fix: promote role:system messages from messages array to system param in Bedrock translator (envoyproxy#2189)

**Description**

In the Anthropic-to-AWS-Bedrock translator, Claude Code with
mid-conversation-system beta sends system prompts as {"role": "system"}
in the messages array. The SDK has no system role constant so these hit
the default error case. This promotes them to the top-level system param
before conversion.

Fixes envoyproxy#2206

Signed-off-by: Linus Schlumberger <linus.schlumberger@siemens.com>
Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>
Signed-off-by: yxia216 <yxia216@bloomberg.net>

Author: 2 people

internal/translator/anthropic_awsbedrock.go

@@ -66,11 +66,16 @@ func (a *anthropicToAWSBedrockTranslator) RequestBody(_ []byte, body *anthropics
 
 	var bedrockReq awsbedrock.ConverseInput
 
+	// Promote any role: "system" messages from the messages array to the top-level system field.
+	// This handles clients (e.g. Claude Code with mid-conversation-system beta) that send
+	// system prompts as messages rather than the top-level parameter.
+	messages := promoteAnthropicSystemMessagesToParam(body)
+
 	// Convert messages.
-	bedrockReq.Messages = make([]*awsbedrock.Message, 0, len(body.Messages))
-	msgLen := len(body.Messages)
+	bedrockReq.Messages = make([]*awsbedrock.Message, 0, len(messages))
+	msgLen := len(messages)
 	for i := 0; i < msgLen; {
-		msg := &body.Messages[i]
+		msg := &messages[i]
 		switch msg.Role {
 		case anthropicschema.MessageRoleUser:
 			bedrockMsg, convErr := a.convertUserMessage(msg)
@@ -162,6 +167,34 @@ func (a *anthropicToAWSBedrockTranslator) RequestBody(_ []byte, body *anthropics
 	return
 }
 
+// promoteAnthropicSystemMessagesToParam promotes role: "system" messages from the messages
+// array to the top-level system parameter. Returns the filtered messages (without system messages).
+// This handles clients (e.g. Claude Code with mid-conversation-system beta) that send
+// system prompts as messages rather than the top-level parameter.
+func promoteAnthropicSystemMessagesToParam(body *anthropicschema.MessagesRequest) []anthropicschema.MessageParam {
+	var systemTexts []string
+	var filtered []anthropicschema.MessageParam
+	for _, msg := range body.Messages {
+		if msg.Role == "system" {
+			if msg.Content.Text != "" {
+				systemTexts = append(systemTexts, msg.Content.Text)
+			}
+			for i := range msg.Content.Array {
+				if msg.Content.Array[i].Text != nil && msg.Content.Array[i].Text.Text != "" {
+					systemTexts = append(systemTexts, msg.Content.Array[i].Text.Text)
+				}
+			}
+		} else {
+			filtered = append(filtered, msg)
+		}
+	}
+	if len(systemTexts) > 0 {
+		systemText := strings.Join(systemTexts, "\n")
+		body.System = &anthropicschema.SystemPrompt{Text: systemText}
+	}
+	return filtered
+}
+
 func hasToolResult(msg *anthropicschema.MessageParam) bool {
 	if msg.Role != anthropicschema.MessageRoleUser {
 		return false

