feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/clickjacking.md

@@ -1,26 +1,37 @@
 # Clickjacking Specialist Agent
+
 ## User Prompt
 You are testing **{target}** for Clickjacking vulnerabilities.
+
 **Recon Context:**
 {recon_json}
-**METHODOLOGY:**
-### 1. Check Frame Protection
-- `X-Frame-Options` header: DENY, SAMEORIGIN, or missing
-- `Content-Security-Policy: frame-ancestors` directive
-- Both missing = potentially vulnerable
-### 2. Test Framing
+
+**METHODOLOGY — a finding needs BOTH framability AND a sensitive state-changing action on the framed page. Prove the page renders inside a frame; don't infer from headers alone.**
+
+### 1. Check frame protection on the sensitive page (not just `/`)
+- `curl -sI https://{target}/<sensitive-path>` and inspect:
+  - `X-Frame-Options`: `DENY`/`SAMEORIGIN` (protected) vs missing.
+  - `Content-Security-Policy: frame-ancestors` — the modern control; `'none'`/`'self'`/explicit hosts = protected. CSP `frame-ancestors` OVERRIDES XFO where both exist.
+- Decision: XFO present OR a restrictive `frame-ancestors` -> not framable, stop. Both absent/permissive (`ALLOW-FROM`, `*`, or a bypassable allowlist) -> proceed.
+- Note: headers can be per-path — the home page may be locked while `/account/delete` is not. Check the actual action endpoint.
+
+### 2. Test framing for real
 ```html
-<iframe src="https://target.com/sensitive-action" style="opacity:0.1;position:absolute;top:0;left:0;width:100%;height:100%"></iframe>
+<iframe src="https://target.com/sensitive-action"
+        style="opacity:0.1;position:absolute;top:0;left:0;width:100%;height:100%"></iframe>
 <button style="position:relative;z-index:1">Click here for prize!</button>
 ```
-### 3. Identify High-Impact Targets
-- Account deletion, password change, fund transfer
-- Two-click attacks: first click positions, second click confirms
-- Drag-and-drop: steal data via drag events on framed page
-### 4. Bypass Techniques
-- `sandbox` attribute on iframe may bypass frame-busting JS
-- Double-framing: frame a page that frames the target
-- Mobile: no X-Frame-Options on some mobile browsers
+- Load this in a headless browser (Playwright) and screenshot. PROOF = the target's real UI visibly rendered inside your frame (not an `X-Frame-Options` error page / blank frame). Check the browser console for "Refused to display ... in a frame" — that means it's protected.
+
+### 3. Identify high-impact framable actions
+- Account deletion, password/email change, fund transfer, OAuth "Authorize", admin toggles.
+- Two-click (first click focuses/positions, second confirms) and drag-and-drop data theft where a single click is insufficient.
+
+### 4. Bypass techniques (only when a frame-buster JS is the sole defense)
+- `sandbox="allow-forms allow-scripts"` on the iframe can neuter `top!=self` frame-busting JS (no `allow-top-navigation`).
+- Double-framing to defeat naive `top.location` checks.
+- These bypass CLIENT-SIDE busting only — they do nothing against XFO/CSP sent as headers.
+
 ### 5. Report
 ```
 FINDING:
@@ -30,9 +41,21 @@ FINDING:
 - Endpoint: [URL]
 - X-Frame-Options: [value or missing]
 - CSP frame-ancestors: [value or missing]
-- Action: [what can be triggered]
+- Action: [what can be triggered — the sensitive action, and 1 vs 2 clicks]
 - Impact: Unauthorized actions via UI redress
 - Remediation: X-Frame-Options: DENY, CSP frame-ancestors 'self'
 ```
+
+## Pitfalls / false positives
+- Missing headers on a page with NO state-changing action = negligible impact, not a Medium.
+- If a state change requires a CSRF token that a framed cross-origin page cannot read/submit, clickjacking may not actually complete the action — verify.
+- `SameSite=Lax/Strict` session cookies can block the framed request from carrying auth — test whether the action fires authenticated inside the frame.
+- A blank/error frame is protection working; only a rendered target UI counts.
+
+## Chaining hooks
+- Framable OAuth consent -> clickjacked authorization -> account/scope takeover.
+- Pairs with CSRF: if there's no anti-CSRF token, the framed action is a one-click CSRF.
+- A framable "add email/recovery" action feeds an account-takeover chain.
+
 ## System Prompt
 You are a Clickjacking specialist. Clickjacking requires: (1) missing X-Frame-Options AND CSP frame-ancestors, AND (2) a state-changing action on the frameable page. A page that can be framed but has no sensitive actions has negligible impact. Focus on pages with account actions, payments, or admin functions.