From 3375059e645779730bba02e8f018c88b32e57bfd Mon Sep 17 00:00:00 2001
From: Serge Ivo <serge.the.dev@gmail.com>
Date: Sat, 11 Jul 2026 13:48:01 +1000
Subject: [PATCH] Add Zoho WorkDrive connector MVP

---
 store/console/src/tabs/KnowledgeTab.tsx | 142 ++++++++++++
 store/console/src/tabs/SettingsTab.tsx  |  66 ++++--
 workers/api/src/index.ts                |   2 +
 workers/api/src/lib/workdrive.test.ts   | 173 ++++++++++++++
 workers/api/src/lib/workdrive.ts        | 290 ++++++++++++++++++++++++
 workers/api/src/routes/drive.ts         |  35 +--
 workers/api/src/routes/workdrive.ts     | 237 +++++++++++++++++++
 workers/api/src/types.ts                |   7 +
 workers/api/wrangler.toml               |   6 +
 9 files changed, 930 insertions(+), 28 deletions(-)
 create mode 100644 workers/api/src/lib/workdrive.test.ts
 create mode 100644 workers/api/src/lib/workdrive.ts
 create mode 100644 workers/api/src/routes/workdrive.ts

diff --git a/store/console/src/tabs/KnowledgeTab.tsx b/store/console/src/tabs/KnowledgeTab.tsx
index a86c29210..55d8df470 100644
--- a/store/console/src/tabs/KnowledgeTab.tsx
+++ b/store/console/src/tabs/KnowledgeTab.tsx
@@ -17,6 +17,16 @@ interface DriveFile {
 	webViewLink?: string;
 }
 
+interface WorkDriveFile {
+	id: string;
+	name: string;
+	type: string;
+	isFolder?: boolean;
+	mimeType?: string;
+	extension?: string;
+	permalink?: string;
+}
+
 interface Props {
 	instanceId: string;
 	isApply: boolean;
@@ -50,6 +60,14 @@ export default function KnowledgeTab({ instanceId, isApply }: Props) {
 	const [driveLoading, setDriveLoading] = useState(false);
 	const [driveMsg, setDriveMsg] = useState("");
 	const [importingDriveId, setImportingDriveId] = useState<string | null>(null);
+	const [showWorkdrive, setShowWorkdrive] = useState(false);
+	const [workdriveStatus, setWorkdriveStatus] = useState<{ connected: boolean; configured: boolean; account?: string | null } | null>(null);
+	const [workdriveRef, setWorkdriveRef] = useState("");
+	const [workdriveFiles, setWorkdriveFiles] = useState<WorkDriveFile[]>([]);
+	const [workdriveNextOffset, setWorkdriveNextOffset] = useState<number | null>(null);
+	const [workdriveLoading, setWorkdriveLoading] = useState(false);
+	const [workdriveMsg, setWorkdriveMsg] = useState("");
+	const [importingWorkdriveId, setImportingWorkdriveId] = useState<string | null>(null);
 
 	const loadDocs = useCallback(async () => {
 		try {
@@ -87,6 +105,10 @@ export default function KnowledgeTab({ instanceId, isApply }: Props) {
 				const s = await api<{ connected: boolean; configured: boolean; email?: string | null }>("/v1/drive/status");
 				setDriveStatus(s);
 			} catch {}
+			try {
+				const s = await api<{ connected: boolean; configured: boolean; account?: string | null }>("/v1/workdrive/status");
+				setWorkdriveStatus(s);
+			} catch {}
 		})();
 	}, [subTab]);
 
@@ -171,6 +193,52 @@ export default function KnowledgeTab({ instanceId, isApply }: Props) {
 		setImportingDriveId(null);
 	};
 
+	const listWorkdriveFolder = async (ref = workdriveRef, offset = 0, append = false) => {
+		const folderRef = ref.trim();
+		if (!folderRef) return;
+		setWorkdriveLoading(true);
+		setWorkdriveMsg("");
+		try {
+			const params = new URLSearchParams({ folder: folderRef, offset: String(offset), limit: "50" });
+			const d = await api<{ files?: WorkDriveFile[]; nextOffset?: number | null }>(`/v1/workdrive/folder?${params}`);
+			const files = d.files || [];
+			setWorkdriveRef(folderRef);
+			setWorkdriveFiles((prev) => (append ? [...prev, ...files] : files));
+			setWorkdriveNextOffset(typeof d.nextOffset === "number" ? d.nextOffset : null);
+			if (!append && !files.length) setWorkdriveMsg("No files or folders found.");
+		} catch (e) {
+			setWorkdriveMsg(e instanceof Error ? e.message : "WorkDrive folder lookup failed");
+		}
+		setWorkdriveLoading(false);
+	};
+
+	const openWorkdriveFolder = (file: WorkDriveFile) => {
+		setWorkdriveFiles([]);
+		setWorkdriveNextOffset(null);
+		listWorkdriveFolder(file.id);
+	};
+
+	const importWorkdriveFile = async (file?: WorkDriveFile) => {
+		const ref = file?.id || workdriveRef.trim();
+		if (!ref) return;
+		setImportingWorkdriveId(file?.id || "__direct__");
+		setWorkdriveMsg("");
+		try {
+			await api(`/v1/workdrive/instances/${instanceId}/import`, {
+				method: "POST",
+				body: JSON.stringify(file ? { resourceId: file.id } : { url: ref }),
+			});
+			setWorkdriveMsg(`Imported ${file?.name || "WorkDrive file"}.`);
+			setShowWorkdrive(false);
+			setWorkdriveFiles([]);
+			setWorkdriveNextOffset(null);
+			loadDocs();
+		} catch (e) {
+			setWorkdriveMsg(e instanceof Error ? e.message : "WorkDrive import failed");
+		}
+		setImportingWorkdriveId(null);
+	};
+
 	const deleteDoc = async (docId: string) => {
 		if (!confirm("Delete this document?")) return;
 		try {
@@ -237,6 +305,17 @@ export default function KnowledgeTab({ instanceId, isApply }: Props) {
 		file.mimeType === "application/vnd.google-apps.presentation"
 	);
 
