[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-212":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":9,"totalLinesOfCode":9,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":9,"subscribersCount":16,"size":16,"stars1d":17,"stars7d":18,"stars30d":19,"stars90d":16,"forks30d":16,"starsTrendScore":20,"compositeScore":21,"rankGlobal":9,"rankLanguage":9,"license":9,"archived":22,"fork":22,"defaultBranch":23,"hasWiki":22,"hasPages":22,"topics":9,"createdAt":9,"pushedAt":9,"updatedAt":24,"readmeContent":25,"aiSummary":26,"trendingCount":16,"starSnapshotCount":16,"syncStatus":27,"lastSyncTime":28,"discoverSource":29},212,"witr","pranshuparmar\u002Fwitr","pranshuparmar","Why is this running?",null,"https:\u002F\u002Fgithub.com\u002Fpranshuparmar\u002Fwitr","Go",17789,550,39,6,0,13,114,2685,76,43.22,false,"main","2026-06-12 02:00:10","\u003Cdiv align=\"center\">\n\n# witr\n\n### Why is this running?\n*with* [**Interactive TUI Mode**](#3-interactive-mode-tui) ✨\n\n[![Go Version](https:\u002F\u002Fimg.shields.io\u002Fgithub\u002Fgo-mod\u002Fgo-version\u002Fpranshuparmar\u002Fwitr?style=flat-square)](https:\u002F\u002Fgithub.com\u002Fpranshuparmar\u002Fwitr\u002Fblob\u002Fmain\u002Fgo.mod) [![Go Report Card](https:\u002F\u002Fgoreportcard.com\u002Fbadge\u002Fgithub.com\u002Fpranshuparmar\u002Fwitr?style=flat-square)](https:\u002F\u002Fgoreportcard.com\u002Freport\u002Fgithub.com\u002Fpranshuparmar\u002Fwitr) [![Release](https:\u002F\u002Fimg.shields.io\u002Fgithub\u002Factions\u002Fworkflow\u002Fstatus\u002Fpranshuparmar\u002Fwitr\u002Frelease.yml?style=flat-square)](https:\u002F\u002Fgithub.com\u002Fpranshuparmar\u002Fwitr\u002Factions\u002Fworkflows\u002Frelease.yml) [![Platforms](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fplatforms-linux%20%7C%20macos%20%7C%20windows%20%7C%20freebsd-blue?style=flat-square)](#6-platform-support) \u003Cbr>\n[![Latest Release](https:\u002F\u002Fimg.shields.io\u002Fgithub\u002Fv\u002Frelease\u002Fpranshuparmar\u002Fwitr?label=Latest%20Release&style=flat-square)](https:\u002F\u002Fgithub.com\u002Fpranshuparmar\u002Fwitr\u002Freleases\u002Flatest) [![Package Managers](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FPackage%20Managers-brew%20|%20conda%20|%20aur%20|%20winget%20|%20npm%20|%20ports%20|%20...%20-blue?style=flat-square)](https:\u002F\u002Frepology.org\u002Fproject\u002Fwitr\u002Fversions)\n\n📖 Read the [story](https:\u002F\u002Fmedium.com\u002F@pranshu.parmar\u002Fwitr-why-is-this-running-a9a97cbedd18) behind witr\n\n\u003Cimg width=\"1232\" height=\"693\" alt=\"witr_banner\" src=\"https:\u002F\u002Fgithub.com\u002Fuser-attachments\u002Fassets\u002Fe9c19ef0-1391-4a5f-a015-f4003d3697a9\" \u002F>\n\n\u003C\u002Fdiv>\n\n---\n\n\u003Cdiv align=\"center\">\n\n[**Purpose**](#1-purpose) • [**Installation**](#2-installation) • ✨ [**TUI**](#3-interactive-mode-tui) • [**Flags**](#4-flags--options) • [**Examples**](#5-example-outputs) • [**Platforms**](#6-platform-support)\n\u003Cbr>\n[**Goals**](#7-goals) • [**Core Concept**](#8-core-concept) • [**Output Behavior**](#9-output-behavior) • [**Success Criteria**](#10-success-criteria) • [**Sponsors**](#11-sponsors)\n\n\u003C\u002Fdiv>\n\n---\n\n## 1. Purpose\n\n**witr** exists to answer a single question:\n\n> **Why is this running?**\n\nWhen something is running on a system, whether it is a process, a service, or something bound to a port, there is always a cause. That cause is often indirect, non-obvious, or spread across multiple layers such as supervisors, containers, services, or shells.\n\nExisting tools (`ps`, `top`, `lsof`, `ss`, `systemctl`, `docker ps`) expose state and metadata. They show _what_ is running, but leave the user to infer _why_ by manually correlating outputs across tools.\n\n**witr** makes that causality explicit.\n\nIt explains **where a running thing came from**, **how it was started**, and **what chain of systems is responsible for it existing right now**, in a single, human-readable output or an **interactive TUI dashboard**.