From ce7cec1a3635bdb66292daa45ec9fe39f37bbffa Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Tue, 8 Sep 2026 16:48:22 -0700
Subject: [PATCH] fix(policy_engine): keep discarded stream rewrites out of the
 applied-guardrails header

A streaming step whose rewrite the executor threw away (a tool-call rewrite, a text rewrite
the translation cannot write back, or one the adapter refused) still marked its guardrail as
applied, so the header claimed an output the client never received. The step now returns
right after releasing the original chunks, which leaves the header as the merge base sent it
---
 litellm/proxy/policy_engine/pipeline_executor.py       | 10 ++++++----
 .../proxy/policy_engine/test_pipeline_executor.py      |  1 +
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/litellm/proxy/policy_engine/pipeline_executor.py b/litellm/proxy/policy_engine/pipeline_executor.py
index 45a113fcda2..9b0d1e60839 100644
--- a/litellm/proxy/policy_engine/pipeline_executor.py
+++ b/litellm/proxy/policy_engine/pipeline_executor.py
@@ -387,7 +387,8 @@ class PipelineExecutor:
         yet (a tool-call rewrite, a text rewrite on a translation without write-back, or one
         the translation or adapter refused with ``UndeliverableStreamRewrite``) is discarded:
         the buffered chunks go back to the originals and the step passes, so the client gets
-        the stream the merge base sent. The response an earlier step's translation stored under
+        the stream the merge base sent, and the guardrail stays out of the applied-guardrails
+        header since its output never reached the client. The response an earlier step's translation stored under
         ``request_data["response"]`` is dropped first, so this step's hook sees the stream as
         the steps before it left it."""
         scanner: Final = (
@@ -419,9 +420,10 @@ class PipelineExecutor:
                 )
         except UndeliverableStreamRewrite:
             _release_original_chunks(step.guardrail, streaming_chunks, originals)
-        else:
-            if observer.rewrote_tool_calls or (observer.rewrote_texts and not deliver_rewrites):
-                _release_original_chunks(step.guardrail, streaming_chunks, originals)
+            return
+        if observer.rewrote_tool_calls or (observer.rewrote_texts and not deliver_rewrites):
+            _release_original_chunks(step.guardrail, streaming_chunks, originals)
+            return
         if not callback.records_own_guardrail_information:
             add_guardrail_to_applied_guardrails_header(request_data=hook_input, guardrail_name=step.guardrail)
 
diff --git a/tests/test_litellm/proxy/policy_engine/test_pipeline_executor.py b/tests/test_litellm/proxy/policy_engine/test_pipeline_executor.py
index ae7754e5821..2af318c88cd 100644
--- a/tests/test_litellm/proxy/policy_engine/test_pipeline_executor.py
+++ b/tests/test_litellm/proxy/policy_engine/test_pipeline_executor.py
@@ -1146,6 +1146,7 @@ def _assert_passed_with_discard_warning(result, caplog):
     assert result.terminal_action == "allow"
     assert [step.outcome for step in result.step_results] == ["pass"]
     assert any("'masker'" in record.getMessage() and "discarded" in record.getMessage() for record in caplog.records)
+    assert "masker" not in ((result.modified_data or {}).get("metadata") or {}).get("applied_guardrails", [])
 
 
 @pytest.mark.asyncio