Quick start
Record your first shell session with ghostshell rec, list it with ls, and replay it with play - all in under two minutes.
You have installed Ghost Shell. Record a session, list it, and replay it.
1. Record
console
$ ghostshell rec /bin/bash -c 'echo "hello from ghostshell"; uname -sr'
ghostshell: recording to /home/alice/.local/share/ghostshell/20260526T145029-1413696.cast — type 'exit' or Ctrl-D to stop
hello from ghostshell
Linux 5.14.0-611.55.1.el9_7.x86_64
ghostshell: session saved to /home/alice/.local/share/ghostshell/20260526T145029-1413696.cast
With no command, ghostshell rec records your $SHELL interactively until you exit.
When ghostshell-daemon is running — it is, after a package install — the banner reads recording to ghostshell-daemon (central) instead, and the session streams to the root-only central store.
2. List
console
$ ghostshell ls
STATUS FILE STARTED DURATION COMMAND
SAVED 20260526T145029-1413696.cast 2026-05-26 14:50:29 2s /bin/bash -c echo "hello from ghostshell"; uname -sr
3. Replay
console
$ ghostshell play --speed 100 20260526T145029-1413696.cast
--- ghostshell replay start ---
hello from ghostshell
Linux 5.14.0-611.55.1.el9_7.x86_64
--- ghostshell replay end ---
On a terminal, play opens a full-screen player with seek, pause, and variable speed — every control is on the replay page.
As root: audit the whole host
console
$ sudo ghostshell ls --all
USER SESSIONS LAST ACTIVE
alice 12 2026-07-11 14:20
deploy 3 2026-07-11 09:02
$ sudo ghostshell search --from "2 days ago" nginx
user=alice when=2026-07-11 14:20:31 session=20260711T142031-4471
cmd: -bash
> sudo systemctl restart nginx
$ sudo ghostshell tail -f 20260711T142031-4471 # watch it live
And on disk? Opaque:
console
$ sudo strings /var/lib/ghostshell/alice/20260711T142031-4471.cast | head -1
TTEC2 # AES-256-GCM ciphertext, not alice's commands
Next
- Audit mode — how the central store works
- Search and live tail
- Commands — the full reference