Skip to content
match-007
FlowScope
Public

About

FlowScope is a local system and application monitor for Windows 10 22H2 and Windows 11 x64. The production build contains one elevated `FlowScope.exe`; the desktop UI, collectors, ETW session, aggregation, SQLite history, alerts, tray icon, and floating monitor all run in the same process.

Resources

Readme
MIT license

Code of conduct

Code of conduct

Contributing

Contributing

Security policy

Security policy
Activity

Stars

1 star

Watchers

0 watching

Forks

0 forks
Report repository
BranchesTags

Latest commit

 

History

4 Commits

Folders and files

NameName
Last commit message
Last commit date
.github
.github
 
 
build
build
 
 
cmd
cmd
 
 
docs
docs
 
 
frontend
frontend
 
 
internal
internal
 
 
migrations
migrations
 
 
scripts
scripts
 
 
.gitignore
.gitignore
 
 
CHANGELOG.md
CHANGELOG.md
 
 
CODE_OF_CONDUCT.md
CODE_OF_CONDUCT.md
 
 
CONTRIBUTING.md
CONTRIBUTING.md
 
 
DESIGN.md
DESIGN.md
 
 
LICENSE
LICENSE
 
 
PRODUCT.md
PRODUCT.md
 
 
README.en.md
README.en.md
 
 
README.md
README.md
 
 
SECURITY.md
SECURITY.md
 
 
THIRD_PARTY_NOTICES.txt
THIRD_PARTY_NOTICES.txt
 
 
app.go
app.go
 
 
desktop_lifecycle.go
desktop_lifecycle.go
 
 
desktop_lifecycle_test.go
desktop_lifecycle_test.go
 
 
floating_view.go
floating_view.go
 
 
floating_window_test.go
floating_window_test.go
 
 
floating_window_windows.go
floating_window_windows.go
 
 
go.mod
go.mod
 
 
go.sum
go.sum
 
 
installer_safety_test.go
installer_safety_test.go
 
 
main.go
main.go
 
 
monitor_runtime_windows.go
monitor_runtime_windows.go
 
 
monitor_runtime_windows_test.go
monitor_runtime_windows_test.go
 
 
package.json
package.json
 
 
startup_windows.go
startup_windows.go
 
 
startup_windows_test.go
startup_windows_test.go
 
 
tray_windows.go
tray_windows.go
 
 
wails.json
wails.json
 
 

Repository files navigation

FlowScope

简体中文 | English

项目预览 / Project preview

运行总览 / Overview

FlowScope 运行总览

性能与硬件 / Performance and hardware

FlowScope 性能与硬件

紧凑悬浮监控 / Compact floating monitor

FlowScope 紧凑悬浮监控

简体中文

FlowScope 是面向 Windows 10 22H2 / Windows 11 x64 的本机系统与应用监控器。正式版本只有一个提升权限的 FlowScope.exe：界面、采集、ETW、聚合、SQLite 历史和告警都在同一进程中运行，不需要安装或连接额外 Agent。

核心特性

  • 真实整机 CPU（含每核心）、内存、磁盘容量/吞吐和物理网卡吞吐。
  • Windows GPU Engine 使用率、厂商 CPU Package 温度，以及 NVIDIA NVAPI/NVML GPU 核心温度；每个传感器独立显示可用性和原因，不把平台热区冒充 CPU 温度。
  • 基于 Microsoft-Windows-Kernel-Network ETW 的每应用 TCP/UDP 上传、下载和累计流量。
  • 使用 boot_id + PID + start_time 隔离 PID 重用，并以 EXE 规范路径和文件身份生成稳定应用 ID。
  • 从本地 EXE 按需提取应用图标；应用列表按父子进程归组，搜索子进程时保留完整应用组并可展开查看。
  • 当前 TCP/UDP 连接、应用详情、5 分钟至 30 天历史、CSV 导出和本地告警。
  • SQLite WAL、分层 Rollup、保留策略、确认清理，以及低功耗/均衡/实时采样模式。
  • 单实例系统托盘：关闭窗口只隐藏并继续监控；托盘右键“退出 FlowScope”才停止监控并退出。
  • 支持开机自启动、中文/English/日本語/한국어切换，以及与主界面并存的独立置顶悬浮窗。悬浮窗支持仪表盘/纯文字两种模式，可分别选择 CPU、内存、网络、GPU、CPU 温度和 GPU 温度。

FlowScope 不捕获网络正文，不保存完整命令行，不上传遥测，也不会修改代理、DNS、路由、网卡或防火墙。

启动

安装版或便携版都只需启动 FlowScope.exe。Windows 会显示 UAC，因为在不保留辅助进程的前提下，应用级 ETW 必须由提升权限的 FlowScope 主进程运行。

关闭窗口后，FlowScope 会留在系统托盘继续监控：

  1. 托盘右键选择“打开 FlowScope”可恢复窗口。
  2. 托盘右键选择“退出 FlowScope”才会停止采集、冲刷数据库并退出。
  3. 隐藏后再次双击快捷方式会唤回原窗口，不会创建第二个监控进程。

监控数据默认保存在 FlowScope.exe 当前文件夹的 config、data 和 logs 目录；WebView2 页面状态与缓存位于 %LOCALAPPDATA%\FlowScope\WebView2，以便 Edge 子进程按普通用户权限读写。首次运行时会以“只复制、不覆盖、不删源数据”的方式迁移旧版 %ProgramData%\FlowScope 数据。卸载默认保留这些目录，只有在确认提示中选择删除才会清理。

