feat(go): port socket detectors

go-agent/internal/config/config.go

@@ -30,6 +30,20 @@ var defaultCredentialAccessAllowComms = []string{
 	"chrome", "google-chrome", "brave", "brave-browser",
 }
 
+var defaultInterpreters = []string{
+	"bash", "sh", "dash", "zsh", "ksh", "ash", "nc", "ncat", "netcat",
+	"socat", "telnet", "python", "python2", "python3", "perl", "ruby",
+	"php", "lua", "awk",
+}
+
+// These defaults intentionally duplicate the Python Config values. The parity
+// harness catches detector output drift, while config tests catch tuning drift
+// before a detector ever runs.
+var defaultStealthNetworkAllowComms = []string{
+	"NetworkManager", "systemd-networkd", "wpa_supplicant", "dhcpcd",
+	"tcpdump", "dumpcap", "wireshark", "suricata", "zeek",
+}
+
 // Config mirrors the Phase 1 settings consumed by the Go sweep loop. More
 // fields are added as their detectors are ported.
 type Config struct {
@@ -39,6 +53,10 @@ type Config struct {
 	InputSnooperAllowComms     map[string]bool
 	CredentialAccessAllowComms map[string]bool
 	CredentialAccessExtraPaths []string
+	Interpreters               map[string]bool
+	EgressAllowCIDRs           []string
+	StealthNetworkAllowComms   map[string]bool
+	StealthNetworkAllowKinds   map[string]bool
 }
 
 // Default returns Python-compatible defaults for the fields currently used.
@@ -54,6 +72,10 @@ func Default() Config {
 		InputSnooperAllowComms:     stringSet(defaultInputSnooperAllowComms),
 		CredentialAccessAllowComms: stringSet(defaultCredentialAccessAllowComms),
 		CredentialAccessExtraPaths: []string{},
+		Interpreters:               stringSet(defaultInterpreters),
+		EgressAllowCIDRs:           []string{},
+		StealthNetworkAllowComms:   stringSet(defaultStealthNetworkAllowComms),
+		StealthNetworkAllowKinds:   map[string]bool{},
 	}
 }
 
@@ -125,6 +147,32 @@ func Load(path string) (Config, error) {
 				return Config{}, fmt.Errorf("credential_access_extra_paths: %w", err)
 			}
 			cfg.CredentialAccessExtraPaths = paths
+		case "interpreters":
+			// Keep arrays as sets where membership is the runtime operation. TOML
+			// order has no behavioral meaning for allowlists.
+			names, err := stringArray(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("interpreters: %w", err)
+			}
+			cfg.Interpreters = stringSet(names)
+		case "egress_allow_cidrs":
+			cidrs, err := stringArray(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("egress_allow_cidrs: %w", err)
+			}
+			cfg.EgressAllowCIDRs = cidrs
+		case "stealth_network_allow_comms":
+			names, err := stringArray(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("stealth_network_allow_comms: %w", err)
+			}
+			cfg.StealthNetworkAllowComms = stringSet(names)
+		case "stealth_network_allow_kinds":
+			kinds, err := stringArray(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("stealth_network_allow_kinds: %w", err)
+			}
+			cfg.StealthNetworkAllowKinds = stringSet(kinds)
 		}
 	}
 	return cfg, nil

go-agent/internal/config/config_test.go

@@ -31,6 +31,10 @@ detectors = [
 input_snooper_allow_comms = ["Xorg"]
 credential_access_allow_comms = ["firefox"]
 credential_access_extra_paths = ["/srv/secrets/"]
+interpreters = ["bash", "python3"]
+egress_allow_cidrs = ["203.0.113.0/24"]
+stealth_network_allow_comms = ["tcpdump"]
+stealth_network_allow_kinds = ["mptcp"]
 unknown_future_key = true
 `)
 	if err := os.WriteFile(path, raw, 0o600); err != nil {
@@ -53,6 +57,13 @@ unknown_future_key = true
 		t.Fatalf("unexpected credential tuning: %#v %#v",
 			cfg.CredentialAccessAllowComms, cfg.CredentialAccessExtraPaths)
 	}
+	if !cfg.Interpreters["bash"] || len(cfg.EgressAllowCIDRs) != 1 {
+		t.Fatalf("unexpected network tuning: %#v %#v", cfg.Interpreters, cfg.EgressAllowCIDRs)
+	}
+	if !cfg.StealthNetworkAllowComms["tcpdump"] || !cfg.StealthNetworkAllowKinds["mptcp"] {
+		t.Fatalf("unexpected stealth tuning: %#v %#v",
+			cfg.StealthNetworkAllowComms, cfg.StealthNetworkAllowKinds)
+	}
 }
 
 func TestMissingFileKeepsDefaults(t *testing.T) {