+	const supportedWorkdriveFile = (file: WorkDriveFile) => {
+		const type = (file.mimeType || "").toLowerCase();
+		const ext = (file.extension || file.name.split(".").pop() || "").toLowerCase();
+		return type.startsWith("text/") || type.includes("json") || type.includes("xml") || ["txt", "md", "csv", "json", "xml", "html", "htm", "yaml", "yml", "tsv"].includes(ext);
+	};
+
+	const isWorkdriveFolder = (file: WorkDriveFile) => {
+		const type = file.type.toLowerCase();
+		return file.isFolder === true || type.includes("folder");
+	};
+
 	const subTabs: { id: KbSubTab; label: string }[] = [
 		{ id: "docs", label: "Documents" },
 		{ id: "memory", label: "Memory" },
@@ -333,6 +412,7 @@ export default function KnowledgeTab({ instanceId, isApply }: Props) {
 								<button type="button" onClick={openNew} className="text-xs px-2.5 py-1.5 rounded-lg bg-accent text-white font-bold">+ New</button>
 								<button type="button" onClick={() => setShowUrl((s) => !s)} className="text-xs px-2.5 py-1.5 rounded-lg border border-line text-muted hover:border-accent hover:text-accent font-semibold">+ URL</button>
 								<button type="button" onClick={() => setShowDrive((s) => !s)} className="text-xs px-2.5 py-1.5 rounded-lg border border-line text-muted hover:border-accent hover:text-accent font-semibold">+ Drive</button>
+								<button type="button" onClick={() => setShowWorkdrive((s) => !s)} className="text-xs px-2.5 py-1.5 rounded-lg border border-line text-muted hover:border-accent hover:text-accent font-semibold">+ WorkDrive</button>
 								<label className="text-xs px-2.5 py-1.5 rounded-lg border border-line text-muted hover:border-accent hover:text-accent font-semibold cursor-pointer">
 									+ File
 									<input type="file" accept=".txt,.md,.csv,.json,.html,.htm,.pdf,.xml" className="hidden" onChange={(e) => { const f = e.target.files?.[0]; if (f) uploadKbFile(f); e.target.value = ""; }} />
@@ -399,6 +479,68 @@ export default function KnowledgeTab({ instanceId, isApply }: Props) {
 							</div>
 						)}
 
+						{showWorkdrive && (
+							<div className="bg-panel border border-line rounded-xl p-4 mb-3">
+								{workdriveStatus?.connected ? (
+									<>
+										<div className="flex gap-2 mb-2 flex-wrap">
+											<input
+												value={workdriveRef}
+												onChange={(e) => setWorkdriveRef(e.target.value)}
+												onKeyDown={(e) => { if (e.key === "Enter") listWorkdriveFolder(); }}
+												placeholder="Zoho WorkDrive file or folder URL / ID"
+												className="flex-1 min-w-[12rem] bg-paper border border-line rounded-lg px-3 py-2 text-sm"
+											/>
+											<button type="button" onClick={() => importWorkdriveFile()} disabled={!workdriveRef.trim() || importingWorkdriveId === "__direct__"} className="text-xs px-3 py-1.5 rounded-lg bg-accent text-white font-bold disabled:opacity-50">
+												{importingWorkdriveId === "__direct__" ? "Importing..." : "Import file"}
+											</button>
+											<button type="button" onClick={() => listWorkdriveFolder()} disabled={workdriveLoading || !workdriveRef.trim()} className="text-xs px-3 py-1.5 rounded-lg border border-line text-muted hover:border-accent hover:text-accent font-semibold disabled:opacity-50">
+												{workdriveLoading ? "Listing..." : "List folder"}
+											</button>
+											<button type="button" onClick={() => setShowWorkdrive(false)} className="text-xs px-3 py-1.5 rounded-lg border border-line text-muted font-semibold">Cancel</button>
+										</div>
+										{workdriveFiles.length > 0 && (
+											<div className="flex flex-col gap-2 mt-3">
+												{workdriveFiles.map((f) => {
+													const folder = isWorkdriveFolder(f);
+													const supported = supportedWorkdriveFile(f);
+													return (
+														<div key={f.id} className="bg-paper border border-line rounded-lg p-3 flex items-start justify-between gap-3">
+															<div className="min-w-0">
+																<div className="text-sm font-semibold truncate">{f.name}</div>
+																<div className="text-xs text-muted truncate">{folder ? "Folder" : f.mimeType || f.extension || f.type}</div>
+															</div>
+															<button
+																type="button"
+																disabled={(!folder && !supported) || importingWorkdriveId === f.id || workdriveLoading}
+																onClick={() => folder ? openWorkdriveFolder(f) : importWorkdriveFile(f)}
+																className="text-xs px-2.5 py-1.5 rounded-lg border border-line text-muted hover:border-accent hover:text-accent font-semibold disabled:opacity-40 disabled:hover:border-line disabled:hover:text-muted"
+															>
+																{importingWorkdriveId === f.id ? "Importing..." : folder ? "Open" : supported ? "Import" : "Unsupported"}
+															</button>
+														</div>
+													);
+												})}
+												{workdriveNextOffset !== null && (
+													<button
+														type="button"
+														onClick={() => listWorkdriveFolder(workdriveRef, workdriveNextOffset, true)}
+														disabled={workdriveLoading}
+														className="self-start text-xs px-3 py-1.5 rounded-lg border border-line text-muted hover:border-accent hover:text-accent font-semibold disabled:opacity-50"
+													>
+														{workdriveLoading ? "Loading..." : "Load more"}
+													</button>
+												)}
+											</div>
+										)}
+									</>
+								) : (
+									<p className="text-sm text-muted">Connect Zoho WorkDrive in Settings before importing WorkDrive files.</p>
+								)}
+								{workdriveMsg && <div className="text-xs text-muted mt-2">{workdriveMsg}</div>}
+							</div>
+						)}
+
 						{docs.length === 0 ? (
 							<p className="text-center py-6 text-muted-soft text-sm">No documents yet. Click <b>+ New</b> to write one in Markdown.</p>
 						) : (
diff --git a/store/console/src/tabs/SettingsTab.tsx b/store/console/src/tabs/SettingsTab.tsx
index 7a9485b50..e2e9e3567 100644
--- a/store/console/src/tabs/SettingsTab.tsx
+++ b/store/console/src/tabs/SettingsTab.tsx
@@ -45,6 +45,8 @@ export default function SettingsTab({ instanceId, isApply, settingsSchema, onUns
 	const [emailMsg, setEmailMsg] = useState("");
 	const [driveStatus, setDriveStatus] = useState<{ connected: boolean; configured: boolean; email?: string | null } | null>(null);
 	const [driveMsg, setDriveMsg] = useState("");
+	const [workdriveStatus, setWorkdriveStatus] = useState<{ connected: boolean; configured: boolean; account?: string | null } | null>(null);
+	const [workdriveMsg, setWorkdriveMsg] = useState("");
 
 	useEffect(() => {
 		(async () => {
@@ -102,6 +104,10 @@ export default function SettingsTab({ instanceId, isApply, settingsSchema, onUns
 				const s = await api<{ connected: boolean; configured: boolean; email?: string | null }>("/v1/drive/status");
 				setDriveStatus(s);
 			} catch {}
+			try {
+				const s = await api<{ connected: boolean; configured: boolean; account?: string | null }>("/v1/workdrive/status");
+				setWorkdriveStatus(s);
+			} catch {}
 			try {
 				const st = await api<{ permissions?: { email?: boolean } }>(`/v1/instances/${instanceId}/state`);
 				setEmailPermission(st.permissions?.email === true);
@@ -109,23 +115,12 @@ export default function SettingsTab({ instanceId, isApply, settingsSchema, onUns
 		})();
 	}, [instanceId]);
 
