[Security]: Tool calls and model output persist secrets in plaintext history

[shauryagangrade]

Problem

Every turn — including tool calls (bash commands, file contents) and model
output — is persisted as plaintext JSON under ~/.gcode/*.json. A bash
command that echoes an env var, or a conversation that includes an API key,
leaves that secret on disk forever. ~/.gcode/.env is at least guarded by
the user's file permissions; history files are written with default perms.

Proposed approach

• Redact known secrets (env-var references like $OPENROUTER_API_KEY,
  sk-or-... patterns) from what's persisted and/or displayed in /history.
• Set restrictive file permissions (0600) on history files.
• Optional: support encrypted history (keyring-based).

Where to look

• gcode/history.py:35-42 (save)
• gcode/agent.py:101-137 (run_turn) — where tool results enter the message list.

Acceptance criteria

• A session containing a sk-or-... string does not persist it verbatim.
• History files are created with 0600.
• Redaction is unit-tested.

Difficulty

Medium — good security intro PR.