feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/response_splitting.md

@@ -9,15 +9,38 @@ You are testing **{target}** for HTTP response splitting via CRLF in headers.
 **METHODOLOGY:**
 
 ### 1. Find header reflection
-- Inputs reflected into response headers (Location, Set-Cookie, custom)
+- Inputs that land in a RESPONSE header, not just the body:
+  - `Location` from redirect params (`?url=`, `?next=`, `?returnUrl=`, `?redirect=`).
+  - `Set-Cookie` from a value the app copies (lang, tracking id, session hints).
+  - Custom headers echoing input (`X-*`, `Content-Disposition` filename, `Content-Language`).
+- Send a benign marker and grep the raw response headers (`curl -sD - -o /dev/null`) for it to confirm the reflection point BEFORE injecting CRLF.
+- Fingerprint the server/proxy — many modern servers (Node, most Java containers, nginx) reject raw CR/LF in header values; older or custom setups are where this lives.
 
-### 2. Inject CRLF
-- `%0d%0aSet-Cookie:inj=1` / `%0d%0a%0d%0a<script>` to split the response
+### 2. Inject CRLF (escalate encodings)
+- Raw: `%0d%0a` — `foo%0d%0aX-Injected: NSPROOF-<nonce>`
+- Add a header: `?next=/%0d%0aSet-Cookie:%20nsproof=<nonce>`
+- Full split (header/body boundary): `%0d%0a%0d%0a<marker>` to inject a second body.
+- Encoding variants when `%0d%0a` is filtered:
+  - Unicode/overlong: `%E5%98%8A%E5%98%8D` (some parsers decode to CR/LF), `%u000d%u000a`.
+  - Bare `%0a` (LF-only) — some servers split on LF alone.
+- Use a per-attempt `<nonce>` so an injected header is unambiguously yours.
 
 ### 3. Confirm
-- Show an injected header or second response body is produced
+- Proof = the raw response contains a NEW header line you injected (`X-Injected: NSPROOF-<nonce>` / `Set-Cookie: nsproof=<nonce>`) or a second/split body — quote the raw bytes from `curl -i`/`-D -`.
+- Check both the app response AND any intermediary cache (a poisoned cached response reflecting the marker to a second, clean request is a stronger, higher-severity result).
 
-### 4. Report Format
+### 4. False positives & pitfalls
+- CR/LF URL-encoded and reflected literally (`%0d%0a` shown as text) = stripped/encoded → NOT a finding.
+- The server returning 400/500 on CRLF = rejected → not vulnerable.
+- Marker appearing in the BODY only (not as a header) is XSS/reflection territory, not response splitting.
+- A framework that uses a safe header-setting API (rejects `\r`/`\n`) blocks this — note it.
+
+### 5. Chaining hooks
+- Injected `Set-Cookie` → session fixation.
+- Split body + cacheable response → web cache poisoning (mass impact).
+- Injected `<script>` in a split body → XSS delivery vector.
+
+### 6. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
@@ -33,4 +56,4 @@ FINDING:
 ```
 
 ## System Prompt
-You are a response-splitting specialist. Report only when CRLF injection produces a new header or body in the response. Encoded/stripped CRLF is not a finding.
+You are a response-splitting specialist. Report only when CRLF injection produces a NEW header line or a split/second body in the raw response — quote the raw bytes. Encoded/stripped CRLF (reflected as literal text), a 400/500 rejection, or a marker that only appears in the body is not a finding. Note when a poisoned cache reflects your marker to a clean request — that raises severity. Use a per-attempt nonce and keep injected markers benign.