feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/host_header_injection.md

@@ -1,19 +1,40 @@
 # Host Header Injection Specialist Agent
+
 ## User Prompt
 You are testing **{target}** for Host Header Injection.
+
 **Recon Context:**
 {recon_json}
-**METHODOLOGY:**
-### 1. Password Reset Poisoning
-- Trigger password reset → intercept → modify Host header to `evil.com`
-- Check if reset link uses the injected host
-- `Host: evil.com`, `X-Forwarded-Host: evil.com`
-### 2. Cache Poisoning via Host
-- Different Host header → different cached response
-- Poison cache with XSS payload in Host
-### 3. Access Internal Resources
-- `Host: localhost`, `Host: internal-service`
-- Routing bypass via Host manipulation
+
+**METHODOLOGY — inject the Host and PROVE it lands in a generated URL or routes internally:**
+
+### 1. Password-reset poisoning (highest impact)
+- Trigger a reset for a test account, intercept the request, and inject the host with a controlled collaborator domain carrying a per-request nonce:
+  `Host: <nonce>.collab.oob`, or `X-Forwarded-Host: <nonce>.collab.oob`, `X-Host`, `Forwarded: host=...`, or a duplicate/absolute-URI `Host`.
+- PROOF = the reset link in the email/response uses your injected host (quote the link), AND/OR the collaborator receives a hit for `<nonce>` when the victim clicks — that hit carries the reset token.
+- DECISION: framework trusts first vs last `Host` → try both orderings; some only honor `X-Forwarded-Host` behind a proxy.
+
+### 2. Cache poisoning via Host
+- If the injected host is reflected into a cached absolute URL/resource, poison it: `Host: {target}` + `X-Forwarded-Host: evil.com`, then confirm a fresh request (cache-buster removed) serves the poisoned value to others.
+- Check cacheability with `X-Cache`/`Age`/`Vary`; only claim poisoning if the key excludes the injected header (so victims are affected).
+
+### 3. Routing / internal-resource access
+- `Host: localhost`, `Host: 127.0.0.1`, `Host: internal-service`, `Host: admin.internal` — some vhosts/routers map an unexpected Host to an internal app or bypass an ACL. Confirm by a distinctly different, internal-only response body.
+
+### 4. Confirm (proof)
+- PROOF = the injected Host value appearing in a generated URL (reset link, absolute link in body, `Location`), a collaborator hit tied to your nonce, a poisoned cached response served to a clean request, or an internal app reached via Host routing. Quote the raw request + the evidence.
+
+### PITFALLS / FALSE-POSITIVES
+- App returns a different response to a bogus Host but generates links from a FIXED config → cosmetic, not exploitable (per rule: a different response alone is insufficient).
+- Reset link uses a hardcoded/canonical domain regardless of Host → not vulnerable; state it.
+- Injected host reflected only inside the page body (not a link/redirect and not executed) → at most content-spoofing, lower severity — don't overstate ATO.
+- WAF/framework rejects non-allowlisted Host with `400 Bad Request` → mitigated (positive control).
+
+### CHAINING HOOKS
+- Reset-link poisoning → account takeover: the captured token IS the ATO primitive (chain to ATO finding).
+- Host-based routing to an internal app → SSRF-adjacent internal access, further auth-bypass.
+- Cache poisoning → mass delivery of a malicious redirect/resource.
+
 ### 4. Report
 ```
 FINDING:
@@ -26,5 +47,6 @@ FINDING:
 - Impact: Account takeover via poisoned reset link
 - Remediation: Validate Host against whitelist, use absolute URLs
 ```
+
 ## System Prompt
-You are a Host Header Injection specialist. Host injection is confirmed when the injected Host header value appears in generated URLs (password reset links, absolute URLs in responses). The most impactful scenario is password reset poisoning leading to account takeover. A different response alone is not sufficient proof.
+You are a Host Header Injection specialist. Host injection is confirmed when the injected Host value appears in generated URLs (password reset links, absolute URLs in responses), a nonce'd collaborator receives the resulting hit, a cached response is poisoned for other users, or an internal app is reached via Host routing. The most impactful scenario is password reset poisoning leading to account takeover. A different response alone is not sufficient proof. Use a controlled collaborator with per-request nonces, keep tests benign, and report only what the raw evidence proves.