fix: Kubernetes exec reported unknown status as success and leaked its socket (#74)

The last two class-level `# pragma: no cover` — `KubernetesPodSandbox` and
`DaytonaSandbox` — and the fourth time removing one has surfaced a real bug.

`_execute_api` defaulted a missing return code to 0. The read loop exits as
soon as the output cap is reached, with the command still running and no code
reported yet, so every truncated command came back as having passed. It now
defaults to 1, which is the convention `LocalBackend` already used.

`resp.close()` sat after the read loop inside the same `try`, so a connection
dropping mid-command skipped it — one leaked websocket per failed command, for
the life of the process. Moved to a `finally`, and opening the stream is now
its own guarded step so a failure there is not confused with a read failure.

30 tests cover the pod-exec path, both readiness outcomes and the polling in
between, liveness, config loading, the `mode="http"` listing failures and the
`mode="api"` fallbacks to the shell, plus Daytona's readiness probe and failure
handlers. No blanket pragma remains in the package.

Author: DEENUU1

CHANGELOG.md

@@ -9,11 +9,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **`KubernetesPodSandbox` and `DaytonaSandbox` are covered.** The last two class-level `# pragma: no cover`; no blanket one remains in the package. 30 tests cover the pod-exec path, both readiness outcomes and the polling in between, liveness, config loading, the `mode="http"` listing failures and the `mode="api"` fallbacks to the shell — plus Daytona's readiness probe and failure handlers. The two exec bugs above are what the pass found.
 - **The console tools' own rendering is covered.** Every tool body sat behind a blanket `# pragma: no cover`, so how a listing, a glob, a grep or a background shell is actually *rendered for the model* was unmeasured — and both `hashline` variants, which register only under `edit_format="hashline"`, had no coverage at all. 29 tests now cover them: the empty and truncated forms of `ls`, `glob` and `grep`, `grep`'s count mode and its error passthrough, a hashline read and a full hashline edit round trip including a stale hash and a failing write-back, and the background tools with and without a sandbox that has a shell.
 - **`LocalBackend`'s failure and denial paths are covered.** 30 of its methods' error handlers sat behind a blanket `# pragma: no cover`, so in the backend most users touch, the code that turns a denied path or a filesystem error into a reportable result was never run by a test — including every `PermissionError` handler on its permission boundary. The pragmas are gone and 45 tests cover it: a path outside the allowed directories for every operation, an unreadable file and directory, an offset past the end, a read of a directory, `OSError` on read, write, edit and glob, and both grep implementations forced explicitly rather than left to whether `rg` happens to be installed — which is what made this file's coverage depend on the machine. The glob truncation above is what the pass found.
 
 ### Fixed
 
+- **A Kubernetes exec no longer reports an unknown status as success.** `_execute_api` defaulted a missing return code to `0`, and the read loop exits as soon as the output cap is hit — with the command still running and no code yet. So **every truncated command was reported as having passed**. It now defaults to `1`, matching `LocalBackend`, which had the convention right.
+- **A Kubernetes exec no longer leaks a websocket on failure.** `resp.close()` sat after the read loop inside the same `try`, so a connection dropping mid-command skipped it entirely — one leaked socket per failed command, for the life of the process. Moved to a `finally`.
 - **A glob no longer silently returns a short answer.** `LocalBackend.glob_info` wrapped its whole walk in one `try`, so a single entry that could not be stat'd — deleted between the glob and the stat, or in a directory the process cannot read — aborted the loop and returned whatever had been collected. Measured on four matching files with one bad entry: **one** came back. The model gets an incomplete answer with nothing to indicate it, which is worse than a missing row and worse than an error. Now skipped per entry, matching `ls_info` and `grep_raw`, which both already carried on.
 
 - **A listing no longer reports paths the sandbox cannot read back.** `ls_info` built each row's `path` from the *shell-quoted* directory, so listing `/my work` returned `'/my work'/notes.md` — a path that does not exist. A model handed that row and asking to read it got a failure it could not recover from, and the directory was effectively unreachable. Plain paths quote to themselves, which is why it went unnoticed. Affects every shell-derived sandbox: Docker, Daytona, Kubernetes and any third-party one.

src/pydantic_ai_backends/backends/daytona.py

@@ -32,7 +32,7 @@
 DEFAULT_EXEC_TIMEOUT = 30 * 60
 
 
-class DaytonaSandbox(BaseSandbox):  # pragma: no cover
+class DaytonaSandbox(BaseSandbox):
     """Daytona cloud sandbox backend.
 
     Creates an ephemeral Daytona sandbox for running commands and managing

src/pydantic_ai_backends/backends/kubernetes.py

@@ -40,7 +40,7 @@
 DEFAULT_PORT = 8080
 
 
-class KubernetesPodSandbox(BaseSandbox):  # pragma: no cover
+class KubernetesPodSandbox(BaseSandbox):
     """Sandbox backed by a Kubernetes pod.
 
