fix: make linting deterministic and clear the 42 ruff findings

[brett-buskirk]

The lint gate was red on every PR, so it signalled nothing — a real regression would have been indistinguishable from the standing failure. And because test declares needs: lint, the test suite never ran in CI at all.

Nothing in this repo changed — the linter did

Dev deps pinned ruff>=0.4; CI resolved ruff 0.16.1, whose default rule set has expanded since 0.4. The code is clean against the rules it was written for:

$ ruff check . --select E4,E7,E9,F     # the historical defaults
All checks passed!

$ ruff check .                          # ruff 0.16 defaults
Found 42 errors.

That reframes the job. Fixing 42 findings without addressing the pin just means the gate goes red again on the next ruff release.

The fix

1. Stop the drift. The rule set is now declared explicitly in [tool.ruff.lint] rather than inherited, and ruff/mypy are upper-bounded. An open-ended linter pin means CI can go red with no code change — which is precisely what happened.

2. Curate the set for what this repo is. Every exclusion is commented in pyproject.toml with its reason. The notable ones:

Excluded	Why
S (bandit)	Flags raw sockets, shell=True, binding 0.0.0.0, reverse shells — the features. It would fight this repo permanently.
BLE001	The blind except Exception blocks are best-effort fallback chains. Narrowing them makes them more brittle — a malformed /proc/net/route line should fall through to the default, not raise.
PLR2004	Protocol code is made of numbers the spec defines (proto == 6), and tests assert literal ports on purpose.
PLR0912/0915	Suppressed on the sniffers main() alone, via a noqa at that function, rather than relaxed repo-wide.

3. Fixed everything the curated set flags — import ordering, percent-format → f-strings in the TCP proxy, collapsed nested conditionals, contextlib.suppress for a Windows-only teardown, list-unpacking over concatenation, an unused unpacked addr, a dict() literal, redundant .keys(), an explicit check=False, and two over-length lines.

One worth your eye

tests/test_cli.py had a closure reading fake_module from the enclosing loop scope (B023). It is correct today only because the closure happens to be invoked within the same iteration — any deferred call would see the last iterations value. Now bound per-iteration as a default argument so it cannot rot into a real bug. I am flagging it as a latent hazard rather than claiming I fixed a live bug, because it was not one.

Verification

ruff check .	All checks passed
mypy src/	Success, 23 source files — it had never actually run, being gated behind lint
pytest	180 passed

Crucially, I ran the suite on a clean worktree of main as a baseline: also 180 passed. Same count before and after, so no test was lost, skipped, or altered in substance. Behaviour is unchanged throughout — this is a lint-and-config change, not a refactor.

Note on the pins

ruff>=0.16,<0.17 and mypy>=2.3,<3 are deliberate. Dependabot will still offer the majors; those become a considered upgrade (bump the pin, re-run, adjust the rule set if defaults moved) rather than a surprise red build on an unrelated PR.

[github-actions]

✅ AgentGate: Passed

18 files changed  ·  +95 -56 lines

No issues found.

_{Generated by AgentGate}