karajan-code 4.22.0 → 4.24.0

package/README.md

@@ -34,6 +34,7 @@ Your AI agent (Claude Code, Codex, Copilot, Antigravity, Cursor…) writes the c
 - **Nothing personal ships** — every outbound boundary audits before it leaves the machine: the pre-commit rejects a staged diff carrying your denylisted personal data, hardcoded platform tokens (`ghp_`, `sk-`, `AKIA`…) block outright, `verify-pack`-style tarball scans guard the publish, and `kj privacy scan <dir>` audits any build output. Your denylist lives in `~/.karajan/privacy.yml` — the install asks and writes it for you.
 - **Installing IS activating** — `kj env install` performs the enforcement itself (git hooks, verdict gate, tool gate) instead of trusting the agent to run setup steps, and ends by printing the method into the very conversation that installed it. A commit outside the method is rejected, not narrated.
 - **The turn cannot end red — the Sentinel** — a deterministic supervisor (zero LLM) wired into the harness's synchronous hooks records the method state of the session as tools run, and a Stop hook blocks the agent from ending its turn while method violations are open. The program rules, the agent thinks. See [guarantee levels](#guarantee-levels-governed-vs-supervised).
+- **Trust expires — the Steward** — `kj steward sweep` checks the project's declared guarantees against their freshness and answers one of FOUR verdicts per invariant: ok, broken, *unknown* (evidence expired → refresh it) or *not observable* (nowhere to look → instrument it) — because confusing the last two with green is how a project decays for weeks behind a passing facade. The verdict is versioned in the repo, sealed in the decision chain, and every break lands on the board as PROPOSED work that nothing executes unreviewed. Runs on demand, on `kj resume` when stale, or as an opt-in scheduled Action.
 - **The review panel never runs dry** — nine built-in agents (Claude Code, Codex, GitHub Copilot, Antigravity `agy` — the gemini successor —, Kimi Code, Qwen, OpenCode, Aider, Gemini legacy), and when the configured reviewer exhausts its quota, `kj review` switches to an authenticated candidate with a LOUD notice — or hands you the menu of candidates with their tier (free / subscription / local) and the exact login command. Never a silent failure, never the brain reviewing itself.
 
 This repo runs under its own environment: every commit to karajan-code carries a cross-AI verdict.
@@ -58,6 +59,14 @@ kj init && kj env install && kj harden && kj review --install-gate
 git config core.hooksPath .karajan/hooks
 ```
 
+Already installed and just want to work — even with no computing background? One command:
+
+```sh
+kj go
+```
+
+It detects your agent (Claude Code or Codex; asks which one only if you have both), prepares the project silently the first time, opens the board in your browser, and drops you into a conversation that already follows the method. Your agent account and login stay yours — kj never touches credentials.
+
 Requires git and at least one AI agent CLI — two enables cross-AI review; three enables arbitration. The npm route is `npm install -g @karajan-family/code` (published as `karajan-code` before joining the scope; the legacy name still installs the same versions). All install routes (npm, binaries, brew, Python wrapper) in the [install docs](https://karajancode.com/docs/v4/install/).
 
 ## The daily loop

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.22.0",
+  "version": "4.24.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",
@@ -123,17 +123,18 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "smol-toml": "^1.7.0",
     "@vitest/coverage-v8": "^4.1.8",
     "esbuild": "^0.28.0",
     "eslint": "^10.4.1",
     "eslint-plugin-import-x": "^4.16.2",
+    "eslint-plugin-node-security": "5.2.2",
     "eslint-plugin-security": "^4.0.0",
     "globals": "^17.6.0",
     "lint-staged": "^17.0.7",
     "postject": "^1.0.0-alpha.6",
     "prettier": "^3.4.2",
     "simple-git-hooks": "^2.13.1",
+    "smol-toml": "^1.7.0",
     "vitest": "^4.1.8"
   }
 }

package/packages/hu-board/public/index.html

@@ -53,6 +53,7 @@
     <div class="modal" id="modal-content"></div>
   </div>
 
+  <script src="/utils/maggle-mode.js"></script>
   <script src="/utils/formatters.js"></script>
   <script src="/utils/modals.js"></script>
   <script src="/utils/api.js"></script>

package/packages/hu-board/public/utils/board-view.js

@@ -87,48 +87,49 @@ async function renderBoard() {
 
     // KJC-TSK-0403: 3 canonical lanes. Failed eliminado — HUs con
     // result=fail aparecen en Pending con badge ✗.
