Lua setfenv/metatable sandbox won't work with ROBLOX methods -

in roblox lua, i'm writing game involves users creating , running lua scripts. obviously, need prevent use of services , functions, such kick function on player class, or related datastore or teleportservice.

so far, i've been successful @ making sandboxed environment using setfenv set function's environment metatable, attached "sandbox" table. on __index, if nothing found in sandbox table, looks in real environment would. allows me put fake functions in sandbox table used instead of real counterparts.

however, let's sandboxed clearallchildren function. players escape sandbox doing this:

someobject.parent.someobject:clearallchildren() 

this because getting instance's parent gives them real version opposed sandboxed version. flaw can pulled off many other ways, too.

so made object wrapper. calling wrap(obj) on instance returns fake version created newproxy(true). __index of metatable makes sure child of object (or instance property such parent) return wrapped version.

my issue way have wrapper set up. attempting call method on object inside sandbox, this:

x = someobject:getchildren() 

results in following error:

expected ':' not '.' calling member function getchildren 

here's full code sandbox currently:

local _env = getfenv(); -- main environment  -- custom object wrapper function wrap(obj)     if pcall(function() return obj.isa end) -- hacky way make sure it's real         local realobj = obj;         local fakeobj = newproxy(true);         local meta = getmetatable(fakeobj);         meta['__index'] = function(_, key)             -- todo: logic here sandbox wrapped objects             return wrap(realobj[key]) -- source of method problem         end;         meta['__tostring'] = function()             return realobj.name or realobj;         end;         meta['__metatable'] = "locked";         return fakeobj;     else         return obj;     end; end;  -- sandbox table (fake objects/functions) local sandbox = {     game = wrap(game);     game = wrap(game);     workspace = wrap(workspace);     workspace = wrap(workspace);     script = wrap(script);     instance = {         new = function(a, b)             return wrap(instance.new(a, b))         end;     }; };  -- sandboxed function function run()     print(script.parent:getchildren())     print(script.parent)     script.parent:clearallchildren() end;  -- setting function environment setfenv(run, setmetatable(sandbox, {__index = _env;}));  run(); 

how can fix this?