… skills

Move Telegram reply() out of skill SKILL.md files into the routine .py
callers via notify_telegram=True on run_skill(). This guarantees exactly
one send per execution — the instruction is appended at the end of the
prompt after all skill steps, so the agent cannot send it early.

- runner.py: add notify_telegram param to run_skill() — reads chat_id
  from TELEGRAM_CHAT_ID env, appends explicit one-shot instruction
- Skills cleaned: prod-end-of-day, prod-good-morning, pulse-faq-sync,
  pulse-daily (custom files gitignored, updated locally)
- Routines updated: end_of_day, good_morning (custom routines gitignored)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Telegram notification was still in the skill file, causing the agent
to call reply() multiple times per run (3x observed on 25/04 at 06:51).

Notification now controlled by notify_telegram=True in review_todoist.py
(gitignored custom routine, already updated on disk).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

… cwd

Ticket threads pass workspace_path (e.g. workspace/personal/) as the
session cwd. loadAgentFile was building the path relative to that cwd,
so it looked for .claude/agents/ inside the ticket's folder instead of
the workspace root — always failing for every agent.

Fix: try WORKSPACE_ROOT/.claude/agents/{name}.md first, fall back to
cwd for custom per-directory agents.

Affected: kai-personal-assistant, flux-finance, and any ticket with
a workspace_path set.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…template

Root cause: notify_telegram instruction showed reply(chat_id=..., text="...")
as an inline code snippet, causing the agent to execute it immediately on
reading the instruction AND again at the end — 2x per instruction.

Financial Pulse was getting 4x because the skill's Step 8 also contained
a reply() call instruction (2 instructions × 2 executions = 4 messages).

Fixes:
- runner.py: rewrite notify_telegram prompt to describe the action in
  plain text without an inline function-call template
- fin-daily-pulse SKILL.md: remove Step 8 Telegram section — notification
  is handled by the routine caller via notify_telegram=True

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Comprehensive sweep of all 175+ skills. Root cause of all duplicate
Telegram notifications: skills contained inline reply(chat_id=...) code
examples that Claude executed immediately on reading, then called again
at the actual end-of-skill step — causing 2x (or 4x when combined with
a second instruction from notify_telegram=True in the routine).

Changes:
- Removed "Notify via Telegram" sections entirely from 10 skills that
  have a corresponding routine using notify_telegram=True:
  fin-weekly-report, gog-email-triage, prod-dashboard, prod-trends,
  pulse-monthly, pulse-weekly, sage-strategy-digest,
  fin-monthly-close-kickoff, social-analytics-report, social-youtube-report

- Rewrote Telegram instructions without inline reply() code in 4 skills
  that are called without notify_telegram (heartbeat or conditional):
  int-sync-meetings, int-github-review, int-linear-review (plain text),
  custom-getfy-sync, custom-omc-sync (plain text, local/gitignored)

The corresponding routines (gitignored) were updated locally to add
notify_telegram=True where the section was removed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

… routing

- Base: upstream main (v0.33.0) with all official updates
- Added: TKR security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy)
- Added: CORS CSRF token support (X-CSRF-Token headers)
- Added: Provider failover chain (getProviderCandidates, resolveProviderChain)
- Added: Platform observability, cache, queue, and metrics modules
- Added: Runtime config, structured logging, request/session security
- Added: Frontend: CommandPalette, ThemeContext, Observability page, SecurityTab
- Preserved: upstream OpenRouter Smart Router native integration
- Adapted: Provider-config.js enhanced with routing and default_model support

v0.33.0 — plugin contract bundle (PRs EvolutionAPI#52→EvolutionAPI#56) + install error surfacing

- Add /api/onboarding/workspace-status endpoint to detect configured workspace
- Auto-skip onboarding in create_user() when workspace is ready
- Fix false positive: check providers.json file exists (not _read_config fallback)
- Auto-skip in OnboardingRouter for pre-existing users with state=null
- Add 'Use existing workspace' button to Welcome screen
- Add translation keys for workspace-ready banner