nolo-cli 0.149.0-alpha.1 → 0.151.0-alpha.3

package/{authCommand-UBJ4EWYZ.js → authCommand-QYN47CQD.js}

@@ -3,7 +3,7 @@ import {
   parseFlagWithOptionalValue,
   runCloudflareOAuthLogin,
   upsertEnvVariable
-} from "./chunk-X2QRZXZH.js";
+} from "./chunk-TYJ5XFEA.js";
 import {
   ANTHROPIC_OAUTH_AUTHORIZE_URL,
   ANTHROPIC_OAUTH_CALLBACK_PORT,
@@ -19,6 +19,11 @@ import {
   CURSOR_POLL_MAX_CONSECUTIVE_ERRORS,
   CURSOR_POLL_MAX_DELAY_MS,
   CURSOR_POLL_URL,
+  WORKBUDDY_APP_VERSION,
+  WORKBUDDY_POLL_INTERVAL_MS,
+  WORKBUDDY_REQUEST_TIMEOUT_MS,
+  WORKBUDDY_SIGN_IN_TIMEOUT_MS,
+  WORKBUDDY_UA_VERSION,
   XAI_ACCESS_TOKEN_CLIENT_SKEW_MS,
   XAI_DEVICE_CODE_DEFAULT_EXPIRES_MS,
   XAI_DEVICE_CODE_DEFAULT_INTERVAL_MS,
@@ -34,7 +39,9 @@ import {
   XAI_TOKEN_REQUEST_TIMEOUT_MS,
   decodeJwtExp,
   generatePkcePair,
+  getWorkBuddySite,
   normalizeAnthropicTokenPayload,
+  normalizeWorkBuddyTokenPayload,
   readJsonBody,
   refreshAntigravityOAuthToken,
   renderDeviceCodeDisplay,
@@ -42,66 +49,74 @@ import {
   runAntigravityOAuthLogin,
   runOpenAiCodexBrowserPkce,
   runOpenAiCodexDeviceCode,
+  sanitizeWorkBuddyDomain,
+  sanitizeWorkBuddyError,
   startCallbackServer,
   validateXAIEndpoint,
   xaiOAuthDiscovery
-} from "./chunk-I4OPU5TK.js";
+} from "./chunk-XS47QOFV.js";
+import {
+  t
+} from "./chunk-SW4S4XYB.js";
 import {
   defaultOpenBrowser
-} from "./chunk-IVZJWTDI.js";
-import "./chunk-ESHYE7WU.js";
+} from "./chunk-36OMEXXR.js";
+import "./chunk-TY3TIUJK.js";
+import "./chunk-S73EPYNC.js";
+import "./chunk-ZEZC7IIM.js";
 import {
   extractGoogleValidationLink
 } from "./chunk-BMQ2MJUK.js";
-import "./chunk-ZOVKKMF6.js";
-import "./chunk-GLKOYSRU.js";
-import "./chunk-JBTJAPUF.js";
+import "./chunk-OW765XBU.js";
 import {
   buildDevinAuthUrl,
   buildDevinOAuthCredential,
   detectLocalDevinCredentials,
   extractDevinToken,
   fetchAntigravityCloudCodeCompletion
-} from "./chunk-P6GMCCAT.js";
-import "./chunk-GMZLP5DV.js";
+} from "./chunk-GQV5KHJU.js";
+import "./chunk-HNUWUO75.js";
 import "./chunk-5ZUL4CUO.js";
-import "./chunk-S5XGT6GB.js";
-import "./chunk-27ONFIEY.js";
-import "./chunk-7KVZ5LDQ.js";
-import {
-  toErrorMessage
-} from "./chunk-HNMXYYJR.js";
-import "./chunk-3BXNTXYI.js";
-import "./chunk-W7XHHYWM.js";
-import {
-  createOAuthTokenStore,
-  resolveFreshAccessToken
-} from "./chunk-ZWQUWF6W.js";
-import {
-  parseUserIdFromAuthToken
-} from "./chunk-A7GB5UGH.js";
-import "./chunk-OLZBQWZU.js";
-import {
-  getProfileOAuthSync,
-  saveProfileOAuthSync
-} from "./chunk-TNIX77YM.js";
-import "./chunk-Y3PMXGLH.js";
-import "./chunk-3AH7LNUB.js";
+import "./chunk-5EMSBTQ6.js";
+import "./chunk-I42VC5KR.js";
+import "./chunk-U6VC4MU4.js";
+import "./chunk-XZNCX52W.js";
 import {
   asOptionalFiniteNumber
 } from "./chunk-WWC7I6TA.js";
-import "./chunk-QSJ3HFEF.js";
+import "./chunk-K2AER7RX.js";
+import "./chunk-UBUH2TCC.js";
+import "./chunk-I4SN4NUQ.js";
+import "./chunk-5BHQICF2.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
