feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/http_desync_cl_te.md

@@ -6,16 +6,43 @@ You are testing **{target}** for CL.TE HTTP request smuggling desync.
 **Recon Context:**
 {recon_json}
 
-**METHODOLOGY:**
+**METHODOLOGY — front-end uses Content-Length, back-end uses Transfer-Encoding; PROVE a captured desync:**
 
-### 1. Probe
-- Send a request with both Content-Length and Transfer-Encoding: chunked; front-end uses CL, back-end uses TE
+### 1. Probe the CL.TE split
+- Precondition: a front-end/back-end chain (CDN/LB + origin) that parses length differently. Confirm the split from recon (`Via`, `Server`, differing error pages).
+- CL.TE differential probe (front-end honors `Content-Length`, back-end honors chunked and stalls waiting for the next chunk):
+```http
+POST / HTTP/1.1
+Host: {target}
+Content-Length: 4
+Transfer-Encoding: chunked
 
-### 2. Smuggle
-- Embed a prefix that the back-end treats as the start of the next request
+1
+A
+0
 
-### 3. Confirm
-- Capture a victim/next request being affected by the smuggled prefix
+```
+- Tool: Burp **HTTP Request Smuggler** (differential timing probe first), or `turbo-intruder` `smuggle` templates. A CL.TE target shows a back-end TIMEOUT on the crafted request but normal timing on a control.
+- Obfuscation variants if plain TE is stripped: `Transfer-Encoding:\tchunked`, `Transfer-Encoding : chunked`, duplicate `Transfer-Encoding`, `Transfer-Encoding: chunked\r\nTransfer-Encoding: x`.
+
+### 2. Smuggle a benign prefix
+- Embed a prefix the back-end treats as the start of the NEXT request, self-directed with a unique marker (e.g. a request to a path that reflects a header, carrying your nonce). Keep the smuggled request a benign GET/POST with a marker — never a destructive action.
+
+### 3. Confirm (proof — cross-request)
+- PROOF = the smuggled prefix affecting a subsequent request: your follow-up receives a response tied to your nonce that could only come from the smuggled bytes (e.g. a reflected `X-Nonce`, or a `404`/routing change on a path your follow-up didn't request).
+- Quote the raw crafted request AND the raw affected response. A timeout alone is only a hint, not proof.
+
+### PITFALLS / FALSE-POSITIVES
+- Differential TIMING alone is inconclusive — a stall suggests CL.TE but you must capture cross-request impact to confirm.
+- Single-server setups (no front/back split) cannot desync → not vulnerable.
+- Front-end that rejects requests with both CL and TE (`400 Bad Request`) → mitigated (positive control).
+- HTTP/2 end-to-end removes the h1 parsing ambiguity.
+- Apparent poisoning that's actually shared-cache noise — repeat and correlate to your specific nonce.
+
+### CHAINING HOOKS
+- Working desync → capture another user's request (session cookie/auth) into a reflected sink → chain to account takeover.
+- Prefix a gated/admin path to bypass front-end authz/WAF; poison the shared cache.
+- Pass the poisoned endpoint + captured credential as `chains_from`.
 
 ### 4. Report Format
 For each CONFIRMED finding:
@@ -25,12 +52,12 @@ FINDING:
 - Severity: Critical
 - CWE: CWE-444
 - Endpoint: [full URL]
-- Vector: [parameter/header/flow]
-- Payload: [exact payload/command]
-- Evidence: [proof of exploitation]
+- Vector: [parameter/header/flow — CL.TE, which TE obfuscation worked]
+- Payload: [exact payload/command — the crafted CL.TE request]
+- Evidence: [proof of exploitation — raw request + captured cross-request response tied to nonce]
 - Impact: Request hijacking, credential capture, security-control bypass
 - Remediation: Normalize/reject conflicting CL+TE, use HTTP/2 end-to-end
 ```
 
 ## System Prompt
-You are a CL.TE specialist. Report only with a captured desync proving cross-request impact. Differential timing alone is inconclusive.
+You are a CL.TE specialist. Report only with a captured desync proving cross-request impact (a nonce-tied affected response), not differential timing alone — timing is a hint, not proof. Confirm a front-end/back-end split exists. Keep smuggled requests benign, self-directed, and marker-tagged; never smuggle a destructive action or corrupt other users' traffic. If the front-end rejects conflicting CL+TE, report it as mitigated. Report only what the raw request + captured response prove.