palaryn 0.5.11 → 0.6.0

package/src/dlp/navigation-instruction-backend.ts

@@ -0,0 +1,309 @@
+import { DLPBackend, DLPDetection } from './interfaces';
+import { DLPPattern } from './patterns';
+import { DLPSeverity } from '../types/tool-result';
+
+/**
+ * DLP backend that detects navigation instructions embedded in response content.
+ *
+ * Addresses the "nested page" attack vector: an agent opens allowed page ABC,
+ * which contains instructions (HTML redirects, JS navigation, explicit text
+ * commands) to open page XYZ. Even though XYZ may pass policy independently,
+ * the agent was *tricked* into requesting it by embedded content.
+ *
+ * Detection categories (all patterns use /gi flags):
+ *
+ *   1. HTML meta-refresh redirects           (high)
+ *   2. JavaScript navigation assignments     (high)
+ *   3. JavaScript navigation function calls  (high)
+ *   4. HTML embedding tags (iframe, frame, object, embed)  (medium)
+ *   5. HTML base tag hijacking               (high)
+ *   6. Auto-submitting forms                 (high)
+ *   7. JS fetch / XHR / sendBeacon           (medium)
+ *   8. WebSocket / EventSource connections   (medium)
+ *   9. Service Worker / dynamic import       (high)
+ *  10. Data URI with HTML content            (high)
+ *  11. Explicit textual navigation commands  (medium)
+ *
+ * Pattern names are prefixed with `navigation_instruction_` for namespacing.
+ *
+ * **False-positive mitigation**: Patterns are designed to match *executable*
+ * navigation directives, not passive hyperlinks (<a href>), CSS url() for
+ * stylesheets, or <link rel="stylesheet">. Documentation containing code
+ * examples may trigger medium-severity detections, which can be filtered
+ * by the `navigation_instruction_action` config setting.
+ */
+
+// ---------------------------------------------------------------------------
+// Category 1: HTML meta-refresh redirects (high)
+// Matches: <meta http-equiv="refresh" content="0;url=https://evil.com">
+// Also handles: content="5; URL=..." with optional spaces and quoting
+// ---------------------------------------------------------------------------
+const META_REFRESH: DLPPattern = {
+  name: 'navigation_instruction_meta_refresh',
+  pattern: /<meta\s[^>]*http-equiv\s*=\s*["']?\s*refresh\s*["']?\s[^>]*content\s*=\s*["']?\s*\d+\s*[;,]\s*url\s*=\s*[^"'\s>]+/gi,
+  severity: 'high',
+};
+
+// ---------------------------------------------------------------------------
+// Category 2: JavaScript navigation assignments (high)
+// Matches: window.location = "...", window.location.href = "...",
+//          document.location = "...", document.location.href = "...",
+//          location.href = "...", self.location = "..."
+// Captures both assignment (=) and property set patterns.
+// ---------------------------------------------------------------------------
+const JS_LOCATION_ASSIGN: DLPPattern = {
+  name: 'navigation_instruction_js_redirect',
+  pattern: /(?:window|document|self|top|parent)?\s*\.?\s*location\s*(?:\.(?:href|replace|assign))?\s*=\s*["'`][^"'`]{1,2000}["'`]/gi,
+  severity: 'high',
+};
+
+// ---------------------------------------------------------------------------
+// Category 3: JavaScript navigation function calls (high)
+// Matches: window.location.replace("..."), window.location.assign("..."),
+//          window.open("..."), location.replace("...")
+// ---------------------------------------------------------------------------
+const JS_LOCATION_FUNC: DLPPattern = {
+  name: 'navigation_instruction_js_navigate_call',