+    // Maggle mode (KJC-TSK-0810): plain label first, jargon as tooltip.
     const visibleColumns = [
-      { title: 'Pending', cls: 'pending', rows: columns.pending },
-      { title: 'Running', cls: 'running', rows: columns.running },
-      { title: 'Done', cls: 'done', rows: columns.done },
+      { title: maggleText('column.pending', 'Pending'), cls: 'pending', rows: columns.pending },
+      { title: maggleText('column.running', 'Running'), cls: 'running', rows: columns.running },
+      { title: maggleText('column.done', 'Done'), cls: 'done', rows: columns.done },
     ];
 
     app.innerHTML = `
       <div class="section-header">
-        <span class="section-header__title" title="${selectedProject ? esc(selectedProject) : ''}">Story Board${selectedProject ? ` - ${esc(projectDisplayName)}` : ''}</span>
+        <span class="section-header__title" title="${selectedProject ? esc(selectedProject) : ''}">${maggleText('board.title', 'Story Board')}${selectedProject ? ` - ${esc(projectDisplayName)}` : ''}</span>
         ${selectedProject ? `
           <button class="control-btn project-rename-btn"
                   style="background:transparent;border:none;color:var(--text-muted);cursor:pointer;font-size:0.9rem;padding:2px 6px;"
                   title="Renombrar este proyecto"
                   onclick="event.stopPropagation(); window.renameProjectModal('${esc(selectedProject)}', '${esc(projectDisplayName.replace(/'/g, '&#39;'))}');">✎</button>
         ` : ''}
-        <span class="section-header__count">${stories.length} stories</span>
+        <span class="section-header__count" title="stories">${stories.length} ${maggleText('board.stories', 'stories')}</span>
         ${costSummary ? `<span class="section-header__cost" title="${esc(costSummary.tooltip)}">💵 ${esc(costSummary.label)}</span>` : ''}
         ${cacheSummary ? `<span class="section-header__cache" title="${esc(cacheSummary.tooltip)}">${esc(cacheSummary.label)}</span>` : ''}
         ${isRunning ? `
           <button id="running-badge-btn" class="section-header__badge"
                 style="margin-left:auto;padding:4px 10px;font-size:0.8rem;background:var(--color-yellow,#eab308);color:#000;border-radius:var(--radius-sm);font-weight:600;border:none;cursor:pointer;"
                 title="Abrir el log de la HU en marcha">
-            ⚙ ${runningCount} running…
+            ⚙ ${runningCount} ${maggleText('board.running', 'running')}…
           </button>
           <button id="stop-run-btn" class="control-btn"
                 style="padding:4px 10px;font-size:0.8rem;background:var(--color-red,#ef4444);color:#fff;border:none;border-radius:var(--radius-sm);cursor:pointer;font-weight:600;"
-                title="Abortar todos los kj run en marcha de este proyecto (SIGTERM con escalado a SIGKILL tras 5s)">
-            ⏹ Stop
+                title="${maggleText('board.stopTitle', 'Abortar todos los kj run en marcha de este proyecto (SIGTERM con escalado a SIGKILL tras 5s)')}">
+            ${maggleText('board.stop', '⏹ Stop')}
           </button>
         ` : ''}
         ${lastOpenedLog ? `
           <button class="control-btn" id="view-log-btn"
                   style="${isRunning ? '' : 'margin-left:auto;'}padding:6px 12px;font-size:0.85rem;background:var(--bg-primary);border:1px solid var(--border);color:var(--text);border-radius:var(--radius-sm);cursor:pointer;"
                   title="Re-open the log of the most recent run/command">
-            📜 View log
+            ${maggleText('board.viewLog', '📜 View log')}
           </button>
         ` : ''}
         ${canRun ? `
           <button class="control-btn" id="run-plan-btn"
                   style="margin-left:auto;padding:6px 14px;font-size:0.9rem;background:var(--color-green);color:#fff;border:none;border-radius:var(--radius-sm);cursor:pointer;font-weight:600;"
-                  title="Launch kj run --plan over every plan in this project">
-            ▶ Run plan (${awaitingCount} HU${awaitingCount === 1 ? '' : 's'})
+                  title="${maggleText('board.runTitle', 'Launch kj run --plan over every plan in this project')}">
+            ${maggleText('board.run', '▶ Run plan')} (${awaitingCount} ${maggleText('board.story', 'HU')}${awaitingCount === 1 ? '' : 's'})
           </button>
         ` : ''}
       </div>
@@ -138,7 +139,7 @@ async function renderBoard() {
         </div>
       </div>
