.forum/poc-g2/cfg_poc.ts

@@ -1,13 +1,5 @@
-import {
-  assert,
-  assertEquals,
-} from "https://deno.land/std@0.224.0/testing/asserts.ts";
-import {
-  dirname,
-  fromFileUrl,
-  join,
-} from "https://deno.land/std@0.224.0/path/mod.ts";
-import { execTool, requireTool } from "./sys_exec.ts";
+import * as acorn from "npm:acorn";
+import { assert, assertEquals } from "https://deno.land/std@0.224.0/testing/asserts.ts";
 
 /**
  * Proof of Concept: Abstract Syntax Trees & Control Flow Graphs (Gen 2)
@@ -15,8 +7,6 @@ import { execTool, requireTool } from "./sys_exec.ts";
  * Demonstrates the Adversary agent consuming a CFG. Instead of a hardcoded JSON,
  * we dynamically generate a basic flow graph by traversing an actual AST of some
  * target code, and then trace if unsanitized user input reaches a sensitive sink.
- *
- * This version uses the native `tree-sitter` CLI to produce an AST representation.
  */
 
 // Simulated malicious or vulnerable code segment
@@ -34,95 +24,66 @@ function handleRequest(req) {
 }
 `;
 
-async function generateAndAnalyzeCFG(code: string): Promise<string[]> {
-  const currentDir = dirname(fromFileUrl(import.meta.url));
-  const TEMP_FILE = join(currentDir, "dummy_cfg_target.js");
+function generateAndAnalyzeCFG(code: string): string[] {
+  const ast = acorn.parse(code, { ecmaVersion: 2022 }) as any;
   const vulnerabilities: string[] = [];
 
-  try {
-    await Deno.writeTextFile(TEMP_FILE, code);
+  // A very rudimentary data-flow tracker for local variables
+  const variableTaints: Record<string, boolean> = {};
 
-    // Call native tree-sitter parser to get XML AST
-    const { code: exitCode, stdout, stderr } = await execTool("tree-sitter", [
-      "parse",
-      TEMP_FILE,
-      "-x",
-    ]);
-
-    if (exitCode !== 0) {
-      throw new Error(`Tree-sitter CLI execution failed: ${stderr || stdout}`);
-    }
-
-    // A very rudimentary data-flow tracker for local variables based on the tree-sitter XML output
-    const variableTaints: Record<string, boolean> = {};
-
-    // 1. Find variable assignments (variable_declarator)
-    const varMatches = stdout.matchAll(
-      /<variable_declarator.*?<identifier field="name".*?>(.*?)<\/identifier>.*?field="value".*?>(.*?)<\/variable_declarator>/gs,
-    );
-    for (const match of varMatches) {
-      const varName = match[1];
-      const valueBlock = match[2];
+  // Walk AST to find variable declarations and function calls
+  function walk(node: any) {
+    if (!node) return;
 
+    if (node.type === "VariableDeclarator") {
+      const varName = node.id.name;
+      // Check if it's assigned from req (our entry point)
       let isTainted = false;
-
-      // Simplistic check: is 'req' anywhere inside the value block?
-      if (valueBlock.includes(">req<")) {
-        isTainted = true;
+      if (node.init && node.init.type === "MemberExpression") {
+          // Simplistic check for req.something
+          let current = node.init;
+          while (current.object) current = current.object;
+          if (current.name === "req") isTainted = true;
       }
 
       // Check if it's assigned from a sanitize call
-      if (
-        valueBlock.includes("call_expression") &&
-        valueBlock.includes(">sanitize<")
-      ) {
-        isTainted = false; // It's clean
+      if (node.init && node.init.type === "CallExpression") {
+          if (node.init.callee.name === "sanitize") {
+              isTainted = false; // It's clean
+          }
       }
 
