feat: show notification source (agent vs SAC) in alerts and reports

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_daily_report.py

@@ -247,7 +247,9 @@ def test_daily_report_telegram_html_uses_report_html(db_session):
         details={"report_html": "<b>📊 OK</b><br>line"},
         payload={},
     )
-    assert format_event_telegram_html(event) == "<b>📊 OK</b>\nline"
+    assert format_event_telegram_html(event) == (
+        "<b>📊 OK</b>\nline\n📡 Оповещение: агент (ssh-monitor)"
+    )
 
 
 def test_sanitize_telegram_html_strips_div_and_br():

backend/tests/test_daily_report_format.py

@@ -4,8 +4,10 @@ from datetime import datetime, timezone
 
 from app.models import Host
 from app.services.daily_report_format import (
+    append_notification_source_plain,
     build_report_body,
     enrich_stats_for_storage,
+    format_notification_source_plain,
     normalize_active_users_list,
     normalize_report_body,
 )
@@ -74,6 +76,28 @@ def test_build_report_body_windows_layout():
     assert len(lines) == 2
 
 
+def test_build_report_body_includes_notification_source():
+    host = Host(hostname="h1", display_name="H1", os_family="linux", product="ssh-monitor")
+    when = datetime(2026, 5, 29, 9, 0, 5, tzinfo=timezone.utc)
+    stats = enrich_stats_for_storage("ssh", {"successful_ssh": 0, "failed_ssh": 0, "sudo_commands": 0, "active_bans": 0})
+    sac_body = build_report_body("ssh", host, stats, when, sac_generated=True)
+    assert "📡 Оповещение: SAC (Security Alert Center)" in sac_body
+    agent_body = build_report_body(
+        "ssh",
+        host,
+        {**stats, "agent_version": "1.2.11-SAC"},
+        when,
+        sac_generated=False,
+    )
+    assert "📡 Оповещение: агент (ssh-monitor 1.2.11-SAC)" in agent_body
+
+
+def test_append_notification_source_plain_dedupes():
+    line = format_notification_source_plain(generated_by="sac")
+    body = append_notification_source_plain(f"title\n\n{line}", generated_by="sac")
+    assert body.count("📡 Оповещение:") == 1
+
+
 def test_normalize_active_users_list_splits_combined_line():
     users = normalize_active_users_list(["👤 k.khodasevich 👤 papatramp"])
     assert len(users) == 2

backend/tests/test_telegram_templates.py

@@ -65,6 +65,26 @@ def test_rdp_success_template():
     text = format_event_telegram_html(event)
     assert "УСПЕШНЫЙ" in text
     assert "Сеть/RDP" in text
+    assert "📡 Оповещение: агент" in text
+
+
+def test_event_telegram_includes_sac_source_for_sac_daily_report():
+    host = Host(hostname="h1", display_name="H1", os_family="linux", product="ssh-monitor")
+    event = Event(
+        event_id="00000000-0000-4000-8000-000000000504",
+        host_id=1,
+        host=host,
+        occurred_at=datetime(2026, 5, 29, 9, 0, tzinfo=timezone.utc),
+        category="report",
+        type="report.daily.ssh",
+        severity="info",
+        title="Отчёт",
+        summary="short",
+        details={"generated_by": "sac", "report_body": "📊 ЕЖЕДНЕВНЫЙ ОТЧЕТ SSH МОНИТОРИНГА\nline"},
+        payload={},
+    )
+    text = format_event_telegram_html(event)
+    assert "📡 Оповещение: SAC (Security Alert Center)" in text
 
 
 def test_rdp_shadow_control_template():