       <div id="rag-panel" class="rag-panel" style="margin:8px 0;display:flex;gap:8px;align-items:flex-start;flex-wrap:wrap;">
-        <input id="rag-query" type="text" placeholder="🔍 RAG search: ask anything about this project's plans / onboarding / code…"
+        <input id="rag-query" type="text" placeholder="${maggleText('board.ragPlaceholder', "🔍 RAG search: ask anything about this project's plans / onboarding / code…")}"
                style="flex:1;min-width:260px;padding:6px 10px;font-size:0.85rem;background:var(--bg-primary);border:1px solid var(--border);color:var(--text);border-radius:var(--radius-sm);" />
         <select id="rag-scope" style="padding:6px 10px;font-size:0.85rem;background:var(--bg-primary);border:1px solid var(--border);color:var(--text);border-radius:var(--radius-sm);">
           <option value="all">All</option><option value="plans">Plans</option><option value="onboarding">Onboarding</option><option value="code">Code</option>
@@ -305,7 +306,7 @@ function renderKanbanColumn(title, cssClass, stories) {
   return `
     <div class="kanban__column kanban__column--${cssClass}" data-column="${cssClass}"${stories.length === 0 ? ' style="opacity:0.55"' : ''}>
       <div class="kanban__column-header">
-        <span class="kanban__column-title">${title}</span>
+        <span class="kanban__column-title" title="${cssClass}">${title}</span>
         <span class="kanban__column-count" data-column-count>${stories.length}</span>
       </div>
       ${stories.map(renderStoryCard).join('')}

package/packages/hu-board/public/utils/command-launcher.js

@@ -60,10 +60,25 @@ async function showCommandLauncher() {
     },
   };
 
+  // Maggle mode (KJC-TSK-0810 AC2): the frequent action leads in plain
+  // language — one textarea, clear promise of what will happen. The full
+  // technical launcher (file paths, architect, clean) stays one click
+  // away behind "Más opciones…".
+  const maggle = isMaggleMode();
+  let advancedVisible = !maggle;
+  if (maggle) {
+    SCHEMAS.plan.label = maggleText('launcher.planLabel', SCHEMAS.plan.label);
+    SCHEMAS.plan.help = maggleText('launcher.planHelp', SCHEMAS.plan.help);
+    SCHEMAS.plan.simpleFields = [
+      { name: 'task', label: maggleText('launcher.taskLabel', 'Task'), type: 'textarea', rows: 6 },
+    ];
+  }
+
   let active = 'plan';
   const renderForm = () => {
     const s = SCHEMAS[active];
-    const fields = s.fields.map((f) => {
+    const visibleFields = (!advancedVisible && s.simpleFields) ? s.simpleFields : s.fields;
+    const fields = visibleFields.map((f) => {
       const id = `cmd-field-${f.name}`;
       if (f.type === 'textarea') {
         return `
@@ -90,14 +105,14 @@ async function showCommandLauncher() {
 
     dlg.innerHTML = `
       <div style="padding:14px 18px;border-bottom:1px solid var(--border);font-weight:600;display:flex;align-items:center;justify-content:space-between;gap:10px">
-        <span>⚡ Run a Karajan command</span>
+        <span>${esc(maggleText('launcher.title', '⚡ Run a Karajan command'))}</span>
         <button id="cmd-close" type="button" class="control-btn"
                 style="padding:4px 10px;border:1px solid var(--border);background:var(--bg-primary);color:var(--text);border-radius:var(--radius-sm);cursor:pointer">
           ✕
         </button>
       </div>
       <div style="padding:12px 18px;display:flex;gap:8px;border-bottom:1px solid var(--border)">
-        ${Object.entries(SCHEMAS).map(([key, s]) => `
+        ${Object.entries(SCHEMAS).filter(([key]) => advancedVisible || key === 'plan').map(([key, s]) => `
           <button type="button" data-cmd="${key}"
                   style="padding:6px 12px;border:1px solid var(--border);
                          background:${key === active ? 'var(--color-green)' : 'var(--bg-primary)'};
@@ -106,6 +121,13 @@ async function showCommandLauncher() {
             ${esc(s.label)}
           </button>
         `).join('')}
+        ${maggle && !advancedVisible ? `
+          <button type="button" id="cmd-more"
+                  style="margin-left:auto;padding:6px 12px;border:1px solid var(--border);background:var(--bg-primary);color:var(--text-muted);border-radius:var(--radius-sm);cursor:pointer;font-size:0.85rem"
+                  title="Comandos técnicos: kj plan con ficheros, kj architect, kj clean">
+            ${esc(maggleText('launcher.more', 'More…'))}
+          </button>
+        ` : ''}
       </div>
       <form id="cmd-form" onsubmit="return false"
