reware-lighthouse 0.1.0__tar.gz

reware_lighthouse-0.1.0/CHANGELOG.md

@@ -0,0 +1,13 @@
+# Changelog
+
+## 0.1.0 (2026-10-06)
+
+First public release of `reware-lighthouse`.
+
+- One `reware-lighthouse` command: `login`, `logout`, `init`, `deinit`, `status`, `scan`, `mcp`.
+- Production endpoint by default; key verified before it is saved; noninteractive login.
+- `init` installs an explicit-only `lighthouse-enhance` skill for Claude Code and Codex, an MCP
+  config, and a pre-commit scan hook. `deinit` removes only unchanged owned content.
+- Branch-aware enhancement (explicit branch, attached branch, then default) with visible warnings.
+- Minimum-version upgrade guidance (`uv tool upgrade` / `pipx upgrade`).
+- Runs on macOS, Linux and Windows (the hook runs through Git for Windows).

reware_lighthouse-0.1.0/LICENSE

@@ -0,0 +1,13 @@
+Copyright (c) 2026 RewareLabs. All rights reserved.
+
+You may install and run this software, unmodified, to use the Lighthouse service
+(https://lighthouse.rewarelabs.com).
+
+You may not copy, modify, merge, publish, distribute, sublicense or sell it, or
+reverse engineer it, except as this notice allows or applicable law permits.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL REWARELABS BE LIABLE FOR
+ANY CLAIM, DAMAGES OR OTHER LIABILITY ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR ITS USE.