-	// Gmail is connected in a popup; re-check when the user returns to this tab.
-	const refreshEmail = async () => {
-		try {
-			const s = await api<{ connected: boolean; configured: boolean; email?: string | null }>("/v1/email/status");
-			setEmailStatus(s);
-		} catch {}
-	};
-	const refreshDrive = async () => {
-		try {
-			const s = await api<{ connected: boolean; configured: boolean; email?: string | null }>("/v1/drive/status");
-			setDriveStatus(s);
-		} catch {}
-	};
+	// Cloud connectors open OAuth in a popup; re-check when the user returns to this tab.
 	useEffect(() => {
 		const onFocus = () => {
 			api<{ connected: boolean; configured: boolean; email?: string | null }>("/v1/email/status").then(setEmailStatus).catch(() => {});
 			api<{ connected: boolean; configured: boolean; email?: string | null }>("/v1/drive/status").then(setDriveStatus).catch(() => {});
+			api<{ connected: boolean; configured: boolean; account?: string | null }>("/v1/workdrive/status").then(setWorkdriveStatus).catch(() => {});
 		};
 		window.addEventListener("focus", onFocus);
 		return () => window.removeEventListener("focus", onFocus);
@@ -210,6 +205,27 @@ export default function SettingsTab({ instanceId, isApply, settingsSchema, onUns
 		}
 	};
 
+	const connectWorkdrive = async () => {
+		try {
+			const { url } = await api<{ url: string }>("/v1/workdrive/zoho/start");
+			window.open(url, "_blank", "noopener");
+			setWorkdriveMsg("Complete the Zoho sign-in in the new tab, then come back here.");
+		} catch (e) {
+			setWorkdriveMsg(e instanceof Error ? e.message : "Failed to start Zoho WorkDrive connection");
+		}
+	};
+
+	const disconnectWorkdrive = async () => {
+		if (!confirm("Disconnect Zoho WorkDrive? Existing imported documents stay, but new WorkDrive imports will stop working.")) return;
+		try {
+			await api("/v1/workdrive/zoho", { method: "DELETE" });
+			setWorkdriveStatus((s) => (s ? { ...s, connected: false } : s));
+			setWorkdriveMsg("Zoho WorkDrive disconnected.");
+		} catch (e) {
+			setWorkdriveMsg(e instanceof Error ? e.message : "Failed");
+		}
+	};
+
 	const toggleEmailPermission = async (on: boolean) => {
 		setEmailPermission(on);
 		try {
@@ -406,6 +422,9 @@ export default function SettingsTab({ instanceId, isApply, settingsSchema, onUns
 				{driveStatus && !driveStatus.configured && (
 					<p className="text-xs text-red mb-2">Google Drive connection isn’t configured on this deployment yet.</p>
 				)}
+				{workdriveStatus && !workdriveStatus.configured && (
+					<p className="text-xs text-red mb-2">Zoho WorkDrive connection isn’t configured on this deployment yet.</p>
+				)}
 
 				<div className="flex items-center justify-between gap-3 mb-3">
 					<div className="text-sm">
@@ -447,6 +466,26 @@ export default function SettingsTab({ instanceId, isApply, settingsSchema, onUns
 					)}
 				</div>
 
+				<div className="flex items-center justify-between gap-3 mb-3">
+					<div className="text-sm">
+						<span className="font-semibold">Zoho WorkDrive</span>{" "}
+						{workdriveStatus?.connected
+							? <span className="text-green">· connected{workdriveStatus.account ? ` (${workdriveStatus.account})` : ""}</span>
+							: <span className="text-muted">· not connected</span>}
+					</div>
+					{workdriveStatus?.configured && (
+						workdriveStatus.connected ? (
+							<button type="button" onClick={disconnectWorkdrive} className="text-xs px-3 py-1.5 rounded-lg border border-line text-muted hover:border-red hover:text-red font-bold">
+								Disconnect
+							</button>
+						) : (
+							<button type="button" onClick={connectWorkdrive} className="text-xs px-3 py-1.5 rounded-lg border border-line text-muted hover:border-accent hover:text-accent font-bold">
+								Connect WorkDrive
+							</button>
+						)
+					)}
+				</div>
+
 				<label className={`flex items-center gap-2 text-sm ${emailStatus?.connected ? "" : "opacity-50"}`}>
 					<input
 						type="checkbox"
@@ -461,6 +500,7 @@ export default function SettingsTab({ instanceId, isApply, settingsSchema, onUns
 				)}
 				{emailMsg && <div className="text-xs text-muted mt-2">{emailMsg}</div>}
 				{driveMsg && <div className="text-xs text-muted mt-2">{driveMsg}</div>}
+				{workdriveMsg && <div className="text-xs text-muted mt-2">{workdriveMsg}</div>}
 			</div>
 
