fix(mcp): scope and redact native-shell-history fallback before returning to agents

Repository: NaNIsaac/codigest
Priority: P1
Create issue: https://github.com/NaNIsaac/codigest/issues/new

Problem

MCP tool terminal_history documents here=True as restricting results to the server's working directory. When no captured entries exist, _terminal_history() calls shellhist.read_recent(count) and directly renders those entries. This fallback does not apply the here/failed filters or redact command text. shellhist.read_recent() reads the newest available shell-history file, which may contain commands from other projects or credentials passed as CLI flags.

The regular ingest path uses termstore.append_entry() to redact, but the native-history fallback bypasses that stage.

Risks

• A tool call limited to the project can return unrelated shell commands from elsewhere.
• Sensitive command arguments can be sent to an LLM without redaction if present in native shell history.

Proposed change

• Redact native-history fallback command text before any MCP/clipboard output.
• Avoid claiming directory scoping for fallback records that have no CWD metadata: return an explicit unscoped warning, require opt-in, or suppress the fallback when here=True.
• Handle failed=True consistently: native history has no exit codes, so it cannot faithfully filter failed commands.

Acceptance criteria

• Unit tests use a temporary shell-history file containing a fake credential and cross-project commands; nothing sensitive escapes.
• terminal_history with here=True never silently returns unscoped shell-history data.
• Documentation explains fallback limitations.

Code

• commands/mcp.py
• core/shellhist.py
• core/termstore.py