow a record changed several times step by step, so they match what the undo will do.
If someone edits a field in the moments between the preview and the undo, LVNDR writes nothing and asks you to preview again, so their edit is kept.
Runs show Undone or Partly undone; an alert closes itself once its batch is undone. Restore points have their own page.
Alert settings, the test email and a full re-read live in Settings. Revoking a key or a store link asks once first.
Large stores: the first snapshot and the daily check continue across passes instead of stopping at 20,000 products; a brief Shopify outage no longer stops them.
A store link lets another store read changes; restore proofs need their own separate permission.

Every write to the store needs the preview someone saw: MCP writes take a confirmation_token for every kind of key, REST writes need the dry run's planHash (400 plan_required without it), the CLI needs --plan-hash with --run, or --yes at a terminal.
New MCP previews for run and batch undos; the undo tools no longer take dryRun. The two deprecated alias tools are gone. lvndr_search_changes takes resourceId.
Run detail says how far LVNDR has caught up (attributedThrough, pendingDeliveries); agents and lvndr guard poll it instead of sleeping (up to 5 minutes).
Runs say what they capture. Only a key with the undo scope opens a run that takes every unattributed change.
Starting a run marks a restore point by default on every surface, and needs only the read scope, like marking a restore point.
Plugin and registry configs need only the URL: clients sign in with OAuth. CLI: help per command, exit 7 for conflicts and 8 when the plan lacks the API.

Run, batch and rollback undos run as background jobs with a progress banner; the API answers 202 with a job (GET /api/v1/jobs/:id, MCP lvndr_get_job) and the CLI waits for it.
Every undo is bound to its preview: if the store moved since, nothing is written and you preview again.
Agent access (API, MCP, CLI) on every plan, with rate limits by plan. New keys can read and undo; rollback and export are opt-in.
Backups: download a ZIP of every tracked record, or have it uploaded daily or weekly to your own S3, R2, B2 or MinIO bucket.
History is never pruned below the longest window the store had in the last 30 days. Restore proofs only write to a linked development store. Uninstalling revokes every key and OAuth connection.

Agent runs: an agent announces its task, a restore point is marked, every change it causes is tagged, and the whole run can be reviewed and undone from the new Runs page, the API, MCP or the CLI.
API keys carry scopes (read, undo, rollback, export) and can expire. Rate limits, Idempotency-Key and a single error shape on the REST API, which now also covers batch, run and rollback undo, alerts and record history, with an OpenAPI document.
MCP: OAuth sign-in through the Shopify admin, 19 tools, resources and prompts. Store writes need a confirmation token from a preview.
CLI: login and profiles, guard (a run around any command), run commands, exit codes.
Signed alert webhook, a read-only Sidekick extension, plugins for Claude Code, Cursor and Codex, an agent skill, and help articles as Markdown for language models.

Audit log, store links, sync progress and notification stamps added to the schema.
Platform round: inventory quantity tracking and undo, collection order undo, Shopify managed billing with plans, API keys, the REST API, the MCP endpoint, the CLI, the weekly restore proof, optional one-sentence summaries, and agent-aware alerts.
App Store listing: icon, copy, screenshots, the public privacy and support pages.
Webhooks hardened against unsigned headers; the production image is now two-stage and much smaller.
Tracking and undo of sales channel publication, product media, navigation menus, metafield definitions and flexible collection sources. Themes tracked (settings and template files).

Scheduler leases so extra servers never double-run a job; smart-collection rules undo; flexible collection sources tracked; moving a post back to its old blog.
Blogs and blog posts tracked and undoable; product options undo.
Security review follow-ups: stale snapshots dropped, faster burst detection, undo exclusion from batches, bounded rollback, safer data deletion and delivery handling.
History retention, split scheduler loops, deterministic ordering of changes.
Delivery queue, throttle-aware Admin API client, GDPR webhooks, anomaly alerts, variant add and remove undo, test suite.
Restore points, roll back to a point, the daily sweep.
Batch undo; collection membership restore that respects smart collections.
Pages tracked and undoable.
Undo of creates and restore of deletes.
Undo by change: preview, grouped writes, snapshot before every write, attribution of the undo itself.
Change log foundation: Shopify event subscriptions, snapshots, diffs, attribution tiers. Attribution spike written up.
Hosting on Railway with Postgres; app linked to Shopify.

Planned, not promised. Order may change.

Annual pricing.
Theme rollback. Needs an exemption from Shopify; without it apps cannot write theme files.
Inventory history per location.