chore(internal): enable targeted ruff pylint rules, fix 104 violations (#2102)

* chore(internal): enable targeted ruff pylint rules, fix 104 violations

- Add PLE (whole prefix) plus 11 individually-selected PLC/PLR/PLW codes
  to pyproject.toml, with rationale for why the PL family isn't selected
  wholesale (PLC0415 fights lazy-init, PLR2004/PLR0913/PLR0917/PLR0911
  are noisy on this codebase's patterns)
- Fix all 104 violations: explicit check=False on 36 subprocess.run
  calls, remove 23 unnecessary lambdas, narrow two global statements to
  only what's assigned, collapse if/else nests to elif, add maxsplit to
  split/rsplit calls, and misc pylint conventions (dict-index-missing,
  repeated-equality, manual-from-import, useless-return)
- Bump webhook-proxy dev add-on version 2.1.1.dev2 -> 2.1.1.dev3 (with
  CHANGELOG entry), required by webhook-proxy-dev-version-guard since
  this PR touches homeassistant-addon-webhook-proxy-dev/

* fix: keep stable webhook-proxy tree dev-first-compliant

Per Codex review: allow-stable-edit is documented for stable-only
hotfixes, not routine maintenance sweeps. Revert the 2 lint fixes in
homeassistant-addon-webhook-proxy/ (keep them in the -dev flavor only)
and add a temporary per-file-ignore for PLC0207/PLR5501 scoped to the
stable tree, removed at the next promote.

---------

Co-authored-by: Sergey <sergey@example.com>

Author: sergeykad

custom_components/ha_mcp_tools/config_flow.py

@@ -228,7 +228,7 @@ def _sentence_prefix(sentence: str, language: str, english: str) -> str:
     if not sentence:
         return sentence
     if (
-        language.split("-")[0].lower() in _NO_ASCII_SENTENCE_SPACE
+        language.split("-", maxsplit=1)[0].lower() in _NO_ASCII_SENTENCE_SPACE
         and sentence != english
     ):
         return sentence

custom_components/ha_mcp_tools/websocket_api.py

@@ -1977,8 +1977,7 @@ def _name_tier(query_lower: str, texts: Any, *, exact: bool) -> int | None:
             if query_norm and query_norm in _sep_normalized(text_lower):
                 return 100
             ratio = _calc_ratio(query_lower, text_lower)
-            if ratio > best_ratio:
-                best_ratio = ratio
+            best_ratio = max(best_ratio, ratio)
     if not exact and best_ratio >= FUZZY_THRESHOLD:
         return best_ratio
     return None
@@ -3206,7 +3205,7 @@ def _exposure_enrichment(
     rather than crashing the join).
     """
     join = _registry_enrichment(view, entity_id)
-    domain = entity_id.split(".")[0] if "." in entity_id else ""
+    domain = entity_id.split(".", maxsplit=1)[0] if "." in entity_id else ""
     info: dict[str, Any] = {
         "domain": domain,
         "area": join["area"],
@@ -5196,7 +5195,7 @@ def _assist_default_exposed(hass: HomeAssistant, entity_id: str) -> bool:
         or getattr(entry, "hidden_by", None) is not None
     ):
         return False
-    domain = entity_id.split(".")[0] if "." in entity_id else entity_id
+    domain = entity_id.split(".", maxsplit=1)[0] if "." in entity_id else entity_id
     if domain in DEFAULT_EXPOSED_DOMAINS:
         return True
     from homeassistant.exceptions import HomeAssistantError

homeassistant-addon-webhook-proxy-dev/CHANGELOG.md

@@ -9,6 +9,11 @@ history from before the fork.
 -->
 
 
+## v2.1.1.dev3 (2026-07-31)
+
+Internal: lint cleanup (ruff pylint rules) — no behavior change.
+
+
 ## v2.1.1.dev2 (2026-07-30)
 