       variableTaints[varName] = isTainted;
     }
 
-    // 2. Find function calls (call_expression)
-    const callMatches = stdout.matchAll(
-      /<call_expression.*?<identifier field="function".*?>(.*?)<\/identifier>.*?<arguments.*?<identifier.*?>(.*?)<\/identifier>.*?<\/arguments>.*?<\/call_expression>/gs,
-    );
-    for (const match of callMatches) {
-      const funcName = match[1];
-      const argName = match[2];
-
-      if (funcName === "db_query") {
-        if (variableTaints[argName]) {
-          vulnerabilities.push(
-            `Vulnerability: Unsanitized input '${argName}' reached sink 'db_query'`,
-          );
+    if (node.type === "CallExpression") {
+        if (node.callee.name === "db_query") {
+            const arg = node.arguments[0];
+            if (arg && arg.type === "Identifier") {
+                if (variableTaints[arg.name]) {
+                    vulnerabilities.push(`Vulnerability: Unsanitized input '${arg.name}' reached sink 'db_query'`);
+                }
+            }
         }
-      }
     }
-  } finally {
-    try {
-      await Deno.remove(TEMP_FILE);
-    } catch {
-      // ignore
+
+    // Recurse over common blocks
+    for (const key in node) {
+        if (node[key] && typeof node[key] === "object") {
+            walk(node[key]);
+        }
     }
   }
 
+  walk(ast);
   return vulnerabilities;
 }
 
-async function run() {
-  const hasTreeSitter = await requireTool(
-    "tree-sitter",
-    "npm install -g tree-sitter-cli",
-  );
-  if (!hasTreeSitter) {
-    console.warn(
-      "⚠️ CFG Security Proving PoC skipped due to missing host dependency.",
-    );
-    return;
-  }
+if (import.meta.main) {
+  console.log("Running CFG Security Proving PoC (Gen 2) tests...");
 
   try {
-    const vulns = await generateAndAnalyzeCFG(targetSource);
+    const vulns = generateAndAnalyzeCFG(targetSource);
 
     console.log("Adversary Agent Dynamic CFG Analysis Results:");
     vulns.forEach((v) => console.log(` - ${v}`));
@@ -130,7 +91,7 @@ async function run() {
     assertEquals(vulns.length, 1);
     assert(
       vulns[0].includes("rawHeader"),
-      "Expected rawHeader to flag a vulnerability",
+      "Expected rawHeader to flag a vulnerability"
     );
 
     console.log(
@@ -141,8 +102,3 @@ async function run() {
     Deno.exit(1);
   }
 }
-
-if (import.meta.main) {
-  console.log("Running CFG Security Proving PoC (Gen 2) tests...");
-  run();
-}

.forum/poc-g2/code_intelligence_poc.ts

@@ -1,17 +1,12 @@
-import {
-  dirname,
-  fromFileUrl,
-  join,
-} from "https://deno.land/std@0.224.0/path/mod.ts";
+import * as acorn from "npm:acorn";
 import { assertEquals } from "https://deno.land/std@0.224.0/testing/asserts.ts";
-import { execTool, requireTool } from "./sys_exec.ts";
 
 /**
  * Proof of Concept: Local Code Intelligence (Gen 2)
  *
  * Replaces the naive regex extraction in Gen 1 with actual AST parsing using
- * the tree-sitter CLI binary natively via system execution, proving that we can
- * extract a true Semantic Code graph structure from code files.
+ * acorn, proving that we can extract a true Semantic
+ * Code graph structure from code files.
  */
 
 export interface ExportSymbol {
@@ -20,78 +15,50 @@ export interface ExportSymbol {
   signature: string;
 }
 
-export async function extractExports(
-  sourceCode: string,
-): Promise<ExportSymbol[]> {
-  const currentDir = dirname(fromFileUrl(import.meta.url));
-  const TEMP_FILE = join(currentDir, "dummy_intelligence_target.js");
+export function extractExports(sourceCode: string): ExportSymbol[] {
+  // Strip TypeScript annotations using a regex just to let acorn parse it as JS
+  // In a real scenario we'd use a TS-capable parser like @typescript-eslint/typescript-estree or swc,
+  // but this proves the concept of AST walking vs regex scraping.
+  const jsCode = sourceCode
+    .replace(/:\s*Promise<[^>]+>/g, '')
+    .replace(/:\s*[a-zA-Z0-9_]+/g, '')
+    .replace(/<[^>]+>/g, '');
+
+  const ast = acorn.parse(jsCode, { ecmaVersion: 2022, sourceType: "module" }) as any;
   const exports: ExportSymbol[] = [];
 
