[jek]

WHY are these changes introduced?

app security check is the last app security command without --json. Its service also rendered output, prompted and set the exit code partway through, so a JSON mode couldn't be added without separating those.

WHAT is this pull request doing?

Adds --json to app security check. A scan returns:

{"status": "success", "valid": true, "app": {…}, "resultsDirectory": "…",
 "deterministicFindingsPath": "…/deterministic-findings.json", "agentChecksPath": "…/agent-checks.json",
 "scope": {"includeDirs": [], "excludes": [], "noGitIgnore": false}, "scanDirectories": [{"directory": "…", "origin": "app-directory"}],
 "agentCheckCount": 36, "blocking": {"level": "none", "blockedCheckCount": 0},
 "instructions": {"content": "<Markdown>", "copied": true}}

• No findings. The result doesn't include them; review --json is the one place findings are reported. valid and blockedCheckCount follow --blocking, with the same rule and exit codes as today.
• Instructions. In a terminal, the instructions prompt is still offered under --json, on stderr. Its choices say that the instructions go into the result. --print-instructions includes them without asking. With --skip-instructions, "Nothing", or --no-input, instructions is left out.
• --list-files --json returns {status, app, scope, scanDirectories, files: [{path}]} with absolute paths.
• Declining "Scan it without app configuration?" prints {"status": "cancelled"} and exits 0. Text mode still exits 1 with the same error.
• Stderr events. Gathering warnings and the "To skip these prompts next time" tip become events on stderr.

Commits:

1. securityCheck returns a listed, scanned or cancelled outcome, and a presenter in security-check/result.ts renders it, prompts for instructions and sets the exit code. Declining is an outcome of the selection rather than an error. No behaviour change.
2. When the instructions can't be copied to the clipboard, check warns instead of failing: the scan has finished, so the exit code still follows --blocking. It has its own patch changeset, which also narrows the clipboard changeset from earlier in the stack.
3. Add --json, and remove the App Security section from the JSON output lint exceptions.

How to manually test your changes?

Build once and run the local CLI directly, so nothing else reaches stdout:

pnpm nx build cli
alias shopify-dev="node $PWD/packages/cli/bin/dev.js"

Run these in a real terminal with stdout redirected, so the prompts show while the result goes to the file:

# An app with two app configuration files: the picker and the instructions prompt appear; out.json holds one object
shopify-dev app security check --path <app> --json > out.json; echo "exit $?"; cat out.json

# A directory without app configuration: answer "No" -> {"status": "cancelled"}, exit 0
shopify-dev app security check --path <empty-dir> --json > out.json; echo "exit $?"; cat out.json

shopify-dev app security check --path <app> --config <name> --json --list-files
shopify-dev app security check --path <app> --config <name> --json --no-input --blocking low; echo "exit $?"   # valid: false, exit 1 when there are findings

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add