feat(go): port process access detectors

go-agent/internal/agent/agent_test.go

@@ -52,3 +52,31 @@ func TestDisabledDetectorEmitsStatusOnly(t *testing.T) {
 		t.Fatalf("unexpected events: %#v", events)
 	}
 }
+
+func TestSweepPreservesPythonDetectorOrder(t *testing.T) {
+	agent := New(config.Default(), func() (model.State, error) {
+		return model.State{
+			LDPreload: "/tmp/global.so",
+			Processes: []model.Process{{
+				PID:       42,
+				Comm:      "dropper",
+				Exe:       "/tmp/dropper (deleted)",
+				FDTargets: map[string]string{"4": "/etc/shadow", "7": "/dev/input/event3"},
+			}},
+		}, nil
+	})
+	events, err := agent.Sweep()
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"ld_preload", "deleted_exe", "input_snooper", "credential_access"}
+	if len(events) != len(want)+1 {
+		t.Fatalf("unexpected events: %#v", events)
+	}
+	for index, signature := range want {
+		alert := events[index]["alert"].(model.Alert)
+		if alert.Signature != signature {
+			t.Fatalf("event %d: got %s, want %s", index, alert.Signature, signature)
+		}
+	}
+}