-  try {
-    // Strip TypeScript annotations using a regex just to let the basic js tree-sitter parse it
-    const jsCode = sourceCode
-      .replace(/:\s*Promise<[^>]+>/g, "")
-      .replace(/:\s*[a-zA-Z0-9_]+/g, "")
-      .replace(/<[^>]+>/g, "");
-
-    await Deno.writeTextFile(TEMP_FILE, jsCode);
-
-    // Call native tree-sitter parser
-    const { code, stdout, stderr } = await execTool("tree-sitter", [
-      "parse",
-      TEMP_FILE,
-      "-x",
-    ]);
-
-    if (code !== 0) {
-      throw new Error(`Tree-sitter CLI execution failed: ${stderr || stdout}`);
-    }
-
-    // In a full implementation, we'd use a real XML or s-expression parser
-    // For this PoC, we will do basic extraction from the XML output format
-    // of tree-sitter to demonstrate the tree traversal concept.
-
-    // Look for exported functions
-    const funcMatches = stdout.matchAll(
-      /<export_statement.*?<function_declaration.*?<identifier field="name".*?>(.*?)<\/identifier>.*?<formal_parameters field="parameters".*?>(.*?)<\/formal_parameters>.*?<\/function_declaration>.*?<\/export_statement>/gs,
-    );
-    for (const match of funcMatches) {
-      const name = match[1];
-      const paramsXml = match[2];
-      const params = [
-        ...paramsXml.matchAll(/<identifier.*?>(.*?)<\/identifier>/gs),
-      ].map((m) => m[1]).join(", ");
-
-      exports.push({
-        name,
-        type: "function",
-        signature: `(${params}) => any`,
-      });
-    }
-
-    // Look for exported consts
-    const constMatches = stdout.matchAll(
-      /<export_statement.*?<lexical_declaration.*?<variable_declarator.*?<identifier field="name".*?>(.*?)<\/identifier>.*?<\/variable_declarator>.*?<\/lexical_declaration>.*?<\/export_statement>/gs,
-    );
-    for (const match of constMatches) {
-      exports.push({
-        name: match[1],
-        type: "const",
-        signature: "const",
-      });
-    }
-  } finally {
-    try {
-      await Deno.remove(TEMP_FILE);
-    } catch {
-      // ignore
+  for (const node of ast.body) {
+    if (node.type === "ExportNamedDeclaration") {
+      if (node.declaration) {
+        if (node.declaration.type === "FunctionDeclaration") {
+          const name = node.declaration.id.name;
+          // Simple mock signature from JS AST
+          const params = node.declaration.params.map((p: any) => p.name).join(", ");
+          exports.push({
+            name,
+            type: "function",
+            signature: `(${params}) => any`,
+          });
+        } else if (node.declaration.type === "VariableDeclaration") {
+          for (const decl of node.declaration.declarations) {
+            exports.push({
+              name: decl.id.name,
+              type: "const",
+              signature: "const",
+            });
+          }
+        }
+      }
     }
   }
 
   return exports;
 }
 
-const mockSourceCode = `
+if (import.meta.main) {
+  console.log("Running Local Code Intelligence PoC (Gen 2) tests...");
+
+  const mockSourceCode = `
 import { stuff } from "somewhere";
 
 /**
@@ -113,20 +80,8 @@ export function doSomethingElse(): void {
 }
 `;
 
-async function run() {
-  const hasTreeSitter = await requireTool(
-    "tree-sitter",
-    "npm install -g tree-sitter-cli",
-  );
-  if (!hasTreeSitter) {
-    console.warn(
-      "⚠️ Local Code Intelligence PoC skipped due to missing host dependency.",
-    );
-    return;
-  }
-
   try {
-    const extracted = await extractExports(mockSourceCode);
+    const extracted = extractExports(mockSourceCode);
 
     assertEquals(extracted.length, 3);
 
