feat: add WorkBuddy agent support

[arbing]

• Register WorkBuddy as the agent type for Tencent Cloud CodeBuddy's office AI agent product.
• Use https://www.codebuddy.cn/work/ as the product reference for the WorkBuddy integration context.
• Parse WorkBuddy JSONL transcripts, including user and assistant messages, tool calls, tool results, token usage, and subagent relationships.
• Discover WorkBuddy project sessions under .workbuddy/projects and wire them into incremental sync and source lookup.
• Expose WorkBuddy in README, CLI environment variable help, settings, and frontend agent metadata.

[roborev-ci]

roborev: Combined Review (3a85067)

Summary verdict: One medium issue found; security review reported no issues.

Medium

• Location: internal/parser/workbuddy.go (ParseWorkBuddySession, case "message":)
• Problem: Token usage is not extracted for standard assistant text responses. applyWorkBuddyUsage is only called for function_call events, so token metrics included in regular assistant message blocks are dropped.
• Fix: Call applyWorkBuddyUsage(&msg, root) for message events when role == RoleAssistant before appending the message.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (fba5b3e)

Summary verdict: One medium issue should be fixed before merge; no high or critical findings were reported.

Medium

• internal/parser/workbuddy.go:361: OpenAI-style rawUsage can provide both prompt_tokens and prompt_tokens_details.cached_tokens. Since cached tokens are already included in prompt_tokens, ContextTokens adds them again, inflating per-message and session totals.
  • Fix: Track the usage shape and either keep ContextTokens as prompt_tokens for OpenAI-style usage, or normalize input_tokens to exclude cached tokens before adding cache fields.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (0f4baf1)

Summary verdict: No Medium, High, or Critical findings to report.

All reported findings are Low severity, and security review found no issues.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (0f4baf1)

Summary verdict: One medium issue remains around WorkBuddy file watching; lower-severity findings omitted.

Medium

• Location: internal/parser/types.go:331
• Problem: WorkBuddy is registered with ShallowWatch: true, but its session files live under nested paths like <projects>/<project>/... and <projects>/<project>/<session>/subagents/.... Watching only the root ~/.workbuddy/projects may miss fsnotify events for nested session files, and because the root is considered watched, it may also bypass the unwatched polling path.
• Fix: Use recursive watching for WorkBuddy, or add a WorkBuddy-specific watcher strategy that watches project/session subdirectories or explicitly polls this root.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (4124e1d)

Medium issues found: WorkBuddy path handling has traversal and project-name misclassification risks.

Medium

• Location: internal/parser/workbuddy.go in FindWorkBuddySourceFile
  Problem: Path traversal risk on Windows. The separator check only uses filepath.Separator, but filepath.Join can also accept /, so a subagentID containing ../ may bypass validation.
  Fix: Explicitly reject both / and \, or preferably validate with IsValidSessionID(subagentID).

• Location: internal/sync/engine.go in SyncSingleSession; internal/parser/workbuddy.go in ParseWorkBuddySession / workBuddyIDs
  Problem: Subagent detection relies on filepath.Base(filepath.Dir(path)) == "subagents" and then climbs parent directories. A normal project named subagents, such as projectsDir/subagents/session.jsonl, can be misclassified as a subagent and assigned the wrong project/parent relationship.
  Fix: Determine subagent status from the validated WorkBuddy layout relative to the configured root, e.g. <project>/<parent-session>/subagents/<child>.jsonl, and extract the project name by fixed depth from the configured agent directory.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (bf02a12)

Clean enough for merge: no Medium, High, or Critical findings were reported.

Only Low-severity findings were raised, so they are omitted per the review rules.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)