 			{/* Voice */}
diff --git a/workers/api/src/index.ts b/workers/api/src/index.ts
index 105f3a99f..0bb383552 100644
--- a/workers/api/src/index.ts
+++ b/workers/api/src/index.ts
@@ -14,6 +14,7 @@ import { profileRoutes } from "./routes/profile.js";
 import { keysRoutes } from "./routes/keys.js";
 import { emailRoutes } from "./routes/email.js";
 import { driveRoutes } from "./routes/drive.js";
+import { workdriveRoutes } from "./routes/workdrive.js";
 import { errorRoutes } from "./routes/errors.js";
 import { dashboardRoutes } from "./routes/dashboard.js";
 import { notificationRoutes } from "./routes/notifications.js";
@@ -101,6 +102,7 @@ app.route("/v1/batch", batchRoutes);       // /v1/batch/bulk-visibility, /bulk-d
 app.route("/v1/keys", keysRoutes); // /v1/keys/providers, /status, /:provider, /proxy/:host/*
 app.route("/v1/email", emailRoutes); // /v1/email/google/start, /callback, /status, DELETE /google
 app.route("/v1/drive", driveRoutes); // /v1/drive/google/start, /callback, /status, /files, /instances/:id/import
+app.route("/v1/workdrive", workdriveRoutes); // /v1/workdrive/zoho/start, /callback, /status, /folder, /instances/:id/import
 app.route("/v1/errors", errorRoutes); // GET /v1/errors — durable error log read-back
 app.route("/v1/public", publicRoutes); // /v1/public/agents/:id, /agents/:id/try, /webhook/:id/ingest
 app.route("/v1/billing", billingRoutes);
diff --git a/workers/api/src/lib/workdrive.test.ts b/workers/api/src/lib/workdrive.test.ts
new file mode 100644
index 000000000..049e8a44b
--- /dev/null
+++ b/workers/api/src/lib/workdrive.test.ts
@@ -0,0 +1,173 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+	exportWorkDriveFile,
+	listWorkDriveFolder,
+	mintWorkDriveAccessToken,
+	WORKDRIVE_SCOPE,
+	workDriveResourceIdFromUrl,
+} from "./workdrive.js";
+
+describe("workDriveResourceIdFromUrl", () => {
+	it("accepts a raw WorkDrive resource id", () => {
+		expect(workDriveResourceIdFromUrl("v310zf0b27cc29f5040c7bda64baaecca983a")).toBe(
+			"v310zf0b27cc29f5040c7bda64baaecca983a",
+		);
+	});
+
+	it("extracts ids from file, folder, and download URLs", () => {
+		expect(workDriveResourceIdFromUrl("https://workdrive.zoho.com/file/l0ai97a15a3915de649969aae63b718da3bae")).toBe(
+			"l0ai97a15a3915de649969aae63b718da3bae",
+		);
+		expect(workDriveResourceIdFromUrl("https://workdrive.zoho.com/home/team/privatespace/folders/folder123")).toBe("folder123");
+		expect(workDriveResourceIdFromUrl("https://download.zoho.com/v1/workdrive/download/file456")).toBe("file456");
+	});
+
+	it("extracts team-folder ids from workspace URLs", () => {
+		expect(workDriveResourceIdFromUrl("https://workdrive.zoho.com/home/team/teams/teamid/ws/ws123/folders/files")).toBe("ws123");
+	});
+
+	it("prefers direct file ids over parent folder ids in nested file URLs", () => {
+		expect(workDriveResourceIdFromUrl("https://workdrive.zoho.com/home/team/teams/teamid/ws/ws123/folders/folder123/files/file456")).toBe("file456");
+	});
+
+	it("extracts ids from common query parameters", () => {
+		expect(workDriveResourceIdFromUrl("https://workdrive.zoho.com/home?folder_id=folder789")).toBe("folder789");
+		expect(workDriveResourceIdFromUrl("https://workdrive.zoho.com/home?file_id=file789")).toBe("file789");
+		expect(workDriveResourceIdFromUrl("https://workdrive.zoho.com/home?resource_id=res789")).toBe("res789");
+	});
+
+	it("returns null for empty or invalid inputs", () => {
+		expect(workDriveResourceIdFromUrl("")).toBeNull();
+		expect(workDriveResourceIdFromUrl("not a url with spaces")).toBeNull();
+	});
+});
+
+describe("WORKDRIVE_SCOPE", () => {
+	it("requests file download and team-folder read scopes", () => {
+		expect(WORKDRIVE_SCOPE.split(",")).toEqual([
+			"aaaserver.profile.READ",
+			"WorkDrive.files.READ",
+			"WorkDrive.teamfolders.READ",
+			"ZohoFiles.files.READ",
+		]);
+	});
+});
+
+describe("listWorkDriveFolder", () => {
+	afterEach(() => {
+		vi.unstubAllGlobals();
+	});
+
+	it("falls back to the teamfolders endpoint for team-folder root ids", async () => {
+		const fetchMock = vi.fn()
+			.mockResolvedValueOnce(new Response(JSON.stringify({ errors: [{ title: "URL Rule is not configured" }] }), { status: 404 }))
+			.mockResolvedValueOnce(new Response(JSON.stringify({
+				data: [
+					{
+						id: "file123456789",
+						type: "files",
+						attributes: { name: "notes.md", extn: "md", mime_type: "text/markdown" },
+					},
+				],
+			}), { status: 200, headers: { "content-type": "application/vnd.api+json" } }));
+		vi.stubGlobal("fetch", fetchMock);
+
+		const page = await listWorkDriveFolder({}, "token", "teamfolder123456789");
+
+		expect(page).toMatchObject({ offset: 0, limit: 50, nextOffset: null, hasMore: false });
+		expect(page.files).toHaveLength(1);
+		expect(page.files[0]).toMatchObject({
+			id: "file123456789",
+			name: "notes.md",
+			type: "files",
+			isFolder: true,
+			extension: "md",
+			mimeType: "text/markdown",
+		});
+		expect(fetchMock).toHaveBeenNthCalledWith(
+			1,
+			expect.stringContaining("/api/v1/files/teamfolder123456789/files?"),
+			expect.any(Object),
+		);
+		expect(fetchMock).toHaveBeenNthCalledWith(
+			2,
+			expect.stringContaining("/api/v1/teamfolders/teamfolder123456789/folders?"),
+			expect.any(Object),
+		);
+	});
+
+	it("passes pagination params and reports the next offset when a page is full", async () => {
+		const fetchMock = vi.fn().mockResolvedValueOnce(new Response(JSON.stringify({
+			data: Array.from({ length: 2 }, (_, i) => ({
+				id: `file${i}123456789`,
+				type: "files",
+				attributes: { name: `file-${i}.txt`, extn: "txt", mime_type: "text/plain" },
+			})),
+		}), { status: 200, headers: { "content-type": "application/vnd.api+json" } }));
+		vi.stubGlobal("fetch", fetchMock);
+
+		const page = await listWorkDriveFolder({}, "token", "folder123456789", { limit: 2, offset: 4 });
+
+		expect(page).toMatchObject({ offset: 4, limit: 2, nextOffset: 6, hasMore: true });
+		const url = String(fetchMock.mock.calls[0][0]);
+		expect(url).toContain("page%5Blimit%5D=2");
+		expect(url).toContain("page%5Boffset%5D=4");
+	});
+});
+
+describe("mintWorkDriveAccessToken", () => {
+	afterEach(() => {
+		vi.unstubAllGlobals();