@@ -145,7 +100,7 @@ async function run() {
     assertEquals(doSomething?.signature, "() => any");
 
     console.log(
-      "✅ Local Code Intelligence PoC (Gen 2) successful: Extracted structured context from raw source using native tree-sitter CLI.",
+      "✅ Local Code Intelligence PoC (Gen 2) successful: Extracted structured context from raw source using AST Parser.",
     );
 
     console.log("\n--- Agent Context Payload ---");
@@ -153,11 +108,5 @@ async function run() {
     console.log("-----------------------------\n");
   } catch (err) {
     console.error("❌ Local Code Intelligence PoC (Gen 2) failed:", err);
-    Deno.exit(1);
   }
 }
-
-if (import.meta.main) {
-  console.log("Running Local Code Intelligence PoC (Gen 2) tests...");
-  run();
-}

.forum/poc-g2/protobuf_poc.ts

@@ -1,17 +1,12 @@
+import protobuf from "npm:protobufjs";
 import { assertEquals } from "https://deno.land/std@0.224.0/testing/asserts.ts";
-import {
-  dirname,
-  fromFileUrl,
-  join,
-} from "https://deno.land/std@0.224.0/path/mod.ts";
-import { requireTool } from "./sys_exec.ts";
 
 /**
  * Proof of Concept: Protocol Buffers (Gen 2)
  *
  * Demonstrates serializing and deserializing agent state using actual
- * protoc CLI instead of a JS library mock, showing high-performance
- * I/O for vector math and state passing using native host tooling.
+ * protobufjs instead of a JSON stringifier mock, showing high-performance
+ * I/O for vector math and state passing.
  */
 
 const protoDefinition = `
@@ -24,25 +19,12 @@ message AgentState {
 }
 `;
 
-async function run() {
-  const hasProtoc = await requireTool(
-    "protoc",
-    "sudo apt-get install protobuf-compiler",
-  );
-  if (!hasProtoc) {
-    console.warn(
-      "⚠️ Protocol Buffers PoC skipped due to missing host dependency.",
-    );
-    return;
-  }
-
-  const currentDir = dirname(fromFileUrl(import.meta.url));
-  const TEMP_PROTO = join(currentDir, "dummy_agent.proto");
-  const TEMP_DATA = join(currentDir, "dummy_data.txt");
-  const TEMP_BIN = join(currentDir, "dummy_encoded.bin");
+if (import.meta.main) {
+  console.log("Running Protocol Buffers PoC (Gen 2) tests...");
 
   try {
-    await Deno.writeTextFile(TEMP_PROTO, protoDefinition);
+    const root = protobuf.parse(protoDefinition).root;
+    const AgentState = root.lookupType("AgentState");
 
     const payload = {
       agentId: "adversary-01",
@@ -50,83 +32,20 @@ async function run() {
       memoryUsage: 1024,
     };
 
-    // Write text format for protoc to consume
-    const textData = `agentId: "${payload.agentId}"
-status: "${payload.status}"
-memoryUsage: ${payload.memoryUsage}
-`;
-    await Deno.writeTextFile(TEMP_DATA, textData);
+    const errMsg = AgentState.verify(payload);
+    if (errMsg) throw Error(errMsg);
 
-    // Encode
-    const encodeCommand = new Deno.Command("protoc", {
-      args: [
-        "--encode=AgentState",
-        `--proto_path=${currentDir}`,
-        "dummy_agent.proto",
-      ],
-      stdin: "piped",
-      stdout: "piped",
-      stderr: "piped",
-    });
-    const encodeProcess = encodeCommand.spawn();
-    const encodeWriter = encodeProcess.stdin.getWriter();
-    await encodeWriter.write(new TextEncoder().encode(textData));
-    await encodeWriter.close();
-    const encodeOutput = await encodeProcess.output();
-
-    if (encodeOutput.code !== 0) {
-      throw new Error(
-        `protoc encode failed: ${
-          new TextDecoder().decode(encodeOutput.stderr)
-        }`,
-      );
-    }
-
-    const buffer = encodeOutput.stdout;
-    await Deno.writeFile(TEMP_BIN, buffer);
+    const message = AgentState.create(payload);
+    const buffer = AgentState.encode(message).finish();
 
     console.log(`Original Data:`, payload);
     console.log(`Serialized Size: ${buffer.length} bytes (binary)`);
 
