feat(go): port process access detectors

go-agent/internal/agent/agent.go

@@ -57,9 +57,18 @@ func (a *Agent) Sweep() ([]map[string]any, error) {
 	timestamp := a.Now().Local().Format(time.RFC3339Nano)
 
 	alerts := make([]model.Alert, 0)
+	if a.Config.Enabled("ld_preload") {
+		alerts = append(alerts, detectors.LDPreload(state)...)
+	}
 	if a.Config.Enabled("deleted_exe") {
 		alerts = append(alerts, detectors.DeletedExe(state)...)
 	}
+	if a.Config.Enabled("input_snooper") {
+		alerts = append(alerts, detectors.InputSnooper(state, a.Config)...)
+	}
+	if a.Config.Enabled("credential_access") {
+		alerts = append(alerts, detectors.CredentialAccess(state, a.Config)...)
+	}
 	events := make([]map[string]any, 0, len(alerts)+1)
 	for _, alert := range alerts {
 		record, err := schema.Build("alert", alert, host, timestamp)

go-agent/internal/agent/agent_test.go

@@ -52,3 +52,31 @@ func TestDisabledDetectorEmitsStatusOnly(t *testing.T) {
 		t.Fatalf("unexpected events: %#v", events)
 	}
 }
+
+func TestSweepPreservesPythonDetectorOrder(t *testing.T) {
+	agent := New(config.Default(), func() (model.State, error) {
+		return model.State{
+			LDPreload: "/tmp/global.so",
+			Processes: []model.Process{{
+				PID:       42,
+				Comm:      "dropper",
+				Exe:       "/tmp/dropper (deleted)",
+				FDTargets: map[string]string{"4": "/etc/shadow", "7": "/dev/input/event3"},
+			}},
+		}, nil
+	})
+	events, err := agent.Sweep()
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"ld_preload", "deleted_exe", "input_snooper", "credential_access"}
+	if len(events) != len(want)+1 {
+		t.Fatalf("unexpected events: %#v", events)
+	}
+	for index, signature := range want {
+		alert := events[index]["alert"].(model.Alert)
+		if alert.Signature != signature {
+			t.Fatalf("event %d: got %s, want %s", index, alert.Signature, signature)
+		}
+	}
+}