witr

witr is a single static binary for Linux, macOS, Windows, and FreeBSD that answers one question: why is this running? Given a process name, PID, port, container, or open file, it builds the causal chain of supervisors, services, shells, and containers responsible for that thing existing right now. Core idea: everything is treated as a process question. Ports, services, containers, and commands all map back to PIDs, and once a PID is identified witr explains what is running, how it started, what keeps it running, and what context it belongs to. This differs from tools like ps, top, lsof, ss, systemctl, or docker ps, which expose state and metadata but leave the user to correlate outputs manually. Usage modes: - Standard output shows target, process, user, command, start time, the ancestry chain (for example systemd to pm2 to node), source, working directory, git repo, and sockets. - --short prints only the ancestry chain; --tree renders ancestry as a tree including up to 10 child processes. - --json emits machine-readable results; --env shows environment variables; --verbose adds extended process information; --warnings shows only warnings. - Positional arguments are treated as process or service names, with substring matching by default and --exact for exact names. Multiple matches are listed with PIDs and a suggestion to re-run with --pid. - --pid, --port, --file, and --container are repeatable and can be mixed with each other and with name arguments; results appear in the order given, separated by labeled dividers. - --container searches across Docker, Podman, nerdctl, K8s/crictl, Incus, LXC, LXD, and FreeBSD jails, matching container name, image, command, and compose project/service labels. Interactive TUI: running witr with no arguments or with -i opens a terminal dashboard with four tabs. Processes shows a live sortable, filterable list with an ancestry side panel. Ports lists listening or all ports with owning processes, toggled with a. Containers aggregates running containers across the supported runtimes with a detail view for mounts, networks, and compose metadata. Locks shows system-wide file locks (POSIX/FLOCK on Linux, lsof-derived on macOS/FreeBSD) and can merge in all interesting open file descriptors. The TUI also supports process actions such as kill, terminate, pause, resume, and renice on Unix, mouse navigation, adaptive light/dark theming, and auto-refresh on an adaptive cadence starting at 3 seconds. Installation is broad: install scripts for Unix and Windows, plus packages via APT, Homebrew, MacPorts, Conda, AUR, Winget, npm, FreeBSD Ports, Chocolatey, Scoop, AOSC OS, GNU Guix, Uniget, Aqua, Brioche, and mise, with deb/rpm/apk artifacts and go install from source. Shell completions are provided for Bash, Zsh, Fish, and PowerShell, and a man page is included. A browser-based simulated tutorial and sandbox is available for trying the workflow without installing.