Audit mode

When ghostshell-daemon runs (it does after a package install), ghostshell rec streams the cast to it over /run/ghostshell-daemon.sock. The recording is written by root to /var/lib/ghostshell/<user>/<sessionid>.cast (root:root 0600, directories 0700). Normal users cannot read other users' — or their own — recordings. See the security model for the full trust boundary.

List users and sessions

The TYPE column distinguishes an interactive login shell from a non-interactive command session. DURATION is the recorded length; an in-progress session shows elapsed-so-far with a trailing +.

Tree view

ghostshell tree <id> does something different — it prints a session's process tree. See process tree and analyze.

Fail-open ingest

If the daemon is unreachable, rejects the session (per-user session cap, store full), or is wedged, ghostshell rec records to the user-local directory (~/.local/share/ghostshell) instead. On its next startup, the daemon ingests those files into the central store. The daemon replies OK only once a session is actually registered, so the recorder can tell a real central session from a rejection — a recording is never silently lost, and a login is never blocked.

What you can do from here

• Search every recording, with natural-language date filters
• Live-tail an in-progress session
• Replay any session by ID
• Prune old recordings interactively

Store location and daemon behavior are tunable — see configuration.