[jek]

WHY are these changes introduced?

In an app with several app configurations, no shopify.app.toml and no shopify app config use choice, shopify app security check aborts with Couldn't find shopify.app.toml in <dir>. It doesn't offer a choice or say what to do next. shopify app security clean --all fails the same way, though it doesn't need a configuration.

WHAT is this pull request doing?

• check asks which configuration to scan when --config, a valid app config use choice and shopify.app.toml don't select one and there are several. The answer isn't saved: check prints the command with --config that skips the question next time. A single configuration is used without asking, and a stale app config use choice falls through to the question instead of re-running app config use.
• When it can't ask, it says what to do. Non-interactive runs, and record, review, clean and instructions, abort with <n> app configurations found in <dir>, and none is selected. and list the configurations to pass to --config.
• --client-id still overrides the selected configuration's client ID, as on deploy. With several configurations and none selected, it aborts instead of asking: it can't be combined with --config, so the printed commands couldn't repeat the choice. The error points to shopify app config use <config>.

Before

After

• clean --all finds the app directory without selecting or validating a configuration, so it works in these apps and with an invalid TOML. It still refuses a --path that doesn't exist, so a mistyped path can't walk up and delete another app's results.

Other app commands still abort in this case. The question is specific to App Security.

After

How to test your changes?

From an app directory with two or more shopify.app.<name>.toml files and no shopify.app.toml:

• pnpm shopify app security check --path <app directory>
• pnpm shopify app security check --path <app directory> < /dev/null
• pnpm shopify app security check --path <app directory> --client-id <client ID> < /dev/null
• pnpm shopify app security clean --all --path <app directory>
• pnpm shopify app security clean --all --path <app directory>/missing

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add