             style="padding:14px 18px;display:flex;flex-direction:column;gap:12px;width:min(640px, 88vw);box-sizing:border-box">
@@ -114,11 +136,11 @@ async function showCommandLauncher() {
         <div style="display:flex;justify-content:flex-end;gap:8px;padding-top:8px;border-top:1px solid var(--border)">
           <button type="button" id="cmd-cancel" class="control-btn"
                   style="padding:6px 14px;border:1px solid var(--border);background:var(--bg-primary);color:var(--text);border-radius:var(--radius-sm);cursor:pointer">
-            Cancel
+            ${esc(maggleText('launcher.cancel', 'Cancel'))}
           </button>
           <button type="button" id="cmd-submit" class="control-btn"
                   style="padding:6px 14px;border:none;background:var(--color-green);color:#fff;border-radius:var(--radius-sm);cursor:pointer;font-weight:600">
-            Run
+            ${esc(maggleText('launcher.submit', 'Run'))}
           </button>
         </div>
       </form>
@@ -127,6 +149,8 @@ async function showCommandLauncher() {
     dlg.querySelectorAll('[data-cmd]').forEach((btn) => {
       btn.addEventListener('click', () => { active = btn.dataset.cmd; renderForm(); });
     });
+    const moreBtn = dlg.querySelector('#cmd-more');
+    if (moreBtn) moreBtn.addEventListener('click', () => { advancedVisible = true; renderForm(); });
     dlg.querySelector('#cmd-close').addEventListener('click', () => dlg.close());
     dlg.querySelector('#cmd-cancel').addEventListener('click', () => dlg.close());
     dlg.querySelector('#cmd-submit').addEventListener('click', () => submitCommand(active));
@@ -146,9 +170,21 @@ async function showCommandLauncher() {
     }
     // plan / architect: at least one of taskFile or task is required.
     if ((command === 'plan' || command === 'architect') && !body.taskFile && !body.task) {
-      await showError('Provide either a SPEC file path or paste the task text.', { title: 'Missing input' });
+      await showError(
+        maggle ? 'Escribe primero qué quieres pedir — con tus palabras vale.' : 'Provide either a SPEC file path or paste the task text.',
+        { title: 'Missing input' }
+      );
       return;
     }
+    // AC2: before launching, the maggle confirms knowing exactly what
+    // will happen — in their language, never a command name alone.
+    if (maggle && command === 'plan') {
+      const ok = await showConfirm(maggleText('launcher.confirm', ''), {
+        title: SCHEMAS.plan.label,
+        okLabel: maggleText('launcher.submit', 'Run'),
+      });
+      if (!ok) return;
+    }
     if (command === 'clean' && body.nuke) {
       const ok = await showConfirm(
         '`kj clean --nuke` will delete EVERY plan / session / batch + wipe the HU Board DB. Cannot be undone.',

package/packages/hu-board/public/utils/log-panel.js

@@ -79,13 +79,13 @@ function openGenericLogPanel({ id, label, tailUrl }) {
                    border-bottom:1px solid var(--border);
                    user-select:none;flex-shrink:0">
       <div style="display:flex;align-items:baseline;gap:10px;min-width:0">
-        <strong style="color:var(--text)">${esc(label)}</strong>
+        <strong style="color:var(--text)" title="${esc(label)}">${esc(maggleText('log.label', label))}</strong>
         <span style="font-family:var(--font-mono, monospace);font-size:0.78rem;
                      color:var(--text-muted);overflow:hidden;text-overflow:ellipsis;
                      white-space:nowrap">${esc(id)}</span>
       </div>
       <div style="display:flex;align-items:center;gap:6px;flex-shrink:0">
-        <span id="log-status" style="font-size:0.75rem;color:var(--text-muted);margin-right:8px">connecting…</span>
+        <span id="log-status" style="font-size:0.75rem;color:var(--text-muted);margin-right:8px">${maggleText('log.connecting', 'connecting…')}</span>
         <button id="log-min" type="button" title="Minimize (run keeps going)"
                 style="${winBtnStyle('#facc15')}">_</button>
         <button id="log-max" type="button" title="Maximize / Restore"
@@ -101,8 +101,8 @@ function openGenericLogPanel({ id, label, tailUrl }) {
                 white-space:pre-wrap;word-break:break-word"></pre>
     <footer style="padding:6px 12px;border-top:1px solid var(--border);
                    font-size:0.7rem;color:var(--text-muted);flex-shrink:0">
-      Closing this panel does NOT stop the run. It keeps going in the background;
-      reopen with the 📜 View log button on the board.