-import "./chunk-U6VC4MU4.js";
+import {
+  toErrorMessage
+} from "./chunk-HNMXYYJR.js";
+import "./chunk-FY4SDK2E.js";
+import "./chunk-GLKOYSRU.js";
+import {
+  parseUserIdFromAuthToken
+} from "./chunk-A7GB5UGH.js";
+import "./chunk-OLZBQWZU.js";
 import "./chunk-LCBAMY2M.js";
 import "./chunk-4SN6J65J.js";
 import "./chunk-CF7PE763.js";
 import "./chunk-G3SUCT4W.js";
+import {
+  getProfileOAuthSync,
+  saveProfileOAuthSync
+} from "./chunk-TNIX77YM.js";
+import "./chunk-CHCS6XPJ.js";
+import "./chunk-QSJ3HFEF.js";
+import {
+  createOAuthTokenStore,
+  resolveFreshAccessToken
+} from "./chunk-ZWQUWF6W.js";
 import "./chunk-4VNS5WPM.js";
 
 // packages/cli/oauth/flows/xai.ts
@@ -710,6 +725,219 @@ async function runDevinOAuthLogin(deps = {}) {
   return buildDevinOAuthCredential(token);
 }
 
+// packages/cli/oauth/flows/workbuddy.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+function validateWorkBuddyAuthUrl(site, authUrlString) {
+  let url;
+  try {
+    url = new URL(authUrlString);
+  } catch {
+    throw new Error(`Invalid WorkBuddy auth URL: "${authUrlString}"`);
+  }
+  if (url.protocol !== "https:") {
+    throw new Error(`WorkBuddy sign-in page must use https:, got ${url.protocol}`);
+  }
+  const hostname = url.hostname.toLowerCase();
+  if (site === "workbuddy") {
+    const isAllowed = hostname === "copilot.tencent.com" || hostname.endsWith(".tencent.com");
+    if (!isAllowed) {
+      throw new Error(`Untrusted authorization host for WorkBuddy: ${hostname}`);
+    }
+  } else if (site === "workbuddy-ai") {
+    const isAllowed = hostname === "www.workbuddy.ai" || hostname === "workbuddy.ai" || hostname.endsWith(".workbuddy.ai");
+    if (!isAllowed) {
+      throw new Error(`Untrusted authorization host for WorkBuddy AI: ${hostname}`);
+    }
+  }
+  return url;
+}
+async function callWorkBuddyApi(siteConfig, method, path, headers, body, fetchImpl) {
+  let response;
+  try {
+    response = await fetchImpl(`${siteConfig.endpoint}${path}`, {
+      method,
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "User-Agent": `WorkBuddy/${WORKBUDDY_UA_VERSION}`,
+        ...headers
+      },
+      body: body === void 0 ? void 0 : JSON.stringify(body),
+      signal: AbortSignal.timeout(WORKBUDDY_REQUEST_TIMEOUT_MS)
+    });
+  } catch (error) {
+    throw new Error(
+      sanitizeWorkBuddyError(`${siteConfig.name} API request failed: ${toErrorMessage(error)}`)
+    );
+  }
+  let text = "";
+  try {
+    text = await response.text();
+  } catch {
+  }
+  let env = {};
+  try {
+    env = JSON.parse(text);
+  } catch {
+  }
+  const code = typeof env.code === "number" ? env.code : Number.parseInt(String(env.code ?? ""), 10) || 0;
+  if (!response.ok) {
+    const why = String(env.msg || env.message || text.slice(0, 200) || response.statusText);
+    const err = new Error(
+      sanitizeWorkBuddyError(
+        `${siteConfig.name}: ${why} (HTTP ${response.status}${code ? `, code ${code}` : ""})`
+      )
+    );
+    err.code = code;
+    err.status = response.status;
