fix: resolve all ruff and mypy issues

Fix line-length violations (E501), unused imports (F401), unused
variables (F841), ambiguous variable name (E741), and mypy type errors.
Add uv.lock to .gitignore.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: jgamblin

.gitignore

@@ -8,3 +8,4 @@ build/
 .mypy_cache/
 .pytest_cache/
 .ruff_cache/
+uv.lock

src/macos_maid/cli.py

@@ -4,13 +4,15 @@
 
 import json
 from pathlib import Path
+from typing import cast
 
 import click
 
 from macos_maid import __version__
 from macos_maid.audit_log import AuditLog
 from macos_maid.config import generate_default_config_yaml, load_config
 from macos_maid.modules import get_all_modules
+from macos_maid.modules.base import CleanResult, ScanResult
 from macos_maid.reporter import Reporter
 from macos_maid.runner import ModuleRunner
 from macos_maid.system import detect_platform
@@ -109,9 +111,9 @@ def clean(
     results = runner.run_clean()
 
     if dry_run:
-        click.echo(reporter.format_dry_run(results))
+        click.echo(reporter.format_dry_run(cast(dict[str, ScanResult], results)))
     else:
-        click.echo(reporter.format_clean(results))
+        click.echo(reporter.format_clean(cast(dict[str, CleanResult], results)))
         audit_log.save(DEFAULT_LOG_DIR)
 
 
@@ -180,9 +182,9 @@ def report(
     audit_results = runner.run_audit()
 
     if dry_run:
-        click.echo(reporter.format_dry_run(clean_results))
+        click.echo(reporter.format_dry_run(cast(dict[str, ScanResult], clean_results)))
     else:
-        click.echo(reporter.format_clean(clean_results))
+        click.echo(reporter.format_clean(cast(dict[str, CleanResult], clean_results)))
 
     click.echo("")
     click.echo(reporter.format_audit(audit_results))

src/macos_maid/modules/app_audit.py

@@ -10,9 +10,9 @@
 
 from __future__ import annotations
 
-import os
 import subprocess
 from pathlib import Path
+from typing import Any
 
 from macos_maid.modules.base import (
     AuditResult,
@@ -87,7 +87,10 @@ def audit(self) -> AuditResult:
                         severity="info",
                         title="Unsigned Application",
                         detail=f"{app_name} is unsigned but appears to be sandboxed",
-                        remediation="Consider verifying the source and reinstalling from official channels if available",
+                        remediation=(
+                            "Consider verifying the source and reinstalling"
+                            " from official channels if available"
+                        ),
                     )
                 )
 
@@ -100,7 +103,10 @@ def audit(self) -> AuditResult:
                         severity="warn",
                         title="Unsigned Application with Elevated Permissions",
                         detail=f"{app_name} is unsigned and may have elevated permissions",
-                        remediation=f"Review {app_name} carefully. Consider removing or replacing with a signed version.",
+                        remediation=(
+                            f"Review {app_name} carefully."
+                            " Consider removing or replacing with a signed version."
+                        ),
                     )
                 )
 
@@ -218,13 +224,13 @@ def _check_elevated_perms(self, app_path: str) -> bool:
         except Exception:
             return False
 
-    def _get_applications(self) -> list[dict]:
+    def _get_applications(self) -> list[dict[str, Any]]:
         """Scan /Applications for .app bundles and check their signing status.
 
         Returns:
             List of dicts with keys: path, signed, from_app_store, has_elevated_perms
         """
-        apps = []
+        apps: list[dict[str, Any]] = []
         applications_dir = Path("/Applications")
 
         if not applications_dir.exists():

src/macos_maid/modules/network.py

@@ -78,7 +78,7 @@ def _check_firewall_enabled(self) -> bool:
                 text=True,
                 check=True,
             )
-            # Output is like "Firewall is enabled. (State = 1)" or "Firewall is disabled. (State = 0)"
+            # "Firewall is enabled. (State = 1)" or "...disabled. (State = 0)"
             return "enabled" in result.stdout.lower()
         except subprocess.CalledProcessError:
             return False
@@ -157,7 +157,9 @@ def audit(self) -> AuditResult:
                     severity="fail",
                     title="Firewall Status",
                     detail="macOS Application Firewall is disabled",
-                    remediation="Enable firewall in System Preferences > Security & Privacy > Firewall",
+                    remediation=(
+                        "Enable firewall in System Preferences > Security & Privacy > Firewall"
+                    ),
                 )
             )
 