+      ${maggleText('log.footer', `Closing this panel does NOT stop the run. It keeps going in the background;
+      reopen with the 📜 View log button on the board.`)}
     </footer>
   `;
 

package/packages/hu-board/public/utils/maggle-mode.js

@@ -0,0 +1,124 @@
+// KJC-TSK-0810 (MGL-C) — maggle mode: the board in plain language.
+//
+// Classic script (no exports), loaded FIRST among the utils so the other
+// scripts can call maggleText() at render time. `kj go` opens the board at
+// /?maggle=1; the choice persists in localStorage so reloads keep the
+// plain-language UI, and ?maggle=0 (the "modo experto" link) clears it.
+// A dev opening the board directly sees no change. If storage is
+// unavailable the mode degrades to the technical UI — it never breaks.
+
+const MAGGLE_STORE_KEY = 'kj-maggle-mode';
+
+// Plain label first; the technical term survives as tooltip/secondary
+// detail where each call site renders it (AC1: llano delante, jerga detrás).
+const MAGGLE_LABELS = {
+  'column.pending': 'Por hacer',
+  'column.running': 'En marcha',
+  'column.done': 'Hecho',
+  'board.title': 'Tu trabajo',
+  'board.stories': 'tareas',
+  'board.story': 'tarea',
+  'board.run': '▶ Continuar con lo pendiente',
+  'board.runTitle': 'Karajan seguirá con las tareas que faltan, una a una. Podrás ver la actividad aquí.',
+  'board.stop': '⏹ Parar',
+  'board.stopTitle': 'Detiene el trabajo en marcha. Lo ya terminado se conserva.',
+  'board.viewLog': '📜 Ver actividad',
+  'board.running': 'en marcha',
+  'board.ragPlaceholder': '🔍 Pregunta lo que quieras sobre este proyecto…',
+  'header.subtitle': 'tu tablero de trabajo',
+  'nav.board': 'Tablero',
+  'nav.dashboard': 'Proyectos',
+  'nav.more': 'Más',
+  'picker.hint': 'Elige un proyecto para ver su tablero. Puedes cambiar de proyecto arriba a la derecha.',
+  'picker.project': 'proyecto',
+  'launcher.title': '📝 Pedir trabajo a Karajan',
+  'launcher.planLabel': '📝 Pedir trabajo nuevo',
+  'launcher.planHelp': 'Cuéntale a Karajan qué quieres construir o cambiar, con tus palabras. Lo convertirá en tareas que verás en el tablero — todavía no toca tu código.',
+  'launcher.taskLabel': 'Qué quieres pedir',
+  'launcher.submit': 'Pedir',
+  'launcher.cancel': 'Cancelar',
+  'launcher.more': 'Más opciones…',
+  'launcher.confirm': 'Voy a convertir tu petición en tareas del tablero. Tardará unos minutos y podrás seguir la actividad en esta ventana. ¿Sigo?',
+  'log.label': 'Actividad',
+  'log.connecting': 'conectando…',
+  'log.footer': 'Cerrar esta ventana NO detiene el trabajo: sigue en marcha. Vuelve a abrirla con el botón «📜 Ver actividad» del tablero.',
+};
+
+function isMaggleMode() {
+  try {
+    const flag = new URLSearchParams(location.search || '').get('maggle');
+    if (flag === '1') { localStorage.setItem(MAGGLE_STORE_KEY, '1'); return true; }
+    if (flag === '0') { localStorage.removeItem(MAGGLE_STORE_KEY); return false; }
+    return localStorage.getItem(MAGGLE_STORE_KEY) === '1';
+  } catch {
+    return false;
+  }
+}
+
+/** Plain label when maggle mode is on; the technical one otherwise. */
+function maggleText(key, technical) {
+  if (!isMaggleMode()) return technical;
+  return MAGGLE_LABELS[key] || technical;
+}
+
+// AC4: an error shown to a maggle is never a stacktrace alone. Pure —
+// the caller (showError) decides by mode and renders the HTML.