-    // Decode
-    const decodeCommand = new Deno.Command("protoc", {
-      args: [
-        "--decode=AgentState",
-        `--proto_path=${currentDir}`,
-        "dummy_agent.proto",
-      ],
-      stdin: "piped",
-      stdout: "piped",
-      stderr: "piped",
-    });
-    const decodeProcess = decodeCommand.spawn();
-    const decodeWriter = decodeProcess.stdin.getWriter();
-    await decodeWriter.write(buffer);
-    await decodeWriter.close();
-    const decodeOutput = await decodeProcess.output();
-
-    if (decodeOutput.code !== 0) {
-      throw new Error(
-        `protoc decode failed: ${
-          new TextDecoder().decode(decodeOutput.stderr)
-        }`,
-      );
-    }
-
-    const decodedString = new TextDecoder().decode(decodeOutput.stdout);
-
-    // Parse text format back to object for assertion
-    // deno-lint-ignore no-explicit-any
-    const deserialized: any = {};
-    decodedString.trim().split("\n").forEach((line) => {
-      const [key, val] = line.split(":").map((s) => s.trim());
-      if (key && val) {
-        if (val.startsWith('"') && val.endsWith('"')) {
-          deserialized[key] = val.slice(1, -1);
-        } else {
-          deserialized[key] = parseInt(val, 10);
-        }
-      }
+    const decodedMessage = AgentState.decode(buffer);
+    const deserialized = AgentState.toObject(decodedMessage, {
+      longs: String,
+      enums: String,
+      bytes: String,
     });
 
     console.log("Deserialized Data:", deserialized);
@@ -136,23 +55,10 @@ memoryUsage: ${payload.memoryUsage}
     assertEquals(deserialized.memoryUsage, payload.memoryUsage);
 
     console.log(
-      "✅ Protocol Buffers PoC (Gen 2) successful: Real protoc CLI serialization/deserialization worked.",
+      "✅ Protocol Buffers PoC (Gen 2) successful: Real protobuf serialization/deserialization worked.",
     );
   } catch (err) {
     console.error("❌ Protocol Buffers PoC (Gen 2) failed:", err);
     Deno.exit(1);
-  } finally {
-    try {
-      await Deno.remove(TEMP_PROTO);
-      await Deno.remove(TEMP_DATA);
-      await Deno.remove(TEMP_BIN);
-    } catch {
-      // ignore
-    }
   }
 }
-
-if (import.meta.main) {
-  console.log("Running Protocol Buffers PoC (Gen 2) tests...");
-  run();
-}

.forum/poc-g2/sys_exec.ts

@@ -1,66 +0,0 @@
-export async function checkToolExists(toolName: string): Promise<boolean> {
-  try {
-    const command = new Deno.Command("which", {
-      args: [toolName],
-      stdout: "piped",
-      stderr: "piped",
-    });
-    const { code } = await command.output();
-    return code === 0;
-  } catch {
-    return false;
-  }
-}
-
-export async function requireTool(
-  toolName: string,
-  installationInstructions: string,
-): Promise<boolean> {
-  const exists = await checkToolExists(toolName);
-  if (!exists) {
-    console.warn(`\n⚠️  [Pre-flight Check] Tool '${toolName}' is missing.`);
-    console.warn(`   Please install it: ${installationInstructions}`);
-    console.warn(`   Skipping execution that depends on this tool.\n`);
-    return false;
-  }
-  return true;
-}
-
-export async function execTool(
-  toolName: string,
-  args: string[],
-  options?: { stdin?: string },
-): Promise<{ code: number; stdout: string; stderr: string }> {
-  const commandOpts: Deno.CommandOptions = {
-    args,
-    stdout: "piped",
-    stderr: "piped",
-  };
-
-  if (options?.stdin) {
-    commandOpts.stdin = "piped";
-  }
-
-  const command = new Deno.Command(toolName, commandOpts);
-
-  if (options?.stdin) {
-    const process = command.spawn();
-    const writer = process.stdin.getWriter();
-    await writer.write(new TextEncoder().encode(options.stdin));
-    await writer.close();
-
-    const { code, stdout, stderr } = await process.output();
-    return {
-      code,
-      stdout: new TextDecoder().decode(stdout),
-      stderr: new TextDecoder().decode(stderr),
-    };
-  }
-
-  const { code, stdout, stderr } = await command.output();
-  return {
-    code,
-    stdout: new TextDecoder().decode(stdout),
-    stderr: new TextDecoder().decode(stderr),
-  };
-}