+	});
+
+	it("throws a reconnect error when token refresh fails", async () => {
+		vi.stubGlobal("fetch", vi.fn().mockResolvedValueOnce(new Response("bad token", { status: 400 })));
+
+		await expect(mintWorkDriveAccessToken({
+			ZOHO_CLIENT_ID: "client",
+			ZOHO_CLIENT_SECRET: "secret",
+		}, "refresh")).rejects.toThrow("Reconnect Zoho WorkDrive");
+	});
+});
+
+describe("exportWorkDriveFile", () => {
+	afterEach(() => {
+		vi.unstubAllGlobals();
+	});
+
+	it("downloads text-like files", async () => {
+		const fetchMock = vi.fn()
+			.mockResolvedValueOnce(new Response(JSON.stringify({
+				data: {
+					id: "file123456789",
+					type: "files",
+					attributes: { name: "notes.md", extn: "md", mime_type: "text/markdown", permalink: "https://workdrive.zoho.com/file/file123456789" },
+				},
+			}), { status: 200, headers: { "content-type": "application/vnd.api+json" } }))
+			.mockResolvedValueOnce(new Response("# Notes", { status: 200, headers: { "content-type": "text/markdown" } }));
+		vi.stubGlobal("fetch", fetchMock);
+
+		await expect(exportWorkDriveFile({}, "token", "file123456789")).resolves.toMatchObject({
+			id: "file123456789",
+			name: "notes.md",
+			mimeType: "text/markdown",
+			permalink: "https://workdrive.zoho.com/file/file123456789",
+			text: "# Notes",
+		});
+	});
+
+	it("rejects unsupported binary files", async () => {
+		const fetchMock = vi.fn()
+			.mockResolvedValueOnce(new Response(JSON.stringify({
+				data: {
+					id: "file123456789",
+					type: "files",
+					attributes: { name: "scan.pdf", extn: "pdf", mime_type: "application/pdf" },
+				},
+			}), { status: 200, headers: { "content-type": "application/vnd.api+json" } }))
+			.mockResolvedValueOnce(new Response("pdf bytes", { status: 200, headers: { "content-type": "application/pdf" } }));
+		vi.stubGlobal("fetch", fetchMock);
+
+		await expect(exportWorkDriveFile({}, "token", "file123456789")).rejects.toThrow("Unsupported WorkDrive file type");
+	});
+});
diff --git a/workers/api/src/lib/workdrive.ts b/workers/api/src/lib/workdrive.ts
new file mode 100644
index 000000000..b5384d76d
--- /dev/null
+++ b/workers/api/src/lib/workdrive.ts
@@ -0,0 +1,290 @@
+const DEFAULT_ACCOUNTS_BASE = "https://accounts.zoho.com";
+const DEFAULT_API_BASE = "https://www.zohoapis.com/workdrive";
+const DEFAULT_DOWNLOAD_BASE = "https://download.zoho.com";
+
+export const WORKDRIVE_SCOPE = [
+	"aaaserver.profile.READ",
+	"WorkDrive.files.READ",
+	"WorkDrive.teamfolders.READ",
+	"ZohoFiles.files.READ",
+].join(",");
+
+export interface WorkDriveEnv {
+	ZOHO_CLIENT_ID?: string;
+	ZOHO_CLIENT_SECRET?: string;
+	ZOHO_ACCOUNTS_BASE?: string;
+	ZOHO_WORKDRIVE_API_BASE?: string;
+	ZOHO_WORKDRIVE_DOWNLOAD_BASE?: string;
+}
+
+export class WorkDriveError extends Error {}
+
+export interface WorkDriveFile {
+	id: string;
+	name: string;
+	type: string;
+	isFolder: boolean;
+	mimeType?: string;
+	extension?: string;
+	permalink?: string;
+	modifiedTime?: string;
+}
+
+export interface WorkDriveFolderPage {
+	files: WorkDriveFile[];
+	offset: number;
+	limit: number;
+	nextOffset: number | null;
+	hasMore: boolean;
+}
+
+export interface WorkDriveExportedFile {
+	id: string;
+	name: string;
+	mimeType?: string;
+	permalink?: string;
+	text: string;
+}
+
+function trimTrailingSlash(value: string): string {
+	return value.replace(/\/+$/, "");
+}
+
+export function workDriveAccountsBase(env: WorkDriveEnv): string {
+	return trimTrailingSlash(env.ZOHO_ACCOUNTS_BASE || DEFAULT_ACCOUNTS_BASE);
+}
+
+function workDriveApiBase(env: WorkDriveEnv): string {
+	return trimTrailingSlash(env.ZOHO_WORKDRIVE_API_BASE || DEFAULT_API_BASE);
+}
+
+function workDriveDownloadBase(env: WorkDriveEnv): string {
+	return trimTrailingSlash(env.ZOHO_WORKDRIVE_DOWNLOAD_BASE || DEFAULT_DOWNLOAD_BASE);
+}
+
+export async function mintWorkDriveAccessToken(
+	env: WorkDriveEnv,
+	refreshToken: string,
+): Promise<string> {
+	if (!env.ZOHO_CLIENT_ID || !env.ZOHO_CLIENT_SECRET) {
+		throw new WorkDriveError("Zoho WorkDrive OAuth is not configured on this deployment");
+	}
+	const res = await fetch(`${workDriveAccountsBase(env)}/oauth/v2/token`, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			client_id: env.ZOHO_CLIENT_ID,
+			client_secret: env.ZOHO_CLIENT_SECRET,
+			refresh_token: refreshToken,
+			grant_type: "refresh_token",
+		}),
+	});
+	if (!res.ok) {
+		throw new WorkDriveError(
+			`Could not refresh Zoho WorkDrive access (${res.status}). Reconnect Zoho WorkDrive in settings.`,
+		);
+	}
+	const data = (await res.json()) as { access_token?: string };
+	if (!data.access_token) throw new WorkDriveError("Zoho did not return an access token");
+	return data.access_token;
+}
+
+export function workDriveResourceIdFromUrl(input: string): string | null {
+	const raw = input.trim();
+	if (!raw) return null;
+	if (/^[a-zA-Z0-9_-]{10,}$/.test(raw) && !raw.includes("/")) return raw;
+	try {
+		const url = new URL(raw);
+		const queryId =
+			url.searchParams.get("resource_id") ||
+			url.searchParams.get("file_id") ||
+			url.searchParams.get("folder_id") ||
+			url.searchParams.get("id");
+		if (queryId) return queryId;
+		const patterns = [
+			/\/files\/([^/?#]+)/,
+			/\/file\/([^/?#]+)/,
+			/\/folder\/([^/?#]+)/,
+			/\/folders\/([^/?#]+)/,
+			/\/ws\/([^/?#]+)/,
+			/\/workdrive\/download\/([^/?#]+)/,
+			/\/download\/([^/?#]+)/,
+		];
+		for (const pattern of patterns) {
+			const match = url.pathname.match(pattern);
+			if (match?.[1] && match[1] !== "files") return match[1];
+		}
+		return null;
+	} catch {
+		return null;
+	}
+}
+
+async function workDriveFetch(env: WorkDriveEnv, accessToken: string, path: string): Promise<Response> {
+	return fetch(`${workDriveApiBase(env)}${path}`, {
+		headers: {
+			Accept: "application/vnd.api+json",
+			Authorization: `Zoho-oauthtoken ${accessToken}`,
+		},
+	});
+}
+
+async function parseWorkDriveFiles(res: Response, opts: { defaultFolder?: boolean } = {}): Promise<WorkDriveFile[]> {
+	const data = (await res.json()) as { data?: Array<{ id?: string; type?: string; attributes?: Record<string, unknown> }> };
+	return (data.data ?? []).map((item) => normalizeFile(item, opts)).filter((f): f is WorkDriveFile => !!f);
