[opensource-elearning]

Summary

Adds toolCalling: "emulated" to the free noauth providers so they stay eligible for tool-calling combos, and replaces the hardcoded auto-combo noauth allowlist with auto-discovery from NOAUTH_PROVIDERS.

Changes

1. Registry entries (open-sse/config/providers/registry/*)

toolCalling: "emulated" added to:

• opencode
• duckduckgo-web
• cloudflare-playground
• uncloseai

2. open-sse/config/providers/shared.ts

New optional field on RegistryEntry, with docs:

toolCalling?: "emulated" | boolean;

Opt-in for providers whose registry/capability rows report toolCalling: false but that serve prompt-emulated tool calling.

3. src/shared/constants/providers/noauth.ts

toolCalling: "emulated" added to opencode, cloudflare-playground and uncloseai. (duckduckgo-web and devin-cli-agentic already carried it on the base branch.)

4. open-sse/services/autoCombo/virtualFactory.ts — auto-discovery

Replaces the hardcoded allowlist:

- const AUTO_COMBO_NOAUTH_ALLOWLIST = new Set<string>(["opencode"]);
+ const EMULATED_TOOL_CALLING_NOAUTH_PROVIDERS = getEmulatedToolCallingNoAuthProviders();

getEmulatedToolCallingNoAuthProviders() scans NOAUTH_PROVIDERS at startup and collects every entry with noAuth: true and toolCalling: "emulated", so there is no hardcoded list to maintain when a provider is added.

Net effect on the fresh-install auto/auto-* noauth pool: {opencode} → {cloudflare-playground, devin-cli-agentic, duckduckgo-web, opencode, uncloseai}. aihorde, auggie, codex-app-server, veoaifree-web and zcode carry no opt-in and stay out.

5. Regression guards updated

tests/unit/noauth-autocombo-allowlist.test.ts and tests/unit/virtual-auto-combo.test.ts pinned the old hardcoded {opencode} allowlist. Both now assert the auto-discovered set — present: cloudflare-playground, devin-cli-agentic, duckduckgo-web, opencode, uncloseai; absent: aihorde, auggie, codex-app-server, veoaifree-web, zcode.

The header of noauth-autocombo-allowlist.test.ts and the docblock above getEmulatedToolCallingNoAuthProviders() keep the operator decision of 2026-07-24 (refs #8183/#6453/#7032) as historical context: duckduckgo-web (429/VQD) and aihorde (401, anon key rejected) were unreliable on the reference egress (VPS .15) and still carry no opt-in, so they stay out. That decision also scoped the pool to the category/tier and flat-variant auto/* pools — auto/<family> selectors still bypass it (bypassAllowlist, refs #6453/#8183).

Adding toolCalling: "emulated" to another NOAUTH_PROVIDERS entry now requires a reviewed diff in both guard files. That is intentional.

Why this matters

Free noauth providers have no native upstream tool calling, so the supportsToolCalling check filtered them out of tool-calling combos (auto/coding, auto/best-coding, …). With toolCalling: "emulated" they stay eligible: the 3rd-party CLI (Claude Code, Codex, Cursor, …) executes the tools while the free provider only emits the call markers.

Scope note

Rebased onto release/v3.8.52 and trimmed to this PR's own 2 commits. Commits belonging to other open PRs were removed and remain in their own PRs: #16323, #16324, #16325, #16326, #16341, #16342, #16346, #16355. The stray pr-body.md (leftover draft belonging to another feature) was dropped from the first commit.

⚠️ base-red inherited: #15306 — the remaining CI failures are inherited, not caused by this PR. Sibling PR #16341 (unrelated change, same base) fails the identical check list. tests/unit/auto-combo-candidates-free-access-reason.test.ts is byte-identical to base here and its fix lives in #16326.

Testing

• npm run typecheck:core — pass
• tests/unit/noauth-autocombo-allowlist.test.ts — 3/3 pass
• tests/unit/virtual-auto-combo.test.ts — 12/12 pass
• tests/unit/capability-filter.test.ts, tests/unit/model-capabilities-registry.test.ts, tests/unit/8488-capability-filter-fail-closed.test.ts — 39/39 pass
• ESLint over the changed files — clean apart from shared.ts:916, which is pre-existing and already listed in config/quality/eslint-suppressions.json