.forum/poc-g2/tool_sandbox_poc.ts

@@ -2,16 +2,17 @@
  * Tool Sandbox PoC (Gen 2 - Production Tooling)
  *
  * This script proves that the execution environment can physically handle
- * invoking actual production-grade tooling constraints (tree-sitter CLI
- * and semgrep CLI) natively via system execution rather than Node imports.
+ * invoking actual production-grade tooling constraints (WASM for Tree-sitter
+ * and Deno.Command for Semgrep).
+ *
+ * Dependencies required on host system for this PoC:
+ * 1. Semgrep: `sudo pip3 install semgrep --break-system-packages`
+ * 2. Tree-sitter: `npm install web-tree-sitter tree-sitter-javascript`
  */
 
-import {
-  dirname,
-  fromFileUrl,
-  join,
-} from "https://deno.land/std@0.224.0/path/mod.ts";
-import { execTool, requireTool } from "./sys_exec.ts";
+import { join, dirname, fromFileUrl } from "https://deno.land/std@0.224.0/path/mod.ts";
+import * as webTreeSitter from "npm:web-tree-sitter@0.26.13";
+const Parser = webTreeSitter.default || webTreeSitter.Parser;
 
 const currentDir = dirname(fromFileUrl(import.meta.url));
 const TEMP_FILE = join(currentDir, "dummy_target.js");
@@ -24,96 +25,83 @@ function vulnerableQuery(userInput) {
 `;
 
 async function testTreeSitter() {
-  console.log("\n--- Testing Tree-sitter (CLI) ---");
-  const hasTreeSitter = await requireTool(
-    "tree-sitter",
-    "npm install -g tree-sitter-cli",
-  );
-  if (!hasTreeSitter) return false;
-
+  console.log("\n--- Testing Tree-sitter (WASM) ---");
   try {
-    await Deno.writeTextFile(TEMP_FILE, DUMMY_CODE);
+    // web-tree-sitter requires initialization to load the base wasm
+    await Parser.init();
 
-    // Provide code as a file, use normal tree-sitter parse output
-    const { code, stdout, stderr } = await execTool("tree-sitter", [
-      "parse",
-      TEMP_FILE,
-      "-q",
-    ]);
+    // Explicitly load the JavaScript language grammar WASM using a direct path
+    // In a real environment, this might be copied to a known static directory.
+    // For this PoC, we point directly to the npm installation path.
+    const rootDir = dirname(dirname(currentDir)); // Root of repo
+    const wasmPath = join(rootDir, "node_modules", "tree-sitter-javascript", "tree-sitter-javascript.wasm");
 
-    if (code !== 0) {
-      console.error("❌ Tree-sitter CLI execution failed:", stderr || stdout);
-      return false;
-    }
+    console.log(`[Sandbox] Loading Language WASM from: ${wasmPath}`);
+    const wasmBytes = await Deno.readFile(wasmPath);
 
-    // We don't have the nice object tree structure, but we can verify it executed successfully
-    // We would parse the sexp output from tree-sitter for full ast traversal in a real scenario
-    console.log("[Sandbox] Successfully executed native tree-sitter binary!");
+    const Lang = await webTreeSitter.Language.load(wasmBytes);
+    const parser = new Parser();
+    parser.setLanguage(Lang);
+
+    const tree = parser.parse(DUMMY_CODE);
+    console.log("[Sandbox] Successfully parsed syntax tree!");
+    console.log(`[Sandbox] Root Node Type: ${tree.rootNode.type}`);
+    console.log(`[Sandbox] Extracted Functions: ${tree.rootNode.children.filter(n => n.type === 'function_declaration').map(n => n.childForFieldName('name')?.text).join(', ')}`);
     return true;
   } catch (error) {
-    console.error("❌ Tree-sitter CLI execution failed:", error);
+    console.error("❌ Tree-sitter WASM execution failed:", error.message);
+    console.error("Please ensure you ran: `npm install web-tree-sitter tree-sitter-javascript`");
     return false;
-  } finally {
-    try {
-      await Deno.remove(TEMP_FILE);
-    } catch {
-      // ignore
-    }
   }
 }
 