+  pattern: /(?:window|document|self|top|parent)?\s*\.?\s*(?:location\s*\.\s*(?:replace|assign)|open)\s*\(\s*["'`][^"'`]{1,2000}["'`]/gi,
+  severity: 'high',
+};
+
+// ---------------------------------------------------------------------------
+// Category 4: HTML embedding tags (medium)
+// Matches: <iframe src="...">, <frame src="...">, <object data="...">,
+//          <embed src="...">
+// These load external content automatically and can be used to redirect
+// or exfiltrate data. Severity is medium because iframes are common in
+// legitimate HTML responses.
+// ---------------------------------------------------------------------------
+const HTML_IFRAME: DLPPattern = {
+  name: 'navigation_instruction_html_embed',
+  pattern: /<(?:iframe|frame)\s[^>]*src\s*=\s*["']?\s*https?:\/\/[^"'\s>]+/gi,
+  severity: 'medium',
+};
+
+const HTML_OBJECT_EMBED: DLPPattern = {
+  name: 'navigation_instruction_html_object',
+  pattern: /<(?:object\s[^>]*data|embed\s[^>]*src)\s*=\s*["']?\s*https?:\/\/[^"'\s>]+/gi,
+  severity: 'medium',
+};
+
+// ---------------------------------------------------------------------------
+// Category 5: HTML base tag hijacking (high)
+// Matches: <base href="https://attacker.com">
+// Silently rewrites all relative URLs in the page to point to attacker domain.
+// ---------------------------------------------------------------------------
+const HTML_BASE_HIJACK: DLPPattern = {
+  name: 'navigation_instruction_base_hijack',
+  pattern: /<base\s[^>]*href\s*=\s*["']?\s*https?:\/\/[^"'\s>]+/gi,
+  severity: 'high',
+};
+
+// ---------------------------------------------------------------------------
+// Category 6: Auto-submitting forms (high)
+// Matches: <form ... with a nearby .submit() call — common CSRF/redirect pattern.
+// Two-part detection: form with action + submit() in close proximity.
+// ---------------------------------------------------------------------------
+const AUTO_SUBMIT_FORM: DLPPattern = {
+  name: 'navigation_instruction_auto_form_submit',
+  pattern: /<form\s[^>]*action\s*=\s*["']?https?:\/\/[^"'\s>]+[^]*?\.submit\s*\(\s*\)/gi,
+  severity: 'high',
+};
+
+// ---------------------------------------------------------------------------
+// Category 7: JS fetch / XHR / sendBeacon (medium)
+// Matches: fetch("https://..."), new XMLHttpRequest() ... .open("GET","https://..."),
+//          navigator.sendBeacon("https://...")
+// Medium severity: these are very common in legitimate web pages.
+// ---------------------------------------------------------------------------
+const JS_FETCH: DLPPattern = {
+  name: 'navigation_instruction_js_fetch',
+  pattern: /(?:fetch|navigator\s*\.\s*sendBeacon)\s*\(\s*["'`]https?:\/\/[^"'`]{1,2000}["'`]/gi,
+  severity: 'medium',
+};
+
+// ---------------------------------------------------------------------------
+// Category 8: WebSocket / EventSource connections (medium)
+// Matches: new WebSocket("wss://..."), new EventSource("https://...")
+// ---------------------------------------------------------------------------
+const JS_WEBSOCKET: DLPPattern = {
+  name: 'navigation_instruction_websocket',
+  pattern: /new\s+(?:WebSocket|EventSource)\s*\(\s*["'`](?:wss?|https?):\/\/[^"'`]{1,2000}["'`]/gi,
+  severity: 'medium',
+};
+
+// ---------------------------------------------------------------------------
+// Category 9: Service Worker / dynamic import (high)
+// Matches: navigator.serviceWorker.register("..."), import("https://...")
+// High severity: service workers can intercept all subsequent requests.
+// ---------------------------------------------------------------------------
+const JS_SERVICE_WORKER: DLPPattern = {