\n\n---\n\n## 2. Installation\n\nwitr is distributed as a single static binary for Linux, macOS, FreeBSD, and Windows.\n\nwitr is also independently packaged and maintained across multiple operating systems and ecosystems. An up-to-date overview of packaging status is available on [Repology](https:\u002F\u002Frepology.org\u002Fproject\u002Fwitr\u002Fversions). Please note that community packages may lag GitHub releases due to independent review and validation.\n\n> [!TIP]\n> If you use a package manager (Homebrew, Conda, Winget, etc.), we recommend installing via that for easier updates. Otherwise, the install script is the quickest way to get started.\n\n---\n\n### 2.1 Quick Install\n\n#### Unix (Linux, macOS & FreeBSD)\n\n```bash\ncurl -fsSL https:\u002F\u002Fraw.githubusercontent.com\u002Fpranshuparmar\u002Fwitr\u002Fmain\u002Finstall.sh | bash\n```\n\n\u003Cdetails>\n\u003Csummary>Script Details\u003C\u002Fsummary>\n\nThe script will:\n- Detect your operating system (`linux`, `darwin` or `freebsd`)\n- Detect your CPU architecture (`amd64` or `arm64`)\n- Download the latest released binary and man page\n- Install it to `\u002Fusr\u002Flocal\u002Fbin\u002Fwitr`\n- Install the man page to `\u002Fusr\u002Flocal\u002Fshare\u002Fman\u002Fman1\u002Fwitr.1`\n- Pass INSTALL_PREFIX to override default install path\n\n\u003C\u002Fdetails>\n\n#### Windows (PowerShell)\n\n```powershell\nirm https:\u002F\u002Fraw.githubusercontent.com\u002Fpranshuparmar\u002Fwitr\u002Fmain\u002Finstall.ps1 | iex\n```\n\n\u003Cdetails>\n\u003Csummary>Script Details\u003C\u002Fsummary>\n\nThe script will:\n- Download the latest release (zip) and verify checksum.\n- Extract `witr.exe` to `%LocalAppData%\\witr\\bin`.\n- Add the bin directory to your User `PATH`.\n\n\u003C\u002Fdetails>\n\n---\n\n### 2.2 Package Managers\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Homebrew (macOS & Linux)\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fformulae.brew.sh\u002Fformula\u002Fwitr\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fhomebrew\u002Fv\u002Fwitr?style=flat-square\" alt=\"Homebrew\">\u003C\u002Fa>\u003C\u002Fsummary>\n\u003Cbr>\n\n\nYou can install **witr** using [Homebrew](https:\u002F\u002Fbrew.sh\u002F) on macOS or Linux:\n\n```bash\nbrew install witr\n```\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Conda (macOS, Linux & Windows)\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fanaconda.org\u002Fconda-forge\u002Fwitr\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fconda\u002Fvn\u002Fconda-forge\u002Fwitr?style=flat-square\" alt=\"Conda\">\u003C\u002Fa>\u003C\u002Fsummary>\n\u003Cbr>\n\n\nYou can install **witr** using [conda](https:\u002F\u002Fdocs.conda.io\u002Fen\u002Flatest\u002F), [mamba](https:\u002F\u002Fmamba.readthedocs.io\u002Fen\u002Flatest\u002F), or [pixi](https:\u002F\u002Fpixi.prefix.dev\u002Flatest\u002F) on macOS, Linux, and Windows:\n\n```bash\nconda install -c conda-forge witr\n# alternatively using mamba\nmamba install -c conda-forge witr\n# alternatively using pixi\npixi global install witr\n```\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Arch Linux (AUR)\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Faur.archlinux.org\u002Fpackages\u002Fwitr-bin\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Faur\u002Fversion\u002Fwitr-bin?style=flat-square\" alt=\"AUR\">\u003C\u002Fa>\u003C\u002Fsummary>\n\u003Cbr>\n\n\nOn Arch Linux and derivatives, install from the [AUR package](https:\u002F\u002Faur.archlinux.org\u002Fpackages\u002Fwitr-bin):\n\n```bash\nyay -S witr-bin\n# alternatively using paru\nparu -S witr-bin\n# or use your preferred AUR helper\n```\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Winget (Windows)\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fwinstall.app\u002Fapps\u002FPranshuParmar.witr\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fwinget\u002Fv\u002FPranshuParmar.witr?style=flat-square\" alt=\"Winget\">\u003C\u002Fa>\u003C\u002Fsummary>\n\u003Cbr>\n\n\nYou can install **witr** via [winget](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fpackage-manager\u002Fwinget\u002F):\n\n```powershell\nwinget install -e --id PranshuParmar.witr\n```\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>NPM (Cross-platform)\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fwww.npmjs.com\u002Fpackage\u002F@pranshuparmar\u002Fwitr\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fnpm\u002Fv\u002F@pranshuparmar\u002Fwitr?label=npm&color=blue&style=flat-square\" alt=\"NPM\">\u003C\u002Fa>\u003C\u002Fsummary>\n\u003Cbr>\n\nYou can install **witr** using [npm](https:\u002F\u002Fwww.npmjs.com\u002Fpackage\u002F@pranshuparmar\u002Fwitr):\n\n```bash\nnpm install -g @pranshuparmar\u002Fwitr\n```\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>FreeBSD Ports\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fwww.freshports.org\u002Fsysutils\u002Fwitr\u002F\">\u003Cimg src=\"https:\u002F\u002Frepology.org\u002Fbadge\u002Fversion-for-repo\u002Ffreebsd\u002Fwitr.svg?style=flat-square\" alt=\"FreeBSD Port\">\u003C\u002Fa>\u003C\u002Fsummary>\n\u003Cbr>\n\n\nYou can install **witr** on FreeBSD from the [FreshPorts port](https:\u002F\u002Fwww.freshports.org\u002Fsysutils\u002Fwitr\u002F):\n\n```bash\npkg install witr\n# or\npkg install sysutils\u002Fwitr\n```\n\nOr build from Ports:\n\n```bash\ncd \u002Fusr\u002Fports\u002Fsysutils\u002Fwitr\u002F\nmake install clean\n```\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Chocolatey (Windows)\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fcommunity.chocolatey.org\u002Fpackages\u002Fwitr\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fchocolatey\u002Fv\u002Fwitr?style=flat-square\" alt=\"Chocolatey\">\u003C\u002Fa>\u003C\u002Fsummary>\n\n\u003Cbr>\n\n\nYou can install **witr** using [Chocolatey](https:\u002F\u002Fcommunity.chocolatey.org):\n\n```powershell\nchoco install witr\n```\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Scoop (Windows)\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fscoop.sh\u002F#\u002Fapps?q=witr\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fscoop\u002Fv\u002Fwitr?bucket=main&style=flat-square\" alt=\"Scoop\">\u003C\u002Fa>\u003C\u002Fsummary>\n\u003Cbr>\n\n\nYou can install **witr** using [Scoop](https:\u002F\u002Fscoop.sh):\n\n```powershell\nscoop install main\u002Fwitr\n```\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>AOSC OS\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fpackages.aosc.io\u002Fpackages\u002Fwitr\">\u003Cimg src=\"https:\u002F\u002Frepology.org\u002Fbadge\u002Fversion-for-repo\u002Faosc\u002Fwitr.svg?style=flat-square\" alt=\"AOSC OS\">\u003C\u002Fa>\u003C\u002Fsummary>\n\u003Cbr>\n\n\nYou can install **witr** from the [AOSC OS repository](https:\u002F\u002Fpackages.aosc.io\u002Fpackages\u002Fwitr):\n\n```bash\noma install witr\n```\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>GNU Guix\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fpackages.guix.gnu.org\u002Fpackages\u002Fwitr\u002F\">\u003Cimg src=\"https:\u002F\u002Frepology.org\u002Fbadge\u002Fversion-for-repo\u002Fgnuguix\u002Fwitr.svg?style=flat-square\" alt=\"GNU Guix\">\u003C\u002Fa>\u003C\u002Fsummary>\n\u003Cbr>\n\n\nYou can install **witr** from the [GNU Guix repository](https:\u002F\u002Fpackages.guix.gnu.org\u002Fpackages\u002Fwitr\u002F):\n\n```bash\nguix install witr\n```\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Uniget (Linux)\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Funiget-org\u002Ftools\u002Ftree\u002Fmain\u002Ftools\u002Fwitr\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fdynamic\u002Fyaml?url=https%3A%2F%2Fraw.githubusercontent.com%2Funiget-org%2Ftools%2Fmain%2Ftools%2Fwitr%2Fmanifest.yaml&query=%24.version&label=uniget&style=flat-square&color=blue\" alt=\"Uniget\">\u003C\u002Fa>\u003C\u002Fsummary>\n\u003Cbr>\n\nYou can install **witr** using [uniget](https:\u002F\u002Funiget.dev\u002F):\n\n```bash\nuniget install witr\n```\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Aqua (macOS, Linux & Windows)\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Faquaproj\u002Faqua-registry\u002Fblob\u002Fmain\u002Fpkgs\u002Fpranshuparmar\u002Fwitr\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fdynamic\u002Fyaml?url=https%3A%2F%2Fraw.githubusercontent.com%2Faquaproj%2Faqua-registry%2Fmain%2Fpkgs%2Fpranshuparmar%2Fwitr%2Fpkg.yaml&query=%24.packages%5B0%5D.name&label=aqua&style=flat-square&color=blue\" alt=\"Aqua\">\u003C\u002Fa>\u003C\u002Fsummary>\n\u003Cbr>\n\nYou can install **witr** using [aqua](https:\u002F\u002Faquaproj.github.io\u002F):\n\n```bash\n# Add package\naqua g -i pranshuparmar\u002Fwitr\n\n# Install package\naqua i pranshuparmar\u002Fwitr\n```\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Brioche (Linux)\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fbrioche-dev\u002Fbrioche-packages\u002Ftree\u002Fmain\u002Fpackages\u002Fwitr\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fstatic\u002Fv1?label=brioche&message=v0.3.0&color=blue&style=flat-square\" alt=\"Brioche\">\u003C\u002Fa>\u003C\u002Fsummary>\n\u003Cbr>\n\nYou can install **witr** using [brioche](https:\u002F\u002Fbrioche.dev\u002F):\n\n```bash\nbrioche install -r witr\n```\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Prebuilt Packages (deb, rpm, apk)\u003C\u002Fstrong>\u003C\u002Fsummary>\n\u003Cbr>\n\n**witr** provides native packages for major Linux distributions. You can download the latest `.deb`, `.rpm`, or `.apk` package from the [GitHub releases page](https:\u002F\u002Fgithub.com\u002Fpranshuparmar\u002Fwitr\u002Freleases\u002Flatest).\n\n- Generic download command using `curl`:\n  ```bash\n  # Replace \u003Cpackage name with the actual package that you need>\n  curl -LO https:\u002F\u002Fgithub.com\u002Fpranshuparmar\u002Fwitr\u002Freleases\u002Flatest\u002Fdownload\u002F\u003Cpackage-name>\n  ```\n\n- **Debian\u002FUbuntu (.deb):**\n  ```bash\n  sudo dpkg -i .\u002Fwitr-*.deb\n  # Or, using apt for dependency resolution:\n  sudo apt install .\u002Fwitr-*.deb\n  ```\n- **Fedora\u002FRHEL\u002FCentOS (.rpm):**\n  ```bash\n  sudo rpm -i .\u002Fwitr-*.rpm\n  ```\n- **Alpine Linux (.apk):**\n  ```bash\n  sudo apk add --allow-untrusted .\u002Fwitr-*.apk\n  ```\n\u003C\u002Fdetails>\n\n---\n\n### 2.3 Source & Manual Installation\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Go (cross-platform)\u003C\u002Fstrong>\u003C\u002Fsummary>\n\u003Cbr>\n\nYou can install the latest version directly from source:\n\n```bash\ngo install github.com\u002Fpranshuparmar\u002Fwitr\u002Fcmd\u002Fwitr@latest\n```\n\nThis will place the `witr` binary in your `$GOPATH\u002Fbin` or `$HOME\u002Fgo\u002Fbin` directory. Make sure this directory is in your `PATH`.\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Manual Installation\u003C\u002Fstrong>\u003C\u002Fsummary>\n\u003Cbr>\n\nIf you prefer manual installation, follow these simple steps for your platform:\n\n**Unix (Linux, macOS, FreeBSD)**\n\n```bash\n# 1. Determine OS and Architecture\nOS=$(uname -s | tr '[:upper:]' '[:lower:]')\nARCH=$(uname -m)\n[ \"$ARCH\" = \"x86_64\" ] && ARCH=\"amd64\"\n[ \"$ARCH\" = \"aarch64\" ] && ARCH=\"arm64\"\n\n# 2. Download the binary\ncurl -fsSL \"https:\u002F\u002Fgithub.com\u002Fpranshuparmar\u002Fwitr\u002Freleases\u002Flatest\u002Fdownload\u002Fwitr-${OS}-${ARCH}\" -o witr\n\n# 3. Verify checksum (Optional)\ncurl -fsSL \"https:\u002F\u002Fgithub.com\u002Fpranshuparmar\u002Fwitr\u002Freleases\u002Flatest\u002Fdownload\u002FSHA256SUMS\" -o SHA256SUMS\ngrep \"witr-${OS}-${ARCH}\" SHA256SUMS | (sha256sum -c - 2>\u002Fdev\u002Fnull || shasum -a 256 -c - 2>\u002Fdev\u002Fnull)\nrm SHA256SUMS\n\n# 4. Rename and install\nchmod +x witr\nsudo mkdir -p \u002Fusr\u002Flocal\u002Fbin\nsudo mv witr \u002Fusr\u002Flocal\u002Fbin\u002Fwitr\n\n# 5. Install man page (Optional)\nsudo mkdir -p \u002Fusr\u002Flocal\u002Fshare\u002Fman\u002Fman1\nsudo curl -fsSL https:\u002F\u002Fgithub.com\u002Fpranshuparmar\u002Fwitr\u002Freleases\u002Flatest\u002Fdownload\u002Fwitr.1 -o \u002Fusr\u002Flocal\u002Fshare\u002Fman\u002Fman1\u002Fwitr.1\n```\n\n**Windows (PowerShell)**\n\n```powershell\n# 1. Determine Architecture\nif ($env:PROCESSOR_ARCHITECTURE -eq \"AMD64\") {\n    $ZipName = \"witr-windows-amd64.zip\"\n} elseif ($env:PROCESSOR_ARCHITECTURE -eq \"ARM64\") {\n    $ZipName = \"witr-windows-arm64.zip\"\n} else {\n    Write-Error \"Unsupported architecture: $($env:PROCESSOR_ARCHITECTURE)\"\n    exit 1\n}\n\n# 2. Download the zip\nInvoke-WebRequest -Uri \"https:\u002F\u002Fgithub.com\u002Fpranshuparmar\u002Fwitr\u002Freleases\u002Flatest\u002Fdownload\u002F$ZipName\" -OutFile \"witr.zip\"\n# 3. Extract the binary\nExpand-Archive -Path \"witr.zip\" -DestinationPath \".\" -Force\n\n# 4. Verify checksum (Optional)\nInvoke-WebRequest -Uri \"https:\u002F\u002Fgithub.com\u002Fpranshuparmar\u002Fwitr\u002Freleases\u002Flatest\u002Fdownload\u002FSHA256SUMS\" -OutFile \"SHA256SUMS\"\n$hash = Get-FileHash -Algorithm SHA256 .\\witr.zip\n$expected = Select-String -Path .\\SHA256SUMS -Pattern $ZipName\nif ($expected -and $hash.Hash.ToLower() -eq $expected.Line.Split(' ')[0]) { Write-Host \"Checksum OK\" } else { Write-Host \"Checksum Mismatch\" }\n\n# 5. Install to local bin directory\n$InstallDir = \"$env:LocalAppData\\witr\\bin\"\nNew-Item -ItemType Directory -Path $InstallDir -Force | Out-Null\nMove-Item .\\witr.exe $InstallDir\\witr.exe -Force\n\n# 6. Add to User Path (Persistent)\n$UserPath = [Environment]::GetEnvironmentVariable(\"Path\", \"User\")\nif ($UserPath -notlike \"*$InstallDir*\") {\n    [Environment]::SetEnvironmentVariable(\"Path\", \"$UserPath;$InstallDir\", \"User\")\n    $env:Path += \";$InstallDir\"\n    Write-Host \"Added to Path. You may need to restart PowerShell.\"\n}\n\n# 7. Cleanup\nRemove-Item witr.zip\nRemove-Item SHA256SUMS\n```\n\u003C\u002Fdetails>\n\n---\n\n### 2.4 Run Without Installation\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Nix Flake\u003C\u002Fstrong>\u003C\u002Fsummary>\n\u003Cbr>\n\nIf you use Nix, you can build **witr** from source and run without installation:\n\n```bash\nnix run github:pranshuparmar\u002Fwitr -- --help\n```\n\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Pixi\u003C\u002Fstrong>\u003C\u002Fsummary>\n\u003Cbr>\n\nIf you use [pixi](https:\u002F\u002Fpixi.prefix.dev\u002Flatest\u002F), you can run without installation on Linux or macOS:\n\n```bash\npixi exec witr --help\n```\n\u003C\u002Fdetails>\n\n---\n\n### 2.5 Other Operations\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Verify Installation\u003C\u002Fstrong>\u003C\u002Fsummary>\n\u003Cbr>\n\n```bash\nwitr --version\nman witr\n```\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Shell Completions\u003C\u002Fstrong>\u003C\u002Fsummary>\n\u003Cbr>\n\n`witr` supports tab completion for all flags. To enable it, add the appropriate line to your shell configuration:\n\n**Bash**\n```bash\necho 'eval \"$(witr completion bash)\"' >> ~\u002F.bashrc\nsource ~\u002F.bashrc\n```\n\n**Zsh**\n```zsh\necho 'eval \"$(witr completion zsh)\"' >> ~\u002F.zshrc\nsource ~\u002F.zshrc\n```\n\n**Fish**\n```fish\nwitr completion fish | source\n# To make it permanent:\nwitr completion fish > ~\u002F.config\u002Ffish\u002Fcompletions\u002Fwitr.fish\n```\n\n**PowerShell**\n```powershell\nwitr completion powershell | Out-String | Invoke-Expression\n# To make it permanent, add the above line to your $PROFILE\n```\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Uninstallation\u003C\u002Fstrong>\u003C\u002Fsummary>\n\u003Cbr>\n\nIf you installed via a package manager (Homebrew, Conda, etc.), please use the respective uninstall command (e.g., `brew uninstall witr`).\n\nTo completely remove script\u002Fmanual installation of **witr**:\n\n**Unix (Linux, macOS, FreeBSD)**\n\n```bash\nsudo rm -f \u002Fusr\u002Flocal\u002Fbin\u002Fwitr\nsudo rm -f \u002Fusr\u002Flocal\u002Fshare\u002Fman\u002Fman1\u002Fwitr.1\n```\n\n**Windows**\n\n```powershell\nRemove-Item -Recurse -Force \"$env:LocalAppData\\witr\"\n```\n\u003C\u002Fdetails>\n\n---\n \n## 3. Interactive Mode (TUI)\n\nRunning `witr` without any arguments or with the `-i` flag launches the **Interactive Mode (TUI)**. This provides a real-time, terminal-based dashboard for exploring processes and ports.