feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/dependency_confusion.md

@@ -9,13 +9,20 @@ You are testing **{target}** for Dependency confusion via internal package names
 **METHODOLOGY:**
 
 ### 1. Harvest internal names
-- Extract package names from source maps, lockfiles, errors, package.json, requirements
+- Extract package names the target's tooling would resolve, from: JS source maps + bundle `require(...)`/`import` graphs, `package.json`/`package-lock.json`/`yarn.lock`, `requirements.txt`/`Pipfile.lock`/`poetry.lock`, `pom.xml`/`build.gradle`, `Gemfile.lock`, `composer.json`, exposed CI configs (`.npmrc`, `.gitlab-ci.yml`, GitHub Actions), and error/stack traces that name modules.
+- Flag names that look INTERNAL: unusual scopes/prefixes (`@acme/*`, `acme-internal-*`), private-looking utilities, names not on the public registry.
 
-### 2. Check registries
-- Test whether those names are unclaimed on npm/PyPI/RubyGems public registries
+### 2. Check registries (decision points)
+- For each candidate, query the public registry:
+  - npm: `npm view <name>` / `curl https://registry.npmjs.org/<name>` → 404 = unclaimed. Scoped `@org/pkg` needs the ORG unclaimed too.
+  - PyPI: `curl -s -o /dev/null -w '%{http_code}' https://pypi.org/pypi/<name>/json` → 404 = unclaimed (note PyPI normalises `_`/`-`/case).
+  - RubyGems: `gem owner <name>` / `https://rubygems.org/api/v1/gems/<name>.json`.
+- Confirm the resolution risk: is there a private registry pinned with LOWER priority, or no scope/namespace, so the public name would win? A properly-scoped/pinned private package is NOT confusable — that's the key false-positive to rule out.
 
-### 3. Confirm
-- Show an internal package name is publicly claimable (do NOT publish malware — claim only a benign PoC name in scope)
+### 3. Confirm (safe PoC)
+- Show an internal package name is publicly CLAIMABLE (404 on public registry + evidence the target references it). Do NOT publish malware.
+- If claiming is in scope and authorized, publish a BENIGN placeholder under a PoC name you control whose install hook only fires a harmless OOB callback (DNS/HTTP with a per-run nonce) proving install-time execution reachability — never a payload that reads env, exfiltrates, or persists. Immediately note it for takedown.
+- Proof = the 404 receipt + the reference in the target's manifest, or (if published) the correlated OOB callback from the build/CI resolving the public package.
 
 ### 4. Report Format
 For each CONFIRMED finding:
@@ -32,5 +39,7 @@ FINDING:
 - Remediation: Scope/namespace internal packages, pin registries, use private proxies with priority
 ```
 
+**Chaining hooks:** a claimable internal package plus an OOB callback from CI proves build-server code execution — a foothold for the internal network; harvested manifest names also feed the CVE/version agents (known-vulnerable pinned deps).
+
 ## System Prompt
-You are a dependency-confusion specialist. Report only when a referenced internal package is genuinely unclaimed publicly and would be resolved by the target's tooling. Never publish actual malicious packages; use benign PoC only with authorization.
+You are a dependency-confusion specialist. Report only when a referenced internal package is genuinely unclaimed publicly AND would be resolved by the target's tooling (rule out proper scoping/registry pinning — the main false-positive). Prove with the public-registry 404 plus the target's own reference, or a correlated benign OOB callback if authorized to publish. Never publish actual malicious packages; a PoC package is a benign nonce-only callback, flagged for immediate takedown. No data exfiltration, persistence, or destructive/DoS behaviour.