+    throw err;
+  }
+  if (code !== 0) {
+    const why = String(env.msg || env.message || "error");
+    const err = new Error(
+      sanitizeWorkBuddyError(`${siteConfig.name}: ${why} (${code})`)
+    );
+    err.code = code;
+    err.status = response.status;
+    throw err;
+  }
+  return env.data;
+}
+async function pollWorkBuddyEndpoint(siteConfig, path, headers, retryCodes, deadline, fetchImpl, sleepFn, nowFn) {
+  while (true) {
+    if (nowFn() > deadline) {
+      throw new Error(`${siteConfig.name} sign-in timed out. Please try again.`);
+    }
+    try {
+      const data = await callWorkBuddyApi(siteConfig, "GET", path, headers, void 0, fetchImpl);
+      if (data && typeof data === "object" && Object.keys(data).length > 0) {
+        return data;
+      }
+    } catch (rawError) {
+      const err = rawError;
+      const isRetryable = typeof err.code === "number" && retryCodes.includes(err.code) || err.status === 408 || err.status === 429;
+      if (!isRetryable) {
+        throw rawError;
+      }
+    }
+    await sleepFn(WORKBUDDY_POLL_INTERVAL_MS);
+  }
+}
+async function resolveEnterpriseId(siteConfig, accessToken, domain, who, fetchImpl) {
+  const own = typeof who.enterpriseId === "string" ? who.enterpriseId.trim() : "";
+  if (own) return own;
+  const type = String(who.type ?? "").trim().toLowerCase();
+  if (!type || type === "personal") return "";
+  try {
+    const list = await callWorkBuddyApi(
+      siteConfig,
+      "GET",
+      "/v2/plugin/accounts",
+      {
+        Authorization: `Bearer ${accessToken}`,
+        "X-Domain": domain
+      },
+      void 0,
+      fetchImpl
+    );
+    const mine = (list?.accounts ?? []).filter(
+      (x) => x?.uid === who.uid && typeof x?.enterpriseId === "string" && x.enterpriseId.trim()
+    );
+    const same = mine.filter((x) => String(x.type ?? "").trim().toLowerCase() === type);
+    const last = mine.filter((x) => x.lastLogin);
+    const pick = same.length === 1 ? same[0] : last.length === 1 ? last[0] : mine.length === 1 ? mine[0] : void 0;
+    return pick && typeof pick.enterpriseId === "string" ? pick.enterpriseId.trim() : "";
+  } catch {
+    return "";
+  }
+}
+async function runWorkBuddyOAuthLogin(site, deps = {}) {
+  const siteConfig = getWorkBuddySite(site);
+  const output = deps.output ?? console;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleepFn = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const nowFn = deps.now ?? (() => Date.now());
+  const stateData = await callWorkBuddyApi(
+    siteConfig,
+    "POST",
+    `/v2/plugin/auth/state?platform=${encodeURIComponent(siteConfig.platform)}`,
+    {
+      "X-No-Authorization": "true",
+      "X-No-User-Id": "true",
+      "X-No-Enterprise-Id": "true",
+      "X-No-Department-Info": "true"
+    },
+    {},
+    fetchImpl
+  );
+  if (!stateData?.state || !stateData?.authUrl) {
+    throw new Error(`${siteConfig.name} gave no sign-in page`);
+  }
+  const validatedUrl = validateWorkBuddyAuthUrl(site, stateData.authUrl);
