[Codeblin]

Git clones now fetch the GitHub release tag instead of a shallow master pull, arsenal commands get full dispatch tests, and CI posts coverage as a sticky PR comment plus a coverage-ubuntu artifact.

Summary

Describe the change and why it matters.

Testing

• python -m pytest
• droidreaver --help
• `droidreaver statGit clones now fetch the GitHub release tag instead of a shallow master pull, arsenal commands get full dispatch tests, and CI posts coverage as a sticky PR comment plus a coverage-ubuntu artifact.

Summary

Medusa (and other git-installed tools) were reporting “—” for Installed and update only ran git pull on a shallow master clone, so they never moved onto the GitHub Latest release tag (e.g. Medusa v3.9.6). Install/update now fetch that tag (or re-download the matching zip), record it as the installed version, and keep Medusa out of the Frida pin group so update medusa does not bump Frida.

Arsenal dispatch is covered end-to-end: every registry tool/alias is a Click command, run/info/arsenal wiring is tested, and live --version/--help probes use ~/.droidreaver/tools (gitignored). Optional DROIDREAVER_ARSENAL_INSTALL=gitleaks,adb pre-installs a small set; CI caches that dir on an ubuntu smoke job.

Coverage no longer depends on GitHub Code Quality (Team/Enterprise). Ubuntu CI writes Cobertura XML + HTML, uploads a coverage-ubuntu artifact, and posts a sticky PR comment with line/branch % and the weakest files.

Also in this change: arsenal Click --help no longer leaked the last tool’s description (loop closure); Windows PATH/is_dir skips inaccessible dirs; uninstall/remove for managed tools.

Testing

• python -m pytest
• droidreaver --help
• droidreaver status --offline

Arsenal suite: python -m pytest tests/test_arsenal.py tests/test_coverage_comment.py tests/test_install_direct.py tests/test_registry.py -q

Live probes skip when a binary is missing. To install then probe:

set DROIDREAVER_ARSENAL_INSTALL=gitleaks,adb
.venv\Scripts\python.exe -m pytest tests/test_arsenal.py -m arsenal_live -rsus --offline`

## Device or Emulator Coverage

If this affects device flows, note what you tested:

- Setup:
- Rooted:
- Command:
- Result:

## Supply Chain Impact

- [ ] No new downloads or network calls
- [ ] New/changed downloads are documented in `THREAT_MODEL.md`
- [ ] Checksums/signatures were added when upstream provides them

[github-actions]

Test coverage

Metric	Value
Lines	49.6% (2474/4986)
Branches	33.7%

Lowest-coverage files:

File	Lines
__main__.py	0.0%
cli.py	31.1%
shims/readline_win.py	34.4%
device.py	35.6%
fix.py	36.4%
versions.py	40.8%
doctor.py	41.4%
console.py	42.8%
installer.py	45.4%
utils.py	54.2%
bypass.py	57.4%
runtime.py	60.3%
medusa_modules.py	67.3%
config.py	73.6%

pytest-cov on ubuntu-latest.