Live tail

Watch an in-progress shell session in real time with ghostshell tail -f, or print the last N lines of any recorded session.

ghostshell tail shows the end of a session's recorded output — or streams it live while the session is still happening. Both forms read the central store and require root.

Last lines of a session

bash

sudo ghostshell tail alice/20260526T145020-1413240.cast      # last 20 lines (default)
sudo ghostshell tail -n 50 20260526T145020-1413240.cast      # last 50 lines

You can pass a bare session ID or a user/session.cast path within the store.

Live stream

bash

sudo ghostshell tail -f 20260526T145020-1413240.cast

tail -f live-streams an in-progress session from the daemon — you see the user's terminal output as it happens.

Finding a live session

In-progress sessions show their elapsed duration with a trailing + in the listings:

console

$ sudo ghostshell ls --user alice STATUS TYPE SESSION STARTED DURATION COMMAND ACTIVE interactive 20260711T142031-4471.cast 2026-07-11 14:20:31 4m12s+ -bash

Then:

bash

sudo ghostshell tail -f 20260711T142031-4471

Note: Like every content-revealing command, tail is gated by the optional playback password if one is set — a second factor on top of root.

How it fits together

Found something suspicious in a finished session? Search for it across every recording.
Want the full picture with original timing? Replay it.
Who is on the box right now? sudo ghostshell ls --all in audit mode.

Source of truth: README on GitHub