reware_lighthouse-0.1.0/PKG-INFO

@@ -0,0 +1,152 @@
+Metadata-Version: 2.5
+Name: reware-lighthouse
+Version: 0.1.0
+Summary: Lighthouse developer CLI — link a repo to a project, enhance prompts, and scan commits
+Project-URL: Homepage, https://lighthouse.rewarelabs.com
+Author: RewareLabs
+License-Expression: LicenseRef-Proprietary
+License-File: LICENSE
+Keywords: ai-agents,claude-code,code-scanning,codex,mcp,pre-commit,security
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Requires-Dist: httpx<1,>=0.28
+Requires-Dist: mcp<3,>=2.0.0
+Provides-Extra: dev
+Requires-Dist: pytest-asyncio<2,>=0.25; extra == 'dev'
+Requires-Dist: pytest<10,>=8.3; extra == 'dev'
+Requires-Dist: respx<1,>=0.22; extra == 'dev'
+Requires-Dist: ruff<1,>=0.12; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# reware-lighthouse
+
+`reware-lighthouse` connects your Git repository to [Lighthouse](https://lighthouse.rewarelabs.com), so your coding agent gets security guidance for your codebase and every commit is scanned before it lands.
+
+It works with Claude Code and Codex on macOS, Linux, and Windows, and needs Python 3.11 or newer. On Windows, the pre-commit hook runs through [Git for Windows](https://gitforwindows.org).
+
+## Quickstart
+
+```bash
+$ uv tool install reware-lighthouse    # or: pipx install reware-lighthouse
+$ reware-lighthouse login              # paste the API key from your dashboard
+$ cd your-repo
+$ reware-lighthouse init
+$ reware-lighthouse status
+```
+
+Restart your coding agent afterward so it picks up the new skill and MCP server.
+
+What just happened?
+
+1. `login` verified your API key and saved it to `~/.config/lighthouse/config.env`.
+2. `init` linked the repository to its Lighthouse project, installed a pre-commit hook, and added the agent skill.
+3. `status` checked that your account, project link, and tooling all work.
+
+You'll need an API key first. Create one on the Lighthouse dashboard. It's shown once, so copy it right away.
+
+## Enhance a coding request
+
+Enhancement adds your repository's security rules to a request before your agent starts coding. It only runs when you ask for it, so ordinary requests are never changed.
+
+In Claude Code:
+
+```text
+/lighthouse-enhance add a password reset endpoint
+```
+
+In Codex, invoke the `lighthouse-enhance` skill with the same request.
+
+Your agent tells you which branch's rules it used, plus any warnings, such as a branch that has no repository-specific rules yet. If enhancement fails, the agent stops and asks before continuing without it. Every enhancement appears in your dashboard history.
+
+To pick a branch, start the request with `--branch`:
+
+```text
+/lighthouse-enhance --branch release add a password reset endpoint
+```
+
+Without the flag, Lighthouse uses the branch attached to your checkout, then the project's default branch.
+
+## Scan commits
+
+The pre-commit hook runs `reware-lighthouse scan` on your staged changes. Whether a finding blocks the commit depends on the blocking policy saved for your project.
+
+If the API is unreachable or the scan times out, the commit goes through. To change the timeout, set `LIGHTHOUSE_SCAN_TIMEOUT` to a number of seconds.
+
+## What `init` creates
+
+| Path | Purpose |
+| --- | --- |
+| `~/.config/lighthouse/config.env` (mode `0600`) | Your API key, written by `login`. Never inside a repository. |
+| `.lighthouse/project.toml` | The link to your project (`owner/name`). It holds no secret, so it's safe to commit. |
+| `.git/hooks/pre-commit` | A marked block that runs the scan. If a hook already exists, the block is appended. |
+| `.mcp.json`, `.codex/config.toml` | The MCP server entry that runs `reware-lighthouse mcp`. |
+| `.claude/skills/lighthouse-enhance/`, `.agents/skills/lighthouse-enhance/` | The enhance skill, set to run only when you invoke it. |
+
+Use `--agent`, `--no-hook`, or `--no-mcp` to set up less. If a step can't finish, `init` reports which items were created, which were already in place, and which need you. Rerunning it is safe.
+
+Note that `init` never edits shared hook setups. If Git uses a shared or global hooks directory (`core.hooksPath` pointing outside the repository), or you use the pre-commit framework, add `reware-lighthouse scan` to that hook yourself. Edits you make to files `init` created are preserved.
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `login` | Saves and verifies your API key. Accepts `--api-key`, `--api-base`, and `--yes` to skip prompts. |
+| `logout` | Removes the saved key. A key set in the environment stays active. |
+| `init` | Links the repository and sets up the hook, MCP config, and skill. |
+| `deinit` | Removes what `init` created here, as long as you haven't edited it. Your key and scan reports stay. |
+| `status` | Checks your account, project link, and tooling. Exits nonzero if something's wrong. |
+| `scan` | Scans staged changes. Accepts `--project`, `--repo`, and `--branch`. The hook runs it for you. |
+| `mcp` | Runs the MCP server over stdio. Your agent starts it, so you rarely run it by hand. |
+
+Run any command with `--help` for an example.
+
+## Environment variables
+
+| Variable | Meaning |
+| --- | --- |
+| `LIGHTHOUSE_API_KEY` | Your API key. It works without `login`, and `logout` doesn't remove it. |
+| `LIGHTHOUSE_API_BASE_URL` | Use a different Lighthouse API endpoint. |
+| `LIGHTHOUSE_PROJECT` | Use this project instead of the link file or Git remote. |
+| `LIGHTHOUSE_SCAN_TIMEOUT` | Scan timeout in seconds. |
+
+## What leaves your machine
+
+- **Enhancement** sends the request you give the skill, plus the repository and branch. Lighthouse stores the original and enhanced prompts and shows them in your dashboard history.
+- **Pre-commit scans** send your staged diff.
+
+Scanning has known gaps in coverage and reporting that we're still working on. Treat it as one safeguard, not the only one.
+
+## Update
+
+```bash
+$ uv tool upgrade reware-lighthouse    # or: pipx upgrade reware-lighthouse
+```
+
+If the API needs a newer version, commands tell you to upgrade and show the commands above.
+
+## Uninstall
+
+Clean up before you remove the tool. Once it's gone, nothing is left to run `deinit` or `logout`.
+
+```bash
+$ reware-lighthouse deinit             # in each repository you set up
+$ reware-lighthouse logout
+$ uv tool uninstall reware-lighthouse  # or: pipx uninstall reware-lighthouse
+```
+
+`logout` only removes the key from your machine. To revoke it, ask an admin to rotate or delete it on the dashboard.
+
+## License
+
+Proprietary. See `LICENSE`.

