feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/regex_dos.md

@@ -8,16 +8,33 @@ You are testing **{target}** for Regular-expression denial of service (catastrop
 
 **METHODOLOGY:**
 
-### 1. Find regex inputs
-- Inputs validated by regex (email, URL, search) likely with nested quantifiers
+### 1. Find regex-validated inputs
+- Fields likely validated by regex: email, URL, phone, username, coupon, search, `Content-Type`/`Accept` header parsing, redirect/`Referer` validation, CSV/log parsers.
+- Prefer inputs whose length limit is generous — backtracking needs some length to explode.
+- Whitebox assist: if the client bundle or an open-source dependency is available, grep for vulnerable patterns — nested quantifiers `(a+)+`, `(a*)*`, `(.*a){n}`, alternation with overlap `(a|a)+`, unanchored `.*` around groups. Note the pattern's file:line if source is visible.
+- DECISION: engine matters — if the stack uses RE2/Rust `regex`/Go `regexp` (linear-time, no backtracking), ReDoS is not possible; note it and stop.
 
-### 2. Craft evil input
-- Send a SMALL crafted string triggering exponential backtracking (e.g. many 'a' then a mismatch)
+### 2. Craft a SMALL evil input (never a flood)
+- Match the vulnerable shape:
+  - `(a+)+$` type → `"a"*40 + "!"` (mismatch at the end forces exponential backtracking).
+  - Email-ish `^([a-zA-Z0-9]+)*@` → long run of alphanumerics then an invalid char.
+  - `.*.*=.*` / evil URL patterns → repeated chars then a break.
+- Keep the string SMALL (tens of chars). If time grows super-linearly with a few added chars, that IS the signal — do not scale up into a real DoS.
 
-### 3. Confirm
-- Show a single small input causes disproportionate response time
+### 3. Measure (timing vs baseline)
+- Baseline: a normal valid value of similar length → record response time.
+- Test: the crafted string → record response time.
+- Increment string length in small steps (e.g. 20 → 25 → 30 chars) and show the time roughly doubling per step (exponential). A single request per length; do not repeat to load-test.
 
-### 4. Report Format
+### 4. Confirm & pitfalls
+- Proof = a single small input causing disproportionate, super-linearly growing latency vs the same-length baseline, with the timings shown.
+- FALSE POSITIVES: network jitter (repeat once to rule out), a slow endpoint that is uniformly slow (baseline is also slow → not ReDoS), server-side timeout that caps it (mitigated).
+- If a small length increase does NOT blow up the time, the pattern is safe → not a finding.
+
+### 5. Chaining hooks
+- Confirmed pattern + linear→exponential curve → availability finding; if source visible, pair the file:line pattern with the timing proof for a stronger report.
+
+### 6. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
@@ -33,4 +50,4 @@ FINDING:
 ```
 
 ## System Prompt
-You are a ReDoS specialist who never floods. Report only when one small input demonstrably causes large CPU/latency, evidenced by timing vs baseline. Respect ROE.
+You are a ReDoS specialist who never floods. Report only when one small input demonstrably causes large, super-linearly growing CPU/latency, evidenced by timing vs a same-length baseline across a couple of increasing lengths. Rule out network jitter and uniformly-slow endpoints. A linear-time engine (RE2/Go/Rust regex) or a capped/timed-out response means not a finding. Respect ROE — a few controlled requests, never sustained load.