+function maggleErrorParts(rawMessage) {
+  return {
+    headline: 'Algo no ha salido como se esperaba',
+    next: 'No has roto nada. Vuelve a intentarlo; si se repite, cuéntaselo a tu agente en la conversación — este detalle le sirve para arreglarlo.',
+    detail: rawMessage,
+  };
+}
+
+// AC2 (nav half): the header keeps Tablero + Proyectos in plain Spanish
+// and folds every advanced view behind one "Más" toggle, which also
+// reveals the way back to the expert UI.
+function applyMaggleChrome() {
+  if (!isMaggleMode()) return;
+  document.body.classList.add('maggle-mode');
+  const subtitle = document.querySelector('.header__subtitle');
+  if (subtitle) subtitle.textContent = MAGGLE_LABELS['header.subtitle'];
+  const nav = document.querySelector('.header__nav');
+  if (!nav) return;
+  const KEEP = { board: MAGGLE_LABELS['nav.board'], dashboard: MAGGLE_LABELS['nav.dashboard'] };
+  const advanced = [];
+  for (const btn of nav.querySelectorAll('.nav-btn')) {
+    const view = btn.dataset.view;
+    if (view && KEEP[view]) {
+      btn.title = `${btn.textContent.trim()} — ${btn.title}`;
+      btn.textContent = KEEP[view];
+    } else {
+      btn.style.display = 'none';
+      advanced.push(btn);
+    }
+  }
+  if (advanced.length === 0) return;
+  const more = document.createElement('button');
+  more.className = 'nav-btn';
+  more.textContent = `${MAGGLE_LABELS['nav.more']} ▾`;
+  more.title = 'Vistas avanzadas y volver al modo experto';
+  more.addEventListener('click', () => {
+    const hidden = advanced[0].style.display === 'none';
+    for (const btn of advanced) btn.style.display = hidden ? '' : 'none';
+    more.textContent = `${MAGGLE_LABELS['nav.more']} ${hidden ? '▴' : '▾'}`;
+    let expert = document.getElementById('maggle-expert-link');
+    if (hidden && !expert) {
+      expert = document.createElement('a');
+      expert.id = 'maggle-expert-link';
+      expert.className = 'nav-btn';
+      expert.href = '/?maggle=0';
+      expert.textContent = 'Modo experto';
+      expert.title = 'Vuelve a la interfaz técnica (Pending/Running/Done, comandos kj)';
+      more.after(expert);
+    } else if (!hidden && expert) {
+      expert.remove();
+    }
+  });
+  // After the LAST nav button, so the plain row reads Tablero | Proyectos | Más.
+  advanced.at(-1).after(more);
+}
+
+if (typeof document !== 'undefined' && document.addEventListener) {
+  document.addEventListener('DOMContentLoaded', applyMaggleChrome);
+}

package/packages/hu-board/public/utils/modals.js

@@ -74,14 +74,23 @@ function ensureDialog() {
 function showError(message, opts = {}) {
   return new Promise((resolve) => {
     const dlg = ensureDialog();
-    const title = opts.title || 'Error';
+    // Maggle mode (KJC-TSK-0810 AC4): plain headline + next step, the raw
+    // message demoted to a collapsed technical detail — never alone.
