Repository navigation
ux(desktop): show security_policy.json path in the policy-managed update notice #23873
Description
Context
PR #20095 adds a notice on the About page when a security policy provider governs the app's updates. The notice text ends with "edit security_policy.json or ask whoever set it up." A usability test found readers didn't know where the file lives, and a single user owning their own computer found both options unhelpful.
Problem
The notice names the file but not its path. For a developer or power user who owns their own machine, the guidance is unclear.
Proposed fix
Show the full resolved path to security_policy.json in the notice (e.g. "~/.kiro/crew/security_policy.json"), or add a "Show in folder" button that opens the directory. When the user clearly owns the machine (e.g. the file is in their home directory), consider dropping "ask whoever set this up" from the copy.
Tracked from PR #20095 UX review (policy file path watch item).
Activity
mbriones98 commentedon Oct 27, 2026
🤖 Kiro Crew Auto-Pipeline [operator: mbriones98#091ded5d]: #20095 has merged, and the notice is the
updates_managed_by_policy_desktopstring on the About page. It names the file but not where it is. Showing the path isn't a copy-only change: the gateway reads its security policy from more than one place, depending on how the machine is set up, and the About page receives no path today. So the gateway would have to report which file actually applies. Two choices need a maintainer: whether that path, or a "Show in folder" action, should be visible in the dashboard at all, and when the "ask whoever set this up" wording may be dropped (only when the file is in the person's own home directory, or never). Once those are settled, the change is small.