fix(guardrails): return 499 on a cancelled validation instead of a failed verdict

Author: waleedlatif1

apps/sim/app/api/guardrails/validate/route.test.ts

@@ -435,4 +435,31 @@ describe('POST /api/guardrails/validate', () => {
     await expect(res.json()).resolves.toEqual({ error: 'Failed to resolve billing attribution' })
     expect(mockValidateHallucination).not.toHaveBeenCalled()
   })
+
+  /**
+   * The signal now reaches the scoring model, so cancellation is reachable here.
+   * `passed: false` would read to a consumer as the guardrail rejecting the content,
+   * blocking a run that was abandoned rather than judged.
+   */
+  it('reports a cancelled run as cancellation rather than a failed guardrail', async () => {
+    mockAuthorizeCredentialUse.mockResolvedValue({ ok: true })
+    mockValidateHallucination.mockRejectedValueOnce(
+      Object.assign(new Error('The operation was aborted.'), { name: 'AbortError' })
+    )
+
+    const res = await POST(
+      createMockRequest('POST', {
+        validationType: 'hallucination',
+        input: 'test input',
+        knowledgeBaseId: 'kb-1',
+        model: 'openai/gpt-4o',
+        workflowId: 'wf-1',
+      })
+    )
+
+    expect(res.status).toBe(499)
+    const json = await res.json()
+    expect(json.success).toBe(false)
+    expect(json.output?.passed).toBeUndefined()
+  })
 })

apps/sim/app/api/guardrails/validate/route.ts

@@ -28,6 +28,7 @@ import {
   ProviderNotAllowedError,
 } from '@/ee/access-control/utils/permission-check'
 import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+import { isAbortError } from '@/providers/streaming-tool-loop-shared'
 import { getProviderFromModel } from '@/providers/utils'
 
 const logger = createLogger('GuardrailsValidateAPI')
@@ -372,6 +373,19 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       },
     })
   } catch (error: any) {
+    /**
+     * A cancelled run must not be reshaped into a verdict. `passed: false` here reads
+     * to a consumer as the guardrail rejecting the content, so an abandoned run would
+     * block content that was never actually judged. 499 matches the convention the
+     * workflow execute route already uses for a client-cancelled request.
+     */
+    if (isAbortError(error)) {
+      logger.info(`[${requestId}] Guardrails validation cancelled by client`)
+      return NextResponse.json(
+        { success: false, error: 'Client cancelled request' },
+        { status: 499 }
+      )
+    }
     logger.error(`[${requestId}] Guardrails validation failed`, { error })
     return NextResponse.json({
       success: true,