fix(tests): drain two base-reds on release/v3.8.50 — auto/glm family pool and the ESLint gate (#10726)

* fix(tests): drain the auto/glm base-red left by the Cloudflare Playground backend

provider-family-combos asserted a fixed provider list for auto/glm and started
failing on release/v3.8.50 once the Cloudflare AI Playground no-auth backend
landed: its registry advertises zai-org/glm-5.2 and zai-org/glm-4.7-flash, so the
virtual combo legitimately spans it.

The test already documents the rule it is failing on — a no-auth backend that
genuinely serves a family model IS a member of the family pool — and carries that
justification for auggie, devin-cli-agentic and zcode. Add cloudflare-playground
to the expectation with the same kind of source-cited note.

* fix(tests): green the ESLint gate left red by two untracked any casts

lint:json --max-warnings 0 failed on release/v3.8.50 because the suppression
counts drifted behind the tree: cli-oauth-commands carried 20 no-explicit-any
violations against a registered 18 (#10491 added two Commander-mock casts) and
executor-gitlab carried 5 against a registered 4 (#10499 added one).

The GitLab test casts are fixable, so they are fixed rather than suppressed: all
five now read the translated payload through a declared GitLabResponseBody
instead of any, and the file leaves the suppression list entirely.

The CLI OAuth casts target bin/cli/commands/oauth.mjs, which ships no types, so
the Commander mock has nothing to cast to; that entry only gets its count
corrected to the 20 already in the tree.

changelog.d/maintenance/release-v3850-basereds-glm-family-20260819.md

@@ -0,0 +1 @@
+- **fix(tests):** drain two base-reds on the release branch — `auto/glm` now expects the Cloudflare AI Playground backend (its registry advertises `zai-org/glm-5.2` and `zai-org/glm-4.7-flash`, so it belongs in the family pool by the same rule already documented for `auggie`, `devin-cli-agentic` and `zcode`), and the ESLint gate is green again after the GitLab executor test dropped its five `as any` casts for a declared response shape and the CLI OAuth suppression count caught up with the two casts #10491 added.

config/quality/eslint-suppressions.json

@@ -1898,7 +1898,7 @@
   },
   "tests/unit/cli-oauth-commands.test.ts": {
     "@typescript-eslint/no-explicit-any": {
-      "count": 18
+      "count": 20
     }
   },
   "tests/unit/cli-oneproxy-commands.test.ts": {
@@ -2396,11 +2396,6 @@
       "count": 7
     }
   },
-  "tests/unit/executor-gitlab.test.ts": {
-    "@typescript-eslint/no-explicit-any": {
-      "count": 4
-    }
-  },
   "tests/unit/executor-nlpcloud.test.ts": {
     "@typescript-eslint/no-explicit-any": {
       "count": 2

tests/unit/autoCombo/provider-family-combos.test.ts

@@ -144,7 +144,17 @@ describe("auto/<family> materialization (#6453)", () => {
     // `zcode` joined for the same documented reason too — #10184 added the local
     // ZCode app-server backend whose registry (registry/zcode) advertises the
     // full GLM_SHARED_MODELS line-up, so it genuinely serves the family.
-    assert.deepEqual(providerIds, ["auggie", "devin-cli-agentic", "glm", "zai", "zcode"]);
+    // `cloudflare-playground` joined on the same rule — its registry
+    // (open-sse/config/providers/registry/cloudflare-playground/index.ts) advertises
+    // zai-org/glm-5.2 and zai-org/glm-4.7-flash, so it genuinely serves the family.
+    assert.deepEqual(providerIds, [
+      "auggie",
+      "cloudflare-playground",
+      "devin-cli-agentic",
+      "glm",
+      "zai",
+      "zcode",
+    ]);
     // Every candidate must be a glm-family model (the Cartesian pool now surfaces
     // each backend's full glm line-up, not only the glm-5.2 default), and the
     // connected openai/gpt-4o-mini backend must be excluded — same family

tests/unit/executor-gitlab.test.ts

@@ -4,6 +4,14 @@ import assert from "node:assert/strict";
 import { GitlabExecutor } from "../../open-sse/executors/gitlab.ts";
 import { getExecutor, hasSpecializedExecutor } from "../../open-sse/executors/index.ts";
 
+/** Shape the GitLab executor tests read back off the translated response. */
+type GitLabResponseBody = {
+  object?: string;
+  model?: string;
+  choices?: { message: { role: string; content: string } }[];
+  error?: { message: string };
+};
+
 function jsonResponse(body: unknown, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
@@ -72,7 +80,7 @@ test("GitlabExecutor posts PAT-backed code suggestion requests to the configured
     assert.match(String(calls[0].body.user_instruction), /Write a hello world function/);
     assert.match(String(calls[0].body.current_file.content_above_cursor), /System instructions:/);
 
-    const body = (await result.response.json()) as any;
+    const body = (await result.response.json()) as GitLabResponseBody;
     assert.equal(body.object, "chat.completion");
     assert.equal(body.choices[0].message.role, "assistant");
     assert.match(body.choices[0].message.content, /hello/);
@@ -131,7 +139,7 @@ test("GitlabExecutor maps upstream auth failures to OpenAI-style errors", async
     });
 
     assert.equal(result.response.status, 403);
-    const body = (await result.response.json()) as any;
+    const body = (await result.response.json()) as GitLabResponseBody;
     assert.match(body.error.message, /auth failed/i);
   } finally {
     globalThis.fetch = originalFetch;
@@ -206,7 +214,7 @@ test("GitlabExecutor uses GitLab direct_access for gitlab-duo and persists the c
       "direct-token"
     );
 
-    const body = (await result.response.json()) as any;
+    const body = (await result.response.json()) as GitLabResponseBody;
     assert.equal(body.model, "GitLab Duo Claude Sonnet");
     assert.match(body.choices[0].message.content, /gitlab duo/i);
   } finally {
@@ -254,7 +262,7 @@ test("GitlabExecutor falls back to the public Code Suggestions endpoint when dir
       "https://gitlab.example.com/api/v4/code_suggestions/completions",
     ]);
 
-    const body = (await result.response.json()) as any;
+    const body = (await result.response.json()) as GitLabResponseBody;
     assert.equal(body.model, "code-gecko");
     assert.match(body.choices[0].message.content, /fallback path/i);
   } finally {
@@ -305,7 +313,7 @@ test("GitlabExecutor falls back to the public Code Suggestions endpoint when dir
       "https://gitlab.example.com/api/v4/code_suggestions/completions",
     ]);
 
-    const body = (await result.response.json()) as any;
+    const body = (await result.response.json()) as GitLabResponseBody;
     assert.equal(body.model, "code-gecko");
     assert.match(body.choices[0].message.content, /monolith fallback works/i);
   } finally {