How can I recover the original working directory of a running Python -m uvicorn main:app –reload process on Windows?

How can I recover the original working directory of a running Python -m uvicorn main:app --reload process on Windows?

I have an interesting Windows debugging puzzle.

I discovered that something on my machine is listening on 127.0.0.1:8004. I can identify the process and its Python executable, but I cannot determine which project directory the application was originally launched from.

What I know

Using PowerShell:

Get-NetTCPConnection -LocalPort 8004 |
    Select-Object LocalAddress, LocalPort, State, OwningProcess

I get:

LocalAddress LocalPort State  OwningProcess
------------ --------- ----- -------------
127.0.0.1         8004 Listen          2504

So PID 2504 owns the listening port.

Inspecting the executable:

(Get-Process -Id 2504).Path

returns:

C:UsersodoemAppDataLocalProgramsPythonPython312python.exe

That identifies the Python interpreter, but not the application source.

I then inspected the full command line:

(Get-CimInstance Win32_Process -Filter "ProcessId = 2504").CommandLine

which returns:

python -m uvicorn main:app --reload --port 8004

This is where the mystery begins.

Because main:app is a relative import reference, I know Uvicorn must have been started from a directory where Python could resolve main.py and find an object called app.

I also inspected the process tree:

Get-CimInstance Win32_Process |
    Where-Object {
        $_.ProcessId -eq 2504 -or
        $_.ParentProcessId -eq 2504
    } |
    Select-Object ProcessId, ParentProcessId, Name, CommandLine

Result:

ProcessId ParentProcessId Name       CommandLine
--------- --------------- ----       -----------
2504      42908           python.exe python -m uvicorn main:app --reload --port 8004
17732     2504            python.exe "C:UsersodoemAppDataLocalProgramsPythonPython312python.exe" "-c" ...

So it appears that:

PID 42908
    │
    └── PID 2504  → Uvicorn reload supervisor
            │
            └── PID 17732 → child Python/Uvicorn-related process

I have not yet terminated the processes because I want to investigate the origin first.

The actual question

Is there a reliable way on Windows to recover or infer the original current working directory (CWD) from which PID 2504 was launched?

Specifically, I would like to determine the directory that made this command possible:

python -m uvicorn main:app --reload --port 8004

without simply recursively searching my entire user profile for every main.py.

I am particularly interested in whether any of the following can help:

1. Inspecting the parent process, PID 42908, and recursively walking further up the process tree.

2. Querying process handles, environment information, or other Windows process metadata.

3. Using PowerShell, WMI/CIM, Sysinternals, Process Explorer, or Process Monitor.

4. Inspecting the child process created by Uvicorn’s --reload mechanism.

5. Determining whether Windows preserves the original working directory of a process in a way that can still be queried after launch.

The key constraint is that I currently know:

• The listening port: 8004

• The process: PID 2504

• The executable: Python 3.12

• The command line: python -m uvicorn main:app --reload --port 8004

• The parent PID: 42908

• A child PID: 17732

…but I do not know the original project directory.

What would be the best forensic/debugging approach to trace this process back to its source directory?