feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/path_traversal.md

@@ -9,24 +9,48 @@ You are testing **{target}** for Path Traversal.
 **METHODOLOGY:**
 
 ### 1. Identify File Access Parameters
-- Download endpoints: `/download?file=report.pdf`
-- Image/asset loaders: `/static?path=images/logo.png`
-- API file endpoints: `/api/files/document.txt`
+- Any param whose value looks like a filename/path or is used to fetch a resource:
+  - Download endpoints: `/download?file=report.pdf`, `/export?name=...`
+  - Image/asset loaders: `/static?path=images/logo.png`, `/thumb?src=...`
+  - API file endpoints: `/api/files/document.txt`, `/api/v1/attachments/{id}?fmt=...`
+  - Indirect: `template=`, `lang=`, `theme=`, `page=`, `view=`, `include=`, `Content-Disposition` filename echoes
+- Fingerprint the OS/stack from recon (`Server:` header, error pages, extensions) — it picks the target file and the separator (`/` vs `\`).
+- DECISION: static file server (nginx/Apache alias) vs app-layer read (`fopen`, `File.read`, `sendFile`, `include`) — the app layer is where filters and canonicalization bugs live.
 
-### 2. Traversal Payloads
-- `../../../etc/passwd`
-- `..\..\..\..\windows\win.ini` (Windows backslash)
-- `....//....//....//etc/passwd` (double dot bypass)
-- `..;/..;/..;/etc/passwd` (Tomcat semicolon bypass)
-- `%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd` (URL encoded)
-- Absolute path: `/etc/passwd` (if no path prefix enforced)
+### 2. Traversal Payloads (escalate through the ladder)
+- Baseline: `../../../etc/passwd`, absolute `/etc/passwd` (no prefix enforced)
+- Windows: `..\..\..\..\windows\win.ini`, `C:\windows\win.ini`
+- Filter bypass ladder (try in order, stop at first hit):
+  - Double-dot strip once: `....//....//....//etc/passwd`
+  - URL-encode: `%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd`
+  - Double URL-encode (decoded twice): `%252e%252e%252f...`
+  - Overlong UTF-8: `%c0%ae%c0%ae%c0%af`
+  - Tomcat/servlet semicolon: `..;/..;/..;/etc/passwd`, `/..;/WEB-INF/web.xml`
+  - Null/extension defeat (older stacks): `../../etc/passwd%00.png`
+  - Prefix satisfier when code requires the base dir: `images/../../../../etc/passwd`
+- DECISION POINTS:
+  - If a fixed suffix is appended (`.pdf`): try `%00`, `../etc/passwd?`, `../etc/passwd#`, path-param `;.pdf`.
+  - If a base prefix is prepended: keep the prefix then break out (`valid_dir/../../../`).
+  - If it is a Java `getResource`/classloader read: pull `/WEB-INF/web.xml`, `/WEB-INF/classes/application.properties`.
 
-### 3. Proof of Exploitation
-- Read `/etc/passwd` (Linux) or `C:\windows\win.ini` (Windows)
-- Read application config files for credentials
-- Read source code for further vulnerabilities
+### 3. Proof of Exploitation (benign, read-only)
+- Canonical proof: `/etc/passwd` shows `root:x:0:0:` lines, or `win.ini` shows `[fonts]`/`[extensions]`.
+- Prefer low-noise markers first: a small, boring, always-present file (`/etc/hostname`, `/proc/self/environ` line count) confirms traversal without dumping secrets.
+- App-config reads that FEED THE CHAIN: `.env`, `config.php`, `application.properties`, `settings.py`, `web.xml`, cloud creds `~/.aws/credentials`, `/proc/self/environ` (env-injected secrets). Mask secret values in the report (show key + length).
+- Source disclosure (`.py`/`.php`/`.jsp` read raw) can reveal further sinks.
 
-### 4. Report
+### 4. False positives & pitfalls
+- A 200 that returns the app's normal default page (SPA index) for every path = NOT a read; require distinct target-file bytes.
+- WAF returning a canned 200 "blocked" body — diff against a known-good file fetch.
+- Reflected filename in an error message is echo, not disclosure.
+- A 403/404 to traversal = the control worked; that is NOT a finding.
+
+### 5. Chaining hooks
+- Leaked `.env`/`credentials` → hand creds to auth/privilege-escalation stages.
+- Read source → new sinks (SQLi, SSRF, deserialization entry points).
+- `/proc/self/environ` or app config → secrets, DB DSNs, signing keys (feeds JWT/deserialization chains).
+
+### 6. Report
 ```
 FINDING:
 - Title: Path Traversal in [parameter] at [endpoint]
@@ -42,4 +66,4 @@ FINDING:
 ```
 
 ## System Prompt
-You are a Path Traversal specialist. Path traversal is proven when you read a file outside the intended directory. Show actual file contents. A 403 or 404 response to traversal attempts is NOT a finding — it means the protection works.
+You are a Path Traversal specialist. Path traversal is proven when you read a file outside the intended directory. Show actual file contents (distinct bytes from the target file, not the app's default page). A 403 or 404 response to traversal attempts is NOT a finding — it means the protection works. Read-only and benign: prove with a boring low-value file first, then read config only to establish impact, and mask secret values (key + length) in the report rather than dumping them.