release: 0.3.2

README.md

@@ -211,7 +211,7 @@ to the new module name and, on Copilot, replaces the old hook file. Your
 settings and ledger move to `shim/` on the next `shim` command that touches
 them, and each move is reported once. The Claude Code plugin keeps loading and
 updating: `shim-guard@shim-guard` still resolves through a marketplace alias,
-which is removed in 0.5.0 along with the `shim-guard-hook` script, the
+which is removed in 1.0 along with the `shim-guard-hook` script, the
 `shim_guard` package and the `SHIM_GUARD_CONFIG` variable.
 
 Codex plugin users are the one exception and need four commands; see

docs/commands.md

@@ -430,7 +430,7 @@ wrote back is `observe`, because it is not a leak.
 | `CLAUDE_CONFIG_DIR`, `CODEX_HOME`, `COPILOT_HOME` | Where each client keeps its settings; shim follows them. |
 
 `SHIM_GUARD_CONFIG` is the 0.2.0 name for `SHIM_CONFIG` and still works. It is
-removed in 0.5.0.
+removed in 1.0.
 
 ## Where shim keeps things
 

docs/compatibility.md

@@ -20,7 +20,7 @@ is 3.9, the plugin route needs no Python beyond 3.9 and the package route needs
 
 The package was renamed from `shim_guard` to `shim_cli` in 0.3.0. Three names
 survive so that an install written by 0.2.0 keeps working, and all three are
-removed in **0.5.0**, the second minor release after 0.3.0:
+removed in **1.0**, the release after 0.3.2:
 
 | Name | Replacement |
 | --- | --- |
@@ -34,7 +34,7 @@ deprecation warning: the hook is a cold-start subprocess whose stderr the
 client shows to the user, and a warning on every event is noise.
 
 The plugin marketplaces carry a second `shim-guard` entry pointing at the same
-directory, also removed in 0.5.0. On Claude Code that entry is enough: the
+directory, also removed in 1.0. On Claude Code that entry is enough: the
 marketplace key is whatever the user typed when they added it, so a plugin
 installed as `shim-guard@shim-guard` keeps loading and updating with no action.
 

docs/releases/0.3.2.md

@@ -144,6 +144,30 @@ their attestations before it publishes. To check a downloaded wheel:
 gh attestation verify shim-0.3.2-py3-none-any.whl --bundle shim-0.3.2.intoto.jsonl --repo GetSHIM/shim-cli
 ```
 
+## 1.0 removes the 0.2.0 names
+
+The compatibility layer that kept 0.2.0 installs working was scheduled for
+removal in 0.5.0. It goes in 1.0 instead, the next release: the `shim_guard`
+package, the `shim-guard-hook` script, the `SHIM_GUARD_*` variables and the
+`shim-guard` marketplace entry.
+
+If `shim doctor` warns that a hook is installed in the 0.2.0 shape, run
+`shim install <client>` now. After 1.0, a settings file that still runs
+`-m shim_guard.hook` makes the client report `No module named shim_guard` on
+every prompt until you do. Settings and ledger files keep moving on their own.
+
+A Claude Code plugin installed as `shim-guard@shim-guard` stops receiving
+updates at 0.3.2. Move it with:
+
+```
+/plugin uninstall shim-guard@shim-guard
+/plugin marketplace add GetSHIM/shim-cli
+/plugin install shim-cli@shim-cli
+```
+
+Codex plugin users already moved in 0.3.0; see
+[compatibility.md](../compatibility.md).
+
 ## Verified
 
 `python scripts/check.py` green on 3.13: 2,005 tests, lint, format, types, and

plugins/shim-cli/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shim-cli",
   "displayName": "shim-cli",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Masks secrets and personal data in the tool results Claude Code reads, before the model sees them; reports what was in your prompts; and, with `shim watch`, shows what a session sent and what it cost. Runs locally with no account, network destination or telemetry.",
   "author": {
     "name": "shim Engineering"

plugins/shim-cli/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "shim-cli",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Reports secrets and personal data found in your Codex prompts before they are sent, locally, with no account, network destination or telemetry. Blocking is opt in.",
   "author": {
     "name": "shim Engineering"

plugins/shim-cli/README.md

@@ -23,7 +23,7 @@ the first that works:
    the newest build and starts faster, because a zipapp has no bytecode cache
    and reparses its modules on every event.
 2. `shim-guard-hook` on `PATH` — the same script under the name 0.2.0 used,
-   kept until 0.5.0.
+   kept until 1.0.
 3. `<plugin-root>/bin/shim.pyz` — the bundled archive. The
    root is the second argument when one is given, else `CLAUDE_PLUGIN_ROOT`.
    Claude sets the variable; Codex sets no such variable, so its `hooks.json`

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "shim"
-version = "0.3.1"
+version = "0.3.2"
 description = "shim-cli: local sensitive-data detection, prompt reporting, opt-in prompt blocking, verified Claude tool-event masking, and API-traffic watching"
 readme = "README.md"
 requires-python = ">=3.10,<3.14"

src/shim_cli/__init__.py

@@ -1 +1 @@
-__version__ = "0.3.1"
+__version__ = "0.3.2"