feat(go): expose retained incident views

go-agent/cmd/enodia-sentinel-go/main_test.go

@@ -3,9 +3,13 @@
 package main
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"io"
+	"os"
+	"path/filepath"
 	"strings"
 	"syscall"
 	"testing"
@@ -15,7 +19,9 @@ import (
 	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
 	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/ebpfsource"
 	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/events"
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/incident"
 	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/snapshot"
 )
 
 type oneExecReader struct {
@@ -160,3 +166,42 @@ func TestProbeFailureStatusIsConcise(t *testing.T) {
 		t.Fatalf("unexpected truncated status: %q", got)
 	}
 }
+
+func TestIncidentReadOnlyCommandsUseIsolatedSnapshotState(t *testing.T) {
+	directory := t.TempDir()
+	store, err := incident.New(directory, true, 1800, 8)
+	if err != nil {
+		t.Fatal(err)
+	}
+	when := time.Date(2026, 7, 22, 10, 0, 0, 0, time.UTC)
+	id, err := store.RecordAlert("alert-1.log", model.Alert{SID: 1, Severity: "HIGH", Signature: "test", PIDs: []int{42}}, map[int]bool{42: true}, when, "host-a", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	report := snapshot.Report{Schema: snapshot.Schema, Time: when.Format(time.RFC3339), Host: "host-a", Severity: "HIGH", Alerts: []model.Alert{{SID: 1, Severity: "HIGH", Signature: "test"}}, Processes: []snapshot.ProcessDetail{{PID: 42}}, Enrichment: map[string]any{}}
+	raw, err := json.Marshal(report)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(directory, "alert-1.json"), raw, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	var list bytes.Buffer
+	if err := writeIncidentList(directory, &list); err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(list.String(), id) {
+		t.Fatalf("list=%s", list.String())
+	}
+	var view bytes.Buffer
+	if err := writeIncidentView(directory, id, &view); err != nil {
+		t.Fatal(err)
+	}
+	var decoded map[string]any
+	if err := json.Unmarshal(view.Bytes(), &decoded); err != nil || decoded["schema"] != "enodia.incident.view.v1" {
+		t.Fatalf("view=%s err=%v", view.String(), err)
+	}
+	if len(decoded["timeline"].([]any)) != 1 || len(decoded["snapshots"].([]any)) != 1 {
+		t.Fatalf("view=%#v", decoded)
+	}
+}