+  validatedUrl.searchParams.set("version", WORKBUDDY_APP_VERSION);
+  validatedUrl.searchParams.set("loginSessionId", randomBytes2(16).toString("hex"));
+  const finalAuthUrl = validatedUrl.toString();
+  output.log(
+    `
+Open this URL in your browser to authorize ${siteConfig.name}:
+${finalAuthUrl}
+
+Waiting for browser authentication...`
+  );
+  if (deps.openBrowser) {
+    try {
+      await deps.openBrowser(finalAuthUrl);
+    } catch {
+    }
+  }
+  const deadline = nowFn() + WORKBUDDY_SIGN_IN_TIMEOUT_MS;
+  const qState = encodeURIComponent(stateData.state);
+  const token = await pollWorkBuddyEndpoint(
+    siteConfig,
+    `/v2/plugin/auth/token?state=${qState}`,
+    {},
+    [11217],
+    deadline,
+    fetchImpl,
+    sleepFn,
+    nowFn
+  );
+  if (typeof token?.accessToken !== "string" || !token.accessToken.trim()) {
+    throw new Error(`${siteConfig.name} sent back no token`);
+  }
+  const defaultHost = new URL(siteConfig.endpoint).host;
+  const tokenDomain = sanitizeWorkBuddyDomain(token.domain, defaultHost);
+  const who = await pollWorkBuddyEndpoint(
+    siteConfig,
+    `/v2/plugin/login/account?state=${qState}`,
+    {
+      Authorization: `Bearer ${token.accessToken}`,
+      "X-Domain": tokenDomain,
+      "X-No-User-Id": "true",
+      "X-No-Enterprise-Id": "true"
+    },
+    [12151],
+    deadline,
+    fetchImpl,
+    sleepFn,
+    nowFn
+  );
+  const enterpriseId = await resolveEnterpriseId(
+    siteConfig,
+    token.accessToken,
+    tokenDomain,
+    who,
+    fetchImpl
+  );
+  const now = nowFn();
+  return normalizeWorkBuddyTokenPayload(site, {
+    ...token,
+    uid: who.uid,
+    nickname: who.nickname || who.phoneNumber,
+    enterpriseId: enterpriseId || who.enterpriseId
+  }, void 0, now);
+}
+
 // packages/cli/oauth/authCommand.ts
 var SYNC_HELP_LINE = `  --sync-to-server     After local save, push the credential to your nolo server and remember this choice.
   --no-sync-to-server  Skip server sync and remember this choice (keeps credentials local only).
@@ -890,6 +1118,42 @@ Options:
 ${SYNC_HELP_LINE}
   --help, -h           Show this help and exit.
 `;
+var WORKBUDDY_HELP_TEXT = `Authorize nolo-cli to call WorkBuddy (China) models via your WorkBuddy account.
+
+This authorizes model API access only. It does NOT log you into the Nolo
+platform. To manage agents, docs, spaces, and other Nolo resources, run
+"nolo login" first.
+
+Usage: nolo auth workbuddy [--browser] [--no-browser] [--sync-to-server] [--help]
+
+The flow opens https://copilot.tencent.com in your browser and polls the login status.
+After approval, tokens are stored in $NOLO_HOME/credentials/workbuddy.json (or ~/.nolo/credentials/workbuddy.json when NOLO_HOME is unset).
+Agents can reference the stored token with apiKeyRef: "workbuddy".
+
+Options:
+  --browser         Open the login URL in your browser automatically (default).
+  --no-browser      Print the login URL without opening a browser.
+${SYNC_HELP_LINE}
+  --help, -h        Show this help and exit.
