[jek]

WHY are these changes introduced?

shopify app security check found its app root and TOML with its own discovery logic, which differed from the rest of the CLI (for example, it refused a symbolic-linked TOML) and had no way to scan code with no app configuration.

WHAT is this pull request doing?

Add a shared resolver that turns --path, --config, --client-id and the new --without-app-config into one selection, using localAppContext like other app commands. When no TOML is found and prompting is available, check offers to scan without app configuration and picks the app with link's picker. The engine now receives the resolved app directory and TOML instead of discovering them, and check reports the selection in its summary and in --json.

How to manually test your changes?

cd <app directory>/app/routes
shopify app security check
shopify app security check --path <directory without a TOML> --without-app-config --client-id <client-id>
shopify app security check --path <directory without a TOML>

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add