shim-cli: Agent Egress Redaction and Session Cost Observability

shim-cli is an Apache-2.0 CLI that masks secrets and PII in coding-agent egress while shim watch surfaces per-session token spend—positioned between LocalGuard-style redaction and enterprise DLP.