chore: ruff format + lint cleanup for policy package (homeassistant-ai#966)

- ruff format reflow on PR-touched files (case statements split to two
  lines, function signatures, line continuations).
- UP042: Verdict now inherits from StrEnum instead of (str, Enum).
- E402: hoist `import anyio` to the top of test_approval_queue.py.
- I001: sort imports in test_evaluator.py and test_model.py.

No behavior change.

Author: kingpanther13

src/ha_mcp/config.py

@@ -103,9 +103,7 @@ class Settings(BaseSettings):
     # Per-tool approval middleware — opt-in gate that routes high-stakes tool
     # calls through a per-tool policy with out-of-band web-UI approval
     # (issue #966). Disabled by default.
-    enable_per_tool_approval: bool = Field(
-        False, alias="ENABLE_PER_TOOL_APPROVAL"
-    )
+    enable_per_tool_approval: bool = Field(False, alias="ENABLE_PER_TOOL_APPROVAL")
 
     # Managed YAML config editing — allows ha_config_set_yaml to add,
     # replace, or remove top-level keys in configuration.yaml and package

src/ha_mcp/policy/approval_queue.py

@@ -44,8 +44,8 @@ def __init__(self) -> None:
     def remember(self, tool_name: str, args_hash: str, *, minutes: int) -> None:
         if minutes <= 0:
             return
-        self._remember[(tool_name, args_hash)] = (
-            datetime.now(UTC) + timedelta(minutes=minutes)
+        self._remember[(tool_name, args_hash)] = datetime.now(UTC) + timedelta(
+            minutes=minutes
         )
 
     def is_remembered(self, tool_name: str, args_hash: str) -> bool:

src/ha_mcp/policy/evaluator.py

@@ -1,15 +1,15 @@
 """Evaluate a tool call against a Policy. Pure functions — no I/O, no state."""
 
 import re
-from enum import Enum
+from enum import StrEnum
 from typing import Any
 
 from .model import Policy, Predicate, Rule
 
 _MISSING = object()
 
 
-class Verdict(str, Enum):
+class Verdict(StrEnum):
     ALLOW = "allow"
     REQUIRE_APPROVAL = "require_approval"
 
@@ -39,15 +39,23 @@ def match_predicate(predicate: Predicate, args: dict[str, Any]) -> bool:
         return False
     pv = predicate.value
     match predicate.op:
-        case "eq":       return val == pv
-        case "neq":      return val != pv
-        case "in":       return val in (pv or [])
-        case "not_in":   return val not in (pv or [])
+        case "eq":
+            return val == pv
+        case "neq":
+            return val != pv
+        case "in":
+            return val in (pv or [])
+        case "not_in":
+            return val not in (pv or [])
         # `regex` is re.search (substring match). Anchor with ^...$ for full-match.
-        case "regex":    return isinstance(val, str) and re.search(pv, val) is not None
-        case "contains": return isinstance(val, (str, list, tuple, set)) and pv in val
-        case "gt":       return val > pv
-        case "lt":       return val < pv
+        case "regex":
+            return isinstance(val, str) and re.search(pv, val) is not None
+        case "contains":
+            return isinstance(val, (str, list, tuple, set)) and pv in val
+        case "gt":
+            return val > pv
+        case "lt":
+            return val < pv
     return False
 
 
@@ -57,8 +65,9 @@ def match_rule(rule: Rule, tool_name: str, args: dict[str, Any]) -> bool:
     return all(match_predicate(p, args) for p in rule.when)
 
 
-def find_matching_rule(tool_name: str, args: dict[str, Any],
-                       policy: Policy) -> Rule | None:
+def find_matching_rule(
+    tool_name: str, args: dict[str, Any], policy: Policy
+) -> Rule | None:
     for rule in policy.rules:
         if match_rule(rule, tool_name, args):
             return rule
@@ -70,6 +79,8 @@ def evaluate(tool_name: str, args: dict[str, Any], policy: Policy) -> Verdict:
         return Verdict.ALLOW
     if find_matching_rule(tool_name, args, policy) is not None:
         return Verdict.REQUIRE_APPROVAL
-    return (Verdict.REQUIRE_APPROVAL
-            if policy.default_action == "require_approval"
-            else Verdict.ALLOW)
+    return (
+        Verdict.REQUIRE_APPROVAL
+        if policy.default_action == "require_approval"
+        else Verdict.ALLOW
+    )

src/ha_mcp/policy/handlers.py

@@ -36,24 +36,30 @@ async def put_config(request: Request) -> JSONResponse:
         return JSONResponse({"saved": True})
 
     async def get_pending(_: Request) -> JSONResponse:
-        return JSONResponse({"pending": [
+        return JSONResponse(
             {
-                "token": e.token,
-                "tool_name": e.tool_name,
-                "args_preview": e.args_preview,
-                "created_at": e.created_at.isoformat(),
-                "expires_at": e.expires_at.isoformat(),
+                "pending": [
+                    {
+                        "token": e.token,
+                        "tool_name": e.tool_name,
+                        "args_preview": e.args_preview,
+                        "created_at": e.created_at.isoformat(),
+                        "expires_at": e.expires_at.isoformat(),
+                    }
+                    for e in queue.list_pending()
+                ]
             }
-            for e in queue.list_pending()
-        ]})
+        )
 
