feat(go): port process access detectors

go-agent/internal/config/config.go

@@ -19,12 +19,26 @@ var defaultDetectors = []string{
 	"first_seen", "new_listener", "new_suid", "persistence", "egress",
 }
 
+var defaultInputSnooperAllowComms = []string{
+	"Xorg", "Xwayland", "gnome-shell", "kwin_wayland", "sway", "Hyprland",
+	"systemd-logind", "input-remapper", "keyd", "kanata",
+}
+
+var defaultCredentialAccessAllowComms = []string{
+	"sshd", "sudo", "su", "login", "gdm-session-worker", "polkitd",
+	"gnome-keyring-daemon", "kwalletd5", "kwalletd6", "firefox", "chromium",
+	"chrome", "google-chrome", "brave", "brave-browser",
+}
+
 // Config mirrors the Phase 1 settings consumed by the Go sweep loop. More
 // fields are added as their detectors are ported.
 type Config struct {
-	SampleInterval  time.Duration
-	HeartbeatMaxAge int
-	Detectors       map[string]bool
+	SampleInterval             time.Duration
+	HeartbeatMaxAge            int
+	Detectors                  map[string]bool
+	InputSnooperAllowComms     map[string]bool
+	CredentialAccessAllowComms map[string]bool
+	CredentialAccessExtraPaths []string
 }
 
 // Default returns Python-compatible defaults for the fields currently used.
@@ -34,9 +48,12 @@ func Default() Config {
 		detectors[name] = true
 	}
 	return Config{
-		SampleInterval:  4 * time.Second,
-		HeartbeatMaxAge: 120,
-		Detectors:       detectors,
+		SampleInterval:             4 * time.Second,
+		HeartbeatMaxAge:            120,
+		Detectors:                  detectors,
+		InputSnooperAllowComms:     stringSet(defaultInputSnooperAllowComms),
+		CredentialAccessAllowComms: stringSet(defaultCredentialAccessAllowComms),
+		CredentialAccessExtraPaths: []string{},
 	}
 }
 
@@ -90,11 +107,37 @@ func Load(path string) (Config, error) {
 			for _, name := range names {
 				cfg.Detectors[name] = true
 			}
+		case "input_snooper_allow_comms":
+			names, err := stringArray(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("input_snooper_allow_comms: %w", err)
+			}
+			cfg.InputSnooperAllowComms = stringSet(names)
+		case "credential_access_allow_comms":
+			names, err := stringArray(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("credential_access_allow_comms: %w", err)
+			}
+			cfg.CredentialAccessAllowComms = stringSet(names)
+		case "credential_access_extra_paths":
+			paths, err := stringArray(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("credential_access_extra_paths: %w", err)
+			}
+			cfg.CredentialAccessExtraPaths = paths
 		}
 	}
 	return cfg, nil
 }
 
+func stringSet(values []string) map[string]bool {
+	result := make(map[string]bool, len(values))
+	for _, value := range values {
+		result[value] = true
+	}
+	return result
+}
+
 func assignments(text string) []string {
 	var out []string
 	var current strings.Builder