[jek]

WHY are these changes introduced?

Coding agents pipe their findings document into app security record. When the document is rejected, they have to read the errors from a terminal box before they can fix them and try again.

WHAT is this pull request doing?

Adds --json to app security record:

{"status": "success", "app": {"directory": "/path/to/app", "configurationPath": "/path/to/app/shopify.app.toml", "clientId": "1234"},
 "resultsDirectory": "/path/to/app/.shopify/app-security/shopify.app",
 "path": "/path/to/app/.shopify/app-security/shopify.app/agent-findings.json", "checkCount": 2, "findingCount": 1}

• Nothing on stdin fails with the code findings-document-missing.
• A rejected document fails with the code findings-document-rejected, and details.errors lists every error. A document is rejected when it isn't valid JSON, is too large, or fails validation. As before, nothing is written.

The first commit moves the terminal presenter to security-record/result.ts without changing behaviour.

How to manually test your changes?

Build once and run the local CLI directly, so nothing else reaches stdout:

pnpm nx build cli
alias shopify-dev="node $PWD/packages/cli/bin/dev.js"

shopify-dev app security check --path <app> --no-input --skip-instructions
shopify-dev app security record --path <app> --json < /dev/null                    # findings-document-missing
echo '{"schema_version": 1}' | shopify-dev app security record --path <app> --json  # findings-document-rejected, with details.errors

For an accepted document, copy the example from step 4 of shopify-dev app security instructions --path <app> and pipe it the same way.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add