+`;
+var WORKBUDDY_AI_HELP_TEXT = `Authorize nolo-cli to call WorkBuddy AI (International) models via your WorkBuddy AI account.
+
+This authorizes model API access only. It does NOT log you into the Nolo
+platform. To manage agents, docs, spaces, and other Nolo resources, run
+"nolo login" first.
+
+Usage: nolo auth workbuddy-ai [--browser] [--no-browser] [--sync-to-server] [--help]
+
+The flow opens https://www.workbuddy.ai in your browser and polls the login status.
+After approval, tokens are stored in $NOLO_HOME/credentials/workbuddy-ai.json (or ~/.nolo/credentials/workbuddy-ai.json when NOLO_HOME is unset).
+Agents can reference the stored token with apiKeyRef: "workbuddy-ai".
+
+Options:
+  --browser         Open the login URL in your browser automatically (default).
+  --no-browser      Print the login URL without opening a browser.
+${SYNC_HELP_LINE}
+  --help, -h        Show this help and exit.
+`;
 var HELP_BY_PROVIDER = {
   chatgpt: CHATGPT_HELP_TEXT,
   xai: XAI_HELP_TEXT,
@@ -897,7 +1161,9 @@ var HELP_BY_PROVIDER = {
   claude: CLAUDE_HELP_TEXT,
   cloudflare: CLOUDFLARE_HELP_TEXT,
   cursor: CURSOR_HELP_TEXT,
-  devin: DEVIN_HELP_TEXT
+  devin: DEVIN_HELP_TEXT,
+  workbuddy: WORKBUDDY_HELP_TEXT,
+  "workbuddy-ai": WORKBUDDY_AI_HELP_TEXT
 };
 function markCredentialServerManaged(provider, credential, syncConfig, deps) {
   const output = deps.output ?? console;
@@ -918,12 +1184,12 @@ function markCredentialServerManaged(provider, credential, syncConfig, deps) {
       }
     });
     output.log(
-      `[nolo] \u672C\u5730\u4E0D\u518D\u4FDD\u5B58 refresh token\uFF1A${provider} \u7531 ${syncConfig.serverOrigin} \u7EDF\u4E00\u5237\u65B0\uFF08\u7528\u5B8C\u5373\u53D6\uFF09\u3002`
+      t("auth.localRefreshTokenDropped", provider, syncConfig.serverOrigin)
     );
     return true;
   } catch (err) {
     output.log(
-      `[nolo] Warning: \u672C\u5730\u51ED\u636E\u72B6\u6001\u66F4\u65B0\u5931\u8D25\uFF08${toErrorMessage(err)}\uFF09\u3002`
+      t("auth.localStateUpdateFailed", toErrorMessage(err))
     );
     return false;
   }
@@ -934,7 +1200,7 @@ async function syncCredentialToServer(provider, credential, deps) {
   const syncConfig = (deps.resolveServerSyncConfig ?? resolveServerSyncConfig)();
   if (!syncConfig) {
     output.log(
-      `[nolo] Warning: server sync requires NOLO_SERVER and AUTH_TOKEN env vars, or a configured profile. Skipping server sync.`
+      t("auth.syncMissingConfig")
     );
     return "sync_failed";
   }
@@ -961,8 +1227,8 @@ async function syncCredentialToServer(provider, credential, deps) {
     if (res.ok) {
       const marked = markCredentialServerManaged(provider, credential, syncConfig, deps);
       if (marked) {
-        output.log(`[nolo] Synced to ${serverOrigin}`);
-        output.log(`[nolo] \u7F51\u9875\u7AEF\u73B0\u5728\u53EF\u4EE5\u4F7F\u7528\u8BE5\u8BA2\u9605\u4E86\u3002`);
+        output.log(t("auth.syncedTo", serverOrigin));
+        output.log(t("auth.syncDoneWebUsable"));
         return "ok";
       }
       return "mark_failed";
@@ -974,13 +1240,13 @@ async function syncCredentialToServer(provider, credential, deps) {
       } catch {
       }
       output.log(
-        `[nolo] Warning: server sync failed (${res.status}${errorDetail ? `: ${errorDetail}` : ""}). Token saved locally.`
+        t("auth.syncFailed", `${res.status}${errorDetail ? `: ${errorDetail}` : ""}`)
       );
       return "sync_failed";
     }
   } catch (err) {
     output.log(
