The wrong question is whether an AI model is smart enough to edit Liquid and CSS. Current models can navigate a theme, reason about layout, and implement changes. The harder question is what happens when the model misunderstands a component, Shopify rejects an asset, a browser shows a regression, or the worker stops halfway through the task.
Prompts guide behavior; permissions enforce safety
“Do not edit the live theme” belongs in the instructions, but it should also be impossible at the tool layer. A safe system binds every write to an unpublished theme and validates that the active run still owns the operation before any external change occurs.
This is the difference between prompt safety and system safety. Prompts express intent. Permissions, identifiers, and transactional tools enforce boundaries when the model or infrastructure behaves unexpectedly.
Every file update should either complete everywhere or roll back everywhere
An autonomous coder may hold copies of a file in a remote sandbox, local recovery storage, and the Shopify draft theme. If one layer updates while another fails, the next task begins from inconsistent evidence.
Prettifai routes theme edits through one atomic change tool. It writes the sandbox, mirrors the persisted bytes locally, and pushes the asset to Shopify. If Shopify rejects the update, the original content is restored. The system returns a failed change only after rollback.
Screenshots must judge value and detect collateral damage
A successful API response proves that Shopify accepted a file. It does not prove that the page looks right. The resulting page must be rendered and compared with the baseline.
Prettifai separates design review from regression review. The design review asks whether the intended improvement exists and fits the surrounding page. Regression review exercises important scenarios, including desktop, mobile, drawers, menus, search, cart, and shared styling, to detect changes that silently broke something else.
Recovery should restart from the last trustworthy state
Agent work is long-running. Servers restart. Network calls fail. Model providers return temporary errors. A dependable system records task states, file checkpoints, ownership leases, and heartbeat data so another worker can determine what is safe to resume.
If no mutation happened after saved agent context, continuing the conversation can be safe. If an edit occurred, restarting that task from its checkpoint is more conservative. This avoids replaying a conversation whose assumptions no longer match the files.
Human control belongs at the publication boundary
Autonomous work and human approval are complementary. The agent removes the technical workload; the merchant decides whether the outcome represents the brand and whether the timing is right.