feat(providers): add Cloudflare AI Playground as a No Auth provider (closes #10389)

[Abhishek4512009]

Summary

Adds Cloudflare AI Playground as a No Auth provider (per #10389), zero credentials — no account, no API key, no cookies.

The playground serves free chat over a PartySocket WebSocket speaking Cloudflare's internal cf_agent RPC protocol. The WS upgrade is gated on a browser-grade TLS fingerprint (raw Node/curl handshakes get 403), so the executor drives a headless Chromium via Playwright and speaks the protocol from inside the page context, then translates the cf_agent frame stream into OpenAI-format SSE.

Catalog (20 curated chat models, captured live from the playground's getModels RPC on 2026-08-15): GLM 5.2, Kimi K2.7 Code, Kimi K2.6, DeepSeek V4 Pro / V4 Flash, gpt-oss-120B/20B, Llama 3.3 70B, Nemotron 3 120B, Qwen2.5 Coder 32B, QwQ 32B, Gemma 4 26B, Mistral Small 3.1, Granite 4 H, and more. Reasoning flags on the verified thinking models.

Related Issues

• Closes [Feature] Add support for Cloudflare AI playground as a No Auth option #10389

Validation

Change type: provider (new No Auth provider, registry + executor + UI entry).

• Focused unit suite: tests/unit/cloudflare-playground-provider.test.ts — 12 tests, all passing (run with the repo's node --test + tsx harness)
• Real captured traffic as test fixtures: identity/state frames, a decoy setConfig RPC done:true frame (must NOT terminate the chat stream — this is a real protocol trap), and the live 3021 rate-limit error frame mapped to HTTP 429
• npx eslint on all touched files — clean
• npx tsc -p open-sse/tsconfig.json — 0 errors (whole open-sse project)
• Adjacent regression suites: noauth-provider-validation, providers-constants-split, auth-noauth-fallback-loop-3061, noauth-autocombo-allowlist — 23/23 passing
• Reconciled with current release base (release/v3.8.50); focused checks rerun afterward
• Production-code changes include new automated tests in this PR

Tests Added Or Updated

• tests/unit/cloudflare-playground-provider.test.ts (new) — registry/noauth wiring, id+alias executor resolution, CfStreamParser translation against real captured frames (incl. the decoy-RPC-done and rate-limit traps), streaming + non-streaming responses, clean 429/502 error surfaces with no stack-trace leaks, @cf/ model prefixing.

Coverage Notes

• New code: open-sse/executors/cloudflare-playground.ts (executor + pure frame parser, transport injectable for tests), open-sse/config/providers/registry/cloudflare-playground/index.ts, src/shared/constants/providers/noauth.ts (UI entry), executor/registry wiring.
• The Playwright browser transport itself (PlaywrightCfTransport) is covered indirectly: transport-level behavior is validated via the injected fake transport in unit tests; a live browser round-trip was verified manually against the real playground (page passes the fingerprint gate, WS round-trip returns a model answer).
• Live upstream behavior verified 2026-08-15 from a residential IP: full chat round-trips on GLM 4.7 Flash and DeepSeek V4 Flash, model switching via setConfig, rate-limit frame captured verbatim.

Reviewer Notes

• Browser dependency: the playground has no HTTP API — the WS upgrade requires a real browser TLS stack. The executor dynamically imports Playwright and launches headless Chromium (stealth args + desktop UA); CLOUDFLARE_PLAYGROUND_CHROME_PATH can point at a full Chrome binary if Playwright's bundled Chromium is fingerprint-blocked in some environments. First request pays a ~1–2 s browser spin-up.
• Rate limits: upstream enforces per-IP inference limits (error 3021). Non-streaming requests surface these as HTTP 429; streaming requests emit an SSE error chunk before [DONE] (status is already committed).
• Protocol stability: this is a reverse-engineered internal protocol (no official API), same category as the existing felo-web/chipotle/zai-web providers — behavior may change upstream. The protocol spec lives in the executor's header docstring.
• v1 scope: text-only chat; client system messages are dropped (playground persona is server-side via setConfig); tool calls/vision not implemented.

[diegosouzapw]

Thanks for this — really solid piece of work. The protocol reverse-engineering write-up in the executor's docstring is excellent, and the test suite is genuinely strong: building fixtures from real captured traffic (including the setConfig done:true decoy trap and the live 3021 rate-limit frame) is exactly the kind of test that actually proves the parser is correct, not just that it runs. I ran the full test file myself and all 12 tests pass; ESLint is clean on every touched file too.

One thing to fix before merge: scripts/ad-hoc/cfp-shim.ts looks like a local debug/standalone bridge script that got committed alongside the real change. It duplicates the executor's frame-parsing and transport logic (~540 lines) but isn't referenced anywhere else in the repo. Could you drop that file? It doesn't add anything once the real executor exists, and leaving it in means we now have two copies of the same protocol logic that can silently drift apart.

Everything else — registry wiring, the NOAUTH_PROVIDERS entry, error sanitization via makeExecutorErrorResult, the doc/i18n regeneration for the 339→340 provider count — looks correct and consistent with how the other reverse-engineered No-Auth providers (felo-web, chipotle, zai-web, gemini-web) are built. Once the ad-hoc script is removed this should be good to go.