reware_lighthouse-0.1.0/README.md

@@ -0,0 +1,121 @@
+# reware-lighthouse
+
+`reware-lighthouse` connects your Git repository to [Lighthouse](https://lighthouse.rewarelabs.com), so your coding agent gets security guidance for your codebase and every commit is scanned before it lands.
+
+It works with Claude Code and Codex on macOS, Linux, and Windows, and needs Python 3.11 or newer. On Windows, the pre-commit hook runs through [Git for Windows](https://gitforwindows.org).
+
+## Quickstart
+
+```bash
+$ uv tool install reware-lighthouse    # or: pipx install reware-lighthouse
+$ reware-lighthouse login              # paste the API key from your dashboard
+$ cd your-repo
+$ reware-lighthouse init
+$ reware-lighthouse status
+```
+
+Restart your coding agent afterward so it picks up the new skill and MCP server.
+
+What just happened?
+
+1. `login` verified your API key and saved it to `~/.config/lighthouse/config.env`.
+2. `init` linked the repository to its Lighthouse project, installed a pre-commit hook, and added the agent skill.
+3. `status` checked that your account, project link, and tooling all work.
+
+You'll need an API key first. Create one on the Lighthouse dashboard. It's shown once, so copy it right away.
+
+## Enhance a coding request
+
+Enhancement adds your repository's security rules to a request before your agent starts coding. It only runs when you ask for it, so ordinary requests are never changed.
+
+In Claude Code:
+
+```text
+/lighthouse-enhance add a password reset endpoint
+```
+
+In Codex, invoke the `lighthouse-enhance` skill with the same request.
+
+Your agent tells you which branch's rules it used, plus any warnings, such as a branch that has no repository-specific rules yet. If enhancement fails, the agent stops and asks before continuing without it. Every enhancement appears in your dashboard history.
+
+To pick a branch, start the request with `--branch`:
+
+```text
+/lighthouse-enhance --branch release add a password reset endpoint
+```
+
+Without the flag, Lighthouse uses the branch attached to your checkout, then the project's default branch.
+
+## Scan commits
+
+The pre-commit hook runs `reware-lighthouse scan` on your staged changes. Whether a finding blocks the commit depends on the blocking policy saved for your project.
+
+If the API is unreachable or the scan times out, the commit goes through. To change the timeout, set `LIGHTHOUSE_SCAN_TIMEOUT` to a number of seconds.
+
+## What `init` creates
+
+| Path | Purpose |
+| --- | --- |
+| `~/.config/lighthouse/config.env` (mode `0600`) | Your API key, written by `login`. Never inside a repository. |
+| `.lighthouse/project.toml` | The link to your project (`owner/name`). It holds no secret, so it's safe to commit. |
+| `.git/hooks/pre-commit` | A marked block that runs the scan. If a hook already exists, the block is appended. |
+| `.mcp.json`, `.codex/config.toml` | The MCP server entry that runs `reware-lighthouse mcp`. |
+| `.claude/skills/lighthouse-enhance/`, `.agents/skills/lighthouse-enhance/` | The enhance skill, set to run only when you invoke it. |
+
+Use `--agent`, `--no-hook`, or `--no-mcp` to set up less. If a step can't finish, `init` reports which items were created, which were already in place, and which need you. Rerunning it is safe.
+
+Note that `init` never edits shared hook setups. If Git uses a shared or global hooks directory (`core.hooksPath` pointing outside the repository), or you use the pre-commit framework, add `reware-lighthouse scan` to that hook yourself. Edits you make to files `init` created are preserved.
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `login` | Saves and verifies your API key. Accepts `--api-key`, `--api-base`, and `--yes` to skip prompts. |
+| `logout` | Removes the saved key. A key set in the environment stays active. |
+| `init` | Links the repository and sets up the hook, MCP config, and skill. |
+| `deinit` | Removes what `init` created here, as long as you haven't edited it. Your key and scan reports stay. |
+| `status` | Checks your account, project link, and tooling. Exits nonzero if something's wrong. |
+| `scan` | Scans staged changes. Accepts `--project`, `--repo`, and `--branch`. The hook runs it for you. |
+| `mcp` | Runs the MCP server over stdio. Your agent starts it, so you rarely run it by hand. |
+
+Run any command with `--help` for an example.
+
+## Environment variables
+
+| Variable | Meaning |
+| --- | --- |
+| `LIGHTHOUSE_API_KEY` | Your API key. It works without `login`, and `logout` doesn't remove it. |
+| `LIGHTHOUSE_API_BASE_URL` | Use a different Lighthouse API endpoint. |
+| `LIGHTHOUSE_PROJECT` | Use this project instead of the link file or Git remote. |
+| `LIGHTHOUSE_SCAN_TIMEOUT` | Scan timeout in seconds. |
+
+## What leaves your machine
+
+- **Enhancement** sends the request you give the skill, plus the repository and branch. Lighthouse stores the original and enhanced prompts and shows them in your dashboard history.
+- **Pre-commit scans** send your staged diff.
+
+Scanning has known gaps in coverage and reporting that we're still working on. Treat it as one safeguard, not the only one.
+
+## Update
+
+```bash
+$ uv tool upgrade reware-lighthouse    # or: pipx upgrade reware-lighthouse
+```
+
+If the API needs a newer version, commands tell you to upgrade and show the commands above.
+
+## Uninstall
+
+Clean up before you remove the tool. Once it's gone, nothing is left to run `deinit` or `logout`.
+
+```bash
+$ reware-lighthouse deinit             # in each repository you set up
+$ reware-lighthouse logout
+$ uv tool uninstall reware-lighthouse  # or: pipx uninstall reware-lighthouse
+```
+
+`logout` only removes the key from your machine. To revoke it, ask an admin to rotate or delete it on the dashboard.
+
+## License
+
+Proprietary. See `LICENSE`.

