[jek]

WHY are these changes introduced?

app security instructions prints the coding-agent workflow as Markdown, or copies or writes it. Callers using --json need the instructions inside a single result, and check (later in this stack) will return them the same way.

WHAT is this pull request doing?

Adds --json to app security instructions:

• By default it returns {"status": "success", "app": {…}, "resultsDirectory": "…", "instructions": {"content": "<Markdown>", "copied": false}}. With --copy, copied is true. The results directory may not exist yet, because the instructions start by running check.
• With --write <file>, stdout holds only {"path": "/abs/file.md", "format": "markdown"}, as with doc fetch.

Commits:

1. Split the instructions into building, delivering (copy or write) and presenting, so check can reuse them. No behaviour change.
2. Add --json.
3. Report clipboard failures as errors. When the clipboard tool is missing (xsel on Linux, for example), --copy used to fail as an unexpected error with a stack trace, reported as a bug. It now fails as an error with the code clipboard-unavailable and suggests printing or --write instead. It has its own patch changeset.

How to manually test your changes?

Build once and run the local CLI directly, so nothing else reaches stdout:

pnpm nx build cli
alias shopify-dev="node $PWD/packages/cli/bin/dev.js"

shopify-dev app security instructions --path <app> --json
shopify-dev app security instructions --path <app> --copy --json             # copied: true; the clipboard holds content
shopify-dev app security instructions --path <app> --write /tmp/instructions.md --json

To see the clipboard error on macOS, hide pbcopy, then run --copy with and without --json:

mkdir -p /tmp/no-pbcopy && ln -sf "$(command -v node)" /tmp/no-pbcopy/
PATH=/tmp/no-pbcopy node packages/cli/bin/dev.js app security instructions --path <app> --copy --json

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add