Add the Ezra relay bridge (Resonant-backed seat) and a Porter scratch seat

app.py

@@ -176,6 +176,12 @@ def _install_security_middleware(token: str, cfg: dict):
         f"http://127.0.0.1:{port}",
         f"http://localhost:{port}",
     }
+    # Deliberately-published origins (e.g. the tailscale serve hostname).
+    # Config-driven so the surface never widens by accident: list each
+    # published origin explicitly in [server] extra_origins in config.toml.
+    for _origin in cfg.get("server", {}).get("extra_origins", []):
+        if isinstance(_origin, str) and _origin.strip():
+            allowed_origins.add(_origin.strip().rstrip("/"))
 
     class SecurityMiddleware(BaseHTTPMiddleware):
         async def dispatch(self, request: Request, call_next):

config.toml

@@ -2,6 +2,8 @@
 port = 8300
 host = "127.0.0.1"
 data_dir = "./data"
+# Published via tailscale serve (tailnet only — Resonant holds 443, room takes 8443).
+extra_origins = ["https://thinkcenter1.taile058ce.ts.net:8443"]
 
 # Add agents here. Each gets a status pill, @mention routing, and color.
 # "cwd" is the working directory for the agent's terminal session.
@@ -13,6 +15,29 @@ cwd = ".."
 color = "#da7756"
 label = "Claude"
 
+# Ezra — the Resonant-backed companion, attached via relay (wrapper_ezra.py).
+# NO CLI is spawned and there is no cwd: @ezra mentions are delivered to the
+# already-running Resonant service over loopback, and his replies post back.
+# The reserved name is used here because this seat IS the real Ezra.
+[agents.ezra]
+type = "api"
+color = "#e8a87c"
+label = "Ezra"
+resonant_url = "http://127.0.0.1:3099"
+internal_token_file = 'C:\Users\aipro\Documents\Codex\Karma-Assistant-System\resonant-app\data\.internal-token'
+
+# Porter — a generic Claude CLI worker seat in a neutral scratch folder.
+# cwd is deliberately away from resonant-app (resonant.db one-writer rule).
+[agents.porter]
+command = "claude"
+cwd = 'C:\Users\aipro\Claude\scratch\porter'
+color = "#7ca982"
+label = "Porter"
+mcp_inject = "flag"
+mcp_flag = "--mcp-config"
+mcp_transport = "http"
+mcp_merge_project = true
+
 [agents.codex]
 command = "codex"
 cwd = ".."

windows/start_ezra_relay.bat

@@ -0,0 +1,31 @@
+@echo off
+REM agentchattr — starts server (if not running) + Ezra relay (Resonant bridge)
+REM No CLI is spawned: this bridges @ezra mentions to the RUNNING Resonant
+REM service. Start Resonant first (Start-Karma-Assistant) or this will exit.
+cd /d "%~dp0.."
+
+REM Auto-create venv and install deps on first run
+if not exist ".venv" (
+    python -m venv .venv
+    .venv\Scripts\pip install -q -r requirements.txt >nul 2>nul
+)
+call .venv\Scripts\activate.bat
+
+REM Start server if not already running, then wait for it
+netstat -ano | findstr :8300 | findstr LISTENING >nul 2>&1
+if %errorlevel% neq 0 (
+    start "agentchattr server" cmd /c "python run.py"
+)
+:wait_server
+netstat -ano | findstr :8300 | findstr LISTENING >nul 2>&1
+if %errorlevel% neq 0 (
+    timeout /t 1 /nobreak >nul
+    goto :wait_server
+)
+
+python wrapper_ezra.py
+if %errorlevel% neq 0 (
+    echo.
+    echo   Relay exited unexpectedly. Check the output above.
+    pause
+)

windows/start_porter.bat

@@ -0,0 +1,40 @@
+@echo off
+REM agentchattr — starts server (if not running) + Porter wrapper (Claude worker, ask-permissions)
+cd /d "%~dp0.."
+
+REM Auto-create venv and install deps on first run
+if not exist ".venv" (
+    python -m venv .venv
+    .venv\Scripts\pip install -q -r requirements.txt >nul 2>nul
+)
+call .venv\Scripts\activate.bat
+
+REM Pre-flight: check that claude CLI is installed
+where claude >nul 2>&1
+if %errorlevel% neq 0 (
+    echo.
+    echo   Error: "claude" was not found on PATH.
+    echo   Install it first, then try again.
+    echo.
+    pause
+    exit /b 1
+)
+
+REM Start server if not already running, then wait for it
+netstat -ano | findstr :8300 | findstr LISTENING >nul 2>&1
+if %errorlevel% neq 0 (
+    start "agentchattr server" cmd /c "python run.py"
+)
+:wait_server
+netstat -ano | findstr :8300 | findstr LISTENING >nul 2>&1
+if %errorlevel% neq 0 (
+    timeout /t 1 /nobreak >nul
+    goto :wait_server
+)
+
+python wrapper.py porter
+if %errorlevel% neq 0 (
+    echo.
+    echo   Agent exited unexpectedly. Check the output above.
+    pause
+)