 Documentation: warn Tailscale Funnel users that Claude.ai connectors require the

homeassistant-addon-webhook-proxy-dev/config.yaml

@@ -1,6 +1,6 @@
 name: "Nabu Casa - Webhook Proxy for HA MCP (Dev)"
 description: "DEV CHANNEL (unstable) — remote access proxy via Nabu Casa or any reverse proxy. Cannot run alongside the stable Webhook Proxy add-on."
-version: "2.1.1.dev2"
+version: "2.1.1.dev3"
 slug: "ha_mcp_webhook_proxy_dev"
 url: "https://github.com/homeassistant-ai/ha-mcp"
 stage: experimental

homeassistant-addon-webhook-proxy-dev/mcp_proxy_dev/__init__.py

@@ -280,7 +280,9 @@ def _validate_and_mask_target(target_url: str, webhook_id: str) -> str:
     """
     # Mask sensitive values in logs to avoid leaking secrets
     if "/private_" in target_url:
-        masked_target = target_url.split("/private_")[0] + "/private_********"
+        masked_target = (
+            target_url.split("/private_", maxsplit=1)[0] + "/private_********"
+        )
     else:
         masked_target = target_url
     masked_wh = webhook_id[:6] + "..." if len(webhook_id) > 6 else "***"

homeassistant-addon-webhook-proxy-dev/mcp_proxy_dev/manifest.json

@@ -7,5 +7,5 @@
   "dependencies": ["webhook"],
   "documentation": "https://github.com/homeassistant-ai/ha-mcp",
   "iot_class": "local_push",
-  "version": "2.1.1.dev2"
+  "version": "2.1.1.dev3"
 }

homeassistant-addon-webhook-proxy-dev/start.py

@@ -1509,41 +1509,40 @@ def _install_integration_and_handle_restart() -> None:
                 {"notification_id": "mcp_proxy_dev_restart"},
             )
             log_info("Setup completed after HA restart")
+    elif not _ensure_config_entry():
+        log_error(
+            "Could not create config entry. Webhook is NOT active. "
+            "Restart Home Assistant; if the problem persists, "
+            "remove and re-add the integration manually from "
+            "Settings → Devices & Services."
+        )
+        _ha_core_api(
+            "POST",
+            "/services/persistent_notification/create",
+            {
+                "title": ("MCP Webhook Proxy: webhook URL is not active"),
+                "message": (
+                    "The addon could not create the integration's "
+                    "config entry, so the webhook URL is currently "
+                    "**not active**. Restart Home Assistant; if "
+                    "the problem persists, remove and re-add the "
+                    "MCP Webhook Proxy integration from "
+                    "Settings → Devices & Services."
+                ),
+                "notification_id": "mcp_proxy_dev_setup_failed",
+            },
+        )
     else:
-        if not _ensure_config_entry():
-            log_error(
-                "Could not create config entry. Webhook is NOT active. "
-                "Restart Home Assistant; if the problem persists, "
-                "remove and re-add the integration manually from "
-                "Settings → Devices & Services."
-            )
-            _ha_core_api(
-                "POST",
-                "/services/persistent_notification/create",
-                {
-                    "title": ("MCP Webhook Proxy: webhook URL is not active"),
-                    "message": (
-                        "The addon could not create the integration's "
-                        "config entry, so the webhook URL is currently "
-                        "**not active**. Restart Home Assistant; if "
-                        "the problem persists, remove and re-add the "
-                        "MCP Webhook Proxy integration from "
-                        "Settings → Devices & Services."
-                    ),
-                    "notification_id": "mcp_proxy_dev_setup_failed",
-                },
-            )
-        else:
-            # Reload the config entry so the integration reads the fresh
-            # config file we just wrote (it may have loaded with stale data
-            # during HA boot, before this addon started).
-            _reload_config_entry()
-            # Dismiss any leftover restart notification from first install
-            _ha_core_api(
-                "POST",
-                "/services/persistent_notification/dismiss",
-                {"notification_id": "mcp_proxy_dev_restart"},
-            )
+        # Reload the config entry so the integration reads the fresh
+        # config file we just wrote (it may have loaded with stale data
+        # during HA boot, before this addon started).
+        _reload_config_entry()
+        # Dismiss any leftover restart notification from first install
+        _ha_core_api(
+            "POST",
+            "/services/persistent_notification/dismiss",
+            {"notification_id": "mcp_proxy_dev_restart"},
+        )
 