+}
+
+async function workDriveDownloadFetch(env: WorkDriveEnv, accessToken: string, resourceId: string): Promise<Response> {
+	return fetch(`${workDriveDownloadBase(env)}/v1/workdrive/download/${encodeURIComponent(resourceId)}`, {
+		headers: { Authorization: `Zoho-oauthtoken ${accessToken}` },
+	});
+}
+
+async function workDriveErrorReason(res: Response): Promise<string> {
+	try {
+		const raw = await res.text();
+		try {
+			const j = JSON.parse(raw) as { errors?: Array<{ title?: string }>; error?: string; message?: string };
+			if (j.errors?.[0]?.title) return j.errors[0].title;
+			return j.message || j.error || raw.slice(0, 200);
+		} catch {
+			return raw.slice(0, 200) || "no error body";
+		}
+	} catch {
+		return "unreadable error body";
+	}
+}
+
+function attrString(attrs: Record<string, unknown>, keys: string[]): string | undefined {
+	for (const key of keys) {
+		const value = attrs[key];
+		if (typeof value === "string" && value) return value;
+	}
+	return undefined;
+}
+
+function normalizeFile(
+	item: { id?: string; type?: string; attributes?: Record<string, unknown> },
+	opts: { defaultFolder?: boolean } = {},
+): WorkDriveFile | null {
+	const id = item.id;
+	if (!id) return null;
+	const a = item.attributes ?? {};
+	const name = String(a.name || a.filename || a.display_name || id);
+	const type = String(item.type || a.type || "files");
+	const semanticType = [
+		type,
+		attrString(a, ["type", "resource_type", "resourceType", "category", "file_type", "fileType"]),
+	]
+		.filter(Boolean)
+		.join(" ")
+		.toLowerCase();
+	return {
+		id,
+		name,
+		type,
+		isFolder: opts.defaultFolder === true || /\bfolders?\b/.test(semanticType),
+		mimeType: attrString(a, ["mime_type", "mimeType"]),
+		extension: attrString(a, ["extn", "extension"]),
+		permalink: attrString(a, ["permalink"]),
+		modifiedTime: attrString(a, ["modified_time", "modifiedTime"]),
+	};
+}
+
+function normalizePage(opts: { limit?: number; offset?: number } = {}): { limit: number; offset: number } {
+	const limit = Math.max(1, Math.min(Math.trunc(opts.limit ?? 50) || 50, 50));
+	const offset = Math.max(0, Math.trunc(opts.offset ?? 0) || 0);
+	return { limit, offset };
+}
+
+export async function listWorkDriveFolder(
+	env: WorkDriveEnv,
+	accessToken: string,
+	folderIdOrUrl: string,
+	opts: { limit?: number; offset?: number } = {},
+): Promise<WorkDriveFolderPage> {
+	const folderId = workDriveResourceIdFromUrl(folderIdOrUrl);
+	if (!folderId) throw new WorkDriveError("Zoho WorkDrive folder id or URL required");
+	const { limit, offset } = normalizePage(opts);
+	const params = new URLSearchParams({
+		"page[limit]": String(limit),
+		"page[offset]": String(offset),
+		"filter[type]": "allfiles",
+	});
+	const filesRes = await workDriveFetch(env, accessToken, `/api/v1/files/${encodeURIComponent(folderId)}/files?${params}`);
+	if (filesRes.ok) {
+		const files = await parseWorkDriveFiles(filesRes);
+		return {
+			files,
+			offset,
+			limit,
+			nextOffset: files.length === limit ? offset + limit : null,
+			hasMore: files.length === limit,
+		};
+	}
+
+	const filesReason = await workDriveErrorReason(filesRes);
+	const teamFolderRes = await workDriveFetch(env, accessToken, `/api/v1/teamfolders/${encodeURIComponent(folderId)}/folders?${params}`);
+	if (teamFolderRes.ok) {
+		const files = await parseWorkDriveFiles(teamFolderRes, { defaultFolder: true });
+		return {
+			files,
+			offset,
+			limit,
+			nextOffset: files.length === limit ? offset + limit : null,
+			hasMore: files.length === limit,
+		};
+	}
+	throw new WorkDriveError(`Zoho WorkDrive folder list failed (${filesRes.status}): ${filesReason}`);
+}
+
+export async function getWorkDriveFile(
+	env: WorkDriveEnv,
+	accessToken: string,
+	resourceIdOrUrl: string,
+): Promise<WorkDriveFile> {
+	const resourceId = workDriveResourceIdFromUrl(resourceIdOrUrl);
+	if (!resourceId) throw new WorkDriveError("Zoho WorkDrive file id or URL required");
+	const res = await workDriveFetch(env, accessToken, `/api/v1/files/${encodeURIComponent(resourceId)}`);
+	if (!res.ok) throw new WorkDriveError(`Zoho WorkDrive file lookup failed (${res.status}): ${await workDriveErrorReason(res)}`);
+	const data = (await res.json()) as { data?: { id?: string; type?: string; attributes?: Record<string, unknown> } };
+	const file = data.data ? normalizeFile(data.data) : null;
+	if (!file) throw new WorkDriveError("Zoho WorkDrive did not return file metadata");
+	return file;
+}
+
+function isTextLike(contentType: string, name: string): boolean {
+	const ct = contentType.toLowerCase();
+	const ext = name.toLowerCase().split(".").pop() || "";
+	return (
+		ct.startsWith("text/") ||
+		ct.includes("json") ||
+		ct.includes("xml") ||
+		["txt", "md", "csv", "json", "xml", "html", "htm", "yaml", "yml", "tsv"].includes(ext)
+	);
+}
+
+export async function exportWorkDriveFile(
+	env: WorkDriveEnv,
+	accessToken: string,
+	resourceIdOrUrl: string,
+): Promise<WorkDriveExportedFile> {
+	const resourceId = workDriveResourceIdFromUrl(resourceIdOrUrl);
+	if (!resourceId) throw new WorkDriveError("Zoho WorkDrive file id or URL required");
+	const meta = await getWorkDriveFile(env, accessToken, resourceId);
+	const res = await workDriveDownloadFetch(env, accessToken, resourceId);
+	if (!res.ok) throw new WorkDriveError(`Zoho WorkDrive download failed (${res.status}): ${await workDriveErrorReason(res)}`);
+	const contentType = res.headers.get("content-type") || meta.mimeType || "";
+	if (!isTextLike(contentType, meta.name)) {
+		throw new WorkDriveError(`Unsupported WorkDrive file type for text import: ${contentType || meta.extension || "unknown"}`);
+	}
+	let text = await res.text();
+	if (text.length > 90_000) text = `${text.slice(0, 90_000)}\n...[truncated]`;
+	return {
+		id: meta.id,
+		name: meta.name,
+		mimeType: contentType || meta.mimeType,
+		permalink: meta.permalink,
+		text,
+	};
+}
diff --git a/workers/api/src/routes/drive.ts b/workers/api/src/routes/drive.ts
index cc07e77cb..18b156341 100644
--- a/workers/api/src/routes/drive.ts
+++ b/workers/api/src/routes/drive.ts
@@ -56,21 +56,26 @@ async function signState(uid: string, exp: number, secret: string): Promise<stri
 }
 
