v1.1.1: Merge pull request #49 from GetSHIM/release/1.1.1

shim-cli 1.1.1

1.1.1 fixes a permission problem in the Claude Code hook and two lines of CLI
output that could leave the hook switched off, and rewrites every part of the
docs that three first-time users, following them from zero, could not get
through on their own.

Upgrading is uv tool upgrade shim or pipx upgrade shim, or
/plugin update shim-cli@shim-cli in Claude Code. The hooks need nothing new:
shim install writes the same entries as in 1.1.0.

A masked tool call keeps its permission prompt

When shim masked a value in the arguments of a Claude Code tool call, its answer
also approved the call, so Claude Code skipped the permission prompt that the
same call gets without the value. Measured on Claude Code 2.1.286 with
claude -p: a WebFetch of https://example.com/?ref=docs was refused because
nothing had approved it, and the same fetch with ?email=ops@example.com in the
URL ran. Anything that could put an email address into a call could have that
call approved. Deny and ask rules in your settings held throughout.

shim now hands back the masked arguments and nothing else, and Claude Code's
permission rules decide as they would without shim. Measured again on the
release build: the fetch above is refused, with ?email=<EMAIL_1> in what
Claude Code reports, and with WebFetch allowed for httpbin.org, a fetch of
https://httpbin.org/get?email=ops@example.com runs and httpbin receives
<EMAIL_1>. shim installs no tool hook for Codex or GitHub Copilot CLI, and VS
Code accepts no replacement for a tool call, so only Claude Code changes.

Turning the hook on in Codex and Copilot CLI

shim install codex ended by telling you to accept the shim hook "when asked".
Codex never asks: it skips a hook it holds no trust record for, without a word,
and prompts go to the model uninspected. The line now says to open /hooks in
Codex, review the shim entry and enable it, as the README already did.

shim doctor copilot told GitHub Copilot CLI users to check the hook with
/hooks, which Copilot CLI does not have, and told anyone running the VS Code
plugin beside shim install copilot to remove one of them. Copilot CLI runs the
hook with no trust step, and the plugin stands down inside Copilot CLI, so that
pairing is the intended one. Both lines now pass and say so, and a healthy
Copilot CLI install prints no warning of its own.

Docs a newcomer can follow

Three simulated first-time users installed the 1.1.0 package in empty sandboxed
homes and followed only the README, the cookbook and the command reference: one
on Claude Code, one on Codex, GitHub Copilot CLI and VS Code, and one running
every recipe and every command example. What stopped or misled them is fixed:

• Install. The pipx line no longer needs Python 3.12 already installed, and
  the install ends with a check, for each client, that the hook really runs.
• VS Code. Refusing a tool call is outbound = "enforce"; the README said
  inbound, which refuses nothing there. A file read in VS Code is not
  inspected at all, and the docs now say so plainly. Installing the plugin has
  concrete steps, and a test prompt stands in for the doctor VS Code does not
  have.
• Settings. The file does not exist until something writes it, and
  shim config --reset --yes creates it safely. The modes are observe, warn
  and enforce, the keys are hyphenated, and because shim config does not
  show [mode], there is a test that blocking is on. On Linux an editor under
  umask 002 writes a file shim refuses, and the fix is named.
• Reports. shim report reads a live session: run it while the session is
  open, or turn the ledger on first. "No session on record" is not "found
  nothing".
• CI. The recipe passed while scanning nothing when origin/main was
  missing, and failed on any binary file. It now scans the lines a change adds,
  with pipefail on.
• The rest. What is and is not detected, the warnings a healthy
  shim doctor prints for each client, what shim demo does and does not
  show, and an uninstall that covers pipx, the plugin, VS Code and what stays
  behind.