+  name: 'navigation_instruction_service_worker',
+  pattern: /navigator\s*\.\s*serviceWorker\s*\.\s*register\s*\(\s*["'`][^"'`]{1,2000}["'`]/gi,
+  severity: 'high',
+};
+
+const JS_DYNAMIC_IMPORT: DLPPattern = {
+  name: 'navigation_instruction_dynamic_import',
+  pattern: /import\s*\(\s*["'`]https?:\/\/[^"'`]{1,2000}["'`]\s*\)/gi,
+  severity: 'high',
+};
+
+// ---------------------------------------------------------------------------
+// Category 10: Data URI with active content (high)
+// Matches: data:text/html, data:image/svg+xml, data:application/javascript,
+//          data:text/javascript, data:text/xml, data:application/xml
+// All can contain executable content (scripts, redirects, event handlers).
+// Note: The text-normalizer already decodes base64 data URIs, but this
+// pattern catches them at the structural level before normalization.
+// ---------------------------------------------------------------------------
+const DATA_URI_ACTIVE: DLPPattern = {
+  name: 'navigation_instruction_data_uri',
+  pattern: /data:(?:text\/html|image\/svg\+xml|application\/javascript|text\/javascript|text\/xml|application\/xml)[^"'\s)>]{0,2000}/gi,
+  severity: 'high',
+};
+
+// Backward-compatible alias for tests referencing the old name
+const DATA_URI_HTML = DATA_URI_ACTIVE;
+
+// ---------------------------------------------------------------------------
+// Category 11: Explicit textual navigation commands (medium)
+// Matches: "visit https://...", "navigate to https://...", "open https://...",
+//          "go to https://...", "browse to https://...", "fetch https://..."
+// Medium severity: may appear in legitimate documentation or instructions.
+// Only matches when followed by an actual URL to reduce false positives.
+// ---------------------------------------------------------------------------
+const EXPLICIT_NAVIGATE_TEXT: DLPPattern = {
+  name: 'navigation_instruction_explicit_text',
+  pattern: /(?:visit|navigate\s+to|open|go\s+to|browse\s+to|fetch|request|call|access|load)\s+(?:the\s+(?:url|page|link|endpoint|site)\s+)?(?:at\s+)?["']?https?:\/\/[^\s"'<>]{4,500}/gi,
+  severity: 'medium',
+};
+
+// ---------------------------------------------------------------------------
+// Category 12: SVG with embedded script (high)
+// SVG files are XML and can contain <script> tags with full JS execution.
+// This is one of the most dangerous image-based attack vectors because
+// SVGs are often treated as "images" but carry executable code.
+// ---------------------------------------------------------------------------
+const SVG_SCRIPT: DLPPattern = {
+  name: 'navigation_instruction_svg_script',
+  pattern: /<svg\b[^>]*>[^]*?<script\b[^>]*>[^]*?<\/script>/gi,
+  severity: 'high',
+};
+
+// ---------------------------------------------------------------------------
+// Category 13: SVG event handlers (high)
+// SVG elements support JavaScript event handlers like onload, onerror.
+// <svg onload="malicious()"> executes immediately when the SVG loads.
+// ---------------------------------------------------------------------------
+const SVG_EVENT_HANDLER: DLPPattern = {
+  name: 'navigation_instruction_svg_event_handler',
+  pattern: /<svg\b[^>]*\son(?:load|error|click|mouseover|focus|blur)\s*=\s*["'][^"']*["']/gi,
+  severity: 'high',
+};
+
+// ---------------------------------------------------------------------------
+// Category 14: SVG foreignObject (high)
+// <foreignObject> embeds arbitrary HTML/XHTML inside SVG, including forms,
+// scripts, iframes — essentially a full HTML injection point within an "image".
