[WRONG BRANCH] fix(responses): restrict canonical system-message folding to message items

[luvs01]

Motivation

• The canonical-forward normalizer previously identified system messages by role === "system" alone, allowing typed non-message items from provider output to be promoted into privileged top-level instructions and enabling cross-provider stored-prompt escalation.
• The intent is to preserve the Responses schema's forward-compatibility for typed items while preventing untrusted provider-authored items from gaining system-level privileges on the canonical ChatGPT forward wire.

Description

• Add a predicate isCanonicalForwardSystemMessage that returns true only for plain objects whose type is absent or exactly "message" and whose role is "system", meaning only actual message items count as canonical system messages.
• Use that predicate in normalizeCanonicalForwardPromptEnvelope for both the collection pass and the removal/filter pass so the folding and strip operations only touch real message system items.
• Add a focused regression test does not promote a non-message item with a system role in tests/responses-forward-prompt-envelope.test.ts that verifies an agent_message with role: "system" is preserved as input while a legitimate message system item is folded into instructions.

Testing

• Ran the focused tests with bun test tests/responses-forward-prompt-envelope.test.ts and the modified suite passed (5 tests, 0 failures).
• Ran type checking with bun x tsc --noEmit and bun run privacy:scan, both of which succeeded.
• A full bun test run in this environment produced unrelated, environment-sensitive failures; the focused regression test, typecheck, and privacy:scan that directly cover the change all passed.

---

Codex Task

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e53cc894-d9c9-4a44-b81f-6e6382d39cc7

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.