Refer to app security checks generically instead of "App Security"

Replace the title-cased "App Security" product name in command help,
messages, agent instructions, check prompts, comments, and tests with
generic wording: "app security check" and "app security check results".
Regenerates the embedded checks, oclif manifest, and docs.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: nickwesselman

.changeset/app-security-generic-wording.md

@@ -0,0 +1,6 @@
+---
+'@shopify/app': patch
+'@shopify/cli': patch
+---
+
+Refer to `shopify app security` results and instructions as an app security check instead of the title-cased "App Security"

packages/app/src/cli/commands/app/security/check.ts

@@ -11,9 +11,9 @@ export default class SecurityCheck extends BaseCommand {
   static summary =
     'Check an app for Shopify-specific security issues and write deterministic-findings.json and agent-checks.json.'
 
-  static descriptionWithMarkdown = `Runs Shopify App Security locally and writes \`deterministic-findings.json\` and \`agent-checks.json\` to the results directory, \`.shopify/app-security/<results key>/\`. The results key is \`--client-id\` when you pass it, and otherwise the name of the app configuration file without \`.toml\`; the other \`app security\` commands take the same selection flags and find the same directory. Every run replaces both files, so it's always safe to run the check again.
+  static descriptionWithMarkdown = `Runs an app security check locally and writes \`deterministic-findings.json\` and \`agent-checks.json\` to the results directory, \`.shopify/app-security/<results key>/\`. The results key is \`--client-id\` when you pass it, and otherwise the name of the app configuration file without \`.toml\`; the other \`app security\` commands take the same selection flags and find the same directory. Every run replaces both files, so it's always safe to run the check again.
 
-\`deterministic-findings.json\` holds the deterministic scan results. \`agent-checks.json\` holds the checks for your coding agent to investigate; the agent's results are recorded with \`shopify app security record\`. Use \`--config\` to select a specific app configuration when the project has multiple \`shopify.app*.toml\` files; App Security inspects only that configuration. Use \`--client-id\` to replace the configuration's client ID for this run. When no app configuration exists, use \`--without-app-config --client-id <client-id>\` to scan \`--path\` anyway with config checks skipped; in an interactive terminal the command offers to do this.
+\`deterministic-findings.json\` holds the deterministic scan results. \`agent-checks.json\` holds the checks for your coding agent to investigate; the agent's results are recorded with \`shopify app security record\`. Use \`--config\` to select a specific app configuration when the project has multiple \`shopify.app*.toml\` files; the check inspects only that configuration. Use \`--client-id\` to replace the configuration's client ID for this run. When no app configuration exists, use \`--without-app-config --client-id <client-id>\` to scan \`--path\` anyway with config checks skipped; in an interactive terminal the command offers to do this.
 
 The check scans the app directory and each \`--include-dir\`. Git ignore rules apply by default: a file or directory that Git ignores is skipped, using the rules of the repository that contains it, while files that Git tracks are always scanned. Use \`--no-git-ignore\` to turn Git ignore rules off for every scanned directory.
 

packages/app/src/cli/commands/app/security/clean.test.ts

@@ -148,7 +148,7 @@ describe('app security clean command', () => {
 
       const printed = await runRejected(['--path', directory])
 
-      expect(printed).toContain('No App Security results for shopify.app in')
+      expect(printed).toContain('No app security check results for shopify.app in')
       expect(printed).toContain('shopify app security check')
       expect(securityClean).not.toHaveBeenCalled()
     })

packages/app/src/cli/commands/app/security/clean.ts

@@ -11,7 +11,7 @@ import {outputResult} from '@shopify/cli-kit/node/output'
 export default class SecurityClean extends BaseCommand {
   static hidden = true
 
-  static summary = 'Remove local App Security results.'
+  static summary = 'Remove local app security check results.'
 
   static descriptionWithMarkdown = `Deletes the results directory, \`.shopify/app-security/<results key>/\`, without asking. The results key is \`--client-id\` when you pass it, and otherwise the name of the app configuration file without \`.toml\`. Other results directories are left alone. Prints each removed path.
 

packages/app/src/cli/commands/app/security/instructions.test.ts

@@ -159,7 +159,7 @@ describe('app security instructions command', () => {
           'process.exit unexpectedly called with "1"',
         )
 
-        expect(output.error()).toContain('No App Security results for shopify.app in')
+        expect(output.error()).toContain('No app security check results for shopify.app in')
         expect(output.error()).toContain('shopify app security check')
         expect(deliverAppSecurityInstructions).not.toHaveBeenCalled()
       } finally {

packages/app/src/cli/commands/app/security/instructions.ts

@@ -11,9 +11,9 @@ import {resolvePath} from '@shopify/cli-kit/node/path'
 export default class SecurityInstructions extends BaseCommand {
   static hidden = true
 
-  static summary = 'Provide App Security instructions to a coding agent.'
+  static summary = 'Provide app security check instructions to a coding agent.'
 
-  static descriptionWithMarkdown = `Prints the complete workflow that a coding agent should follow to review App Security results.
+  static descriptionWithMarkdown = `Prints the complete workflow that a coding agent should follow to review app security check results.
 
 By default, the instructions are printed to stdout. Use \`--copy\` to copy them to the clipboard or \`--write\` to write them to a file. Standalone instructions always start by running \`shopify app security check\`; only that invocation's generated review pack is trusted as workflow input.`
 

packages/app/src/cli/commands/app/security/record.test.ts

@@ -153,7 +153,7 @@ describe('app security record command', () => {
           'process.exit unexpectedly called with "1"',
         )
 
-        expect(output.error()).toContain('No App Security results for shopify.app in')
+        expect(output.error()).toContain('No app security check results for shopify.app in')
         expect(output.error()).toContain('shopify app security check')
         expect(securityRecord).not.toHaveBeenCalled()
       } finally {

packages/app/src/cli/commands/app/security/record.ts

@@ -10,7 +10,7 @@ import {outputResult} from '@shopify/cli-kit/node/output'
 export default class SecurityRecord extends BaseCommand {
   static hidden = true
 
-  static summary = 'Record agent App Security findings.'
+  static summary = 'Record agent findings from an app security check.'
 
   static descriptionWithMarkdown = `Reads a coding agent's complete findings document from stdin, validates it, and replaces \`agent-findings.json\` in the results directory, \`.shopify/app-security/<results key>/\`. The results key is \`--client-id\` when you pass it, and otherwise the name of the app configuration file without \`.toml\`.
 

packages/app/src/cli/commands/app/security/review.ts

@@ -9,7 +9,7 @@ import {globalFlags, jsonFlag} from '@shopify/cli-kit/node/cli'
 export default class SecurityReview extends BaseCommand {
   static hidden = true
 
-  static summary = 'Show the combined App Security results.'
+  static summary = 'Show the combined app security check results.'
 
   static descriptionWithMarkdown = `Combines the deterministic results (\`deterministic-findings.json\`, written by \`shopify app security check\`) with the recorded agent results (\`agent-findings.json\`, written by \`shopify app security record\`) and shows one view of every check: its findings, status and source. Both files are in the results directory, \`.shopify/app-security/<results key>/\`.
 

packages/app/src/cli/index.test.ts

@@ -7,7 +7,7 @@ import SecurityReview from './commands/app/security/review.js'
 import {describe, expect, test} from 'vitest'
 
 describe('@shopify/app command registration', () => {
-  test('registers App Security commands', () => {
+  test('registers app security commands', () => {
     expect(commands['app:security:check']).toBe(SecurityCheck)
     expect(commands['app:security:clean']).toBe(SecurityClean)
     expect(commands['app:security:instructions']).toBe(SecurityInstructions)