history: Refuse to merge in private mode

It makes *no* sense.

Fixes #9050.

(cherry picked from commit bd7934ccbf)

CHANGELOG.rst

@@ -6,6 +6,7 @@ This release of fish introduces the following small enhancements:
 - Cursor shaping for Vi mode is enabled by default in tmux, and will be used if the outer terminal is capable (:issue:`8981`).
 - ``printf`` returns a better error when used with arguments interpreted as octal numbers (:issue:`9035`).
 - New completions for ``qdbus`` (:issue:`9031:`) and ``reflector`` (:issue:`9027`), and improvements to some completions.
+- ``history merge`` when in private mode is now an error, rather than wiping out other sessions' history (:issue:`9050`).
 
 This release also fixes a number of problems identified in fish 3.5.0.
 

src/builtins/history.cpp

@@ -305,6 +305,12 @@ maybe_t<int> builtin_history(parser_t &parser, io_streams_t &streams, const wcha
                 break;
             }
 
+            if (in_private_mode(parser.vars())) {
+                streams.err.append_format(
+                                          _(L"%ls: can't merge history in private mode\n"), cmd);
+                status = STATUS_INVALID_ARGS;
+                break;
+            }
             history->incorporate_external_changes();
             break;
         }

tests/checks/history.fish

@@ -66,3 +66,7 @@ builtin history -t merge
 # Now do a history command that should succeed so we exit with a zero,
 # success, status.
 builtin history save
+
+set -g fish_private_mode 1
+builtin history merge
+#CHECKERR: history: can't merge history in private mode