Under the hood
AutoMem file scanning now filters candidate files against an allowed-paths list before reading them
What
A new function filters the files AutoMem and AutoMemPinned would scan as pinned memory, keeping only those within the workspace root's allowed paths. This filter runs before file headers are scanned, and is used both when building the AutoMem index and when identifying pinned memory candidates.
Why
This prevents AutoMem from scanning memory files outside the paths it's permitted to read.