src/macos_maid/modules/privacy.py

@@ -216,7 +216,10 @@ def audit(self) -> AuditResult:
                             severity="info",
                             title=f"{human_name} Permission",
                             detail=f"{len(apps)} app(s) have {human_name} access: {app_list}",
-                            remediation=f"Review {human_name} permissions in System Preferences > Security & Privacy > Privacy",
+                            remediation=(
+                                f"Review {human_name} permissions in"
+                                " System Preferences > Security & Privacy > Privacy"
+                            ),
                         )
                     )
 
@@ -230,7 +233,11 @@ def audit(self) -> AuditResult:
                 Finding(
                     severity="info",
                     title="Old Downloads Files",
-                    detail=f"Found {len(old_downloads)} file(s) in Downloads older than {self.downloads_older_than} days ({size_mb:.1f} MB)",
+                    detail=(
+                        f"Found {len(old_downloads)} file(s) in Downloads"
+                        f" older than {self.downloads_older_than} days"
+                        f" ({size_mb:.1f} MB)"
+                    ),
                     remediation="Review and manually clean up old files in ~/Downloads",
                 )
             )

src/macos_maid/modules/system_integrity.py

@@ -80,7 +80,9 @@ def _check_sip(self) -> Finding:
                     severity="fail",
                     title="System Integrity Protection",
                     detail="SIP is disabled",
-                    remediation="Enable SIP by booting into Recovery Mode and running 'csrutil enable'",
+                    remediation=(
+                        "Enable SIP by booting into Recovery Mode and running 'csrutil enable'"
+                    ),
                 )
         except Exception as e:
             return Finding(
@@ -113,7 +115,9 @@ def _check_filevault(self) -> Finding:
                     severity="fail",
                     title="FileVault Encryption",
                     detail="FileVault is off",
-                    remediation="Enable FileVault in System Preferences > Security & Privacy > FileVault",
+                    remediation=(
+                        "Enable FileVault in System Preferences > Security & Privacy > FileVault"
+                    ),
                 )
         except Exception as e:
             return Finding(
@@ -193,7 +197,11 @@ def _check_xprotect(self) -> Finding:
                 severity="warn",
                 title="XProtect",
                 detail=f"Could not check XProtect status: {e}",
-                remediation="Verify XProtect manually with 'system_profiler SPInstallHistoryDataType | grep -i xprotect'",
+                remediation=(
+                    "Verify XProtect manually with"
+                    " 'system_profiler SPInstallHistoryDataType"
+                    " | grep -i xprotect'"
+                ),
             )
 
     def _check_firewall(self) -> Finding:
@@ -219,12 +227,18 @@ def _check_firewall(self) -> Finding:
                     severity="fail",
                     title="Firewall",
                     detail="Firewall is disabled",
-                    remediation="Enable firewall in System Preferences > Security & Privacy > Firewall",
+                    remediation=(
+                        "Enable firewall in System Preferences > Security & Privacy > Firewall"
+                    ),
                 )
         except Exception as e:
             return Finding(
                 severity="warn",
                 title="Firewall",
                 detail=f"Could not check firewall status: {e}",
-                remediation="Verify firewall manually with '/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate'",
+                remediation=(
+                    "Verify firewall manually with"
+                    " '/usr/libexec/ApplicationFirewall/"
+                    "socketfilterfw --getglobalstate'"
+                ),
             )

