// the find
pranshuparmar/witr
witr - Why is this running? A fast, cross-platform CLI + TUI that traces any process, port, container, or open file back to what started it, and why.
witr is a process-lineage CLI and TUI for developers and sysadmins who want to know why something is running without manually correlating ps, lsof, ss, and docker ps output. It builds a causal ancestry chain from a PID, port, file lock, or container name and presents it in one place. It's most useful during incidents or when you inherit an unfamiliar server.
Native Win32 API usage on Windows (ToolHelp32, PSAPI, SCM) instead of spawning PowerShell or WMI — startup is fast and you avoid the infamous Get-CimInstance hang that plagues most Go sysadmin tools. Multi-container runtime coverage is genuine: Docker, Podman, nerdctl, crictl, Incus, LXC, LXD, and FreeBSD jails all resolved in a single command. Exit codes are thoughtfully designed (0=clean, 1=warnings, 2=not found, 3=permission denied, 4=invalid, 5=internal) — actually useful in CI health checks and monitoring scripts. The test suite is thorough: platform-specific test files per subsystem (net_linux_test.go, boot_windows_test.go, service_linux_test.go, etc.) with snapshot tests for output formatting.
Container detection requires the runtime CLI on PATH — if you have a Docker daemon but installed via a path that isn't on your shell's PATH, it silently sees nothing. Windows is a second-class citizen: no Locks tab in TUI, no process signals (kill/pause/resume), no tmux/screen detection, open file counts only (no names), and environment variables blocked for system processes; the feature matrix shows six explicit gaps on Windows versus zero on Linux. The causal chain is process ancestry walking, not true intentionality — it tells you systemd started it, but not why the unit was enabled or what triggered the socket activation; that distinction matters when you're debugging something that shouldn't be running at all. There's no persistent monitoring mode: the TUI auto-refreshes but doesn't emit events, so you can't use witr to alert when an unexpected process appears.