reticle login is one tool, not a second binary.
/v1 API. The moat is the server, not the verbs.
Where credentials live
Auth for any command is
RETICLE_CLOUD_KEY from the environment (the agent path) if set, otherwise the login token. RETICLE_CLOUD_URL overrides the endpoint; the default is http://localhost:8890.
The commands
reticle login
--email, it runs a browser device flow like gh auth login: fetch a device and user code, open the browser to approve, poll until confirmed. With --email it keeps the two-step code path for CI and servers, because it proves you own the inbox before handing out a session. A local cloud whose dev mailer cannot deliver echoes the code back and completes in one command.
reticle logout
Empties session.json. Per-project keys in credentials.json stay. Prints { "loggedOut": true }.
reticle whoami
The one call to make when you do not know your state. Real capture:
reticle link.
reticle link
RETICLE_CLOUD_KEY already set, it resolves that key’s project instead. --project accepts a slug id or a display name; omitted, it uses the default project. Writes cloud.json and the key.
reticle project
rename and rm work but are not in the usage block. Missing or malformed arguments exit 2.
reticle config
.reticle/cloud.json in place. Any value other than on or off (or local or server for --verify) exits 2. Requires the repo to be linked.
reticle push
Sends local run artifacts from .reticle to the linked project, honoring the sync policy. With sync.runs off it does nothing and says so. Prints { pushed, failed, total, project }.
reticle runs
The linked project’s recent run artifacts. The key scopes the query server-side.
reticle regression
The CI gate: which flows broke relative to before. Exits 3 when any flow regressed, which is the whole point of it being a separate command.
reticle share
runId exits 2.
Exit codes
Output is pretty-printed JSON on stdout. Errors and next-step nudges go to stderr, so an agent parsing stdout is unaffected.