witr turns ports and containers back into process ancestry
A listening port is usually only the start of an investigation. lsof may identify a PID, ps shows its parent, a service manager knows the unit, and a container CLI supplies the image or Compose service. witr joins those clues into one explanation. A query by process name, PID, port, file, or container ends with an ancestry chain and context such as the working directory, Git branch, sockets, supervisor, and restart count.
The design is narrow enough to remember under pressure. witr --port 5000 --short prints only the ancestry. --tree includes child processes, while --json is available for scripts. Target flags can be repeated and mixed, so one command can inspect a name, port, and PID in sequence. Five documented exit codes distinguish a clean result, warnings, missing targets, permission denial, bad input, and internal errors.
The TUI watches 4 kinds of system evidence
Running witr with no target opens a terminal dashboard with Processes, Ports, Containers, and Locks tabs. The process view can sort and filter entries, then expand a selected process into ancestry, children, environment, sockets, and file context. The container view combines Docker, Podman, nerdctl, Kubernetes through crictl, Incus, LXC, LXD, and FreeBSD jails when their command-line tools are present.
Unix users can terminate, kill, pause, resume, or renice a process from the TUI. That convenience changes the risk profile: inspection and mutation sit in the same interface. Windows does not support those actions, and it also lacks the Locks tab. Auto-refresh begins at 3 seconds and backs off under load. For incident use, start read-only and confirm the selected PID and ancestry before sending a signal.
What happened when we ran it
Our sandbox completed the Go setup in 19 seconds and installed 0 packages. The build passed in 22 seconds. Go test then reported 7 passed and 0 failed in 11 seconds. The measured commit dc4fa1d therefore cleared every install, compiler, and test step that our harness invoked.
The checkout was compact at 1 MB, although it contained 292 files and roughly 28,135 lines of source. We found 6 CI workflow files, no Dockerfile, and no separate tests directory. Go permits tests beside the package source, which is consistent with the 7 cases the command found. These figures measure repository mechanics in a 3-CPU, 8 GB Debian container, not accuracy across every supported operating system.
Our run also did not prove the central causal claims against systemd, PM2, Docker, launchd, Windows Services, or FreeBSD jails. A useful acceptance test should create known chains on each production platform, including a public listener, a restarted service, a container port, and an open file. Compare witr's selected source and ancestry with the native tools before using its JSON in automated response logic.
Permissions and PID reuse limit certainty
System introspection is constrained by the operating system. Linux and FreeBSD may require elevated access to system directories. macOS uses ps, lsof, and launchctl, but System Integrity Protection can hide details even with sudo. Windows talks to native Win32 APIs instead of PowerShell or WMI, yet processes owned by other users or the system may still require an Administrator terminal. Missing context can therefore mean denied visibility rather than no context.
Two open issues cut directly into ancestry accuracy. Issue 219 asks witr to handle processes whose parent has disappeared. Issue 220 says the ancestry walk needs stronger protection against recycled PIDs, where an identifier now belongs to a different process than the original parent. A related pull request stops ancestry at recycled parents. Until that work settles, treat an odd chain as a prompt to verify timestamps and native process records, not as forensic proof.
Platform support is broad but intentionally uneven
The README lists Linux, macOS, Windows, and FreeBSD on x86_64 and arm64. Core lookup by name, PID, port, file, and container is marked available on all 4 systems. Service managers map to systemd, launchd, Windows Services, and rc.d. Windows lacks tmux or screen detection, schedule detection, file locks, and TUI process actions. Linux alone gets Snap and Flatpak detection plus capability warnings.
Windows still has active rough edges. Issue 227 reports TCP LISTEN ports missing from the Ports tab and says the Toggle All action breaks that view; a current pull request normalizes localized listener states. Release v0.3.3 fixed Darwin lsof file-descriptor parsing and added Incus or LXC detection from cgroups. Those changes show why the compatibility matrix needs version-specific testing rather than a checkmark copied into procurement notes.
August 2026 fixes support a cautious install
GitHub showed 21,694 stars and 11 combined open issues and pull requests. The repository was pushed on August 15, 2026, and v0.3.3 was released June 24. Current work covers Windows listeners, recycled PID protection, richer Docker details, and network topology. Record and replay remains a feature request, so witr is a live-state investigator rather than a historical recorder.
The package reach is unusually wide for a young utility: the README lists prebuilt binaries plus Homebrew, Debian, Conda, Winget, npm, FreeBSD Ports, Chocolatey, Scoop, and other channels. Community packages may lag GitHub releases. Pick the operating system's package manager for updates, then validate one known ancestry chain. witr is most useful as a fast first explanation, followed by native evidence when the answer could trigger a production action.