---
title: "Live activity"
description: "Watch active Alpacon work sessions as events happen. Follow terminal, command, sudo, and file transfer activity, then complete or revoke a session when needed."
---

> Full documentation index: https://docs.alpacax.com/llms.txt

# Live activity

**Live activity** (under **Execution**) shows work sessions that are happening right now, so you can watch activity as it unfolds and step in if needed.

Live activity is available to users with the Admin or Superuser role. It does not appear in the menu for anyone else.

## Active sessions

The page lists active [work sessions](/use/work-sessions/) as a table, one row per session. Click a row for the live detail view.

| Column | What it shows |
| --- | --- |
| **Purpose** | The session title. When it differs from the description the requester wrote, hover it to read the description |
| **Assignee** | Who is running the session, as an icon and a name. The icon shows the kind: a person's avatar, a bot for an AI agent, or a key for a token. The name is the person, or the token the session runs on |
| **Server** | The target servers. Where there are several, the first carries a `+N`; hover it for the rest |
| **Risk** | The highest command risk band so far, and how many commands policy blocked (for example `High · 2 blocked`). Before any command is judged it reads **No command judged yet** |
| **Last activity** | The most recent activity in one line: a command, a terminal opening or closing, a file transfer, or a sudo request |

The connect-as account, the allowed features, and when the latest activity happened are in the detail view.

**The assignee's icon separates what the server verified from what the client reported.** A bot with a check means the server confirmed from the session's credential that an agent is driving it; a bot without one means the client reported it. The check covers the fact that it is an agent, never the agent's name, which the server does not verify. Hover the name for a tooltip that states one fact per line:

- Whether a person, an agent, or a token is running the session
- Who requested it, when someone else opened the session for the assignee
- The channel the session came in through (for example `Via MCP`)
- Whether the server verified the requester type or the client reported it
- For an agent that names itself, the full value with its version (for example `claude-code/1.2.3`), reported by the client

**Sessions that need attention come first.** A session that had a command blocked by policy, or whose risk reached High or Critical, sorts to the top of the list. Two views sit above the table: **All active** lists every running session, and **Needs attention** lists only the sessions that need attention, with their count.

The filter bar narrows either view by **Type** (**User** or **Agent**), **Assignee** and **Server**. The `+` button adds **Scope**, the features a session allows, and **Access path**, how it came in. You can also search sessions. The view, filters, and search stay in the page URL, so you can share a filtered list as a link. On the Free plan, the list shows only sessions assigned to you, for administrators too, and there is no assignee filter.

Superusers and a session's assignee see Risk and Last activity for the whole session. When you reach someone else's session because you own or manage one of its servers, the two values reflect only activity on the servers you own or manage—the same range the detail view narrows to. The ordering and the **Needs attention** view follow that range too, so something that happened only on someone else's server does not pull a session up your list.

On a self-hosted deployment whose Alpacon server does not serve this summary yet, the Risk and Last activity columns and the **Needs attention** view do not appear. The rest of the list and the detail view work as usual. Ask your administrator.

Ending or revoking a session lives in the detail view, not the list.

## Live detail

The detail view streams the session in real time:

- **Connection status**: Live, Reconnecting, Closed, or Connection error, with the time of the latest snapshot.
- **Status history**: the session's lifecycle (Requested → Approved → Active → Completed/Expired/Revoked).
- **Activity timeline**: a real-time feed of events: commands created/running/finished, terminal opened/closed, sudo requested/granted/denied, and file uploads/downloads. Filter by category (Command, Websh, Sudo, WebFTP, Status). A rejected command shows its reason and suggested next step when a reason is available; see [Understanding a rejection](/use/audit/events/commands/#understanding-a-rejection).

## Actions

- **Complete session**: ends an active session immediately. Anyone who can [manage the session](/use/work-sessions/detail/#manage-a-session) can use it.
- **Revoke session**: ends an approved session that hasn't started yet. Superusers only. A Superuser can also revoke an active session with [`alpacon work-session revoke`](/reference/cli/work-session/revoke/); see [Manage a session](/use/work-sessions/detail/#manage-a-session).

## Related docs

- [Work sessions](/use/work-sessions/)
- [Session history](/use/audit/sessions/)
- [Approvals](/use/approvals/)

Source: https://docs.alpacax.com/use/live-activity/