---
id: TASK-11
title: Fail fast when sandboxed zconf.lua accesses blacklisted globals
status: Done
assignee:
  - codex
created_date: '2026-02-04 16:47'
updated_date: '2026-02-04 17:26'
labels:
  - bug
dependencies: []
---

## Description

<!-- SECTION:DESCRIPTION:BEGIN -->
When zconf.lua is executed in the sandbox, attempts to access blacklisted globals (e.g., os) should surface as an error so zync does not continue with silently-unconfigured state. This addresses user reports that sandbox violations currently fail quietly. The bug had already been fixed in `configurator.lua`, however, the test suite needs to be updated to reflect current behavior.
<!-- SECTION:DESCRIPTION:END -->

## Acceptance Criteria
<!-- AC:BEGIN -->
- [x] #1 Sandboxed zconf.lua access to blacklisted globals results in an explicit error surfaced to the user (non-zero exit).
- [x] #2 zync does not proceed with unconfigured execution when sandbox violations occur.
- [x] #3 Tests cover the error path for sandboxed zconf.lua accessing a blacklisted global.
- [x] #4 User-facing messaging is clear about the sandbox violation (including which global/module triggered the failure).
<!-- AC:END -->

## Implementation Plan

<!-- SECTION:PLAN:BEGIN -->
1. Add or adjust Busted tests covering sandboxed zconf.lua access to a blacklisted global; assert non-zero exit and message.
2. Run relevant tests to confirm behavior aligns with acceptance criteria.
<!-- SECTION:PLAN:END -->

## Implementation Notes

<!-- SECTION:NOTES:BEGIN -->
Observed Configurator.init_conf now calls error(err, 2) when sandbox.load_zconf returns err (in lua/zync/api/configurator.lua). Next step: add tests to cover sandbox violation behavior at init_conf/CLI level.

Updated configurator specs to expect init_conf to error on invalid profiles and added sandbox violation test. Tests run: `busted -c spec/api_spec/configurator_spec.lua` (19 successes).
<!-- SECTION:NOTES:END -->

## Final Summary

<!-- SECTION:FINAL_SUMMARY:BEGIN -->
Summary:
- Added configurator spec coverage to assert sandboxed zconf.lua access to forbidden globals fails loudly with a clear error.
- Updated configurator specs to expect init_conf to raise on invalid profiles under the current error-propagation behavior.

Tests:
- busted -c spec/api_spec/configurator_spec.lua

- Adjusted zync_spec to expect early error on sandbox violation when loading zconf before any command runs.

Tests:
- busted -c
<!-- SECTION:FINAL_SUMMARY:END -->