src/macos_maid/modules/tools.py

@@ -74,7 +74,10 @@ def audit(self) -> AuditResult:
                     Finding(
                         severity="info",
                         title="Lynis Not Installed",
-                        detail="Install Lynis for comprehensive system security auditing. Install with: brew install lynis",
+                        detail=(
+                            "Install Lynis for comprehensive system security"
+                            " auditing. Install with: brew install lynis"
+                        ),
                         remediation=None,
                     )
                 )
@@ -98,7 +101,10 @@ def audit(self) -> AuditResult:
                     Finding(
                         severity="info",
                         title="Osquery Not Installed",
-                        detail="Install osquery for system querying and monitoring. Install with: brew install osquery",
+                        detail=(
+                            "Install osquery for system querying and"
+                            " monitoring. Install with: brew install osquery"
+                        ),
                         remediation=None,
                     )
                 )
@@ -229,7 +235,7 @@ def _run_lynis(self) -> list[Finding]:
                     remediation="Try running 'lynis audit system --quick' manually",
                 )
             )
-        except Exception as e:
+        except Exception:
             raise  # Re-raise to be caught by audit()
 
         return findings
@@ -277,7 +283,10 @@ def _run_osquery_check(self) -> list[Finding]:
                     Finding(
                         severity="warn",
                         title="Unsigned Processes Detected",
-                        detail=f"Found {len(unsigned_processes)} unsigned processes: {', '.join(process_names)}",
+                        detail=(
+                            f"Found {len(unsigned_processes)} unsigned"
+                            f" processes: {', '.join(process_names)}"
+                        ),
                         remediation="Investigate and remove suspicious unsigned processes",
                     )
                 )
@@ -307,7 +316,8 @@ def _run_osquery_check(self) -> list[Finding]:
             listeners = json.loads(result.stdout)
             if listeners:
                 listener_info = [
-                    f"{l.get('name', 'unknown')}:{l.get('port', '?')}" for l in listeners[:5]
+                    f"{item.get('name', 'unknown')}:{item.get('port', '?')}"
+                    for item in listeners[:5]
                 ]
                 findings.append(
                     Finding(
@@ -338,7 +348,9 @@ def _run_knockknock_check(self) -> list[Finding]:
                 Finding(
                     severity="info",
                     title="KnockKnock Available",
-                    detail="KnockKnock is installed. Run it manually to scan for persistent malware.",
+                    detail=(
+                        "KnockKnock is installed. Run it manually to scan for persistent malware."
+                    ),
                     remediation=None,
                 )
             )

src/macos_maid/reporter.py

@@ -8,9 +8,8 @@
 
 import json
 from datetime import datetime, timezone
-from typing import Union
 
-from macos_maid.modules.base import AuditResult, CleanResult, Finding, ScanResult
+from macos_maid.modules.base import AuditResult, CleanResult, ScanResult
 from macos_maid.system import Platform
 
 
@@ -35,7 +34,11 @@ def __init__(self, platform: Platform, output_format: str = "terminal") -> None:
     def _header(self) -> str:
         p = self._platform
         date = datetime.now(timezone.utc).strftime("%Y-%m-%d")
-        return f"MacOS Maid Report — {date}\nmacOS {p.macos_name} {'.'.join(str(v) for v in p.macos_version)} | {p.arch} | {p.filesystem.upper()}"
+        ver = ".".join(str(v) for v in p.macos_version)
+        return (
+            f"MacOS Maid Report — {date}\n"
+            f"macOS {p.macos_name} {ver} | {p.arch} | {p.filesystem.upper()}"
+        )
 
     def format_clean(self, results: dict[str, CleanResult]) -> str:
         if self._format == "json":

src/macos_maid/runner.py

@@ -7,7 +7,7 @@
 
 from __future__ import annotations
 
-from typing import Any, Union
+from typing import Any
 
 from macos_maid.audit_log import AuditLog
 from macos_maid.modules.base import AuditResult, CleanResult, Module, ScanResult
@@ -48,7 +48,7 @@ def _filter_modules(self, require_sudo_check: bool = True) -> list[Module]:
 
         return filtered
 
-    def run_clean(self) -> dict[str, Union[ScanResult, CleanResult]]:
+    def run_clean(self) -> dict[str, ScanResult | CleanResult]:
         """Run cleanup on all matching modules.
 
         Returns ScanResult per module in dry-run mode, CleanResult otherwise.

tests/modules/test_app_audit.py

@@ -1,9 +1,7 @@
 # tests/modules/test_app_audit.py
 """Tests for app audit module."""
 
-from unittest.mock import MagicMock, patch
-
-import pytest
+from unittest.mock import patch
 
 from macos_maid.modules.app_audit import AppAuditModule