\n\n### Key Features:\n- **Live Process List**: Real-time view of all running processes with sorting and filtering.\n- **Port View**: Explore open ports and immediately see which processes are holding them.\n- **Process Details**: Deep-dive into a specific process to see its full ancestry tree, child processes, environment variables, working directory, and more.\n- **Process Actions**: Send signals (Kill, Terminate, Pause, Resume) or Renice processes directly from the UI.\n- **Mouse Support**: Navigate, sort columns, and click rows using your mouse.\n\n---\n\n## 4. Flags & Options\n\n```\n      --env              show environment variables for the process\n  -x, --exact            use exact name matching (no substring search)\n  -f, --file strings     file path(s) to find process for (repeatable)\n  -h, --help             help for witr\n  -i, --interactive      interactive mode (TUI)\n      --json             show result as JSON\n      --no-color         disable colorized output\n  -p, --pid strings      pid(s) to look up (repeatable)\n  -o, --port strings     port(s) to look up (repeatable)\n  -s, --short            show only ancestry\n  -t, --tree             show only ancestry as a tree\n      --verbose          show extended process information\n  -v, --version          version for witr\n      --warnings         show only warnings\n```\n\nPositional arguments (without flags) are treated as process or service names. Multiple names can be passed. By default, name matching uses substring matching (fuzzy search). Use `--exact` to match only processes with the exact name.\n\nAll target flags (`--pid`, `--port`, `--file`) are repeatable and can be mixed with each other and with positional name arguments. When multiple targets are provided, results are shown sequentially with labeled dividers. All output modes (standard, short, tree, JSON, env, warnings, verbose) work with multiple inputs.\n\nThe TUI is launched if no arguments or relevant flags (`--pid`, `--port`, `--file`) are provided, or if the `--interactive` flag is explicitly used.\n\n---\n\n## 5. Example Outputs\n\n### 5.1 Name Based Query\n\n```bash\nwitr node\n```\n\n```\nTarget      : node\n\nProcess     : node (pid 14233)\nUser        : pm2\nCommand     : node index.js\nStarted     : 2 days ago (Mon 2025-02-02 11:42:10 +05:30)\nRestarts    : 1\n\nWhy It Exists :\n  systemd (pid 1) → pm2 (pid 5034) → node (pid 14233)\n\nSource      : pm2\n\nWorking Dir : \u002Fopt\u002Fapps\u002Fexpense-manager\nGit Repo    : expense-manager (main)\nListening   : 127.0.0.1:5001\n```\n\n---\n\n### 5.2 Short Output\n\n```bash\nwitr --port 5000 --short\n```\n\n```\nsystemd (pid 1) → PM2 v5.3.1: God (pid 1481580) → python (pid 1482060)\n```\n\n---\n\n### 5.3 Tree Output\n\n```bash\nwitr --pid 143895 --tree\n```\n\n```\nsystemd (pid 1)\n  └─ init-systemd(Ub (pid 2)\n    └─ SessionLeader (pid 143858)\n      └─ Relay(143860) (pid 143859)\n        └─ bash (pid 143860)\n          └─ sh (pid 143886)\n            └─ node (pid 143895)\n              ├─ node (pid 143930)\n              ├─ node (pid 144189)\n              └─ node (pid 144234)\n```\n\nNote: _Tree view includes child processes (up to 10) and highlights the target process._\n\n---\n\n### 5.4 Multiple Matches\n\n```bash\nwitr ng\n```\n\n```\nMultiple matching processes found:\n\n[1] nginx (pid 2311)\n    nginx -g daemon off;\n[2] nginx (pid 24891)\n    nginx -g daemon off;\n[3] ngrok (pid 14233)\n    ngrok http 5000\n\nRe-run with:\n  witr --pid \u003Cpid>\n```\n\nTo avoid substring matching and only find processes with an exact name, use the `--exact` flag:\n\n```bash\nwitr nginx -x\n```\n\n---\n\n### 5.5 File Based Query\n\n```bash\nwitr --file \u002Fvar\u002Flib\u002Fdpkg\u002Flock\n```\n\nExplains the process holding a file open.