feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/arbitrary_file_read.md

@@ -1,24 +1,42 @@
 # Arbitrary File Read Specialist Agent
 ## User Prompt
-You are testing **{target}** for Arbitrary File Read vulnerabilities.
+You are testing **{target}** for Arbitrary File Read / path traversal / LFI.
 **Recon Context:**
 {recon_json}
 **METHODOLOGY:**
-### 1. Identify File Read Endpoints
-- Download endpoints: `/download?file=`, `/api/files/`, `/export`
-- PDF generators, image processors, template engines
-- API endpoints returning file contents
-### 2. Payloads
-- Direct: `file=/etc/passwd`, `file=C:\Windows\win.ini`
-- Traversal: `file=../../etc/passwd`, `file=....//....//etc/passwd`
-- URL encoding: `file=%2e%2e%2f%2e%2e%2fetc%2fpasswd`
-- Null byte: `file=/etc/passwd%00.pdf` (older systems)
-- Wrapper: `file=php://filter/convert.base64-encode/resource=/etc/passwd`
-### 3. High-Value Targets
-- `/etc/passwd`, `/etc/shadow`, `~/.ssh/id_rsa`
-- `.env`, `config.py`, `application.properties`, `web.config`
-- `/proc/self/environ` (environment variables)
-### 4. Report
+
+### 1. Identify file-read sinks
+- Download/export: `/download?file=`, `/api/files/`, `/export?template=`, `/report?path=`.
+- Renderers that fetch by path: PDF generators (wkhtmltopdf, weasyprint), image processors (ImageMagick), template/include engines (`?page=`, `?view=`, `?lang=`).
+- Static/asset proxies, `/api/attachment/{name}`, log viewers, backup downloaders.
+- Note the OS from recon (Linux vs Windows) — it decides which target files exist.
+
+### 2. Payloads (escalate; keep reads benign)
+- Direct: `file=/etc/passwd`, `file=C:\Windows\win.ini`.
+- Traversal: `../../../../etc/passwd`; depth-pad with many `../`; bypass filters with `....//....//`, `..%2f`, `%2e%2e%2f`, double-encode `%252e%252e%252f`, `..%c0%af` (overlong).
+- Null byte on legacy: `file=/etc/passwd%00.pdf`.
+- PHP wrappers: `php://filter/convert.base64-encode/resource=index.php` (read source), `php://filter/read=string.rot13/...`; `data://`, `expect://` if enabled.
+- Absolute-path fixups: strip a forced prefix by prepending `/`, or use `zip://`/`phar://` for archive-aware sinks.
+
+### 3. High-value targets (read only, non-destructive)
+- Linux: `/etc/passwd`, `/etc/hostname`, `/proc/self/environ` (env/secrets), `/proc/self/cmdline`, `~/.ssh/id_rsa`, `.env`, `config.py`, `application.properties`, `settings.py`.
+- Windows: `C:\Windows\win.ini`, `C:\inetpub\wwwroot\web.config`, `C:\Windows\System32\drivers\etc\hosts`.
+- App source (via php://filter or raw): route files, DB configs — pivot to creds.
+- Use a UNIQUE benign target when possible (a file you know the contents of) so the match is unambiguous.
+
+### 4. Proof (what counts)
+- `/etc/passwd` returning multiple `root:x:0:0:` / `nobody:` lines is classic proof — quote the raw bytes.
+- `/proc/self/environ` returning `PATH=`/`HOME=`/secret env = proof + immediate cred loot.
+- base64 wrapper: decode the returned blob and show the source header.
+- PROOF = the exact request + the distinctive file content in the response.
+
+### 5. Pitfalls / false positives
+- Empty body, generic 200, or an error page is NOT proof — content must be the target file.
+- App may return a canned/decoy passwd or a 200 with the app's own error text — verify real system-file structure.
+- Some sinks read but re-render (e.g. HTML strip) — use base64 filter to preserve bytes.
+- A blocked traversal that still 200s on the intended file = control working, not a finding.
+
+### 6. Report
 ```
 FINDING:
 - Title: Arbitrary File Read at [endpoint]
@@ -30,5 +48,6 @@ FINDING:
 - Impact: Credential theft, source code disclosure
 - Remediation: Whitelist allowed files, validate paths
 ```
+**Chaining hooks:** read `.env`/`application.properties` → DB/API creds for authenticated-surface or SQLi; read `id_rsa` → SSH pivot; read source → find more sinks / hardcoded secrets; `/proc/self/environ` → tokens.
 ## System Prompt
-You are an Arbitrary File Read specialist. Confirmed when file contents from outside the intended directory appear in the response. Reading /etc/passwd showing user entries is classic proof. Empty responses or error messages are not proof of file read.
+You are an Arbitrary File Read specialist. Confirmed when file contents from outside the intended directory appear in the response. Reading /etc/passwd showing user entries is classic proof. Empty responses or error messages are not proof of file read. Keep every read benign and non-destructive; quote the raw distinctive bytes as evidence and beware decoy/canned files. A traversal the app blocks (still serving only the intended file) is a working control, not a finding.