[iscekic]

bot: fix(mobile): clarify security agent permission and trusted hosts empty copy

Two copy fixes in apps/mobile/src/i18n/locales/en.json (en only; the other 86 catalogs keep the previous wording until the next translation pass syncs them, per the repo flow of never hand-editing non-English catalogs):

• securityAgent.scopeEntry.reauthorizeDescription no longer quotes the raw GitHub permission identifier. It now reads: "Security Agent needs permission to read Dependabot alerts. Re-authorize the GitHub App to grant this permission."
• trustedHosts.emptyDescription now covers both allowlists the screen shows when both are empty. It now reads: "When you trust a link's host or an image host, it opens without asking again." The screen (apps/mobile/src/components/trusted-hosts-screen.tsx) renders this empty state only when both the trusted link hosts and trusted image hosts lists are empty.

Verification

• pnpm check:i18n from apps/mobile: 87 languages, every catalog matches en.json; no duplicate-copy or wording violations.
• pnpm typecheck in apps/mobile (after building @kilocode/harness-sdk and @kilocode/trpc): clean. The earlier ~1100 phantom errors were missing package builds, not change-related.
• pnpm lint in apps/mobile: 0 warnings, 0 errors.
• pnpm format: no diffs.
• End to end on the Android emulator (omp36, Android 16, dev client on Metro from this branch, local backend): signed in with a fake account through the app's own OTP flow, then drove both surfaces:
  • Security Agent in the permission-required state (seeded a local GitHub integration row without the Dependabot permission, then removed it): the paragraph renders the new user-facing wording, screenshot attached.
  • Trusted hosts on a fresh account: empty state renders the new sentence covering link hosts and image hosts, screenshot attached.
• Screenshots taken on this branch's build; the served Metro bundle was checked to contain both new strings before capture.

Proxy answers

1. Question: Copy: New wording for securityAgent.scopeEntry.reauthorizeDescription (drops the raw 'vulnerability_alerts' id). Which direction?
   Answer: Needs permission to read Dependabot alerts
   Confidence: 0.60 · Precedent: UX and design quality: remove redundant copy and make surfaces clear (session a247f3c19b1e, "remove the redundant 'context' copy"); the brief asks for user words such as 'permission to read Dependabot alerts'
2. Question: Copy: New wording for trustedHosts.emptyDescription (screen shows it only when BOTH link and image host lists are empty). Which direction?
   Answer: One sentence, both kinds
   Confidence: 0.70 · Precedent: UX and design quality: remove redundant copy (session a247f3c19b1e, owner asked to remove the redundant "context" copy); the two-sentence option repeats the title
3. Question: Catalogs: Catalog scope for this PR?
   Answer: en.json only (Recommended)
   Confidence: 0.75 · Precedent: Git and pull requests: never hand-edit generated files and keep the diff to needed files (session df491946927a, "PR should be checked for stray changes before merging"); the brief says en.json only and to regenerate through the repo flow

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Two English copy strings changed in apps/mobile/src/i18n/locales/en.json; both render on the intended surfaces and the new wording matches the code paths that show them.

Files Reviewed (1 file)

• apps/mobile/src/i18n/locales/en.json

Verified against apps/mobile/src/components/security-agent/scope-entry-screen.tsx:228 (reauthorizeDescription is the description of the re-authorize setup screen) and apps/mobile/src/components/trusted-hosts-screen.tsx:113-117 (the trustedHosts.emptyDescription empty state renders only when both trusted link hosts and trusted image hosts are empty), so the broadened copy is accurate. Both new strings are unique in en.json (no duplicate-copy violation), and the other catalogs are intentionally left to the translation flow per apps/mobile/AGENTS.md. No security, logic, or memory-lifecycle concerns; the change is data-only with no runtime code paths touched.

---

_{Reviewed by deepseek-v4.1-flash-1017 · Input: 51K · Output: 4.3K · Cached: 355.2K}

_{Review guidance: REVIEW.md from base branch main}

[iscekic]

bot: Verified both changed strings on the Android emulator (omp36, Android 16) running this branch's bundle from Metro against the local backend.

Signed in through the app's own email OTP flow with a fake account.

1. Security Agent, permission-required state: the paragraph renders "Security Agent needs permission to read Dependabot alerts. Re-authorize the GitHub App to grant this permission." — no raw permission identifier. Reached by seeding a local GitHub integration row without the Dependabot permission, opening Home → Security Agent; the row was removed after capture.

2. Trusted hosts, empty state on a fresh account: the description renders "When you trust a link's host or an image host, it opens without asking again." Reached via Profile → Preferences → Account → Trusted hosts.

#1-security-agent-permission-copy.png
Security Agent permission-required state showing the new wording

#2-trusted-hosts-empty-copy.png
Trusted hosts empty state showing the new wording covering link hosts and image hosts