reware_lighthouse-0.1.0/pyproject.toml

@@ -0,0 +1,64 @@
+[project]
+name = "reware-lighthouse"
+version = "0.1.0"
+description = "Lighthouse developer CLI — link a repo to a project, enhance prompts, and scan commits"
+readme = "README.md"
+license = "LicenseRef-Proprietary"
+license-files = ["LICENSE"]
+authors = [{ name = "RewareLabs" }]
+keywords = ["security", "ai-agents", "mcp", "pre-commit", "code-scanning", "claude-code", "codex"]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Environment :: Console",
+  "Intended Audience :: Developers",
+  "Topic :: Security",
+  "Topic :: Software Development :: Quality Assurance",
+  "Operating System :: MacOS",
+  "Operating System :: POSIX :: Linux",
+  "Operating System :: Microsoft :: Windows",  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.14",
+]
+requires-python = ">=3.11"
+dependencies = [
+  "httpx>=0.28,<1",
+  "mcp>=2.0.0,<3",
+]
+
+[project.urls]
+Homepage = "https://lighthouse.rewarelabs.com"
+
+[project.optional-dependencies]
+dev = [
+  "pytest>=8.3,<10",
+  "pytest-asyncio>=0.25,<2",
+  "respx>=0.22,<1",
+  "ruff>=0.12,<1",
+]
+
+[project.scripts]
+reware-lighthouse = "lighthouse_cli.cli:run"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/lighthouse_cli"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src", "README.md", "CHANGELOG.md", "LICENSE", "pyproject.toml"]
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+testpaths = ["tests"]
+pythonpath = ["src"]
+markers = ["posix: needs POSIX file modes or a POSIX shell; skipped on Windows"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py311"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B", "SIM"]

reware_lighthouse-0.1.0/src/lighthouse_cli/__init__.py

@@ -0,0 +1,9 @@
+"""Lighthouse developer CLI."""
+
+
+def __getattr__(name: str) -> str:
+    if name == "__version__":
+        from lighthouse_cli.identity import version
+
+        return version()
+    raise AttributeError(name)

