fix(billing): keep the charge on completed runs that fail after execution

Three paths dropped cost the sandbox had already earned.

A harvest that cannot return what the run produced — more files than the
export limit, nesting past the listing depth, or an output directory the
code deleted — was excluded from the billable-error set. All three arrive
only after the sandbox has executed and all three are the caller's to fix,
so they belong with the post-completion export failures the policy already
bills rather than the provider failures it absorbs. A completed run whose
code wrote one file too many went free.

That also left the route with nothing to read: it already consults
readTrustedSandboxOutputCost for these errors, so attaching the cost at the
sandbox layer is what carries it into the response.

Separately, a Function block whose handler succeeded could still fail in
the steps that follow it — base64 hydration, and large-value redaction that
throws rather than emit unredacted data. Those errors carry no cost of
their own, so the completed sandbox went unbilled. The handler's cost is
now held across that window, in the same way streamingPartialOutput already
is, and used only when the error has none.

The new conformance case was confirmed to fail against the narrower catch.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/executor/execution/block-executor.ts

@@ -249,6 +249,17 @@ export class BlockExecutor {
     cleanupSelfReference?.()
 
     let streamingPartialOutput: Record<string, any> | undefined
+    /**
+     * Cost of a handler that already finished, kept for the catch below.
+     *
+     * A Function block's sandbox is paid for the moment it completes, but the
+     * steps after the handler returns — base64 hydration, and large-value
+     * redaction that deliberately throws rather than emit unredacted data — can
+     * still fail the block. The error those raise carries no cost of its own, so
+     * without holding it here the completed sandbox would go unbilled. Hoisted
+     * for the same reason `streamingPartialOutput` above is.
+     */
+    let completedHandlerCost: TrustedExecutionCost | undefined
     try {
       /**
        * Only the handler call is retried. A streaming handler returns before any
@@ -261,6 +272,8 @@ export class BlockExecutor {
           : handler.execute(blockCtx, block, resolvedInputs, nodeMetadata)
       )
 
+      completedHandlerCost = readTrustedExecutionCost(output)
+
       const isStreamingExecution =
         output && typeof output === 'object' && 'stream' in output && 'execution' in output
 
@@ -436,7 +449,8 @@ export class BlockExecutor {
           inputDisplayRegistry,
           isSentinel,
           'execution',
-          streamingPartialOutput
+          streamingPartialOutput,
+          completedHandlerCost
         )
       } finally {
         commitBlockRegistry()
@@ -596,7 +610,8 @@ export class BlockExecutor {
     inputDisplayRegistry: ResolvedSecretTraceRegistry | undefined,
     isSentinel: boolean,
     phase: 'input_resolution' | 'execution',
-    streamingPartialOutput?: Record<string, any>
+    streamingPartialOutput?: Record<string, any>,
+    completedHandlerCost?: TrustedExecutionCost
   ): Promise<NormalizedBlockOutput> {
     const endedAt = new Date().toISOString()
     const duration = performance.now() - startTime
@@ -668,7 +683,7 @@ export class BlockExecutor {
       return softOutput
     }
 
-    const trustedExecutionCost = readTrustedExecutionCost(error)
+    const trustedExecutionCost = readTrustedExecutionCost(error) ?? completedHandlerCost
     const errorOutput: NormalizedBlockOutput = {
       error: errorMessage,
       ...(trustedExecutionCost ? { cost: trustedExecutionCost } : {}),

apps/sim/lib/execution/remote-sandbox/conformance.test.ts

@@ -134,6 +134,7 @@ import {
 } from '@/lib/execution/remote-sandbox/e2b'
 import {
   MAX_SANDBOX_OUTPUT_BYTES,
+  MAX_SANDBOX_OUTPUT_FILES,
   MAX_SANDBOX_PROCESS_OUTPUT_BYTES,
   MAX_SANDBOX_STREAMED_OUTPUT_TAIL_BYTES,
   readTrustedSandboxOutputCost,
@@ -713,6 +714,34 @@ describe.each(PROVIDERS)('sandbox conformance [%s]', (provider) => {
     }
   }
 
+  it('bills a completed run whose harvest produced more files than it can export', async () => {
+    // The sandbox executed and was paid for; the refusal is about what the code
+    // wrote, so it belongs with the post-completion export failures rather than
+    // the provider failures the policy absorbs.
+    stubCodeRun(provider, `${SIM_RESULT_PREFIX}null`)
+    stubOutputDirListing(
+      Array.from({ length: MAX_SANDBOX_OUTPUT_FILES + 1 }, (_, index) => ({
+        path: `/tmp/sim/outputs/file-${index}.txt`,
+        size: 1,
+      }))
+    )
+
+    const error = await executeInSandbox({
+      code: 'x',
+      language: CodeLanguage.Python,
+      timeoutMs: 1000,
+      outputSandboxDir: '/tmp/sim/outputs',
+      meterUsage: true,
+    }).catch((error: unknown) => error)
+
+    expect(error).toMatchObject({ code: 'sandbox_output_not_exportable' })
+    expect(readTrustedSandboxOutputCost(error)).toEqual({
+      input: 0,
+      output: 0,
+      total: expect.any(Number),
+    })
+  })
+
   it('creates the output directory before user code runs', async () => {
     stubCodeRun(provider, `__SIM_RESULT__=${JSON.stringify('done')}`)
     stubOutputDirListing([])

apps/sim/lib/execution/remote-sandbox/index.ts

@@ -18,6 +18,7 @@ import {
   attachTrustedSandboxOutputCost,
   isSandboxOutputFileError,
   isSandboxOutputLimitError,
+  isSandboxOutputNotExportableError,
   MAX_SANDBOX_OUTPUT_BYTES,
   MAX_SANDBOX_OUTPUT_FILES,
   MAX_SANDBOX_PROCESS_OUTPUT_BYTES,
@@ -919,7 +920,19 @@ async function executeInSandboxWithinBudget(
       billableResult.exportedFiles = exportedFiles
       billableResult.collectedFiles = collectedFiles
     } catch (error) {
-      if (isSandboxOutputLimitError(error) || isSandboxOutputFileError(error)) {
+      /*
+       * A harvest that cannot return what the run produced — too many files, too
+       * deep, or an output directory the code deleted — is the caller's to fix
+       * and arrives only after the sandbox has already executed. It belongs with
+       * the other post-completion export failures the policy bills, not with the
+       * provider failures it absorbs; leaving it out let a completed run whose
+       * code wrote one file too many go free.
+       */
+      if (
+        isSandboxOutputLimitError(error) ||
+        isSandboxOutputFileError(error) ||
+        isSandboxOutputNotExportableError(error)
+      ) {
         billableOutputError = error
       }
       throw error
@@ -1050,7 +1063,19 @@ async function executeShellInSandboxWithinBudget(
       billableResult.exportedFiles = exportedFiles
       billableResult.collectedFiles = collectedFiles
     } catch (error) {
-      if (isSandboxOutputLimitError(error) || isSandboxOutputFileError(error)) {
+      /*
+       * A harvest that cannot return what the run produced — too many files, too
+       * deep, or an output directory the code deleted — is the caller's to fix
+       * and arrives only after the sandbox has already executed. It belongs with
+       * the other post-completion export failures the policy bills, not with the
+       * provider failures it absorbs; leaving it out let a completed run whose
+       * code wrote one file too many go free.
+       */
+      if (
+        isSandboxOutputLimitError(error) ||
+        isSandboxOutputFileError(error) ||
+        isSandboxOutputNotExportableError(error)
+      ) {
         billableOutputError = error
       }
       throw error