[codex] Add daemon-backed CLI chat

AGENTS.md

@@ -148,7 +148,7 @@ Kassiber is currently in **dev mode**: renaming commands, breaking flags, and re
 
 ## Command surface
 
-- `init`, `status`, `daemon`, `context {show,current,set}`
+- `init`, `status`, `daemon`, `chat`, `context {show,current,set}`
 - `secrets {init,init-resume,change-passphrase,verify,status,migrate-credentials}`
 - `backup {export,import}`
 - `workspaces {list,create}`
@@ -168,7 +168,8 @@ Kassiber is currently in **dev mode**: renaming commands, breaking flags, and re
 - `rates {pairs,sync,rebuild,latest,range,set}`
 - `diagnostics {collect}`
 - `ai providers {list,get,create,update,delete,set-default,clear-default}`
-- `ai {models,chat}`
+- `ai {models,chat}` — provider/model management plus legacy provider-only chat;
+  use top-level `chat` for the daemon-backed tool loop with consent/cancel parity.
 
 ## Pagination
 
@@ -336,6 +337,7 @@ uv run python -m kassiber reports export-austrian-e1kv-csv --help
 uv run python -m kassiber reports balance-history --help
 uv run python -m kassiber rates --help
 uv run python -m kassiber diagnostics collect --help
+uv run python -m kassiber chat --help
 uv run python -m kassiber ai --help
 uv run python -m kassiber ai providers --help
 uv run python -m kassiber ai providers create --help

README.md

@@ -58,8 +58,9 @@ workflow almost nobody else covers.
   [jlopp/physical-bitcoin-attacks](https://github.com/jlopp/physical-bitcoin-attacks)
   catalog covers the threats this addresses.
 - **Local AI Chat** — assistant defaults to local
-  [Ollama](https://ollama.com/); off-device providers require explicit
-  per-provider acknowledgement and per-tool consent.
+  [Ollama](https://ollama.com/); the desktop Assistant and `kassiber chat`
+  both use the same daemon tool loop. Off-device providers require explicit
+  per-provider acknowledgement and mutating tools require consent.
 - **AGPL 3.0** — auditable, forkable, no vendor lock-in.
 
 ## Highlights
@@ -131,8 +132,9 @@ python3 -m kassiber reports summary
 
 For transfer pairing, swap matching, source-of-funds, Austrian E 1kv,
 BTCPay reconciliation, and the concept model, see
-[docs/quickstart.md](docs/quickstart.md). Both surfaces speak the same
-Python daemon, so a daily flow can move freely between them.
+[docs/quickstart.md](docs/quickstart.md). The desktop GUI is optional:
+the Assistant sidebar and `kassiber chat` speak the same Python daemon, so a
+daily flow can move freely between them.
 
 ## Architecture
 

docs/reference/ai.md

@@ -18,8 +18,8 @@ Two surfaces ship today:
   assistants.
 - An **in-app assistant** in the desktop UI that streams chat from an
   OpenAI-compatible endpoint or fixed Claude/Codex CLI adapter, plus a
-  parallel CLI surface (`kassiber ai providers …`, `kassiber ai models`,
-  `kassiber ai chat`) that reuses the same provider config.
+  parallel CLI surface (`kassiber chat`, `kassiber ai providers …`,
+  `kassiber ai models`) that reuses the same provider config.
 
 The repo-local skill helps an AI assistant use the Kassiber CLI safely and
 correctly for:
@@ -138,9 +138,23 @@ printf '%s\n' "$OPENAI_API_KEY" | kassiber ai providers create openai --base-url
 kassiber ai providers create claude-cli --base-url claude-cli://default --kind remote --acknowledge --default-model default
 kassiber ai providers set-default openai
 kassiber ai models
-kassiber ai chat "Summarise the last week of imports."
+kassiber chat "Summarise the last week of imports."
+kassiber chat
 ```
 
+`kassiber chat` is the CLI client for the same daemon-backed assistant used by
+the desktop UI. It starts a local daemon transport, sends `ai.chat` requests
+with `tools_enabled=true`, renders streaming deltas in the terminal, and sends
+`ai.tool_call.consent` decisions when mutating tools ask for approval. Omit the
+prompt for REPL mode; pass a prompt positionally or with `--prompt` for one
+turn. `kassiber ai chat` remains a provider-only compatibility command and
+does not run the daemon tool loop.
+
+For automation, `kassiber chat --yes "..."` approves mutating tool requests for
+that chat session without prompting. Prefer the narrower
+`--allow-tool ui.journals.process` form when a script should approve only one
+tool; unlisted mutating tools are denied without a TTY.
+
 Provider API-key entry supports `--api-key-stdin` and `--api-key-fd FD`. The
 legacy `--api-key <value>` form still works as a warning-on-use compatibility
 shim, but docs and tests avoid it because argv can land in shell history and
@@ -198,7 +212,8 @@ with phases such as `preparing`, `connecting`, and `waiting_for_model`. These
 records are UI progress hints only; chain-of-thought is shown only when the
 provider emits inline `<think>` content or structured `reasoning` deltas.
 
-Pressing **Stop** sends `ai.chat.cancel` with
+Pressing **Stop** in the desktop UI, choosing cancel at a terminal consent
+prompt, or interrupting `kassiber chat` sends `ai.chat.cancel` with
 `args.target_request_id = <active ai.chat request_id>`. Cancellation is
 best-effort and cooperative: Kassiber stops forwarding deltas once the Python
 worker returns between provider chunks, then emits the terminal `ai.chat`
@@ -207,7 +222,7 @@ tokens already generated or in flight may still be billed.
 
 ## Tool use
 
-The in-app assistant can opt into a bounded tool loop with
+The desktop assistant and `kassiber chat` opt into a bounded tool loop with
 `ai.chat` top-level args:
 
 ```json