 async function verifyState(token: string, secret: string): Promise<string | null> {
-	const [payload, sig] = token.split(".");
-	if (!payload || !sig) return null;
-	const valid = await crypto.subtle.verify(
-		"HMAC",
-		await hmacKey(secret),
-		unb64url(sig),
-		new TextEncoder().encode(payload),
-	);
-	if (!valid) return null;
-	const { uid, exp } = JSON.parse(new TextDecoder().decode(unb64url(payload))) as {
-		uid: string;
-		exp: number;
-	};
-	if (exp < Math.floor(Date.now() / 1000)) return null;
-	return uid;
+	try {
+		const [payload, sig] = token.split(".");
+		if (!payload || !sig) return null;
+		const valid = await crypto.subtle.verify(
+			"HMAC",
+			await hmacKey(secret),
+			unb64url(sig),
+			new TextEncoder().encode(payload),
+		);
+		if (!valid) return null;
+		const { uid, exp } = JSON.parse(new TextDecoder().decode(unb64url(payload))) as {
+			uid: string;
+			exp: number;
+		};
+		if (typeof uid !== "string" || typeof exp !== "number") return null;
+		if (exp < Math.floor(Date.now() / 1000)) return null;
+		return uid;
+	} catch {
+		return null;
+	}
 }
 
