Jan agent tools workspace-guard bypass: prompt injection writes files outside workspace via dangling symlinks

The agent-tools gate.rs guard can be bypassed via dangling symlinks: when the agent follows a symlink planted in the repository, the write/edit tools write outside the sandboxed workspace. A prompt-injection payload steers the agent into creating files such as an authorized_keys entry.

Agent workspace guards are a primary containment control against prompt-injection exfiltration. A symlink bypass converts an injected prompt into host file writes, which can be escalated to persistence (e.g., SSH key) on the developer machine running Jan.

An attacker supplies a malicious repository; prompt injection makes the agent's write/edit tools traverse a dangling symlink so files are written outside the workspace — for example, to ~/.ssh/authorized_keys on the host.

Jan >= 0.8.5, < 0.8.8

Upgrade Jan to >=0.8.8 (GHSA-7j4g-mj5j-p842 / commit 840c33e6).