开发

前置环境：Windows x64、Go 1.25+、Node.js 22+、npm 10+。

.\scripts\dev.ps1

开发数据默认写入工作区 .flowscope\dev，不会修改本机网络配置。完整应用网络采集仍要求开发进程已提升权限。

构建与测试

.\scripts\build.ps1

构建脚本执行前端锁定安装、TypeScript 检查、gofmt 检查、go vet、全部 Go 测试、Wails x64 构建、NSIS 安装器、便携包和 SHA-256 校验。产物位于 dist：

FlowScope-Setup-x64.exe
FlowScope-Portable-x64.zip
checksums.txt
THIRD_PARTY_NOTICES.txt

安装器与便携包均只包含一个应用可执行文件 FlowScope.exe。cmd/netprobe 和 cmd/traffic-test 仅是源码级 ETW 验证工具，不进入发布包。管理员 ETW 验收命令：

.\scripts\validate-etw-admin.ps1

该脚本只使用本机回环，不修改任何网络配置。

文档

参与项目之前请阅读 贡献指南、行为准则 和 安全策略。版本变化记录在 CHANGELOG.md。

许可证

项目暂定使用 MIT License。第三方依赖声明见 THIRD_PARTY_NOTICES.txt。

English

FlowScope is a local system and application monitor for Windows 10 22H2 and Windows 11 x64. The production build contains one elevated FlowScope.exe: the UI, collectors, ETW session, aggregation, SQLite history, and alerts all run in the same process, with no separately installed or connected Agent.

Highlights

  • Real system-wide and per-core CPU, memory, disk capacity/throughput, and physical-adapter throughput.
  • Windows GPU Engine utilization, vendor CPU package temperature, and NVIDIA GPU core temperature through NVAPI/NVML. Every sensor reports its own availability and reason; platform thermal zones are never presented as CPU temperature.
  • Per-application TCP/UDP upload, download, and cumulative traffic through Microsoft-Windows-Kernel-Network ETW.
  • PID-reuse isolation through boot_id + PID + start_time, plus stable application IDs derived from canonical EXE paths and Windows file identity.
  • On-demand icon extraction from local executables. The application list groups parent and child processes, preserves the complete group when a child matches a search, and allows process-level expansion.
  • Current TCP/UDP connections, application details, history from 5 minutes to 30 days, CSV export, and local alerts.
  • SQLite WAL, tiered rollups, retention controls, confirmed cleanup, and low-power/balanced/realtime sampling modes.
  • Single-instance system tray lifecycle: closing the window only hides it and monitoring continues; only Exit FlowScope from the tray stops monitoring and exits.
  • Optional Windows startup, Chinese/English/Japanese/Korean UI languages, and an independent always-on-top monitor. Dashboard and text-only modes can separately show CPU, memory, network, GPU, CPU temperature, and GPU temperature.

FlowScope does not capture network payloads, save full command lines, upload telemetry, or change proxy, DNS, routing, adapter, or firewall settings.

Run

Launch FlowScope.exe from either the installer or portable package. Windows requests elevation because application-level ETW must run in the main FlowScope process when no helper process is retained.

After the main window is closed, FlowScope remains in the system tray:

  1. Choose Open FlowScope from the tray menu to restore the window.
  2. Choose Exit FlowScope to stop collection, flush the database, and quit.
  3. Launching the shortcut again while hidden restores the existing window instead of starting another monitoring process.

By default, monitoring data is stored in config, data, and logs beside FlowScope.exe. WebView2 page state and cache use %LOCALAPPDATA%\FlowScope\WebView2 so the Edge child process can read and write them as the current user. On first launch, legacy %ProgramData%\FlowScope data is migrated by copying only: existing destination files are not overwritten and source data is not deleted. Uninstall keeps these directories unless data removal is explicitly confirmed.

Develop

Requirements: Windows x64, Go 1.25+, Node.js 22+, and npm 10+.

.\scripts\dev.ps1

Development data is written to .flowscope\dev, and the script does not change local network configuration. Full per-application network collection still requires an elevated development process.

Build and test

.\scripts\build.ps1

The build script performs locked frontend installation, TypeScript checks, gofmt verification, go vet, all Go tests, the Wails x64 build, NSIS installer packaging, portable packaging, and SHA-256 generation. Artifacts are written to dist:

FlowScope-Setup-x64.exe
FlowScope-Portable-x64.zip
checksums.txt
THIRD_PARTY_NOTICES.txt

The installer and portable package each contain only one application executable, FlowScope.exe. cmd/netprobe and cmd/traffic-test are source-level ETW validation tools and are not included in releases. Run the administrator ETW acceptance check with:

.\scripts\validate-etw-admin.ps1

The validation script uses loopback traffic only and does not change network configuration.

Documentation

Before contributing, read the contribution guide, code of conduct, and security policy. Version changes are recorded in CHANGELOG.md.

License

The project is licensed under the MIT License. Third-party notices are listed in THIRD_PARTY_NOTICES.txt.

About

FlowScope is a local system and application monitor for Windows 10 22H2 and Windows 11 x64. The production build contains one elevated `FlowScope.exe`; the desktop UI, collectors, ETW session, aggregation, SQLite history, alerts, tray icon, and floating monitor all run in the same process.

Resources

Readme
MIT license

Code of conduct

Code of conduct

Contributing

Contributing

Security policy

Security policy
Activity

Stars

1 star

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors

Languages