 async function storedRefreshToken(env: Env, userId: string): Promise<string> {
diff --git a/workers/api/src/routes/workdrive.ts b/workers/api/src/routes/workdrive.ts
new file mode 100644
index 000000000..2778249c5
--- /dev/null
+++ b/workers/api/src/routes/workdrive.ts
@@ -0,0 +1,237 @@
+/**
+ * Zoho WorkDrive connector.
+ *
+ * Users connect WorkDrive with read-only OAuth. We store only the refresh token,
+ * encrypted in the key vault as provider "zoho_workdrive". Imported files are
+ * copied into the instance knowledge base through the existing vectorizing path.
+ */
+import { Hono } from "hono";
+import type { ContentfulStatusCode } from "hono/utils/http-status";
+import { HttpError, requireUser } from "../lib/auth.js";
+import { decryptKey, encryptKey } from "../lib/crypto.js";
+import {
+	exportWorkDriveFile,
+	listWorkDriveFolder,
+	mintWorkDriveAccessToken,
+	WORKDRIVE_SCOPE,
+	workDriveAccountsBase,
+} from "../lib/workdrive.js";
+import type { Env } from "../types.js";
+import { requireOwnedInstance } from "./instances-runtime.js";
+
+export const workdriveRoutes = new Hono<{ Bindings: Env }>();
+
+const STATE_TTL_SECONDS = 10 * 60;
+const PROVIDER = "zoho_workdrive";
+
+function redirectUri(c: { req: { url: string } }): string {
+	return new URL("/v1/workdrive/zoho/callback", c.req.url).toString();
+}
+
+function b64url(bytes: Uint8Array): string {
+	return btoa(String.fromCharCode(...bytes))
+		.replace(/\+/g, "-")
+		.replace(/\//g, "_")
+		.replace(/=+$/, "");
+}
+
+function unb64url(s: string): Uint8Array {
+	const padded = s.replace(/-/g, "+").replace(/_/g, "/") + "==".slice(0, (4 - (s.length % 4)) % 4);
+	return Uint8Array.from(atob(padded), (ch) => ch.charCodeAt(0));
+}
+
+async function hmacKey(secret: string): Promise<CryptoKey> {
+	return crypto.subtle.importKey(
+		"raw",
+		new TextEncoder().encode(secret),
+		{ name: "HMAC", hash: "SHA-256" },
+		false,
+		["sign", "verify"],
+	);
+}
+
+async function signState(uid: string, exp: number, secret: string): Promise<string> {
+	const payload = b64url(new TextEncoder().encode(JSON.stringify({ uid, exp })));
+	const sig = b64url(
+		new Uint8Array(await crypto.subtle.sign("HMAC", await hmacKey(secret), new TextEncoder().encode(payload))),
+	);
+	return `${payload}.${sig}`;
+}
+
+async function verifyState(token: string, secret: string): Promise<string | null> {
+	try {
+		const [payload, sig] = token.split(".");
+		if (!payload || !sig) return null;
+		const valid = await crypto.subtle.verify(
+			"HMAC",
+			await hmacKey(secret),
+			unb64url(sig),
+			new TextEncoder().encode(payload),
+		);
+		if (!valid) return null;
+		const { uid, exp } = JSON.parse(new TextDecoder().decode(unb64url(payload))) as {
+			uid: string;
+			exp: number;
+		};
+		if (typeof uid !== "string" || typeof exp !== "number") return null;
+		if (exp < Math.floor(Date.now() / 1000)) return null;
+		return uid;
+	} catch {
+		return null;
+	}
+}
+
+async function storedRefreshToken(env: Env, userId: string): Promise<string> {
+	if (!env.KEY_ENCRYPTION_KEY) throw new HttpError(500, "Key encryption not configured");
+	const row = await env.DB.prepare(
+		"SELECT key_ciphertext, dek_wrapped, iv FROM user_api_keys WHERE user_id = ?1 AND provider = ?2",
+	)
+		.bind(userId, PROVIDER)
+		.first<{ key_ciphertext: ArrayBuffer; dek_wrapped: ArrayBuffer; iv: ArrayBuffer }>();
+	if (!row) throw new HttpError(400, "Zoho WorkDrive is not connected");
+	return decryptKey(
+		new Uint8Array(row.key_ciphertext),
+		new Uint8Array(row.dek_wrapped),
+		new Uint8Array(row.iv),
+		env.KEY_ENCRYPTION_KEY,
+	);
+}
+
+workdriveRoutes.get("/zoho/start", async (c) => {
+	const session = await requireUser(c);
+	if (!c.env.ZOHO_CLIENT_ID || !c.env.ZOHO_CLIENT_SECRET) {
+		throw new HttpError(503, "Zoho WorkDrive connection is not configured on this deployment");
+	}
+	const state = await signState(
+		session.uid,
+		Math.floor(Date.now() / 1000) + STATE_TTL_SECONDS,
+		c.env.SESSION_SIGNING_KEY,
+	);
+	const url = new URL(`${workDriveAccountsBase(c.env)}/oauth/v2/auth`);
+	url.searchParams.set("client_id", c.env.ZOHO_CLIENT_ID);
+	url.searchParams.set("redirect_uri", redirectUri(c));
+	url.searchParams.set("response_type", "code");
+	url.searchParams.set("scope", WORKDRIVE_SCOPE);
+	url.searchParams.set("access_type", "offline");
+	url.searchParams.set("prompt", "consent");
+	url.searchParams.set("state", state);
+	return c.json({ url: url.toString() });
+});
+
+workdriveRoutes.get("/status", async (c) => {
+	const session = await requireUser(c);
+	const configured = !!(c.env.ZOHO_CLIENT_ID && c.env.ZOHO_CLIENT_SECRET);
+	const row = await c.env.DB.prepare(
+		"SELECT created_at, account_label FROM user_api_keys WHERE user_id = ?1 AND provider = ?2",
+	)
+		.bind(session.uid, PROVIDER)
+		.first<{ created_at: string; account_label: string | null }>();
+	return c.json({ connected: !!row, account: row?.account_label ?? null, connectedAt: row?.created_at ?? null, configured });
+});
+
+workdriveRoutes.delete("/zoho", async (c) => {
+	const session = await requireUser(c);
+	await c.env.DB.prepare(
+		"DELETE FROM user_api_keys WHERE user_id = ?1 AND provider = ?2",
+	)
+		.bind(session.uid, PROVIDER)
+		.run();
+	return c.json({ success: true });
+});
+
+workdriveRoutes.get("/zoho/callback", async (c) => {
+	const code = c.req.query("code");
+	const stateRaw = c.req.query("state");
+	if (!code || !stateRaw) return c.text("missing code or state", 400);
+	if (!c.env.ZOHO_CLIENT_ID || !c.env.ZOHO_CLIENT_SECRET) {
+		return c.text("Zoho WorkDrive connection is not configured", 503);
+	}
+	if (!c.env.KEY_ENCRYPTION_KEY) return c.text("Key encryption not configured", 500);
+
+	const uid = await verifyState(stateRaw, c.env.SESSION_SIGNING_KEY);
+	if (!uid) return c.text("invalid or expired state", 400);
+
+	const tokenRes = await fetch(`${workDriveAccountsBase(c.env)}/oauth/v2/token`, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			client_id: c.env.ZOHO_CLIENT_ID,
+			client_secret: c.env.ZOHO_CLIENT_SECRET,
+			code,
+			redirect_uri: redirectUri(c),
+			grant_type: "authorization_code",
+		}),
+	});
+	if (!tokenRes.ok) return c.text(`Zoho WorkDrive token exchange failed (${tokenRes.status})`, 400);
+	const tok = (await tokenRes.json()) as { refresh_token?: string };
+	if (!tok.refresh_token) {
+		return c.text(
+			"Zoho did not return a refresh token. Revoke this app in Zoho Accounts and reconnect WorkDrive.",
+			400,
+		);
+	}
+
+	const { ciphertext, dekWrapped, iv } = await encryptKey(
+		tok.refresh_token,
+		c.env.KEY_ENCRYPTION_KEY,
+	);
+	await c.env.DB.prepare(
+		`INSERT INTO user_api_keys (user_id, provider, key_ciphertext, dek_wrapped, iv, account_label, created_at)
+     VALUES (?1, ?2, ?3, ?4, ?5, ?6, datetime('now'))
+     ON CONFLICT(user_id, provider) DO UPDATE SET
+       key_ciphertext = excluded.key_ciphertext,
+       dek_wrapped = excluded.dek_wrapped,
+       iv = excluded.iv,
+       account_label = excluded.account_label,
+       created_at = excluded.created_at`,
+	)
+		.bind(uid, PROVIDER, ciphertext, dekWrapped, iv, "Zoho WorkDrive")
+		.run();
+
+	return c.html(
+		"<!doctype html><title>Zoho WorkDrive connected</title><body style='font-family:system-ui;display:grid;place-items:center;height:100vh;margin:0'><div style='text-align:center'><h1>Zoho WorkDrive connected</h1><p>You can close this tab and return to ProAgentStore.</p></div></body>",
+	);
+});
+
+workdriveRoutes.get("/folder", async (c) => {
+	const session = await requireUser(c);
+	const folder = c.req.query("folder") || c.req.query("url") || "";
+	if (!folder) throw new HttpError(400, "folder or url required");
+	const limit = Number(c.req.query("limit")) || undefined;
+	const offset = Number(c.req.query("offset")) || undefined;
+	const refresh = await storedRefreshToken(c.env, session.uid);
+	const accessToken = await mintWorkDriveAccessToken(c.env, refresh);
+	return c.json(await listWorkDriveFolder(c.env, accessToken, folder, { limit, offset }));
+});
+
+workdriveRoutes.post("/instances/:instanceId/import", async (c) => {
+	const session = await requireUser(c);
+	const instanceId = c.req.param("instanceId");
+	await requireOwnedInstance(c.env, instanceId, session.uid);
+	const body = (await c.req.json().catch(() => ({}))) as { resourceId?: string; url?: string; title?: string };
+	const fileRef = body.resourceId || body.url;
+	if (!fileRef) throw new HttpError(400, "resourceId or url required");
+
+	const refresh = await storedRefreshToken(c.env, session.uid);
+	const accessToken = await mintWorkDriveAccessToken(c.env, refresh);
+	const file = await exportWorkDriveFile(c.env, accessToken, fileRef);
+	const title = (body.title?.trim() || file.name || "Zoho WorkDrive import").slice(0, 500);
+	const stub = c.env.AGENT.get(c.env.AGENT.idFromName(instanceId));
+	const doRes = await stub.fetch(
+		new Request("https://agent/knowledge", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				title,
+				content: file.text,
+				source: "workdrive",
+				sourceUrl: file.permalink,
+			}),
+		}),
+	);
+	const payload = (await doRes.json()) as Record<string, unknown>;
+	return c.json(
+		{ ...payload, workdriveFile: { id: file.id, name: file.name, mimeType: file.mimeType, permalink: file.permalink } },
+		(doRes.ok ? 201 : doRes.status) as ContentfulStatusCode,
+	);
+});
diff --git a/workers/api/src/types.ts b/workers/api/src/types.ts
index 209c7d149..eacc2112f 100644
--- a/workers/api/src/types.ts
+++ b/workers/api/src/types.ts
@@ -37,6 +37,13 @@ export interface Env {
 	/** Google OAuth client used for the Gmail email-access connection. */
 	GOOGLE_CLIENT_ID?: string;
 	GOOGLE_CLIENT_SECRET?: string;
+	/** Zoho OAuth client used for the WorkDrive read-only connector. */
+	ZOHO_CLIENT_ID?: string;
+	ZOHO_CLIENT_SECRET?: string;
+	/** Optional Zoho DC overrides, e.g. https://accounts.zoho.com.au and https://www.zohoapis.com.au/workdrive. */
+	ZOHO_ACCOUNTS_BASE?: string;
+	ZOHO_WORKDRIVE_API_BASE?: string;
+	ZOHO_WORKDRIVE_DOWNLOAD_BASE?: string;
 	/** Web Push (VAPID). Public key is non-secret; private key is a secret. */
 	VAPID_PUBLIC_KEY?: string;
 	VAPID_PRIVATE_KEY?: string;
diff --git a/workers/api/wrangler.toml b/workers/api/wrangler.toml
index f185296ad..2a3de87b7 100644
--- a/workers/api/wrangler.toml
+++ b/workers/api/wrangler.toml
@@ -22,6 +22,11 @@ PLATFORM_AI_ENABLED = "true"
 #                               # account. Set together with the STRIPE_* secrets.
 # PAYWALL_ENFORCE = "1"         # SOFT LAUNCH: leave unset until Stripe is wired + verified.
 #                               # "1" enforces the free tier (2 agents, Pro-only runner).
+# Zoho WorkDrive connector:
+# ZOHO_CLIENT_ID = "1000.…"     # Zoho OAuth client id (server-based app)
+# ZOHO_ACCOUNTS_BASE = "https://accounts.zoho.com"          # Optional DC override: .com.au, .eu, .in, …
+# ZOHO_WORKDRIVE_API_BASE = "https://www.zohoapis.com/workdrive"
+# ZOHO_WORKDRIVE_DOWNLOAD_BASE = "https://download.zoho.com"
 
 [[d1_databases]]
 binding = "DB"
@@ -83,6 +88,7 @@ new_classes = ["RelayDO"]
 # VAPID_PUBLIC_KEY  (Web Push, also non-secret — served via /v1/push/vapid-key)
 # VAPID_PRIVATE_KEY (Web Push signing — secret)
 # VAPID_SUBJECT     (mailto: contact)
+# ZOHO_CLIENT_SECRET
 # GITHUB_APP_ID          (coding workspace — GitHub App for repo access; optional)
 # GITHUB_APP_PRIVATE_KEY (coding workspace — App private key PEM; optional)
 # GITHUB_APP_SLUG        (coding workspace — App slug for install URLs; optional)