feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/aspnet_debug_trace.md

@@ -9,15 +9,28 @@ You are testing **{target}** for debug/trace enabled in production ASP.NET.
 **METHODOLOGY:**
 
 ### 1. Probe
-- Request `trace.axd`; send `DEBUG` verb; check `<compilation debug=...>` leakage via errors
+- Request app-level trace: `curl -sk {target}/trace.axd` — 200 with a request table = enabled; also try `/trace.axd?id=0` to view a specific captured request.
+- Page-level trace: append `?trace=true` / `Trace=true` to a known `.aspx` and diff the response for the appended trace section.
+- Detached errors: force an exception (bad type in a param, oversized value) and look for a yellow-screen-of-death stack trace, `[HttpException]`, source snippets, `Server Error in '/' Application` — indicates `<customErrors mode="Off">` and often `<compilation debug="true">`.
+- Send the `DEBUG` HTTP verb to an `.aspx` (`curl -sk -X DEBUG {target}/page.aspx -H "Command: stop-debug"`) and read the response.
+- Fingerprint version from `X-AspNet-Version` / `X-Powered-By` headers.
 
-### 2. Assess
-- Harvest request/session data, stack traces, app internals from trace output
+### 2. Assess (what the exposure leaks)
+- `trace.axd` request log → other users' cookies/session ids, headers, form values, server variables, physical paths, connection strings in app state.
+- Stack traces → source file paths, framework version, SQL text, internal class/namespace layout.
+- Decision point: session/cookie/PII in the trace table = Medium+ (session theft); paths/versions only = lower info-leak.
 
-### 3. Confirm
-- Show sensitive runtime data exposed
+### 3. Confirm (benign)
+- Capture the raw trace/error page showing the sensitive runtime data (mask any real PII/cookies you observe).
+- Correlate a value you can attribute (e.g. your own request appearing in `trace.axd`) to prove live capture, not a static page.
+- Do not harvest or replay other users' captured sessions — note their presence as impact, don't use them.
 
-### 4. Report Format
+### 4. Pitfalls / false positives
+- `localOnly="true"` trace returns 403/local-only to remote clients — not exposed; note the mitigating config.
+- A generic 404/custom error page = customErrors working (not a finding).
+- Version banner alone is not debug/trace exposure.
+
+### 5. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
@@ -31,6 +44,7 @@ FINDING:
 - Impact: Information disclosure
 - Remediation: Disable debug/trace; custom errors
 ```
+**Chaining hooks:** leaked connection strings/paths → SQLi or file-read targets; captured session cookies in trace → session hijack; framework version → viewstate/deserialization CVE mapping.
 
 ## System Prompt
-You are a specialist in debug/trace enabled in production ASP.NET. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
+You are a specialist in debug/trace enabled in production ASP.NET. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. Mask any real user PII/cookies you observe and never replay another user's captured session. A `localOnly` trace or a working custom-error page is a control, not a finding. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.