-      `[nolo] Warning: server sync failed (${err?.message ?? "network error"}). Token saved locally.`
+      t("auth.syncFailed", err?.message ?? "network error")
     );
     return "sync_failed";
   }
@@ -1008,14 +1274,17 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
     const credential = tokenStore.read(provider);
     if (!credential) {
       error.error(
-        `[nolo] No local ${provider} credential. Run: nolo auth ${provider}`
+        t("auth.noLocalCredential", provider)
       );
       return 1;
     }
     if (credential.serverManaged) {
       error.error(
-        `[nolo] ${provider} \u51ED\u636E\u5DF2\u7531 ${credential.serverManaged.origin} \u670D\u52A1\u7AEF\u6258\u7BA1\uFF08\u672C\u5730\u65E0 refreshToken\uFF09\u3002
-\u5982\u9700\u91CD\u65B0\u540C\u6B65\uFF0C\u8BF7\u8FD0\u884C: nolo auth ${provider} --sync-to-server`
+        t(
+          "auth.credentialServerManaged",
+          provider,
+          credential.serverManaged.origin
+        )
       );
       return 1;
     }
@@ -1024,18 +1293,16 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
   }
   if (verify) {
     if (provider !== "antigravity") {
-      error.error(`[nolo] --verify is only supported for "nolo auth antigravity".`);
+      error.error(t("auth.verifyUnsupported"));
       return 1;
     }
     const credential = tokenStore.read(provider);
     if (!credential?.accessToken) {
-      error.error(
-        `[nolo] No local antigravity credential. Run: nolo auth antigravity`
-      );
+      error.error(t("auth.noLocalCredential", provider));
       return 1;
     }
     output.log(
-      `[nolo] Checking the current verification challenge (one lightweight request)...`
+      t("auth.checkingVerificationChallenge")
     );
     let accessToken = null;
     let refreshError;
@@ -1051,7 +1318,7 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
         refreshError
       )) {
         error.error(
-          `[nolo] The antigravity refresh token is no longer valid (${refreshError}). Re-run \`nolo auth antigravity\` to re-authorize this account.`
+          t("auth.refreshTokenInvalid", refreshError)
         );
         return 1;
       }
@@ -1069,18 +1336,18 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
       const msg = toErrorMessage(err);
       if (/projectId|metadata\.projectId|Re-run `nolo auth/i.test(msg)) {
         error.error(
-          `[nolo] The stored antigravity credential is incomplete (${msg}). Re-run \`nolo auth antigravity\` to re-authorize.`
+          t("auth.credentialIncomplete", msg)
         );
       } else {
         error.error(
-          `[nolo] Could not reach the antigravity provider: ${msg}. Check your network and retry.`
+          t("auth.providerUnreachable", msg)
         );
       }
       return 1;
     }
     if (result.status >= 200 && result.status < 300) {
       output.log(
-        `[nolo] \u2713 The credential is working \u2014 no verification is required right now. You can retry your agent.`
+        t("auth.credentialWorking")
       );
       return 0;
     }
@@ -1089,18 +1356,24 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
     );
     if (result.status === 403 && validationUrl) {
       output.log(
-        `[nolo] Google requires a one-time account verification for ${credential.accountId ?? "this account"}.`
+        t("auth.googleVerificationRequired", credential.accountId ?? "this account")
       );
       output.log(`[nolo]   ${validationUrl}`);