reware_lighthouse-0.1.0/src/lighthouse_cli/__main__.py

@@ -0,0 +1,4 @@
+from lighthouse_cli.cli import run
+
+if __name__ == "__main__":
+    raise SystemExit(run())

reware_lighthouse-0.1.0/src/lighthouse_cli/api.py

@@ -0,0 +1,39 @@
+"""Typed wrappers over the Lighthouse product API endpoints the CLI uses."""
+
+from typing import Any, TypedDict
+
+from lighthouse_cli.config import ClientConfig
+from lighthouse_cli.git_remote import normalize_repo_full_name
+from lighthouse_cli.http import get_json
+
+
+class Project(TypedDict, total=False):
+    name: str
+    slug: str
+    repo_full_name: str | None
+
+
+def whoami(config: ClientConfig) -> dict[str, Any]:
+    """GET /v1/me — verify the API key and return {user, team}."""
+    body = get_json(config, "/v1/me")
+    return body if isinstance(body, dict) else {}
+
+
+def list_projects(config: ClientConfig) -> list[Project]:
+    """GET /v1/projects — the team's registered projects."""
+    body = get_json(config, "/v1/projects")
+    return [p for p in body if isinstance(p, dict)] if isinstance(body, list) else []
+
+
+def match_project(projects: list[Project], identifier: str) -> Project | None:
+    """Find the project whose repo_full_name or slug matches the identifier."""
+    wanted = identifier.strip().lower()
+    normalized = normalize_repo_full_name(identifier) or wanted
+    for project in projects:
+        repo = (project.get("repo_full_name") or "").lower()
+        if (repo and repo == normalized) or project.get("slug", "").lower() == wanted:
+            return project
+    return None
+
+
+__all__ = ["Project", "list_projects", "match_project", "whoami"]

reware_lighthouse-0.1.0/src/lighthouse_cli/cli.py

@@ -0,0 +1,100 @@
+"""The `reware-lighthouse` command dispatcher.
+
+Each subcommand owns its own argument parsing, so the dispatcher just routes the
+first token and forwards the rest. New subcommands register in ``_COMMANDS``.
+"""
+
+import sys
+from collections.abc import Callable
+
+from lighthouse_cli import ui
+from lighthouse_cli.commands import deinit, init, login, logout, scan, status
+from lighthouse_cli.config import ClientConfigError
+from lighthouse_cli.http import ClientRequestError
+from lighthouse_cli.identity import COMMAND, NotInstalledError, version
+from lighthouse_cli.link import LinkError
+from lighthouse_cli.mcp import run as run_mcp
+
+_COMMANDS: dict[str, Callable[[list[str]], int]] = {
+    "login": login.run,
+    "logout": logout.run,
+    "init": init.run,
+    "deinit": deinit.run,
+    "scan": scan.run,
+    "status": status.run,
+    "mcp": run_mcp,
+}
+
+_USAGE = f"""{COMMAND} — developer CLI for Lighthouse
+
+Usage: {COMMAND} <command> [options]
+       {COMMAND} --version
+
+Commands:
+  login    Store and verify your API key
+  logout   Remove the saved API key
+  init     Link this repository to a project and set up tooling
+  deinit   Remove what init set up in this repository
+  scan     Run the pre-commit security scan
+  status   Check your account, project and tooling (exit 0 means it works)
+  mcp      Run the stdio MCP server (usually launched by your coding agent)
+  help     Show help for a command: {COMMAND} help <command>
+
+Prompt enhancement runs only when you ask for it in your coding agent:
+/lighthouse-enhance <request> in Claude Code, the lighthouse-enhance skill in Codex.
+
+Run `{COMMAND} <command> --help` for command-specific options."""
+
+
+def _print_version(_argv: list[str]) -> int:
+    print(f"{COMMAND} {version()}")
+    return 0
+
+
+_ORDINARY = (ClientConfigError, ClientRequestError, LinkError, OSError, ui.NoTerminalError)
+_OWN_ERRORS = frozenset({"scan", "mcp"})  # scan fails open itself; mcp owns stdout
+
+
+def _guarded(
+    handler: Callable[[list[str]], int], argv: list[str], *, ordinary: bool = False
+) -> int:
+    try:
+        return handler(argv)
+    except NotInstalledError as exc:
+        print(f"{COMMAND}: {exc}", file=sys.stderr)
+        return 1
+    except Exception as exc:
+        if not (ordinary and isinstance(exc, _ORDINARY)):
+            raise
+        ui.error(str(exc))
+        return 2 if isinstance(exc, ui.NoTerminalError) else 1
+    except KeyboardInterrupt:
+        if not ordinary:
+            raise
+        print("Interrupted.", file=sys.stderr)
+        return 130
+
+
+def run(argv: list[str] | None = None) -> int:
+    for stream in (sys.stdout, sys.stderr):
+        # A git hook on Windows pipes output through a legacy codepage that lacks ✓ and •.
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(errors="replace")
+    args = list(sys.argv[1:] if argv is None else argv)
+    if args[:1] == ["help"] and len(args) > 1:
+        args = [args[1], "--help"]
+    if not args or args[0] in {"-h", "--help", "help"}:
+        print(_USAGE)
+        return 0
+    if args[0] in {"-V", "--version"}:
+        return _guarded(_print_version, [])
+    command, rest = args[0], args[1:]
+    handler = _COMMANDS.get(command)
+    if handler is None:
+        print(f"{COMMAND}: unknown command '{command}'.\n\n{_USAGE}", file=sys.stderr)
+        return 2
+    return _guarded(handler, rest, ordinary=command not in _OWN_ERRORS)
+
+
+if __name__ == "__main__":
+    raise SystemExit(run())