+// ---------------------------------------------------------------------------
+const SVG_FOREIGN_OBJECT: DLPPattern = {
+  name: 'navigation_instruction_svg_foreign_object',
+  pattern: /<foreignObject\b[^>]*>[^]*?<\/foreignObject>/gi,
+  severity: 'high',
+};
+
+// ---------------------------------------------------------------------------
+// Category 15: HTML event handlers in any tag (high)
+// Catches event handlers (onload, onerror, etc.) on any HTML element,
+// not just SVG. These auto-execute JavaScript without user interaction.
+// ---------------------------------------------------------------------------
+const HTML_EVENT_HANDLER: DLPPattern = {
+  name: 'navigation_instruction_html_event_handler',
+  pattern: /<[a-z][a-z0-9]*\s[^>]*?on(?:load|error|click|mouseover|focus|blur|mouseenter|submit|change|input)\s*=\s*["'][^"']*["']/gi,
+  severity: 'high',
+};
+
+// ---------------------------------------------------------------------------
+// All patterns collected for iteration
+// ---------------------------------------------------------------------------
+const NAVIGATION_PATTERNS: DLPPattern[] = [
+  META_REFRESH,
+  JS_LOCATION_ASSIGN,
+  JS_LOCATION_FUNC,
+  HTML_IFRAME,
+  HTML_OBJECT_EMBED,
+  HTML_BASE_HIJACK,
+  AUTO_SUBMIT_FORM,
+  JS_FETCH,
+  JS_WEBSOCKET,
+  JS_SERVICE_WORKER,
+  JS_DYNAMIC_IMPORT,
+  DATA_URI_ACTIVE,
+  SVG_SCRIPT,
+  SVG_EVENT_HANDLER,
+  SVG_FOREIGN_OBJECT,
+  HTML_EVENT_HANDLER,
+  EXPLICIT_NAVIGATE_TEXT,
+];
+
+/**
+ * Extract target URLs from a navigation instruction match.
+ * Returns the first URL found in the matched string, or null.
+ */
+function extractTargetUrl(match: string): string | null {
+  // Try to extract URL from common patterns
+  const urlPatterns = [
+    /url\s*=\s*["']?([^"'\s;>]+)/i,              // meta-refresh url=...
+    /=\s*["'`](https?:\/\/[^"'`]+)["'`]/i,       // assignment = "https://..."
+    /\(\s*["'`](https?:\/\/[^"'`]+)["'`]/i,      // function call("https://...")
+    /(?:src|data|href|action)\s*=\s*["']?(https?:\/\/[^"'\s>]+)/i, // HTML attributes
+    /(https?:\/\/[^\s"'<>]+)/i,                    // bare URL fallback
+    /((?:wss?):\/\/[^\s"'<>]+)/i,                  // WebSocket URL
+    /(data:text\/html[^\s"'<>)]*)/i,               // data URI
+  ];
+
+  for (const urlPat of urlPatterns) {
+    const m = urlPat.exec(match);
+    if (m && m[1]) {
+      return m[1];
+    }
+  }
+  return null;
+}
+
+export class NavigationInstructionBackend implements DLPBackend {
+  readonly name = 'navigation_instruction';
+
+  scanString(value: string): DLPDetection[] {
+    const detections: DLPDetection[] = [];
+
+    // Skip very short strings — no meaningful navigation instructions possible
+    if (value.length < 15) return detections;
+
+    for (const pat of NAVIGATION_PATTERNS) {
+      pat.pattern.lastIndex = 0;
+      let m: RegExpExecArray | null;
+      while ((m = pat.pattern.exec(value)) !== null) {
+        const targetUrl = extractTargetUrl(m[0]);
+        detections.push({
+          pattern_name: pat.name,
+          severity: pat.severity as DLPSeverity,
+          match: m[0].slice(0, 500), // Truncate long matches for logging
+          start: m.index,
+          end: m.index + m[0].length,
+          ...(targetUrl ? { target_url: targetUrl } : {}),
+        } as DLPDetection & { target_url?: string });
+
+        // Guard against zero-length matches causing infinite loops
+        if (m[0].length === 0) {
+          pat.pattern.lastIndex++;
+        }
+      }
+      // Reset lastIndex for stateful /g regex reuse
+      pat.pattern.lastIndex = 0;
+    }
+
+    return detections;
+  }
+}

