- glob: validate each match against read-permitted roots to prevent symlink escape
- approval: canonicalize absolute command paths before scope checks
- session: tighten classifyTurnError order and remove broad backup keyword
Co-authored-by: Cursor <cursoragent@cursor.com>