     Args:
@@ -322,23 +322,37 @@ def _execute_api(self, command: str, timeout_seconds: int) -> ExecuteResponse:
                 tty=False,
                 _preload_content=False,
             )
+        except Exception as exc:
+            return ExecuteResponse(output=f"Error: {exc}", exit_code=1, truncated=False)
+
+        # `close` in `finally`: the read loop below can raise on a dropped
+        # connection, and the websocket would then stay open for the life of the
+        # process — one leaked socket per failed command.
+        try:
             output = bytearray()
             while resp.is_open() and len(output) < MAX_EXECUTE_OUTPUT_BYTES:
                 resp.update(timeout=1)
                 if resp.peek_stdout():
                     output.extend(resp.read_stdout().encode("utf-8", errors="replace"))
                 if resp.peek_stderr():
                     output.extend(resp.read_stderr().encode("utf-8", errors="replace"))
-            exit_code = resp.returncode if resp.returncode is not None else 0
-            resp.close()
-            truncated = len(output) >= MAX_EXECUTE_OUTPUT_BYTES
-            return ExecuteResponse(
-                output=bytes(output[:MAX_EXECUTE_OUTPUT_BYTES]).decode("utf-8", errors="replace"),
-                exit_code=exit_code,
-                truncated=truncated,
-            )
+            # `1` for an unknown status, never `0`. The loop also exits once the
+            # output cap is hit, with the command still running and no return
+            # code yet — reporting that as success told the caller a truncated
+            # command had passed. `LocalBackend` already defaults to `1`.
+            exit_code = resp.returncode if resp.returncode is not None else 1
         except Exception as exc:
             return ExecuteResponse(output=f"Error: {exc}", exit_code=1, truncated=False)
+        finally:
+            with contextlib.suppress(Exception):
+                resp.close()
+
+        truncated = len(output) >= MAX_EXECUTE_OUTPUT_BYTES
+        return ExecuteResponse(
+            output=bytes(output[:MAX_EXECUTE_OUTPUT_BYTES]).decode("utf-8", errors="replace"),
+            exit_code=exit_code,
+            truncated=truncated,
+        )
 
     def read_bytes(self, path: str) -> bytes:
         # Match LocalBackend semantics: return b"" on missing / transport /

tests/test_daytona_sandbox.py

@@ -456,3 +456,79 @@ def test_in_all(self) -> None:
         import pydantic_ai_backends
 
         assert "DaytonaSandbox" in pydantic_ai_backends.__all__
+
+
+class TestDaytonaFailurePaths:
+    """Handlers that were hidden by the class-level pragma."""
+
+    def _sandbox(self):
+        from pydantic_ai_backends import DaytonaSandbox
+
+        sandbox = DaytonaSandbox.__new__(DaytonaSandbox)
+        sandbox._id = "s1"
+        sandbox._last_activity = 0.0
+        return sandbox
+
+    def test_is_alive_is_false_when_the_probe_fails(self, monkeypatch):
+        sandbox = self._sandbox()
+        monkeypatch.setattr(
+            type(sandbox),
+            "execute",
+            lambda self, cmd, timeout=None: (_ for _ in ()).throw(OSError("transport gone")),
+        )
+
+        assert sandbox.is_alive() is False
+
+    def test_is_alive_is_false_on_a_nonzero_exit(self, monkeypatch):
+        from pydantic_ai_backends.types import ExecuteResponse
+
+        sandbox = self._sandbox()
+        monkeypatch.setattr(
+            type(sandbox),
+            "execute",
+            lambda self, cmd, timeout=None: ExecuteResponse(output="", exit_code=1),
+        )
+
+        assert sandbox.is_alive() is False
+
+    def test_an_unexpected_failure_during_edit_is_reported(self, monkeypatch):
+        sandbox = self._sandbox()
+        monkeypatch.setattr(
+            type(sandbox),
+            # `edit` probes existence first, so that is where the failure lands.
+            "exists",
+            lambda self, path: (_ for _ in ()).throw(RuntimeError("api exploded")),
+        )
+
+        result = sandbox.edit("/f.txt", "a", "b")
+
+        assert result.error is not None
+        assert "api exploded" in result.error
+
+    def test_readiness_polling_tolerates_a_failing_probe(self, monkeypatch):
+        """A sandbox that is not up yet raises; that is expected, not fatal."""
+        from pydantic_ai_backends.backends import daytona as module
+
+        sandbox = self._sandbox()
+        attempts: list[int] = []
+
+        class Process:
+            def exec(self, command: str, timeout: int = 5):
+                attempts.append(1)
+                if len(attempts) == 1:
+                    raise OSError("not listening yet")
+
+                class Ok:
+                    exit_code = 0
+
+                return Ok()
+
+        class Inner:
+            process = Process()
+
+        sandbox._sandbox = Inner()
+        monkeypatch.setattr(module.time, "sleep", lambda seconds: None)
+
+        sandbox._wait_until_ready(timeout=30)
+
+        assert len(attempts) == 2