package/src/dlp/nemo-backend.ts

@@ -1,6 +1,7 @@
 import { execFileSync } from 'child_process';
 import { DLPBackend, DLPDetection } from './interfaces';
 import { DLPSeverity } from '../types/tool-result';
+import { CircuitBreaker } from './circuit-breaker';
 
 export interface NemoGuardrailsConfig {
   /** NeMo Guardrails API URL (e.g. 'http://nemo:8000'). */
@@ -25,15 +26,22 @@ export class NemoGuardrailsBackend implements DLPBackend {
 
   private readonly apiUrl: string;
   private readonly timeoutMs: number;
+  readonly circuitBreaker: CircuitBreaker;
 
   constructor(config: NemoGuardrailsConfig) {
     this.apiUrl = config.api_url.replace(/\/+$/, '');
     this.timeoutMs = config.timeout_ms ?? 5000;
+    this.circuitBreaker = new CircuitBreaker({ name: 'nemo', failureThreshold: 5, resetTimeoutMs: 30_000 });
   }
 
   scanString(value: string): DLPDetection[] {
     if (!value || value.length < 5) return [];
 
+    if (!this.circuitBreaker.allowRequest()) {
+      console.warn(`[NemoGuardrailsBackend] circuit OPEN — skipping external call`);
+      return [];
+    }
+
     try {
       const payload = JSON.stringify({
         messages: [{ role: 'user', content: value }],
@@ -53,8 +61,10 @@ export class NemoGuardrailsBackend implements DLPBackend {
         stdio: ['pipe', 'pipe', 'pipe'],
       });
 
+      this.circuitBreaker.recordSuccess();
       return this.parseResponse(stdout, value);
     } catch (err: unknown) {
+      this.circuitBreaker.recordFailure();
       const message = err instanceof Error ? err.message : String(err);
       console.warn(`[NemoGuardrailsBackend] scan failed: ${message}`);
       return [];

package/src/dlp/prompt-injection-patterns.ts

@@ -401,6 +401,43 @@ export const PROMPT_INJECTION_PATTERNS: DLPPattern[] = [
     pattern: /(?:you\s+have\s+)?no\s+(?:rules|limits|limitations|boundaries|restrictions|ethical\s+guidelines|safety\s+(?:measures|protocols|guidelines))/gi,
     severity: 'medium',
   },
+
+  // -----------------------------------------------------------------------
+  // Category 18: Policy/config self-modification (high)
+  // Detects instructions to modify the agent's own policy, config, or
+  // governance files — the most dangerous form of prompt injection as it
+  // can disable all security controls.
+  // -----------------------------------------------------------------------
+  {
+    name: 'prompt_injection_modify_policy',
+    pattern: /(?:modify|change|update|edit|overwrite|replace|rewrite|alter)\s+(?:the\s+|your\s+)?(?:policy|policies|policy[\s_-]*(?:pack|file|yaml|config|rules?))/gi,
+    severity: 'high',
+  },
+  {
+    name: 'prompt_injection_write_policy_file',
+    pattern: /(?:write|save|create|output|put|dump)\s+(?:this\s+|the\s+following\s+)?(?:to|into|in)\s+(?:the\s+)?(?:policy|config|yaml|yml|configuration)\s*(?:file|pack)?/gi,
+    severity: 'high',
+  },
+  {
+    name: 'prompt_injection_disable_security',
+    pattern: /(?:disable|turn\s+off|deactivate|remove|bypass|skip)\s+(?:all\s+)?(?:the\s+)?(?:security|DLP|firewall|policy|protection|enforcement|validation|rate[\s_-]*limit|budget[\s_-]*check|approval)/gi,
+    severity: 'high',
+  },
+  {
+    name: 'prompt_injection_allow_all_policy',
+    pattern: /(?:set|change|make|switch)\s+(?:the\s+)?(?:default\s+)?(?:policy|effect|rule)\s+(?:to\s+)?(?:allow[\s_-]*all|permissive|allow\s+everything)/gi,
+    severity: 'high',
+  },
+  {
+    name: 'prompt_injection_policy_pack_path',
+    pattern: /policy[\s_-]*packs?\/[^\s"']+\.ya?ml/gi,
+    severity: 'high',
+  },
+  {
+    name: 'prompt_injection_remove_rules',
+    pattern: /(?:remove|delete|clear|empty|wipe)\s+(?:all\s+)?(?:the\s+)?(?:policy\s+)?(?:rules?|restrictions?|blocklist|denylist|deny\s+rules?)/gi,
+    severity: 'high',
+  },
 ];
 
