[jek]

WHY are these changes introduced?

Fixes https://github.com/shop/issues-develop/issues/24069

After check, the question "How would you like to hand the results to your coding agent?" didn't say that the scan isn't complete until the agent runs its checks.

WHAT is this pull request doing?

• The question leads with the work left: " recommended agent checks available to complete your scan. How do you want to pass that prompt to your agent?"
• Next step 1 is now "Have your coding agent run the agent checks". It no longer repeats the agent checks path, which Artifacts already shows.
• Artifacts renames "Agent checks" to "Agent security check instructions", and shows both paths relative to the app directory, like the scan directories and issue locations.

Before

After

How to manually test your changes?

• pnpm shopify app security check --path <app directory> in an interactive terminal, and check the report and the question.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

[jek]

/snapit

[github-actions]

🫰✨ Thanks @jek! Your snapshot has been published to npm.

Built from 4eb63f38da8d08e037c0f18120c4bfaef0efaa57. Workflow run.

Test the snapshot by installing your package globally:

pnpm i -g --@shopify:registry=https://registry.npmjs.org @shopify/cli@0.0.0-snapshot-20261005151400

Caution

After installing, validate the version by running shopify version in your terminal.
If the versions don't match, you might have multiple global instances installed.
Use which shopify to find out which one you are running and uninstall it.

[jplhomer]

Nice

[github-actions]

⚠️ Potential Breaking Changes Detected

This PR contains changes that may break the existing contract.

@shopify/dev_experience — this PR contains breaking changes that require coordination for the next major release.

🏳️ Removed Flags

The following flags were removed from existing commands:

Command	Flag
app:security:check	--ignore