     async def post_approve(request: Request) -> JSONResponse:
         try:
             body = await request.json()
         except (ValueError, TypeError):
             return JSONResponse({"error": "invalid JSON body"}, status_code=400)
         if not isinstance(body, dict):
-            return JSONResponse({"error": "body must be a JSON object"}, status_code=400)
+            return JSONResponse(
+                {"error": "body must be a JSON object"}, status_code=400
+            )
         token = body.get("token")
         if not token or queue.get(token) is None:
             return JSONResponse({"error": "unknown token"}, status_code=404)
@@ -68,7 +74,9 @@ async def post_deny(request: Request) -> JSONResponse:
         except (ValueError, TypeError):
             return JSONResponse({"error": "invalid JSON body"}, status_code=400)
         if not isinstance(body, dict):
-            return JSONResponse({"error": "body must be a JSON object"}, status_code=400)
+            return JSONResponse(
+                {"error": "body must be a JSON object"}, status_code=400
+            )
         token = body.get("token")
         if not token or queue.get(token) is None:
             return JSONResponse({"error": "unknown token"}, status_code=404)

src/ha_mcp/policy/middleware.py

@@ -17,12 +17,14 @@
 
 # Toolsearch proxy meta-tools — always pass through; the inner real-tool
 # call re-enters the middleware via ctx.fastmcp.call_tool() and gets gated there.
-PROXY_META_TOOLS = frozenset({
-    "ha_call_read_tool",
-    "ha_call_write_tool",
-    "ha_call_delete_tool",
-    "ha_search_tools",
-})
+PROXY_META_TOOLS = frozenset(
+    {
+        "ha_call_read_tool",
+        "ha_call_write_tool",
+        "ha_call_delete_tool",
+        "ha_search_tools",
+    }
+)
 
 
 class PolicyMiddleware(Middleware):
@@ -65,24 +67,33 @@ async def on_call_tool(
         existing = self._queue.find(name, args_hash)
         if existing and existing.decision == "approved":
             self._queue.consume_and_maybe_remember(
-                existing, remember_minutes=rule.remember_minutes if rule else 0,
+                existing,
+                remember_minutes=rule.remember_minutes if rule else 0,
             )
             return await call_next(context)
         if existing and existing.decision == "denied":
             self._queue.remove(existing.token)
             raise self._denied_error()
 
         pending = existing or self._queue.create(
-            name, args_hash, args, ttl_minutes=policy.approval_ttl_minutes,
+            name,
+            args_hash,
+            args,
+            ttl_minutes=policy.approval_ttl_minutes,
         )
         approval_url = self._approval_url_builder(pending.token)
 
-        wait = self._wait_override if self._wait_override is not None else policy.wait_seconds
+        wait = (
+            self._wait_override
+            if self._wait_override is not None
+            else policy.wait_seconds
+        )
         await self._wait_for_decision(context, pending, approval_url, wait)
 
         if pending.decision == "approved":
             self._queue.consume_and_maybe_remember(
-                pending, remember_minutes=rule.remember_minutes if rule else 0,
+                pending,
+                remember_minutes=rule.remember_minutes if rule else 0,
             )
             return await call_next(context)
         if pending.decision == "denied":
@@ -101,7 +112,8 @@ async def _wait_for_decision(
         deadline = anyio.current_time() + wait_seconds
         while anyio.current_time() < deadline and pending.decision == "pending":
             await self._safe_report_progress(
-                context, f"Awaiting user approval — open {approval_url}")
+                context, f"Awaiting user approval — open {approval_url}"
+            )
             remaining = deadline - anyio.current_time()
             if remaining <= 0:
                 break
@@ -118,33 +130,43 @@ async def _safe_report_progress(context: MiddlewareContext, message: str) -> Non
 
     @staticmethod
     def _denied_error() -> ToolError:
-        return ToolError(json.dumps({
-            "success": False,
-            "error": {
-                "code": "USER_DENIED",
-                "message": "User explicitly denied this tool call.",
-                "suggestions": ["Do not retry without confirming with the user first."],
-            },
-        }))
+        return ToolError(
+            json.dumps(
+                {
+                    "success": False,
+                    "error": {
+                        "code": "USER_DENIED",
+                        "message": "User explicitly denied this tool call.",
+                        "suggestions": [
+                            "Do not retry without confirming with the user first."
+                        ],
+                    },
+                }
+            )
+        )
 
     def _pending_error(self, pending: PendingApproval, approval_url: str) -> ToolError:
         remaining = int((pending.expires_at - pending.created_at).total_seconds())
-        return ToolError(json.dumps({
-            "success": False,
-            "error": {
-                "code": "USER_APPROVAL_REQUIRED",
-                "message": (
-                    f"User approval required. Open {approval_url} to review the "
-                    "exact call and approve. Re-call this tool with the same "
-                    "arguments after the user approves."
-                ),
-                "context": {
-                    "approve_url": approval_url,
-                    "expires_in_seconds": remaining,
-                },
-                "suggestions": [
-                    "Tell the user to click the approval link.",
-                    "Re-call this tool with the same arguments after the user approves.",
-                ],
-            },
-        }))
+        return ToolError(
+            json.dumps(
+                {
+                    "success": False,
+                    "error": {
+                        "code": "USER_APPROVAL_REQUIRED",
+                        "message": (
+                            f"User approval required. Open {approval_url} to review the "
+                            "exact call and approve. Re-call this tool with the same "
+                            "arguments after the user approves."
+                        ),
+                        "context": {
+                            "approve_url": approval_url,
+                            "expires_in_seconds": remaining,
+                        },
+                        "suggestions": [
+                            "Tell the user to click the approval link.",
+                            "Re-call this tool with the same arguments after the user approves.",
+                        ],
+                    },
+                }
+            )
+        )

tests/src/unit/policy/test_approval_queue.py

@@ -1,5 +1,6 @@
 from datetime import UTC, datetime, timedelta
 
+import anyio
 import pytest
 
 from ha_mcp.policy.approval_queue import (
@@ -46,7 +47,6 @@ def test_remember_cache_expired():
 
 
 # --- appended for Task 2.2: pending-entry lifecycle ---
-import anyio
 
 
 def test_create_returns_pending_entry():