 async function testSemgrep() {
   console.log("\n--- Testing Semgrep (Binary) ---");
-  const hasSemgrep = await requireTool(
-    "semgrep",
-    "pip3 install semgrep --break-system-packages",
-  );
-  if (!hasSemgrep) return false;
-
   try {
     // Write out dummy file for semgrep to scan
     await Deno.writeTextFile(TEMP_FILE, DUMMY_CODE);
 
     // Define a basic semgrep rule directly via CLI flag to detect our dummy issue
-    const { code, stdout, stderr } = await execTool("semgrep", [
-      "--quiet",
-      "--json",
-      "--lang",
-      "javascript",
-      "-e",
-      '"$SELECT ... " + $INPUT',
-      TEMP_FILE,
-    ]);
+    const command = new Deno.Command("semgrep", {
+      args: [
+        "--quiet",
+        "--json",
+        "--lang", "javascript",
+        "-e", '"$SELECT ... " + $INPUT',
+        TEMP_FILE
+      ],
+      stdout: "piped",
+      stderr: "piped",
+    });
+
+    const { code, stdout, stderr } = await command.output();
+    const decoder = new TextDecoder();
 
     if (code !== 0 && code !== 1) { // 1 means findings found, 0 means no findings. Other codes are errors.
       console.error("❌ Semgrep execution returned error code:", code);
-      console.error(stderr);
+      console.error(decoder.decode(stderr));
       return false;
     }
 
-    const jsonResult = JSON.parse(stdout);
+    const outputString = decoder.decode(stdout);
+    const jsonResult = JSON.parse(outputString);
 
     console.log("[Sandbox] Successfully executed native semgrep binary!");
-    console.log(
-      `[Sandbox] Vulnerabilities found: ${jsonResult.results.length}`,
-    );
+    console.log(`[Sandbox] Vulnerabilities found: ${jsonResult.results.length}`);
     if (jsonResult.results.length > 0) {
-      console.log(
-        `[Sandbox] Details: ${jsonResult.results[0].extra.message} (Line ${
-          jsonResult.results[0].start.line
-        })`,
-      );
+       console.log(`[Sandbox] Details: ${jsonResult.results[0].extra.message} (Line ${jsonResult.results[0].start.line})`);
     }
 
     return true;
   } catch (error) {
-    console.error("❌ Semgrep binary execution failed:", error);
-    return false;
+     console.error("❌ Semgrep binary execution failed:", error.message);
+     console.error("Please ensure Semgrep is installed: `sudo pip3 install semgrep --break-system-packages`");
+     return false;
   } finally {
     try {
-      await Deno.remove(TEMP_FILE);
+        await Deno.remove(TEMP_FILE);
     } catch {
-      // ignore
+        // ignore
     }
   }
 }
@@ -124,16 +112,11 @@ async function runSandbox() {
   const tsSuccess = await testTreeSitter();
   const sgSuccess = await testSemgrep();
 
-  // For PoC execution, we don't strictly fail if tools are missing, because
-  // the environment might be a basic docker. But we do want to record if it succeeded.
   if (tsSuccess && sgSuccess) {
-    console.log(
-      "\n✅ Gen 2 Sandbox execution completed successfully. Physical tools verified.",
-    );
+    console.log("\n✅ Gen 2 Sandbox execution completed successfully. Physical tools verified.");
   } else {
-    console.warn(
-      "\n⚠️ Gen 2 Sandbox finished with skipped/failed host dependencies. Assuming graceful pass for PoC.",
-    );
+    console.error("\n❌ Gen 2 Sandbox failed due to missing or malfunctioning host dependencies.");
+    Deno.exit(1);
   }
 }