reware_lighthouse-0.1.0/src/lighthouse_cli/commands/__init__.py

@@ -0,0 +1 @@
+"""`lighthouse` subcommands."""

reware_lighthouse-0.1.0/src/lighthouse_cli/commands/deinit.py

@@ -0,0 +1,57 @@
+"""`lighthouse deinit` — undo what `init` set up in this repository.
+
+Removes only content `init` recorded and the developer has not edited. Saved credentials
+(`logout`), scan reports and the installed tool are left alone.
+"""
+
+import contextlib
+from pathlib import Path
+
+from lighthouse_cli import ui
+from lighthouse_cli.config import has_saved_api_key
+from lighthouse_cli.git_remote import git_toplevel
+from lighthouse_cli.identity import COMMAND
+from lighthouse_cli.link import LINK_DIR, LinkError, remove_link
+from lighthouse_cli.parsing import parser
+from lighthouse_cli.setup import remove
+
+
+def _remove_link(root: Path) -> bool:
+    try:
+        path = remove_link(root)
+    except (LinkError, OSError) as exc:
+        ui.warn(f"Left the project link as is: {exc}")
+        return False
+    if path:
+        ui.success(f"Removed {path}.")
+    with contextlib.suppress(OSError):
+        (root / LINK_DIR).rmdir()  # only succeeds when nothing else lives there
+    return True
+
+
+def run(argv: list[str] | None = None) -> int:
+    parser("deinit", "Remove what init set up in this repository.", "deinit").parse_args(argv)
+
+    root_path = git_toplevel()
+    if root_path is None:
+        ui.error(f"Run `{COMMAND} deinit` from inside a Git repository.")
+        return 1
+    root = Path(root_path)
+
+    report = remove(root)
+    for step in report.steps:
+        (ui.success if step.ok else ui.warn)(step.message)
+    linked = _remove_link(root)
+    if not report.complete or not linked:
+        ui.error("Cleanup is incomplete. Finish the items above by hand.")
+        return 1
+    if has_saved_api_key():
+        ui.hint(
+            f"Your API key stays saved (`{COMMAND} logout` removes it) and scan reports are kept."
+        )
+    else:
+        ui.hint("Scan reports are kept.")
+    return 0
+
+
+__all__ = ["run"]