Worker file tools can now read Rust crate sources and toolchains without permission prompts, including published registry sources and git dependency checkouts; the cargo git database stays governed.
Resolved roots are pinned to canonical real paths, so later symlink changes cannot widen access; only roots with real directories below the configured home are granted, because a missing root is retried and a worker shell could create it as a link to another project.
Only daemon-attested worker scopes receive these built-in grants; heads and other scopes do not.
Writes, credential/cache/config paths, permanent deny floors, and shell confinement are unchanged.
Confidence Score: 5/5
The latest changes introduce no separate merge blocker beyond the issue already covered by the earlier symlink thread.
Summary
The latest change checks each directory below the configured Rust home before granting worker reads.
Workers can read Rust crate and toolchain sources without approval prompts.