\n\n---\n\n### 5.6 Multiple Inputs\n\n```bash\nwitr nginx --port 5432 --pid 1234\n```\n\n```\n----- [name: nginx] -----\nTarget      : nginx\nProcess     : nginx (pid 2311)\n...\n\n----- [port: 5432] -----\nTarget      : postgres\nProcess     : postgres (pid 891)\n...\n\n----- [pid: 1234] -----\nTarget      : node\nProcess     : node (pid 1234)\n...\n```\n\nAll target flags are repeatable and can be mixed. Results appear in the order you typed them. All output modes (`--short`, `--tree`, `--json`, `--env`, `--warnings`, `--verbose`) work with multiple inputs.\n\n---\n\n## 6. Platform Support\n\n- **Linux** (x86_64, arm64) - Full feature support (`\u002Fproc`).\n- **macOS** (x86_64, arm64) - Uses `ps`, `lsof`, `sysctl`, `pgrep`.\n- **Windows** (x86_64, arm64) - Uses `Get-CimInstance`, `tasklist`, `netstat`.\n- **FreeBSD** (x86_64, arm64) - Uses `procstat`, `ps`, `lsof`.\n\n---\n\n### 5.1 Feature Compatibility Matrix\n\n| Feature | Linux | macOS | Windows | FreeBSD | Notes |\n|---------|:-----:|:-----:|:-------:|:-------:|-------|\n| **Process Selection** |\n| By Name | ✅ | ✅ | ✅ | ✅ | |\n| By PID | ✅ | ✅ | ✅ | ✅ | |\n| By Port | ✅ | ✅ | ✅ | ✅ | |\n| By File | ✅ | ✅ | ❌ | ✅ | |\n| Multiple\u002Fmixed inputs | ✅ | ✅ | ✅ | ✅ | Repeatable flags, mixed types. |\n| Exact Match | ✅ | ✅ | ✅ | ✅ | |\n| Full command line | ✅ | ✅ | ✅ | ✅ | |\n| Process start time | ✅ | ✅ | ✅ | ✅ | |\n| Working directory | ✅ | ✅ | ✅ | ✅ | |\n| Environment variables | ✅ | ⚠️ | ❌ | ✅ | macOS: Partial support due to SIP restrictions. |\n| **Network** |\n| Listening ports | ✅ | ✅ | ✅ | ✅ | |\n| Bind addresses | ✅ | ✅ | ✅ | ✅ | |\n| Port → PID resolution | ✅ | ✅ | ✅ | ✅ | |\n| **Service Detection** |\n| Service Manager | ✅ | ✅ | ✅ | ✅ | Linux: systemd, macOS: launchd, Windows: Services, FreeBSD: rc.d |\n| Service Description | ✅ | ✅ | ✅ | ✅ | Linux: `Description`, macOS: `Comment`, Windows: `Display Name`, FreeBSD: `rc` header |\n| Configuration Source | ✅ | ✅ | ✅ | ✅ | Linux: Unit File, macOS: Plist, Windows: Registry Key, FreeBSD: Rc Script |\n| Supervisor | ✅ | ✅ | ✅ | ✅ | |\n| Containers | ✅ | ✅ | ✅ | ✅ | Docker (plus Compose mappings), Podman, K8s (Kubepods), Containerd. Colima on macOS\u002FLinux. Jails on FreeBSD. |\n| SSH session detection | ✅ | ✅ | ✅ | ✅ | Detects remote IP and terminal. |\n| tmux\u002Fscreen detection | ✅ | ✅ | ❌ | ✅ | Shows session name in source. |\n| Schedule detection | ✅ | ✅ | ❌ | ❌ | Linux: systemd timers, macOS: launchd intervals\u002Fcalendar. |\n| Snap\u002FFlatpak detection | ✅ | ❌ | ❌ | ❌ | |\n| **Health & Diagnostics** |\n| CPU usage detection | ✅ | ✅ | ✅ | ✅ | |\n| Memory usage detection | ✅ | ✅ | ✅ | ✅ | |\n| Health status detection | ✅ | ✅ | ✅ | ✅ | |\n| Open Files \u002F Handles | ✅ | ✅ | ⚠️ | ✅ | Windows: count only. |\n| Deleted binary detection | ✅ | ✅ | ✅ | ✅ | Warns if executable is missing. |\n| Capability warnings | ✅ | ❌ | ❌ | ❌ | Warns about dangerous capabilities on non-root processes. |\n| **Context** |\n| Git repo\u002Fbranch detection | ✅ | ✅ | ✅ | ✅ | |\n| **Interactive Mode (TUI)** |\n| Process Dashboard | ✅ | ✅ | ✅ | ✅ | |\n| Port Dashboard | ✅ | ✅ | ✅ | ✅ | |\n| Process Details | ✅ | ✅ | ✅ | ✅ | |\n| Process Actions | ✅ | ✅ | ❌ | ✅ | |\n\n**Legend:** ✅ Full support | ⚠️ Partial\u002Flimited support | ❌ Not available\n\n---\n\n### 5.2 Permissions Note\n\n#### Linux\u002FFreeBSD\n\nwitr inspects system directories which may require elevated permissions.\n\nIf you are not seeing the expected information, try running witr with sudo:\n\n```bash\nsudo witr [your arguments]\n```\n\n#### macOS\n\nOn macOS, witr uses `ps`, `lsof`, and `launchctl` to gather process information. Some operations may require elevated permissions:\n\n```bash\nsudo witr [your arguments]\n```\n\nNote: Due to macOS System Integrity Protection (SIP), some system process details may not be accessible even with sudo.\n\n#### Windows\n\nOn Windows, witr uses `Get-CimInstance`, `tasklist`, and `netstat`. To see details for processes owned by other users or system services, you must run the terminal as **Administrator**.\n\n```powershell\n# Run in Administrator PowerShell\n.