release: v0.10.0 — coverage push to 85%

Internal quality release. Raises pytest coverage from 74% (the
v0.9.0 baseline) to 85% via 397 new tests across 15 new test
files, with no source-code changes outside one small
`pyproject.toml` lint-config tweak.

Every new test targets a previously-uncovered code path in the
existing modules — no new tools, no new public APIs, no
behavioural changes. The shape of the push:

  core/          command, platform, menu, host_service, systemd,
                 ui (banner, spinner, quiet mode, color override)
  cli            doctor full run, config show/path/edit/validate,
                 self-update no-update path, per-tool --help
  java/          manager menu loop + _menu_install/upgrade/switch/
                 uninstall/remove_oracle branches, scanner
                 (scan + homebrew + sdkman + JAVA_HOME),
                 installer (5 lifecycle methods + verify +
                 reload_env), brew (prefix cache, lifecycle
                 wrappers, outdated_java JSON parse), oracle
                 (safe-roots refusal)
  ssh/           manager keys_generate/rotate + agent_add +
                 known_hosts + perms + config + run() loop,
                 scanner (parse_agent_keys both formats,
                 parse_known_hosts, prune_known_hosts_duplicates,
                 audit_perms tree walk, _looks_like_private_key,
                 _read_pub_metadata edge cases)
  adguard/       manager scan / verify / loopback DNS / ports_show
                 / ports_set with API + yaml fallback, service +
                 logs + rollback + config_validate, ports
                 (psutil branch + cgroup unified vs legacy)
  dns/           manager diagnose + flush + show + test + set +
                 reset + fix dispatcher, fixer (detect_interference,
                 step_detect_vpn, _make_backup_dir safety guard,
                 latest_backup_dir, rollback)
  db/            _to_status_row helper edges, --on-host JSON
                 paths, Linux + macOS service-name resolution,
                 dump-to-file
  gpg/           manager keys_generate/export, git_signing_show/
                 configure, agent_status, run() loop, missing-
                 git remediation path
  docker_clean/  manager prune dispatch, quick dry-run, nuke
                 token, inspect, compose_down with/without -v,
                 schedule_emit to stdout vs file
  tls/           revoke dry-run, renew failure exit propagation,
                 status with unparseable cert, cron-install
                 delegation
  hosts/         _read_source URL + local + missing, _back_up
                 sudo fail/succeed, _atomic_write fallback chain,
                 run() interactive
  web/nginx/     list empty, apply + remove severe-token gate,
                 generate flavors

Two minor non-test changes:

- `pyproject.toml` — adds `tests/* = ["RUF012"]` to ruff's
  per-file-ignores. Test stubs use throwaway classes to mock
  pydantic models; RUF012 (mutable class-attribute defaults
  need ClassVar) is real-code advice that doesn't apply to
  dataclass-style test fakes.

Test count: 630 → 1027 (+397). Coverage: 74% → 85% (1,266 lines
still uncovered, mostly UI rendering paths in adguard/manager
and interactive menu loops that branch on Menu.select choices
we can't deterministically enumerate without re-implementing
each manager's dispatch table).

Gates: pytest 1027 passed, ruff clean, mypy strict clean. No
new dependencies, no new optional extras.

