Anesis

Command Palette

Search for a command to run...

Authentication

Browser login, local session storage, and when auth is actually needed

Anesis stores a local auth session in ~/.anesis/auth.json, uses the backend for login initiation and account fetches, and only needs that session for flows that touch the remote registry or other protected endpoints.

anesis loginanesis accountanesis logoutUnix auth file mode 0600

The auth commands

These are the only dedicated auth commands exposed by the current CLI.

anesis login
anesis account
anesis logout

If you are already logged in, Anesis asks for confirmation before starting a new login flow, so re-running anesis login is a safe way to switch accounts.

What anesis login does

The login command is a browser-based flow with CSRF protection and a local callback server.

  1. Generate a random state token for CSRF protection.
  2. Open the browser to <backend>/auth/cli-login?state=....
  3. Start a local auth server and wait for the frontend callback.
  4. Serialize the returned user payload into ~/.anesis/auth.json.
  5. On Unix, the file is written with owner-only permissions 0600.

What anesis account does

Account lookup confirms who you are signed in as.

anesis account uses the saved bearer token and prints the GitHub login returned by /user/info. If no session is saved, it asks you to log in first.

What anesis logout does

Logout is intentionally small: it removes the local auth file.

If ~/.anesis/auth.json exists, Anesis deletes it and prints Logout successful. If the file is missing, the command exits with an error instead of silently succeeding.

No remote revocation call is sent from the current CLI implementation — logging out only clears local state.

When authentication is required

Some commands always reach the backend; others work entirely from the local cache.

Commands that require auth

  • anesis template install, anesis addon install, and anesis stack install always talk to the backend registry.
  • anesis template publish/update, anesis addon publish/update, and anesis stack publish/update send authenticated mutations.
  • anesis account fetches the current user from the backend.
  • anesis new, anesis use <addon-id> <command>, and anesis new --stack <id> require auth only when they must download an uncached template, addon, or stack first.
  • anesis search and anesis outdated reach the backend but degrade gracefully (empty or partial results) without a session.

Commands that can run fully locally

  • anesis template list/remove, anesis addon list/remove, and anesis stack list/remove operate on local cache files only.
  • anesis template link and anesis addon link validate and cache a local directory — no network call.
  • anesis new, anesis use <addon-id> <command>, and anesis new --stack <id> can all run without logging in once the template/addon/stack is already cached locally.
  • anesis undo, anesis update <addon-id> (project-level upgrade), and anesis status operate on the current project's anesis.lock/anesis.json.
  • anesis mcp itself starts locally; individual tool calls follow the same rules as their underlying commands.

Token-based auth for CI and agents

A personal access token bypasses the browser flow entirely — the same session file is never touched.

  • Set ANESIS_TOKEN to a personal access token (create one on /account/tokens) to skip the browser flow entirely — every authenticated command uses it instead.
  • get_auth_user checks ANESIS_TOKEN first, before falling back to ~/.anesis/auth.json, so a token in the environment always takes priority.
  • This is the auth path used by CI and the anesis mcp server — see the AI Agents & MCP page for the full setup.

See AI Agents & MCP for the full token setup and the anesis mcp server.

Using Templates