+    const maggle = isMaggleMode() ? maggleErrorParts(message) : null;
+    const title = maggle ? maggle.headline : (opts.title || 'Error');
+    const body = maggle
+      ? `${esc(maggle.next)}
+         <details style="margin-top:10px"><summary style="cursor:pointer;color:var(--text-muted)">Detalle técnico${opts.title ? ` — ${esc(opts.title)}` : ''}</summary>
+           <pre style="white-space:pre-wrap;font-size:0.8rem;color:var(--text-muted);margin:8px 0 0">${esc(maggle.detail)}</pre>
+         </details>`
+      : esc(message);
     dlg.innerHTML = `
       <div style="padding:14px 18px;border-bottom:1px solid var(--border);
                   font-weight:600;color:var(--color-red,#ef4444)">
         ${esc(title)}
       </div>
       <div style="padding:16px 18px;font-size:0.9rem;line-height:1.5;
-                  white-space:pre-wrap">${esc(message)}</div>
+                  white-space:pre-wrap">${body}</div>
       <div style="padding:12px 18px;border-top:1px solid var(--border);
                   text-align:right">
         <button id="app-dialog-ok" class="control-btn"

package/packages/hu-board/public/utils/project-picker-view.js

@@ -70,11 +70,11 @@ async function renderProjectPicker() {
 
   app.innerHTML = `
     <div class="section-header">
-      <span class="section-header__title">Story Board</span>
-      <span class="section-header__count">${sorted.length} project${sorted.length === 1 ? '' : 's'}</span>
+      <span class="section-header__title">${maggleText('board.title', 'Story Board')}</span>
+      <span class="section-header__count">${sorted.length} ${maggleText('picker.project', 'project')}${sorted.length === 1 ? '' : 's'}</span>
     </div>
     <p style="padding:8px 4px 16px;color:var(--text-muted);font-size:0.9rem">
-      Pick a project to see its kanban. Use the project selector in the header to switch later.
+      ${maggleText('picker.hint', 'Pick a project to see its kanban. Use the project selector in the header to switch later.')}
     </p>
     <div style="display:grid;grid-template-columns:repeat(auto-fill, minmax(320px, 1fr));gap:14px">
       ${sorted.map((p) => {

package/packages/hu-board/src/auth.js

@@ -20,6 +20,8 @@
  *     legacy callers keep working.
  */
 
+import { timingSafeEqual } from "node:crypto";
+
 /** Loopback addresses we trust without auth, regardless of token state. */
 const LOOPBACK_ADDRESSES = new Set([
   "127.0.0.1",
@@ -41,7 +43,7 @@ export function authMiddleware() {
     if (isLoopback(req)) return next();
 
     const token = extractToken(req);
-    if (token === expected) return next();
+    if (tokensMatch(token, expected)) return next();
 
     return res.status(401).json({
       error: "Unauthorized",
@@ -53,6 +55,32 @@ export function authMiddleware() {
   };
 }
 
+/**
+ * Constant-time comparison of a presented token against the expected one.
+ *
+ * `===` on strings stops at the first differing byte, so the time it takes to
+ * reject a token leaks how much of a correct prefix was supplied. Over the
+ * loopback interface that is noise — but this middleware exists precisely for
+ * the case the header above describes, where the board is bound beyond
+ * loopback and the peer is on the LAN. There the difference is measurable, and
+ * the token can be recovered a byte at a time.
+ *
+ * `timingSafeEqual` throws when the buffers differ in length, so the length is
+ * checked first. That is not a leak worth closing: the length of the expected
+ * token is fixed by whatever wrote `~/.karajan/hu-board/token`, and a token of
+ * the wrong length is wrong regardless of its contents.
+ *
+ * @param {string|undefined} presented
+ * @param {string} expected
+ * @returns {boolean}
+ */
+function tokensMatch(presented, expected) {
+  if (typeof presented !== "string") return false;
+  const left = Buffer.from(presented, "utf8");
+  const right = Buffer.from(expected, "utf8");
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+
 /**
  * @param {import('express').Request} req
  * @returns {boolean}

package/scripts/install-binary.ps1

@@ -62,7 +62,10 @@ try {
       Write-Host "kj-install: Node $(& node --version) found — installing via npm (full product)..."
       & npm install -g (Get-NpmPkg)
       if ($LASTEXITCODE -ne 0) { throw "npm install failed (exit $LASTEXITCODE)." }
-      Write-Host "kj-install: installed. Run 'kj doctor' next, then 'kj install-tools' to complete the whole stack."
