[jek]

WHY are these changes introduced?

The shopify app security commands have no --json output: they're listed as exceptions in the JSON output lint rule. Coding agents and scripts that drive the app security workflow have to read terminal boxes instead. This stack adds typed JSON output to each command, one PR per command, and then switches the agent workflow to it.

WHAT is this pull request doing?

Adds --json to app security clean. The result says whether anything was removed, and lists the removed results directories as absolute paths:

{"status": "success", "changed": true,
 "app": {"directory": "/path/to/app", "configurationPath": "/path/to/app/shopify.app.toml", "clientId": "1234"},
 "resultsDirectories": ["/path/to/app/.shopify/app-security/shopify.app"]}

• With --all, only the app directory is known, so app holds only directory. Nothing to remove gives changed: false and an empty list.
• A missing results directory fails with the code results-directory-not-found, which record and review share.
• app-security-json-output.ts holds the definitions that the other app security commands reuse, starting with app.

The first commit moves the terminal presenter to security-clean/result.ts without changing behaviour.

How to manually test your changes?

Build once and run the local CLI directly, so nothing else reaches stdout:

pnpm nx build cli
alias shopify-dev="node $PWD/packages/cli/bin/dev.js"

In an app directory:

shopify-dev app security check --path <app> --no-input --skip-instructions
shopify-dev app security clean --path <app> --json                # removes the results directory
shopify-dev app security clean --path <app> --json; echo "exit $?" # error with code results-directory-not-found, exit 1
shopify-dev app security clean --path <app> --all --json          # changed: false, app has only directory

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add