 // ---------------------------------------------------------------------------

package/src/dlp/text-normalizer.ts

@@ -6,6 +6,9 @@
  * into canonical ASCII text before pattern matching.
  */
 
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const punycode = require('punycode/');
+
 // ---------------------------------------------------------------------------
 // Zero-width character stripping
 // ---------------------------------------------------------------------------
@@ -13,9 +16,10 @@
 /** Regex matching zero-width and invisible Unicode characters.
  *  Comprehensive list covering: zero-width spaces/joiners, soft hyphen, BOM,
  *  directional marks/isolates, word joiners, invisible operators,
- *  combining grapheme joiner, Arabic letter mark, and deprecated formatting chars.
+ *  combining grapheme joiner, Arabic letter mark, deprecated formatting chars,
+ *  and Unicode Tags block (U+E0001-U+E007F, deprecated language tags).
  */
-export const ZERO_WIDTH_REGEX = /[\u200B\u200C\u200D\u00AD\uFEFF\u200E\u200F\u034F\u061C\u180E\u2060\u2061\u2062\u2063\u2064\u2066\u2067\u2068\u2069\u206A\u206B\u206C\u206D\u206E\u206F]/g;
+export const ZERO_WIDTH_REGEX = /[\u200B\u200C\u200D\u00AD\uFEFF\u200E\u200F\u034F\u061C\u180E\u2060\u2061\u2062\u2063\u2064\u2066\u2067\u2068\u2069\u206A\u206B\u206C\u206D\u206E\u206F\u{E0001}-\u{E007F}]/gu;
 
 // ---------------------------------------------------------------------------
 // Homoglyph map (visually similar characters -> ASCII equivalents)
@@ -263,23 +267,39 @@ function stripEmojisBetweenLetters(input: string): string {
  * Normalize text for bypass-resistant pattern matching.
  *
  * Applies transformations in order:
- * 1. Strip zero-width / invisible Unicode characters
+ * 1. Strip zero-width / invisible Unicode characters (incl. Unicode Tags block)
  * 2. Unicode NFKC normalization (collapses fullwidth, ligatures, etc.)
  * 3. Decode HTML entities (named + numeric)
- * 4. Decode URL percent-encoding
+ * 4. Decode URL percent-encoding (multi-pass, up to 3 iterations)
+ * 4.5. Decode Punycode domains (xn-- labels -> Unicode -> homoglyph collapse)
  * 5. Collapse homoglyphs (Cyrillic/Greek lookalikes -> ASCII)
  * 6. Collapse repeated whitespace to single space
  *
  * @param input - The raw text to normalize.
  * @returns The normalized text suitable for pattern matching.
  */
+/**
+ * Decode Punycode (xn--) domain labels to Unicode.
+ * Enables homoglyph normalization to collapse Punycode-encoded lookalike domains.
+ */
+function decodePunycodeDomains(input: string): string {
+  // Match xn-- labels in domain-like contexts (dot-separated labels)
+  return input.replace(/\bxn--[a-z0-9-]+(?:\.[a-z0-9-]+)*/gi, (domain) => {
+    try {
+      return punycode.toUnicode(domain);
+    } catch {
+      return domain; // Leave as-is if decode fails
+    }
+  });
+}
+
 export function normalizeText(input: string): string {
   // Early exit for very short strings
   if (input.length === 0) return input;
 
   let text = input;
 
-  // 1. Strip zero-width characters
+  // 1. Strip zero-width characters (including Unicode Tags block U+E0001-E007F)
   text = text.replace(ZERO_WIDTH_REGEX, '');
 
   // 2. NFKC normalization (fullwidth -> ASCII, ligatures -> components, etc.)
@@ -296,8 +316,17 @@ export function normalizeText(input: string): string {
   // 3. Decode HTML entities
   text = decodeHTMLEntities(text);
 
