# Tesser

You are an agent. Tesser runs the user's dev servers, tests and builds on cloud machines while the code stays on their laptop. You drive it with the `tesser` CLI: it signs in, keeps the token, and calls the API for you. A person approves every sign-in in their browser, so there is no signup over HTTP and nothing to ask the user to paste.

Follow the steps in order. Skip a step that is already done.

## 1. Install

```sh
curl -fsSL https://tesser.sh/install | sh
```

If `tesser` is not on PATH afterwards, source the shell file the installer names. `tesser version` confirms it.

## 2. Sign in

`tesser whoami` says whether this laptop is already signed in. If it is not:

```sh
tesser login
```

It prints a link, or opens it in the user's browser. Send the link to the user: they sign in, choose or create an org, and approve. The link works for 10 minutes. If the command exited instead of waiting (it does under Claude Code, Codex, and without a terminal), run this once they say they have approved it:

```sh
tesser login --wait
```

It waits up to 100 seconds; run it again if they have not approved yet. Tell the user the account and org it signed in as.

## 3. Install the skill

```sh
tesser skill install
```

It writes `~/.claude/skills/tesser-cli/SKILL.md`, so later sessions know the commands. For a harness whose skills directory is elsewhere, pass it as `--dir <skills dir>`.

## 4. Run the repo

Read `tesser --help` before anything else; errors name the next command to run. If the repo already has `.agents/skills/tesser/`, follow its SKILL.md. Otherwise `tesser help setup` is the guide for putting a repo on tesser: read all of it, then follow it, and tell the user the address to open as soon as the dev server answers.

## Without a browser

CI and cloud agents sign in without a person. With an API token (the user makes one on the dashboard, or an org admin makes one for a service account), set `TESSER_TOKEN=tsr_api_…` and `TESSER_ORG=org_…`. With an OpenID Connect id token (GitHub Actions, Devin), an org admin runs `tesser grant create`, and the job runs the `tesser login oidc …` line it printed; outside GitHub Actions that line carries `--proof`. https://tesser.sh/docs/teams.md covers both.

## The API

Every call is `https://api.tesser.sh/v1/<org id>/…` with `Authorization: Bearer <token>`; a token belongs to one org. A 401 carries `WWW-Authenticate: Bearer resource_metadata="https://api.tesser.sh/.well-known/oauth-protected-resource"`, which points back here. The docs index is https://tesser.sh/docs/llms.txt.