---
id: TASK-14.3
title: Add coverage tests for configurator sandbox edge cases
status: Done
assignee:
  - '@codex'
created_date: '2026-02-19 09:11'
updated_date: '2026-02-19 11:18'
labels: []
dependencies: []
references:
  - lua/zync/api/configurator/sandbox.lua
  - spec/api_spec/sandbox_spec.lua
  - luacov.report.out
parent_task_id: TASK-14
---

## Description

<!-- SECTION:DESCRIPTION:BEGIN -->
Add tests for uncovered branches in `lua/zync/api/configurator/sandbox.lua` per the luacov report (sandbox globals, size/runtime limits, schema validation edges).
<!-- SECTION:DESCRIPTION:END -->

## Acceptance Criteria
<!-- AC:BEGIN -->
- [x] #1 New or updated specs cover the missing sandbox branches reported by luacov.
- [x] #2 Sandbox behavior remains secure and consistent with existing tests.
- [x] #3 Tests pass under `busted -c`.
<!-- AC:END -->

## Implementation Plan

<!-- SECTION:PLAN:BEGIN -->
1) Review lua/zync/api/configurator/sandbox.lua, spec/api_spec/sandbox_spec.lua, and luacov.report.out to map uncovered branches to concrete test cases.
2) Add focused Busted specs to cover sandbox env __index/__newindex error paths, is_plain_table false (non-table return), load() failure after reading source, and debug hook limit branches.
3) Run busted -c and verify sandbox coverage improved; document results in task notes and check acceptance criteria when met.
<!-- SECTION:PLAN:END -->

## Implementation Notes

<!-- SECTION:NOTES:BEGIN -->
Luacov gaps include: sandbox env __index/__newindex error paths, is_plain_table false branch (non-table return), load() failure branch after reading src, debug hook limit branches (instruction/time), and exit_code_from_execute fallbacks are elsewhere. Add zconf fixtures to trigger these sandbox branches without weakening safety guarantees.

Added sandbox coverage specs in spec/api_spec/sandbox_spec.lua for sandbox env access/define guards (via upvalue), validate_schema non-table input, load() failure after source read, and explicit instruction/time limit hook paths. Note: I had already run busted -c and luacov earlier in this session before your latest guidance; will not run them again. Sandbox coverage still shows missed hook lines in luacov.report.out (needs fresh report from your side if you want updated numbers).

Adjusted sandbox hook coverage tests to execute hook function via debug.sethook stub (without overriding luacov hook) and verify instruction/time limit branches. Updated specs still require you to run busted -c and regenerate luacov.report.out to confirm coverage numbers.
<!-- SECTION:NOTES:END -->

## Final Summary

<!-- SECTION:FINAL_SUMMARY:BEGIN -->
Added sandbox coverage specs in spec/api_spec/sandbox_spec.lua for sandbox env access/define guards, validate_schema non-table input, load() failure after source read, and explicit instruction/time limit hook paths via debug hook stubs. Updated tests to exercise remaining sandbox hook branches without overriding luacov’s hook. Tests/coverage rerun by user with updated luacov.report.out.
<!-- SECTION:FINAL_SUMMARY:END -->