-  // 4. Decode URL percent-encoding
-  text = decodeURLEncoding(text);
+  // 4. Decode URL percent-encoding (multi-pass for layered encoding like %2569 -> %69 -> i)
+  let prevText: string;
+  let passes = 0;
+  do {
+    prevText = text;
+    text = decodeURLEncoding(text);
+    passes++;
+  } while (text !== prevText && passes < 3);
+
+  // 4.5 Decode Punycode domains (xn-- labels -> Unicode for homoglyph matching)
+  text = decodePunycodeDomains(text);
 
   // 5. Collapse homoglyphs
   text = text.replace(homoglyphRegex, (ch) => HOMOGLYPH_MAP[ch] || ch);

package/src/dlp/tool-patterns.ts

@@ -1,4 +1,39 @@
 import { DLPPattern } from './patterns';
+import { DLPBackend, DLPDetection } from './interfaces';
+import { DLPSeverity } from '../types/tool-result';
+
+/**
+ * DLP backend that scans for sensitive file paths in tool arguments.
+ * Detects references to policy packs, .env files, and governance config
+ * that could indicate a policy self-modification attack.
+ */
+export class SensitiveFileBackend implements DLPBackend {
+  readonly name = 'sensitive_file';
+
+  scanString(value: string): DLPDetection[] {
+    const detections: DLPDetection[] = [];
+    if (value.length < 4) return detections;
+
+    for (const pat of SENSITIVE_FILE_PATTERNS) {
+      pat.pattern.lastIndex = 0;
+      let m: RegExpExecArray | null;
+      while ((m = pat.pattern.exec(value)) !== null) {
+        detections.push({
+          pattern_name: pat.name,
+          severity: pat.severity as DLPSeverity,
+          match: m[0],
+          start: m.index,
+          end: m.index + m[0].length,
+        });
+        if (m[0].length === 0) {
+          pat.pattern.lastIndex++;
+        }
+      }
+      pat.pattern.lastIndex = 0;
+    }
+    return detections;
+  }
+}
 
 // Shell injection patterns
 export const SHELL_INJECTION_PATTERNS: DLPPattern[] = [
@@ -32,6 +67,11 @@ export const SENSITIVE_FILE_PATTERNS: DLPPattern[] = [
   { name: 'sensitive_file_gitconfig', pattern: /\.gitconfig/gi, severity: 'low' },
   { name: 'sensitive_file_shadow', pattern: /\/etc\/shadow/gi, severity: 'high' },
   { name: 'sensitive_file_shell_rc', pattern: /\.(?:bashrc|zshrc|profile|bash_history|zsh_history)/gi, severity: 'medium' },
+  // Palaryn governance / policy files — modification disables security controls
+  { name: 'sensitive_file_policy_pack', pattern: /policy[\s_-]*packs?\/[^\s"']*\.ya?ml/gi, severity: 'high' },
+  { name: 'sensitive_file_policy_yaml', pattern: /(?:^|[\\/])(?:policy|policies|rules)\.ya?ml/gi, severity: 'high' },
+  { name: 'sensitive_file_env', pattern: /(?:^|[\\/\s"'])\.env(?:\.\w+)?(?=$|[\s"'\\/])/gi, severity: 'high' },
+  { name: 'sensitive_file_palaryn_config', pattern: /palaryn[\s_-]*(?:config|settings)\.(?:ya?ml|json|toml)/gi, severity: 'high' },
 ];
 
