Commands

Name: Ghost Shell
Author: Karannnnn614

Full ghostshell command reference - personal commands, root-only audit commands, and the flags for rec and play.

Run ghostshell --help for overall usage, or ghostshell help <command> for per-command detail (including every player control).

Personal commands

Command	Description
`ghostshell rec [-q] [-o file] [cmd...]`	Record a session. Runs `$SHELL` (fallback `/bin/bash`) with no command.
`ghostshell play [--speed N] [--idle N] <file\|id>`	Replay a recording. Auto-detects: existing local file plays locally; otherwise a central-store session ID (requires root). See replay.
`ghostshell ls`	List local recordings (`STATUS`, `FILE`, `STARTED`, `DURATION`, `COMMAND`).
`ghostshell ls --all`	List all users in the central store with session counts (root).
`ghostshell ls --user <name>`	List one user's central-store sessions (root).
`ghostshell init`	First-time setup wizard; `--reset-password` / `--clear-password` manage the playback password (both require the current password).
`ghostshell --check`	Validate `/etc/ghostshell/ghostshell.conf` and print all resolved values. See configuration.
`ghostshell completion bash`	Print the bash completion script. See shell completion.
`ghostshell version`	Print the version.
`ghostshell help [command]`	Overall usage, or one command's detailed help.

-o <file> — write a local file at that path
-q (or GHOSTSHELL_QUIET=1) — suppress the recording banner and saved-path message

--speed N — playback multiplier (default 1.0)
--idle N — cap idle gaps to N seconds; default 0 keeps exact original timing

The full-screen player UI and every keyboard control are documented on the replay page.

These read the central root-only store and require root:

Command	Description
`ghostshell ls --all`	List all users and their session counts.
`ghostshell ls --user <name>`	List a user's sessions (STATUS, TYPE, SESSION, STARTED, DURATION, COMMAND).
`ghostshell play <sessionid>`	Replay a session by ID, searched across all users (auto-detect).
`ghostshell tail [-n N] <id>`	Show the last N lines of a session's output (default 20). See live tail.
`ghostshell tail -f <id>`	Live-stream an in-progress session from the daemon.
`ghostshell tree`	Print a users → sessions tree. See audit mode.
`ghostshell tree <id> [--json]`	Print one session's process tree — commands captured by the trace shim, nested, with exit codes and durations. See process tree and analyze.
`ghostshell analyze <id> [--no-ai] [--model N] [--allow-remote]`	Deterministic analysis of a session's process tree plus an optional fully local AI summary via Ollama.
`ghostshell search [--from T] [--to T] [--user U] [-i] <pattern>`	Find a string across recordings. `--from`/`--to` accept any `date -d` format. See search.
`ghostshell export [-o file] <id>`	Decrypt a recording to a plaintext asciinema cast. See export.
`ghostshell prune [--yes]`	Interactively delete recordings by user and time. See backup and prune.
`ghostshell backup`	Run the configured backup of the central store immediately (respects `backup_type`/`backup_target`).