Detect React Router apps outside the app directory in app security check

[jplhomer]

WHY are these changes introduced?

Refs shop/issues-develop#24160 (checklist item 3)

shopify app security check only treats the app directory as a React Router code root: it looks for app/routes/ and app/shopify.server.* relative to it. In monorepos the React Router server often lives elsewhere, such as packages/server added with --include-dir, or web/ under a root shopify.app.toml. Those files are already gathered, but the framework is reported as unknown, so nine deterministic checks are gated off as unsupported_framework or only partly run: UNAUTHENTICATED_ENDPOINT, REQUEST_CONTROLLED_ADMIN_CONTEXT, CREDENTIAL_LOG_LEAKAGE, CREDENTIAL_BROWSER_LEAKAGE, APP_PROXY_LIQUID_INJECTION, DEPRECATED_SCRIPT_TAG_SCOPE, UNSAFE_INNERHTML, EOL_API_VERSION and EXPIRING_OFFLINE_TOKEN.

WHAT is this pull request doing?

• Detect React Router roots as the directory of each gathered package.json that declares @shopify/shopify-app-react-router and has app/routes/ plus app/shopify.server.*. The app directory keeps its existing rule, so flat apps are detected exactly as before.
• Leave out roots inside another app's directory (the directories already reported as otherAppDirectories), so a sibling app in scope doesn't become this app's React Router root.
• Make the roots available to rules on the scan context, and match EOL_API_VERSION shopify.server declarations under each root instead of only app/shopify.server.*.

The roots are on the scan context rather than ProjectDetection, because ProjectDetection is written as the detection block of the deterministic findings document. This keeps that output unchanged.

Not included: EXPIRING_OFFLINE_TOKEN still reads every shopifyApp( setup in the gathered files, so a sibling app in scope can still cause a false positive there. That's tracked separately as checklist item 4.

How to manually test your changes?

1. In a monorepo, put a shopify.app.toml in apps/foo and a React Router app (package.json with @shopify/shopify-app-react-router, app/routes/, app/shopify.server.ts) in packages/server.
2. Run shopify app security check --path apps/foo --include-dir packages/server.
3. The framework is reported as React Router, and the source checks listed above run instead of reporting an unsupported framework.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

[Copilot]

🟢 Approval recommended

The focused detection change has regression coverage and no unresolved findings; tests were not executed.

0 open findings

What changed in this PR

Extends app security checks to detect React Router code in monorepo packages and nested directories without changing the serialized detection format.

Changes:

• Detects additional React Router roots while excluding roots belonging to other apps.
• Uses detected roots for API-version checks and adds regression coverage.

File	Description
packages/​app/​src/​cli/​services/​app-security-engine/​tests/​rule-analysis.test.ts	Updates scan-context fixtures.
packages/​app/​src/​cli/​services/​app-security-engine/​tests/​react-router-detection.test.ts	Covers flat, nested, included, and sibling-app layouts.
packages/​app/​src/​cli/​services/​app-security-engine/​scanners/​index.ts	Integrates root discovery into scanning.
packages/​app/​src/​cli/​services/​app-security-engine/​rules/​types.ts	Adds roots to the scan context.
packages/​app/​src/​cli/​services/​app-security-engine/​rules/​compliance-rules.ts	Checks API versions across detected roots.
packages/​app/​src/​cli/​services/​app-security-engine/​capabilities/​detect.ts	Implements root detection and ownership filtering.
.changeset/​app-security-react-router-roots.md	Records the user-facing fix.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/public/node/system.d.ts

@@ -104,9 +104,9 @@ export declare function sleep(seconds: number): Promise<void>;
  */
 export declare function terminalSupportsHyperlinks(): boolean;
 /**
- * Check if standard input and standard error are terminals that support prompting.
+ * Check if the standard input and output streams support prompting.
  *
- * @returns True if standard input and standard error support prompting.
+ * @returns True if the standard input and output streams support prompting.
  */
 export declare function terminalSupportsPrompting(): boolean;
 /**

packages/cli-kit/dist/public/node/ui.d.ts

@@ -21,7 +21,6 @@ interface UIDebugOptions {
     skipTTYCheck?: boolean;
 }
 export interface RenderConcurrentOptions extends PartialBy<ConcurrentOutputProps, 'abortSignal'> {
-    /** Ink options for terminal UI. Finite JSON output uses the command event channel on stderr instead. */
     renderOptions?: RenderOptions;
 }
 /**

packages/cli-kit/dist/private/node/ui/components/ConcurrentOutput.d.ts

@@ -1,4 +1,4 @@
-import { type OutputProcess } from '../../../../public/node/output.js';
+import { OutputProcess } from '../../../../public/node/output.js';
 import { AbortSignal } from '../../../../public/node/abort.js';
 import { FunctionComponent } from 'react';
 export interface ConcurrentOutputProps {
@@ -6,21 +6,14 @@ export interface ConcurrentOutputProps {
     prefixColumnSize?: number;
     abortSignal: AbortSignal;
     showTimestamps?: boolean;
-    /**
-     * Keeps terminal UI running after all processes finish. Defaults to false.
-     * In JSON mode, false uses finite progress/diagnostic events; true retains streaming terminal UI.
-     */
     keepRunningAfterProcessesResolve?: boolean;
     useAlternativeColorPalette?: boolean;
 }
 interface ConcurrentOutputContext {
     outputPrefix?: string;
-    /** Controls ANSI stripping for terminal output. JSON diagnostics are always unstyled. */
     stripAnsi?: boolean;
 }
 declare function useConcurrentOutputContext<T>(context: ConcurrentOutputContext, callback: () => T): T;
-/** Runs finite processes concurrently and routes their output through the shared diagnostic context. */
-export declare function runConcurrentProcessesForJson({ processes, abortSignal, }: Pick<ConcurrentOutputProps, 'processes' | 'abortSignal'>): Promise<void>;
 /**
  * Renders output from concurrent processes to the terminal.
  * Output will be divided in a three column layout

[jek]

Could we add a case showing that all qualifying React Router roots attributed to the selected app are scanned, rather than only one?

i.e. for something like

   repository/
   ├── apps/
   │   └── product-reviews/
   │       └── shopify.app.toml
   └── packages/
       ├── server/
       └── server-next/

[dmerand]

The agent had an edge case here worth looking at. Otherwise LGTM.

[dmerand]

Please keep gathered shared app code in the check inputs, or report its omitted coverage. With the selected TOML at the app root and only web/ detected, a route imports ../../../lib/preview, but lib/preview.ts is dropped here.

I reproduced this with a fresh build, the compiled engine, and the actual CLI: the helper is listed and read, but element.innerHTML = payload produces UNSAFE_INNERHTML v3 executed with zero findings and no coverage reason for this omission. Moving the same helper to web/lib/preview.ts produces one finding. Please add a regression test while retaining the sibling-app exclusion.

[jplhomer]

Updated!