fix: strip NUL bytes from history commands (closes #3589)

External tools (e.g. AI agents) can mis-escape values and write raw NUL
bytes into the shell history. NUL bytes break downstream consumers that
expect valid UTF-8 text — search output, pipes, messagepack serialisation,
and so on. Rather than reject the entire otherwise-useful entry, strip the
NUL bytes at the point where new history entries are constructed
(History::new), so clean and dirty paths alike are handled.

Adds a sanitize_command helper with a fast-path for the common case
(no NUL bytes present) and a test for both the stripped and clean paths.

Author: flowsnow

crates/atuin-client/src/history.rs

@@ -126,6 +126,24 @@ impl History {
         })
     }
 
+    /// Strip NUL bytes from a command string.
+    ///
+    /// NUL bytes can enter the history when an external tool (e.g. an AI agent
+    /// that mis-escapes a value like `start=\0` instead of `start=0`) writes a
+    /// raw NUL byte into the command. NUL bytes break downstream consumers
+    /// that expect valid UTF-8 text — search output, pipes, messagepack
+    /// serialization, etc. Rather than reject the whole entry, we silently
+    /// strip the offending bytes so the (otherwise useful) command is still
+    /// recorded. See atuinsh/atuin#3589.
+    fn sanitize_command(command: String) -> String {
+        if !command.contains('\0') {
+            // fast path: most commands are clean
+            command
+        } else {
+            command.replace('\0', "")
+        }
+    }
+
     #[allow(clippy::too_many_arguments)]
     fn new(
         timestamp: OffsetDateTime,
@@ -152,7 +170,7 @@ impl History {
         Self {
             id: uuid_v7().as_simple().to_string().into(),
             timestamp,
-            command,
+            command: Self::sanitize_command(command),
             cwd,
             exit,
             duration,
@@ -698,6 +716,31 @@ mod tests {
         assert_eq!(history, deserialized);
     }
 
+    #[test]
+    fn test_sanitize_strips_nul_bytes() {
+        // Simulate the "start=\0" mis-escape reported in #3589
+        let entry: History = History::capture()
+            .timestamp(time::OffsetDateTime::now_utc())
+            .command("start=\0 foo\0bar")
+            .cwd("/")
+            .build()
+            .into();
+
+        assert_eq!(entry.command, "start= foobar");
+    }
+
+    #[test]
+    fn test_sanitize_preserves_clean_command() {
+        let entry: History = History::capture()
+            .timestamp(time::OffsetDateTime::now_utc())
+            .command("git status")
+            .cwd("/")
+            .build()
+            .into();
+
+        assert_eq!(entry.command, "git status");
+    }
+
     #[test]
     fn test_serialize_deserialize_version() {
         // v0