Three bugs fixed, all confirmed end-to-end in a live FreeIPA + client VM:
1. Wrong `who` column: loginctl is SESSION/UID/USER (col 3), but `who` is
USER/TTY/DATE (col 1) — the fallback used col 3, delivering to the wrong
user. Split into _parse_session_user() with per-source column selection.
2. Delivered to all users: alerts were sent to every active non-root session
instead of only members of usr_scan-notify. Added `id -nG` group check
inside _parse_session_user().
3. smbclient ls path breakage: `smbclient -c "ls alerts\host\"` treats the
argument as a glob pattern, returning NT_STATUS_NO_SUCH_FILE. Changed to
`cd alerts\host; ls` which correctly lists directory contents.
Bonus: track ACKNOWLEDGED set so alerts deleted-from-server in the current
run are not re-downloaded (avoiding a spurious WARN on the same run).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DHops6PU4c2Mv5UyhUj8Ms
Amir Alexander Abdelbaki
00ce4f5260