Live activity
Live activity (under Execution) shows work sessions that are happening right now, so you can watch activity as it unfolds and step in if needed.
Live activity is available to users with the Admin or Superuser role. It does not appear in the menu for anyone else.
Active sessions
The page lists active work sessions as a table, one row per session. Click a row for the live detail view.
| Column | What it shows |
|---|---|
| Session | The session title and its purpose |
| Risk | The highest command risk band so far, with two counts beneath it: how many commands were blocked by policy, and how many were high-risk |
| Last activity | The most recent activity in one line—a command, a terminal opening or closing, a file transfer, a sudo request—and how long ago |
| Requester | Who created the session, and whether a person or an agent is driving it. When the assignee running it differs from the creator, a runs as {assignee} line sits beneath |
| Target | The target servers, the connect-as account, and the allowed features |
Where a session spans several servers or features, the first one carries a +N; hover it for the full list. The connect-as account appears only when it is not the assignee’s own, and root is highlighted.
The Requester column separates what the server verified from what the client reported. The tag reads User or AI agent. A check on its icon means the server confirmed that from the session’s credential; without one, the client reported it. When an agent names itself, its name (for example claude-code) takes the place of AI agent; when it does not, the tag stays AI agent. The check covers the fact that it is an agent, never the name, which the server does not verify.
Hover the tag for a tooltip that states one fact per line:
- The channel the session came in through (for example
Via MCP) - Whether the server verified the requester type or the client reported it
- For a named agent, the full value with its version (for example
claude-code/1.2.3), reported by the client
The list shows the agent’s name only; the version is in the tooltip and the detail view.
Sessions that need attention come first. A session that had a command blocked by policy, or whose risk reached High or Critical, sorts to the top of the list and carries a colored edge. The chips above the table narrow the list: All, Users, Agents, Needs attention.
Superusers and a session’s assignee see Risk and Last activity for the whole session. When you reach someone else’s session because you own or manage one of its servers, the two values reflect only activity on the servers you own or manage—the same range the detail view narrows to. The ordering and the Needs attention filter above follow that range too, so something that happened only on someone else’s server does not pull a session up your list.
On a self-hosted deployment, if Risk and Last activity are empty on every row, the Alpacon server you are running does not serve this summary yet. The rest of the list and the detail view work as usual. Ask your administrator.
Ending or revoking a session lives in the detail view, not the list.
Live detail
The detail view streams the session in real time:
- Connection status — Live, Reconnecting, Closed, or Connection error, with the time of the latest snapshot.
- Status history — the session’s lifecycle (Requested → Approved → Active → Completed/Expired/Revoked).
- Activity timeline — a real-time feed of events: commands created/running/finished, terminal opened/closed, sudo requested/granted/denied, and file uploads/downloads. Filter by category (Command, Websh, Sudo, WebFTP, Status).
Actions
- Complete session — end the session immediately.
- Revoke session — end an approved session before it becomes active.