feat: add WorkBuddy agent support

[arbing]

• Register WorkBuddy as the agent type for Tencent Cloud CodeBuddy's office AI agent product.
• Use https://www.codebuddy.cn/work/ as the product reference for the WorkBuddy integration context.
• Parse WorkBuddy JSONL transcripts, including user and assistant messages, tool calls, tool results, token usage, and subagent relationships.
• Discover WorkBuddy project sessions under .workbuddy/projects and wire them into incremental sync and source lookup.
• Expose WorkBuddy in README, CLI environment variable help, settings, and frontend agent metadata.

[roborev-ci]

roborev: Combined Review (3a85067)

Summary verdict: One medium issue found; security review reported no issues.

Medium

• Location: internal/parser/workbuddy.go (ParseWorkBuddySession, case "message":)
• Problem: Token usage is not extracted for standard assistant text responses. applyWorkBuddyUsage is only called for function_call events, so token metrics included in regular assistant message blocks are dropped.
• Fix: Call applyWorkBuddyUsage(&msg, root) for message events when role == RoleAssistant before appending the message.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (fba5b3e)

Summary verdict: One medium issue should be fixed before merge; no high or critical findings were reported.

Medium

• internal/parser/workbuddy.go:361: OpenAI-style rawUsage can provide both prompt_tokens and prompt_tokens_details.cached_tokens. Since cached tokens are already included in prompt_tokens, ContextTokens adds them again, inflating per-message and session totals.
  • Fix: Track the usage shape and either keep ContextTokens as prompt_tokens for OpenAI-style usage, or normalize input_tokens to exclude cached tokens before adding cache fields.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (0f4baf1)

Summary verdict: No Medium, High, or Critical findings to report.

All reported findings are Low severity, and security review found no issues.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (0f4baf1)

Summary verdict: One medium issue remains around WorkBuddy file watching; lower-severity findings omitted.

Medium

• Location: internal/parser/types.go:331
• Problem: WorkBuddy is registered with ShallowWatch: true, but its session files live under nested paths like <projects>/<project>/... and <projects>/<project>/<session>/subagents/.... Watching only the root ~/.workbuddy/projects may miss fsnotify events for nested session files, and because the root is considered watched, it may also bypass the unwatched polling path.
• Fix: Use recursive watching for WorkBuddy, or add a WorkBuddy-specific watcher strategy that watches project/session subdirectories or explicitly polls this root.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (4124e1d)

Medium issues found: WorkBuddy path handling has traversal and project-name misclassification risks.

Medium

• Location: internal/parser/workbuddy.go in FindWorkBuddySourceFile
  Problem: Path traversal risk on Windows. The separator check only uses filepath.Separator, but filepath.Join can also accept /, so a subagentID containing ../ may bypass validation.
  Fix: Explicitly reject both / and \, or preferably validate with IsValidSessionID(subagentID).

• Location: internal/sync/engine.go in SyncSingleSession; internal/parser/workbuddy.go in ParseWorkBuddySession / workBuddyIDs
  Problem: Subagent detection relies on filepath.Base(filepath.Dir(path)) == "subagents" and then climbs parent directories. A normal project named subagents, such as projectsDir/subagents/session.jsonl, can be misclassified as a subagent and assigned the wrong project/parent relationship.
  Fix: Determine subagent status from the validated WorkBuddy layout relative to the configured root, e.g. <project>/<parent-session>/subagents/<child>.jsonl, and extract the project name by fixed depth from the configured agent directory.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (bf02a12)

Clean enough for merge: no Medium, High, or Critical findings were reported.

Only Low-severity findings were raised, so they are omitted per the review rules.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (67827b7)

No Medium, High, or Critical findings reported.

All review agents found the code clean.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (67827b7)

No medium-or-higher findings reported; the reviewed changes look clean.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (86a80b6)

High: One blocking issue found; security review reported clean.

High

• internal/sync/workbuddy_test.go:9, .golangci.nilaway.yml:14
  The new test and NilAway config use go.kenn.io/agentsview, but the repository module and existing imports still use github.com/wesm/agentsview. This can make the new test fail to compile due to the wrong internal/parser import path, and NilAway may stop matching the local module.

  Fix: Keep these paths on github.com/wesm/agentsview, or migrate go.mod and all repository imports to go.kenn.io/agentsview in the same change.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (62f69ad)

Adds WorkBuddy support, but there are High/Medium issues that should be fixed before merge.

High

• internal/sync/workbuddy_test.go:9
  The new test imports go.kenn.io/agentsview/internal/parser, but the repository module path is currently github.com/wesm/agentsview, so go test will fail for this package.
  Fix: Change the import to github.com/wesm/agentsview/internal/parser unless the module is being renamed consistently.

Medium

• .golangci.nilaway.yml:14
include-pkgs was changed to go.kenn.io/agentsview, which no longer matches go.mod, so NilAway will stop analyzing this project.
  Fix: Keep include-pkgs aligned with the module path, currently github.com/wesm/agentsview.

• internal/parser/workbuddy.go:304
  Object-shaped WorkBuddy tool results like {"type":"text","text":"/tmp/proj"} are stored raw, but DecodeContent does not decode generic object text fields, so paired tool calls may show empty result content.
  Fix: Normalize WorkBuddy object outputs to quoted text, or extend result decoding to handle this WorkBuddy object shape.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (e851236)

Verdict: No Medium, High, or Critical issues found.

All review agents reported the code is clean.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (e851236)

Clean review: no Medium, High, or Critical issues were reported by any agent.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)