shim Guard 0.2.0

September 2, 2026 ยท View on GitHub

This release expands shim Guard from prompt-only checks into local session reporting and verified Claude tool-event handling while keeping prompt blocking opt in.

The PyPI distribution is now shim. Existing shim-guard installations must be uninstalled before installing shim; command and plugin names are unchanged.

Public behavior

  • Claude Code, Codex CLI, and GitHub Copilot prompts are detected locally. Claude and Codex report findings and pass the prompt by default. Copilot masks its rewritable transformed prompt. Blocking a Claude or Codex prompt requires an explicit enforce mode.
  • Claude PreToolUse and PostToolUse are the only verified native tool-event adapters. Eligible sensitive fields in structured outbound arguments and inbound results are masked by default. No native tool-event support is claimed for Codex or Copilot.
  • shim report shows the latest session summary, shim ledger purge removes every retained ledger file, and shim watch -- CLIENT ... measures API traffic through a process-local proxy. Claude watch is verified; Codex watch warns that sign-in compatibility is unverified; Copilot watch is unsupported.
  • Inbound Claude tool results compact eligible JSON by default. Trailing- whitespace removal is available only through explicit configuration because it can remove Markdown hard breaks. Prompt-injection shapes in those results are reported as markers and never trigger rewriting.

Configuration and persisted data

  • ledger is a new boolean TOML setting and remains off by default. When enabled, metadata-only JSONL records are retained in monthly files. A month becomes eligible for pruning 30 days after that month ends; the next ledger write prunes eligible files. shim ledger purge removes them immediately.
  • diet is a new TOML setting. It defaults to the lossless json transform, accepts a list of transform names, and can be set to false. The whitespace transform must be selected explicitly.
  • Session records are metadata only: they contain decisions, entity counts, byte counts, applied transforms, report-only markers, and bounded labels, but never prompt text, tool input or response bodies, commands, detected values, or the client-supplied session identifier. The default spool is bounded and uses OS temporary storage. Claude SessionEnd deletes its session spool; the prompt-only Codex and Copilot integrations rely on OS temporary cleanup. The ledger is the explicit persistence opt in.
  • Existing TOML files remain valid. The previous enabled_entities, [mode], and [entities] settings retain their meaning, and omitted keys inherit the shipped defaults.

Python 3.9 through 3.13 remains supported.

Release evidence

The release candidate passed its automated protocol, package, corpus, and quality gates. Fresh Codex safe and finding paths passed on macOS; the release owner accepted the documented remaining client-boundary risk without further local client testing. See docs/compatibility.md for the exact scope.