 // SQL injection patterns

package/src/executor/filesystem-executor.ts

@@ -10,6 +10,24 @@ import { FilesystemExecutorConfig } from '../types/config';
  * Handles tool calls with tool name `file.*` (e.g., file.read, file.write).
  * All paths are resolved relative to and contained within base_dir.
  */
+/**
+ * Hardcoded protected path patterns that CANNOT be written to or deleted.
+ * This is a defense-in-depth measure against policy self-modification attacks
+ * where a prompt injection instructs the agent to overwrite governance files.
+ * These paths are blocked regardless of config, allowlist, or policy settings.
+ */
+const PROTECTED_PATH_PATTERNS = [
+  /policy[\s_-]*packs?\//i,
+  /\.env(?:\.\w+)?$/i,
+  /palaryn[\s_-]*config\./i,
+];
+
+const PROTECTED_FILENAMES = [
+  'policy.yaml', 'policy.yml', 'policies.yaml', 'policies.yml',
+  'rules.yaml', 'rules.yml',
+  '.env', '.env.local', '.env.production', '.env.development',
+];
+
 export class FilesystemExecutor implements ToolExecutor {
   private config: FilesystemExecutorConfig;
   private resolvedBaseDir: string;
@@ -19,6 +37,29 @@ export class FilesystemExecutor implements ToolExecutor {
     this.resolvedBaseDir = path.resolve(config.base_dir);
   }
 
+  /**
+   * Check if a file path targets a protected governance/config file.
+   * This is a hardcoded safeguard that cannot be disabled by configuration.
+   */
+  private isProtectedPath(filePath: string): boolean {
+    const normalized = filePath.replace(/\\/g, '/');
+    const basename = path.basename(normalized).toLowerCase();
+
+    // Check against protected filenames
+    if (PROTECTED_FILENAMES.includes(basename)) {
+      return true;
+    }
+
+    // Check against protected path patterns
+    for (const pattern of PROTECTED_PATH_PATTERNS) {
+      if (pattern.test(normalized)) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
   async execute(toolCall: ToolCall): Promise<ToolOutput> {
     const action = this.resolveAction(toolCall);
 
@@ -102,6 +143,11 @@ export class FilesystemExecutor implements ToolExecutor {
     if (!filePath || typeof filePath !== 'string') {
       throw new Error('Missing or invalid "path" argument for file.write');
     }
+
+    // Hardcoded protection: block writes to governance/policy/config files
+    if (this.isProtectedPath(filePath)) {
+      throw new Error(`Write denied: "${filePath}" is a protected governance/config file and cannot be modified by agent tool calls`);
+    }
     if (content === undefined || content === null) {
       throw new Error('Missing "content" argument for file.write');
     }
@@ -138,6 +184,11 @@ export class FilesystemExecutor implements ToolExecutor {
       throw new Error('Missing or invalid "path" argument for file.delete');
     }
 
+    // Hardcoded protection: block deleting governance/policy/config files
+    if (this.isProtectedPath(filePath)) {
+      throw new Error(`Delete denied: "${filePath}" is a protected governance/config file and cannot be deleted by agent tool calls`);
+    }
+
     const resolved = this.resolveSafePath(filePath);
 
     const stat = await fs.stat(resolved);

package/src/metrics/collector.ts

@@ -31,6 +31,7 @@ export class GatewayMetrics {
   // Histograms
   private requestDuration: promClient.Histogram;
   private costPerRequest: promClient.Histogram;
+  private policyEvaluationSeconds: promClient.Histogram;
 
   // Gauge
   private activeApprovals: promClient.Gauge;
@@ -69,6 +70,15 @@ export class GatewayMetrics {
       registers: [this.registry],
     });
 
+    // palaryn_policy_evaluation_seconds
+    this.policyEvaluationSeconds = new promClient.Histogram({
+      name: 'palaryn_policy_evaluation_seconds',
+      help: 'Time spent evaluating policy rules',
+      labelNames: ['engine'],
+      buckets: [0.001, 0.005, 0.01, 0.05, 0.1, 0.5, 1.0],
+      registers: [this.registry],
+    });
+
     // palaryn_dlp_detections_total
     this.dlpDetectionsTotal = new promClient.Counter({
       name: 'palaryn_dlp_detections_total',
@@ -220,6 +230,13 @@ export class GatewayMetrics {
     this.policyDecisionsTotal.inc({ decision, rule_id: ruleId });
   }
 
+  /**
+   * Record policy evaluation duration.
+   */
+  recordPolicyEvaluation(engine: string, durationSeconds: number): void {
+    this.policyEvaluationSeconds.observe({ engine }, durationSeconds);
+  }
+
   /**
    * Record a DLP detection event.
    */