\\witr.exe [your arguments]\n```\n\n---\n\n## 7. Goals\n\n### Primary goals\n\n- Explain **why a process exists**, not just that it exists\n- Reduce time‑to‑understanding during debugging and outages\n- Work with zero configuration\n- Be safe, read‑only, and non‑destructive\n- Prefer clarity over completeness\n\n### Non‑goals\n\n- Not a monitoring tool\n- Not a performance profiler\n- Not a replacement for systemd\u002Fdocker tooling\n- Not a remediation or auto‑fix tool\n\n---\n\n## 8. Core Concept\n\nwitr treats **everything as a process question**.\n\nPorts, services, containers, and commands all eventually map to **PIDs**. Once a PID is identified, witr builds a causal chain explaining _why that PID exists_.\n\nAt its core, witr answers:\n\n1. What is running?\n2. How did it start?\n3. What is keeping it running?\n4. What context does it belong to?\n\n---\n\n## 9. Output Behavior\n\n### 9.1 Output Principles\n\n- Single screen by default (best effort)\n- Deterministic ordering\n- Narrative-style explanation\n- Best-effort detection with explicit uncertainty\n\n---\n\n### 9.2 Exit Codes\n\nwitr returns meaningful exit codes for use in scripts, CI pipelines, and monitoring:\n\n| Code | Meaning |\n|------|---------|\n| 0 | Clean: process found, no warnings |\n| 1 | Warnings: process found but has one or more warnings |\n| 2 | Not found: no matching process or service |\n| 3 | Permission denied: insufficient privileges |\n| 4 | Invalid input: bad arguments or ambiguous match |\n\n#### Example Usage:\n\n```bash\nwitr nginx --short\ncase $? in\n  0) echo \"All clear\" ;;\n  1) echo \"Warnings detected\" ;;\n  2) echo \"Process not running\" ;;\n  3) echo \"Need elevated privileges\" ;;\n  4) echo \"Invalid input or ambiguous match\" ;;\nesac\n```\n\n---\n\n### 9.3 Standard Output Sections\n\n#### Target\n\nWhat the user asked about.\n\n#### Process\n\nExecutable, PID, user, command, start time and restart count.\n\n#### Why It Exists\n\nA causal ancestry chain showing how the process came to exist.\nThis is the core value of witr.\n\n#### Source\n\nThe primary system responsible for starting or supervising the process (best effort).\n\nExamples:\n\n- systemd unit with schedule info for timer-triggered services (Linux)\n- launchd service with schedule\u002Ftrigger details (macOS)\n- SSH session (with remote IP and terminal)\n- docker container\n- pm2\n- cron\n- interactive shell (detects tmux\u002Fscreen sessions)\n- Snap\u002FFlatpak sandbox (Linux)\n\nOnly **one primary source** is selected.\n\n#### Context (best effort)\n\n- Working directory\n- Git repository name and branch\n- Container name \u002F image (docker, podman, kubernetes, colima, containerd)\n- Public vs private bind\n\n#### Warnings\n\nNon‑blocking observations such as:\n\n- Process is running as root\n- Dangerous Linux capabilities on non-root processes (CAP_SYS_ADMIN, etc.)\n- Process is listening on a public interface (0.0.0.0 \u002F ::)\n- Restarted multiple times (warning only if above threshold)\n- Process is using high memory (>1GB RSS)\n- Process has been running for over 90 days\n- Deleted binary, library injection indicators (LD_PRELOAD, DYLD_*)\n\n---\n\n## 10. Success Criteria\n\nwitr is successful if:\n\n- A user can answer \"why is this running?\" within seconds\n- It reduces reliance on multiple tools\n- Output is understandable under stress\n- Users trust it during incidents\n\n---\n\n## 11. Sponsors\n\nSpecial thanks to the people supporting **witr** ❤️\n\n\u003Cp>\n  \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Ftimcolson\" title=\"Tim Colson\">\n    \u003Cimg src=\"https:\u002F\u002Fimages.weserv.nl\u002F?url=github.com\u002Ftimcolson.png&mask=circle&w=80&h=80\" width=\"80\">\n  \u003C\u002Fa>\n\u003C\u002Fp>\n","witr 是一个旨在解答“为什么这个在运行？”问题的工具。它通过Go语言开发，能够明确地展示系统中运行进程、服务或端口绑定的原因及其启动链路，支持Linux、macOS、Windows和FreeBSD等多平台。与传统工具如`ps`、`top`仅展示运行状态不同，witr 通过交互式TUI界面提供了一种直观的方式，帮助用户理解特定运行项的起源及依赖关系。适用于需要深入分析系统运行状况、排查问题根源或是进行安全审查的场景。",2,"2026-06-11 02:31:32","trending"]