       const opener = noBrowser ? void 0 : deps.openBrowser ?? defaultOpenBrowser;
       const opened = opener ? await opener(validationUrl) : false;
       output.log(
-        opened ? `[nolo] \u2713 Opened it in your browser \u2014 complete the verification there (sign in with the same Google account), then retry your agent.` : `[nolo] Copy the URL above into a browser signed into ${credential.accountId ?? "that account"}, complete the verification, then retry your agent.`
+        opened ? t("auth.verificationOpened") : t("auth.verificationCopyUrl", credential.accountId ?? "that account")
       );
       return 0;
     }
+    const refreshSuffix = refreshError ? t("auth.httpWithoutVerificationLink.refreshSuffix", refreshError) : "";
     error.error(
-      `[nolo] The provider returned HTTP ${result.status} without a verification link \u2014 this is not the one-time-verification case --verify handles.` + (refreshError ? ` (token refresh also failed earlier: ${refreshError})` : "") + ` Response detail: ${JSON.stringify(result.body ?? {}).slice(0, 400)}`
+      t(
+        "auth.httpWithoutVerificationLink",
+        String(result.status),
+        refreshSuffix,
+        JSON.stringify(result.body ?? {}).slice(0, 400)
+      )
     );
     return 1;
   }
@@ -1131,6 +1404,8 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
       credential = await runCursorOAuthLogin(flowDeps);
     } else if (provider === "devin") {
       credential = await runDevinOAuthLogin(flowDeps);
+    } else if (provider === "workbuddy" || provider === "workbuddy-ai") {
+      credential = await runWorkBuddyOAuthLogin(provider, flowDeps);
     } else if (provider === "cloudflare") {
       credential = await runCloudflareOAuthLogin({
         ...flowDeps,
@@ -1147,10 +1422,12 @@ async function runAuthProviderCommand(provider, args, _ctx, deps = {}) {
           fetchImpl: deps.fetchImpl ?? fetch
         });
         output.log(
-          `[nolo] Generated Cloudflare API token for zone ${zoneName} (${zoneId}).
-Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
-  ${token}
-`
+          t(
+            "auth.cloudflareTokenGenerated",
+            zoneName,
+            zoneId,
+            token
+          )
         );
         if (writeToEnvPath) {
           upsertEnvVariable(
@@ -1159,7 +1436,7 @@ Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
             token
           );
           output.log(
-            `[nolo] Updated ${writeToEnvPath} with CLOUDFLARE_EMAIL_ROUTING_API_TOKEN.`
+            t("auth.envUpdated", writeToEnvPath)
           );
         }
       }
@@ -1169,7 +1446,11 @@ Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
     tokenStore.write(provider, credential);
     const accountLabel = credential.metadata?.email ?? credential.accountId ?? "";
     output.log(
-      `[nolo] ${provider} authorization saved` + (accountLabel ? ` for ${accountLabel}` : "") + `.`
+      t(
+        "auth.authorizationSaved",
+        provider,
+        accountLabel ? t("auth.authorizationSavedForAccount", accountLabel) : ""
+      )
     );
     const hasExplicitNoSync = args.includes("--no-sync-to-server");
     const hasExplicitSync = args.includes("--sync-to-server");
@@ -1179,7 +1460,17 @@ Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
       saveProfileOAuthSync(p, s);
     });
     let shouldSync = false;
-    if (hasExplicitNoSync || envAutoSync === "0") {
+    if (provider === "workbuddy" || provider === "workbuddy-ai") {
+      if (hasExplicitSync) {
