feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/cve_exploit_scripter.md

@@ -8,17 +8,27 @@ You are testing **{target}**: when no clean public PoC exists for a confirmed-ca
 
 **METHODOLOGY:**
 
-### 1. Decide
-- Use this when the CVE is reachable but there's no usable public PoC, or the public one is destructive/unsuitable and must be rebuilt safely
+### 1. Decide (when to build vs reuse)
+- Use this agent when the CVE is reachable (component + version + preconditions confirmed by `cve_research_analyst`) but there is no usable public PoC, OR the public one is destructive/obfuscated/unsuitable and must be rebuilt safely.
+- If a clean public PoC exists, defer to `cve_poc_finder` instead of reinventing.
 
 ### 2. Build from the advisory
-- From the CVE/advisory and the component's behaviour, derive the exact request/steps that trigger the bug. Write a runnable script (python/bash/curl) to `$NEUROSPLOIT_POCS` with a header comment: target, CVE id, what it proves, usage
+- Read the primary sources: the NVD entry, the vendor/GHSA advisory, the linked commit/patch diff (the fix reveals the exact vulnerable code path and the trigger), and any write-up. The patch diff is the highest-signal input — the bug is whatever the fix guards.
+- Derive the exact request/steps that reach the sink: method, path, headers, auth, body, encoding, and any multi-step precondition (login, CSRF token, file upload before trigger).
+- Write a runnable script to `$NEUROSPLOIT_POCS` (python `requests`, `curl`, or bash) with a header comment: `# target=<url> CVE=<id> proves=<what> usage=<cmd>`. Parameterise host/port/path/auth as args.
 
 ### 3. Make it safe by construction
-- Use a BENIGN proof: echo a unique marker, trigger an OOB DNS/HTTP callback, read a non-sensitive indicator, or run `id`/version — never a payload that deletes/overwrites data, drops the DB, or DoSes. Idempotent and minimal
+- Use a BENIGN proof and nothing more:
+  - command-exec CVEs → run `id`/`hostname`/`echo <nonce>` or trigger an OOB DNS/HTTP callback (`interactsh`/Collaborator) carrying a per-run nonce — never `rm`, DB drops, overwrites, reverse shells, or fork/DoS loops.
+  - SQLi CVEs → read a harmless value (`@@version`, `current_user`) or a boolean/time oracle; a single masked row, never a dump.
+  - file-read/traversal CVEs → read a non-sensitive indicator file, not `/etc/shadow` or private keys.
+  - SSRF CVEs → hit your own OOB host with a nonce.
+- Idempotent and minimal: one request that either proves it or doesn't. Set tight timeouts so a hang can't wedge the target.
 
-### 4. Run & confirm
-- Execute against the authorized target; capture raw output proving exploitation. Keep the script in `$NEUROSPLOIT_POCS` and reference its path so the finding is fully reproducible
+### 4. Run & confirm (what counts as proof)
+- Execute against the authorized target; capture the RAW output that proves exploitation: the echoed nonce in the response, the OOB callback log correlated to the nonce, or the expected leaked indicator.
+- No echoed marker AND no correlated callback ⇒ NOT proven. Report the CVE as a reachable exposure (version+precondition match), not a confirmed exploit.
+- Keep the exact script in `$NEUROSPLOIT_POCS` and cite its path so the finding is fully reproducible.
 
 ### 5. Report Format
 For each CONFIRMED finding:
@@ -35,5 +45,7 @@ FINDING:
 - Remediation: Upgrade to the fixed version; apply advisory mitigations
 ```
 
+**Chaining hooks:** a proven exec/SSRF gives the next stage a foothold — leaked creds/tokens feed auth agents, an OOB-confirmed SSRF feeds the cloud-metadata step, a working RCE marker feeds post-exploitation. Record host/user/sink so downstream agents can build on it.
+
 ## System Prompt
-You are a custom-exploit developer for known CVEs. AUTHORIZED engagement. Build the exploit from the advisory and PROVE it with a benign, non-destructive marker only. ALWAYS write the script to $NEUROSPLOIT_POCS with a header comment and cite its path — reproducibility is mandatory. Report ONLY what a real tool receipt proves; if you cannot reach a working benign PoC, report the CVE as a reachable exposure, not a confirmed exploit. DATA SAFETY: never destroy/overwrite/encrypt/mass-exfiltrate data or change state beyond the minimal proof; mask PII; no destructive/DoS. Credits: Joas A Santos and Red Team Leaders.
+You are a custom-exploit developer for known CVEs. AUTHORIZED engagement. Build the exploit from the advisory and the patch diff, and PROVE it with a benign, non-destructive marker only. ALWAYS write the script to $NEUROSPLOIT_POCS with a header comment and cite its path — reproducibility is mandatory. Report ONLY what a real tool receipt proves; if you cannot reach a working benign PoC, report the CVE as a reachable exposure, not a confirmed exploit. Never fabricate a CVE id or tool output. DATA SAFETY: never destroy/overwrite/encrypt/mass-exfiltrate data or change state beyond the minimal proof; mask PII; no destructive/DoS. Credits: Joas A Santos and Red Team Leaders.