Author: imanimanyara

CHANGELOG.md

@@ -6,6 +6,66 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [0.10.0] — 2026-05-15
+
+### Tests
+
+- Coverage push from 74% to **85%** (1009 → 1027 tests added across
+  11 new test files; +397 tests on top of the v0.9.0 baseline).
+  All new tests target previously-thin code paths in:
+  - `core/` — command (sudo/has_sudo/CommandResult), platform
+    (WSL detection, brew-prefix, container probes), menu
+    (FallbackMenu fallback paths + Menu.prompt_for_change),
+    host_service (SystemdHost + BrewServicesHost), systemd
+    (state / lifecycle / journal), ui (banner / spinner / quiet).
+  - `tools/java/` — manager menu paths (_menu_install /
+    _menu_upgrade / _menu_switch / _menu_uninstall /
+    _menu_remove_oracle / run() loop), scanner (scan / homebrew
+    versions / SDKman / JAVA_HOME), installer (install /
+    reinstall / uninstall / upgrade / switch / verify /
+    reload_env), brew (prefix cache / install / outdated / link),
+    oracle (safe-roots enforcement).
+  - `tools/ssh/` — manager (keys_generate / keys_rotate / agent
+    paths / known_hosts audit + prune / perms audit + fix /
+    config show / run() loop), scanner (parse_agent_keys / 
+    parse_known_hosts / prune_known_hosts / list_keys / 
+    _looks_like_private_key / _read_pub_metadata).
+  - `tools/adguard/` — manager (scan with/without conflicts /
+    verify / loopback DNS / ports_show / ports_set / service /
+    logs / rollback / config_validate), ports (psutil branch +
+    cgroup parsing).
+  - `tools/dns/` — manager (diagnose / flush / show / test /
+    set / reset / fix dispatcher / no-service paths), fixer
+    (detect_interference / step_detect_vpn / _make_backup_dir
+    safety / latest_backup_dir / rollback).
+  - `tools/db/` — _to_status_row helper, --on-host JSON output
+    paths, on-host Linux + macOS service-name resolution, dump
+    to file, status JSON shape with running container.
+  - `tools/gpg/` — manager (keys_generate / keys_export /
+    git_signing_show / git_signing_configure / agent_status /
+    run() loop), error paths for missing git binary.
+  - `tools/docker_clean/` — manager (prune dispatch / quick
+    dry-run / nuke token enforcement / inspect / compose_down
+    with/without --volumes / schedule_emit stdout vs file).
+  - `tools/tls/` — revoke dry-run, renew failure exit-code
+    propagation, status with unparseable expiry, cron-install
+    delegation.
+  - `tools/hosts/` — _read_source URL + local file paths,
+    _back_up sudo failure + success, _atomic_write fallback
+    chain, run() interactive loop.
+  - `tools/web/nginx/` — list with empty sites-available, apply
+    + remove severe-token enforcement, vhost generate flavors.
+  - `cli.py` — config show/path/edit/validate, doctor full run,
+    self-update no-update path, per-tool --help registration.
+
+### Changed
+
+- `pyproject.toml` — added `tests/* = ["RUF012"]` to ruff's
+  `per-file-ignores`. Test stubs use throwaway classes to mock
+  pydantic models; RUF012 (mutable class-attribute defaults
+  need ClassVar) is real-code advice that doesn't apply to
+  dataclass-style test fakes.
+
 ## [0.9.0] — 2026-05-15
 
 ### Added

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "shimkit"
-version = "0.9.0"
+version = "0.10.0"
 description = "A toolkit of developer utilities — Java version manager, shell upgrader, and more. Python tools, shimmed by bash."
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -117,6 +117,12 @@ ignore = ["E501"]
 # B008 would otherwise flag every command we declare.
 extend-immutable-calls = ["typer.Argument", "typer.Option"]
 
+[tool.ruff.lint.per-file-ignores]
+# Test stubs use throwaway classes to mock pydantic models; RUF012 (mutable
+# class-attribute defaults need ClassVar) is real-code advice that doesn't
+# apply to dataclass-style test fakes.
+"tests/*" = ["RUF012"]
+
 [tool.ruff.lint.isort]
 # CI installs shimkit editably via `pip install -e ".[dev]"`, after which
 # ruff's first-party heuristic can flip-flop on whether `shimkit` is the

src/shimkit/__init__.py

@@ -3,5 +3,5 @@
 Python tools, shimmed by bash.
 """
 
-__version__ = "0.9.0"
+__version__ = "0.10.0"
 __all__ = ["__version__"]