+        setOAuthSync(provider, true);
+        shouldSync = true;
+      } else {
+        if (hasExplicitNoSync) {
+          setOAuthSync(provider, false);
+        }
+        shouldSync = false;
+      }
+    } else if (hasExplicitNoSync || envAutoSync === "0") {
       if (hasExplicitNoSync) {
         setOAuthSync(provider, false);
       }
@@ -1198,12 +1489,16 @@ Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
         if (!syncConfig) {
           shouldSync = false;
           output.log(
-            `[nolo] \u672A\u914D\u7F6E\u670D\u52A1\u5668\u3002\u5982\u9700\u5728\u7F51\u9875\u7AEF\u4F7F\u7528\uFF0C\u8BF7\u5148\u8FD0\u884C nolo login\uFF0C\u518D\u8FD0\u884C nolo auth ${provider} --sync-only`
+            t("auth.noServerConfigured", provider)
           );
         } else {
           const isTTY = typeof deps.isTTY === "function" ? deps.isTTY() : deps.isTTY ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
           if (isTTY) {
-            const question = `\u540C\u6B65\u5230 ${syncConfig.serverOrigin}\uFF0C\u8BA9\u7F51\u9875\u7AEF\u4E5F\u80FD\u4F7F\u7528\u8FD9\u4E2A ${provider} \u8BA2\u9605\uFF1F\u51ED\u8BC1\u52A0\u5BC6\u5B58\u50A8\uFF0C\u53EF\u968F\u65F6 nolo auth ${provider} --no-sync-to-server \u5173\u95ED [Y/n] `;
+            const question = t(
+              "auth.syncPrompt",
+              syncConfig.serverOrigin,
+              provider
+            );
             let answer;
             if (deps.promptOAuthSync) {
               answer = await deps.promptOAuthSync(question);
@@ -1231,7 +1526,7 @@ Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
           } else {
             shouldSync = false;
             output.log(
-              `[nolo] \u672A\u540C\u6B65\u51ED\u636E\u5230\u670D\u52A1\u5668\u3002\u5982\u9700\u7F51\u9875\u7AEF\u4F7F\u7528\uFF0C\u8BF7\u8FD0\u884C: nolo auth ${provider} --sync-to-server\uFF08\u6216 --sync-only\uFF09`
+              t("auth.notSyncedToServer", provider)
             );
           }
         }
@@ -1240,14 +1535,14 @@ Store it as CLOUDFLARE_EMAIL_ROUTING_API_TOKEN:
     if (shouldSync) {
       const syncResult = await syncCredentialToServer(provider, credential, deps);
       if (syncResult === "mark_failed") {
-        error.error(`[nolo] \u51ED\u636E\u5DF2\u6210\u529F\u4E0A\u4F20\u670D\u52A1\u5668\uFF0C\u4F46\u672C\u5730\u6253\u4E0A\u6258\u7BA1\u6807\u8BB0\u5931\u8D25\u3002\u4E3A\u9632\u53CC\u65B9\u7ADE\u6001\u5237\u65B0\u5BFC\u81F4\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743\u3002`);
+        error.error(t("auth.markFailed"));
         return 1;
       }
     }
     return 0;
   } catch (err) {
     error.error(
-      `nolo auth ${provider} failed: ${toErrorMessage(err)}`
+      t("auth.commandFailed", provider, toErrorMessage(err))
     );
     return 1;
   }
@@ -1273,6 +1568,12 @@ async function runAuthCursorCommand(args, ctx, deps) {
 async function runAuthDevinCommand(args, ctx, deps) {
   return runAuthProviderCommand("devin", args, ctx, deps);
 }
+async function runAuthWorkbuddyCommand(args, ctx, deps) {
+  return runAuthProviderCommand("workbuddy", args, ctx, deps);
+}
+async function runAuthWorkbuddyAiCommand(args, ctx, deps) {
+  return runAuthProviderCommand("workbuddy-ai", args, ctx, deps);
+}
 export {
   resolveServerSyncConfig,
   runAuthAntigravityCommand,
@@ -1282,5 +1583,7 @@ export {
   runAuthCursorCommand,
   runAuthDevinCommand,
   runAuthProviderCommand,
+  runAuthWorkbuddyAiCommand,
+  runAuthWorkbuddyCommand,
   runAuthXaiCommand
 };