+      Write-Host ""
+      Write-Host "  Listo. Ahora escribe:  kj go"
+      Write-Host ""
+      Write-Host "  (avanzado: 'kj doctor' revisa la instalacion, 'kj install-tools' completa el stack)"
       return
     }
 
@@ -137,7 +140,10 @@ try {
     Add-UserPath $installDir
     $installed = (& (Join-Path $installDir "kj.cmd") --version) 2>$null
     Write-Host "kj-install: installed kj $installed (full product) — kj at $(Join-Path $installDir 'kj.cmd')"
-    Write-Host "kj-install: next — run 'kj doctor', then 'kj install-tools' to complete the whole stack."
+    Write-Host ""
+    Write-Host "  Listo. Ahora escribe:  kj go"
+    Write-Host ""
+    Write-Host "  (avanzado: 'kj doctor' revisa la instalacion, 'kj install-tools' completa el stack)"
     return
   }
 
@@ -168,7 +174,10 @@ try {
   Add-UserPath $installDir
   $installed = (& $dest --version) 2>$null
   Write-Host "kj-install: installed standalone kj $installed to $dest"
-  Write-Host "kj-install: next — run 'kj doctor'. For the full product later: re-run without KJ_STANDALONE."
+  Write-Host ""
+  Write-Host "  Listo. Ahora escribe:  kj go"
+  Write-Host ""
+  Write-Host "  (avanzado: 'kj doctor' revisa la instalacion; para el producto completo, re-ejecuta sin KJ_STANDALONE)"
 } finally {
   Remove-Item -Path $tmp -Recurse -Force -ErrorAction SilentlyContinue
 }

package/scripts/install-binary.sh

@@ -71,7 +71,11 @@ if [ "$MODE" = "full" ]; then
   if node_ok; then
     echo "kj-install: Node $(node --version) found — installing via npm (full product)..."
     npm install -g "$(npm_pkg)" || die "npm install failed. If it was a permissions error, set a user prefix (npm config set prefix ~/.local) and re-run."
-    echo "kj-install: installed $(kj --version 2>/dev/null || echo karajan-code). Run 'kj doctor' next."
+    echo "kj-install: installed $(kj --version 2>/dev/null || echo karajan-code)."
+    echo ""
+    echo "  Listo. Ahora escribe:  kj go"
+    echo ""
+    echo "  (avanzado: 'kj doctor' revisa la instalacion, 'kj install-tools' completa el stack)"
     exit 0
   fi
 
@@ -125,7 +129,10 @@ if [ "$MODE" = "full" ]; then
   installed="$("${INSTALL_DIR}/kj" --version 2>/dev/null || echo '?')"
   echo "kj-install: installed kj ${installed} (full product) — kj at ${INSTALL_DIR}/kj"
   path_hint "$INSTALL_DIR"
-  echo "kj-install: next — run 'kj doctor', then 'kj install-tools' to complete the whole stack."
+  echo ""
+  echo "  Listo. Ahora escribe:  kj go"
+  echo ""
+  echo "  (avanzado: 'kj doctor' revisa la instalacion, 'kj install-tools' completa el stack)"
   exit 0
 fi
 
@@ -156,4 +163,7 @@ fi
 installed="$("${INSTALL_DIR}/kj" --version 2>/dev/null || echo '?')"
 echo "kj-install: installed standalone kj ${installed} to ${INSTALL_DIR}/kj"
 path_hint "$INSTALL_DIR"
-echo "kj-install: next — run 'kj doctor'. For the full product later: re-run this installer without --standalone."
+echo ""
+echo "  Listo. Ahora escribe:  kj go"
+echo ""
+echo "  (avanzado: 'kj doctor' revisa la instalacion; para el producto completo, re-ejecuta sin --standalone)"

package/src/audit/basal-cost.js

@@ -272,10 +272,14 @@ export async function saveAuditSnapshot(projectDir, metrics) {
 
 export function computeGrowthDelta(current, previous) {
   if (!previous) return null;
+  // AC8 (KJC-TSK-0794): "not measured before" must never read as "unchanged" —
+  // the derivative only exists when BOTH snapshots actually measured it.
+  const bothMeasured = Array.isArray(current.deadExports) && Array.isArray(previous.deadExports);
   return {
     lines: current.totalLines - previous.totalLines,
     files: current.totalFiles - previous.totalFiles,
     deps: current.dependencies.total - (previous.dependencies?.total ?? 0),
+    deadExports: bothMeasured ? current.deadExports.length - previous.deadExports.length : null,
     since: previous.timestamp || null
   };
 }