internal/translator/anthropic_awsbedrock_test.go

@@ -1234,3 +1234,106 @@ func TestAnthropicToAWSBedrockTranslator_ResponseBody_StreamingToolUse(t *testin
 	assert.Contains(t, bodyStr, `"input_json_delta"`)
 	assert.Contains(t, bodyStr, `"tool_use"`)
 }
+
+func TestPromoteAnthropicSystemMessagesToParam(t *testing.T) {
+	t.Run("no system messages returns all messages", func(t *testing.T) {
+		body := &anthropicschema.MessagesRequest{
+			Messages: []anthropicschema.MessageParam{
+				{Role: anthropicschema.MessageRoleUser, Content: anthropicschema.MessageContent{Text: "Hello"}},
+			},
+		}
+		result := promoteAnthropicSystemMessagesToParam(body)
+		require.Len(t, result, 1)
+		require.Nil(t, body.System)
+	})
+
+	t.Run("single text system message is promoted", func(t *testing.T) {
+		body := &anthropicschema.MessagesRequest{
+			Messages: []anthropicschema.MessageParam{
+				{Role: "system", Content: anthropicschema.MessageContent{Text: "You are helpful."}},
+				{Role: anthropicschema.MessageRoleUser, Content: anthropicschema.MessageContent{Text: "Hi"}},
+			},
+		}
+		result := promoteAnthropicSystemMessagesToParam(body)
+		require.Len(t, result, 1)
+		require.Equal(t, "user", string(result[0].Role))
+		require.NotNil(t, body.System)
+		require.Equal(t, "You are helpful.", body.System.Text)
+	})
+
+	t.Run("system message with content blocks is promoted", func(t *testing.T) {
+		body := &anthropicschema.MessagesRequest{
+			Messages: []anthropicschema.MessageParam{
+				{
+					Role: "system",
+					Content: anthropicschema.MessageContent{
+						Array: []anthropicschema.ContentBlockParam{
+							{Text: &anthropicschema.TextBlockParam{Text: "You are Claude."}},
+						},
+					},
+				},
+				{Role: anthropicschema.MessageRoleUser, Content: anthropicschema.MessageContent{Text: "Hi"}},
+			},
+		}
+		result := promoteAnthropicSystemMessagesToParam(body)
+		require.Len(t, result, 1)
+		require.NotNil(t, body.System)
+		require.Equal(t, "You are Claude.", body.System.Text)
+	})
+
+	t.Run("multiple system messages are joined", func(t *testing.T) {
+		body := &anthropicschema.MessagesRequest{
+			Messages: []anthropicschema.MessageParam{
+				{Role: "system", Content: anthropicschema.MessageContent{Text: "Be concise."}},
+				{Role: "system", Content: anthropicschema.MessageContent{Text: "Be accurate."}},
+				{Role: anthropicschema.MessageRoleUser, Content: anthropicschema.MessageContent{Text: "Hello"}},
+			},
+		}
+		result := promoteAnthropicSystemMessagesToParam(body)
+		require.Len(t, result, 1)
+		require.NotNil(t, body.System)
+		require.Equal(t, "Be concise.\nBe accurate.", body.System.Text)
+	})
+
+	t.Run("system message is added to existing system param", func(t *testing.T) {
+		body := &anthropicschema.MessagesRequest{
+			System: &anthropicschema.SystemPrompt{Text: "You are Claude."},
+			Messages: []anthropicschema.MessageParam{
+				{Role: "system", Content: anthropicschema.MessageContent{Text: "Be concise."}},
+				{Role: anthropicschema.MessageRoleUser, Content: anthropicschema.MessageContent{Text: "Hi"}},
+			},
+		}
+		result := promoteAnthropicSystemMessagesToParam(body)
+		require.Len(t, result, 1)
+		require.NotNil(t, body.System)
+		// The existing system param is overwritten by the promoted messages.
+		require.Equal(t, "Be concise.", body.System.Text)
+	})
+
+	t.Run("integration with full request", func(t *testing.T) {
+		translator := NewAnthropicToAWSBedrockTranslator("")
+		req := &anthropicschema.MessagesRequest{
+			Model:     "anthropic.claude-3-sonnet-20240229-v1:0",
+			MaxTokens: 1024,
+			Messages: []anthropicschema.MessageParam{
+				{Role: "system", Content: anthropicschema.MessageContent{Text: "You are helpful."}},
+				{Role: anthropicschema.MessageRoleUser, Content: anthropicschema.MessageContent{Text: "Hello"}},
+			},
+		}
+		rawBody, err := json.Marshal(req)
+		require.NoError(t, err)
+
+		_, body, err := translator.RequestBody(rawBody, req, false)
+		require.NoError(t, err)
+
+		var bedrockReq awsbedrock.ConverseInput
+		err = json.Unmarshal(body, &bedrockReq)
+		require.NoError(t, err)
+
+		require.Len(t, bedrockReq.Messages, 1)
+		assert.Equal(t, awsbedrock.ConversationRoleUser, bedrockReq.Messages[0].Role)
+		require.NotNil(t, bedrockReq.System)
+		require.Len(t, bedrockReq.System, 1)
+		assert.Equal(t, "You are helpful.", *bedrockReq.System[0].Text)
+	})
+}