tap is tmux-like session management for Linux sysadmins, except it works across the entire system — including shells nobody started in tmux. List every active session, look at any of them live, attach, type, lock, quarantine, send messages, kill. You don't have to set anything up beforehand. The shells were already running. Drive it remotely or hand it to an AI →
Open one menu, see every shell, do what you need to it.
Bring up a tmux-style picker that lists every shell on the host you're allowed to see. Live-refreshing. Side panel shows the highlighted session's screen as it updates. Arrows to navigate. Enter to attach. q to leave.
Press Enter on any session and you're in it like it's your own terminal. Live output, your keystrokes go through. Detach with one keystroke and you're back at the menu, picking the next one.
One key freezes the session — the user's typing stops working until you say so. Another key kills it cleanly. Another sends them a visible admin message ("hey, what are you up to?") that lands as terminal output, not as commands their shell would run.
Suspicious user on your box? One key drops them into a sandboxed honeypot shell that looks like a normal Linux. Their real shell stays frozen behind the scenes. You investigate calmly. If they're legitimate, swap them back. If not, you've stalled the damage while you decide.
Apache caught a zero-day. The exploit landed an attacker in a worker process and a chained privesc dropped them into a root shell — under the www-data service account. Auditd flagged it; alice got paged. She ssh's to web-prod, sudoes to root, runs tap. The picker shows two ptys — her own, and the rogue one with login www-data and euid 0. She watches, quarantines them into a honeypot, asks what they're doing, ends the session.
Real sysadmin scenarios where tap is the right tool — and the others aren't.
The build server's slow. Five engineers are SSH'd in. With tap you flip through their shells in seconds and see who's hung on which command. No "can you describe what you're seeing?" pingpong on Slack.
A junior is debugging on a shared box. Drop into their shell, watch what they're doing, type a hint into their prompt when they get stuck. Like sitting next to them, except you don't have to.
A login from a country you don't recognize. Quarantine them into a sandbox. They keep typing into a fake shell while you investigate — without tipping them off. If it was just the user on holiday, hand them back. If not, you've already stopped them from doing damage.
"Show me what was on screen at 09:42 when the deploy went sideways." tap snapshots any session's current screen. Pair it with a logger and you have byte-faithful records of who saw what, when.
Watch new hires work through their first real ticket. Type a correction into their shell when they're about to rm something they shouldn't. Send them a "good catch" message via tap when they don't.
You SSH in to fix something, forget to detach, walk away. Days later, "is that shell still open?" — yes, and tap will tell you, snapshot what's on it, and let you close it cleanly without having to find which terminal window you left it in.
Same picker, opposite use. bob is stuck on a failing nginx reload and pings alice on slack. She sudoes, runs tap, finds bob's pty, attaches, watches him bounce off journalctl. One Ctrl-G message — "try nginx -t" — and he's unstuck. No screen-share, no "can you describe what you're seeing?"
One curl. Linux only.
Installs in seconds. Runs as a service. Nothing to configure — type tap and you're in.
The same authority model Linux has always had. No new ACLs, no new keys, no new accounts.
If you're alice, tap shows alice's shells. You can attach, lock, message, kill the sessions you opened — but not anyone else's. They don't even appear in the list.
If you're root, you see every shell on the host and have every operation available against each of them. The same way root can read any file or signal any process. tap inherits that authority — it doesn't invent a new one.
alice's session is alice's session even when she sudo's. So a user can't escape your view by escalating privileges, and you always know whose terminal you're attached to.
tap runs on the host the shells live on. Linux for now — macOS and Windows aren't supported on the host side. You can drive tap from any OS, though: pair it with hop for authenticated remote access and AI-driven session management from anywhere.