 
 def _enforce_oauth_or_disable(enable_oauth: bool) -> None:

pyproject.toml

@@ -140,6 +140,26 @@ select = [
     "A",     # builtin shadowing
     "LOG",   # logging best practices
     "SIM",   # simplify
+    "PLE",   # pylint errors (real bugs: bad logging args, await outside async)
+    # Targeted pylint conventions/refactors/warnings. The PL family is NOT
+    # selected wholesale: PLC0415 (import-outside-top-level) fights the
+    # deliberate lazy-init architecture, and PLR2004 (magic values),
+    # PLR0913/PLR0917 (wide FastMCP tool signatures) and PLR0911 (too many
+    # returns -- a separate signal from C901's cyclomatic complexity, and
+    # noisy on this codebase's early-return validation style) are noise
+    # here. Add codes individually so a new upstream PLR rule does not land
+    # enabled by default.
+    "PLC0206", # dict-index-missing-items
+    "PLC0207", # missing-maxsplit-arg
+    "PLR0402", # manual-from-import
+    "PLR1711", # useless-return
+    "PLR1714", # repeated-equality-comparison
+    "PLR1730", # if-stmt-min-max
+    "PLR5501", # collapsible-else-if
+    "PLW0108", # unnecessary-lambda
+    "PLW0602", # global-variable-not-assigned
+    "PLW1510", # subprocess-run-without-check
+    "PLW2901", # redefined-loop-name
 ]
 ignore = [
     "E501",    # line too long — formatter handles this
@@ -162,6 +182,12 @@ ignore = [
 [tool.ruff.lint.per-file-ignores]
 "__init__.py" = ["F401"]
 "tests/**/*" = ["E501", "B011"]
+# Temporary: the equivalent PLC0207/PLR5501 fixes landed in
+# homeassistant-addon-webhook-proxy-dev/ only, per the dev-first/promote-only
+# flow (allow-stable-edit is for stable-only hotfixes, not routine sweeps —
+# see homeassistant-addon-webhook-proxy/AGENTS.md "Dev-first, promote-only").
+# Remove this ignore once the next promote carries the fix into stable.
+"homeassistant-addon-webhook-proxy/**" = ["PLC0207", "PLR5501"]
 # C901 is enforced repo-wide with no per-file exemptions (the grandfathered
 # list was fully cleared by issue #925). Do NOT add "path" = ["C901"] entries
 # here — extract helpers to bring the function below the threshold instead:

scripts/build_mirror_release_notes.py

@@ -110,6 +110,7 @@ def _run_git(args: list[str], repo_dir: Path) -> str:
         cwd=repo_dir,
         capture_output=True,
         text=True,
+        check=False,
     )
     if result.returncode != 0:
         raise RuntimeError(f"git {' '.join(args)} failed: {result.stderr.strip()}")

src/ha_mcp/__main__.py

@@ -574,8 +574,6 @@ def _get_timestamped_uvicorn_log_config() -> dict:
 
 async def _cleanup_resources() -> None:
     """Clean up all server resources gracefully."""
-    global _server
-
     logger.info("Cleaning up server resources...")
 
     # Close WebSocket listener service if running
@@ -730,7 +728,7 @@ def _signal_handler(signum: int, frame: Any) -> None:
     This handler initiates graceful shutdown on first signal.
     On second signal, forces immediate exit.
     """
-    global _shutdown_in_progress, _shutdown_event
+    global _shutdown_in_progress
 
     sig_name = signal.Signals(signum).name