# 使用 Homebrew Cask 安装 truetree

查看 truetree 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

## 安装

```sh
sudo av install cask:truetree
```

其他安装命令:

### macOS

- Homebrew Cask (100%):

```sh
brew install --cask truetree
```

  证据: local Homebrew cask metadata

## 软件包事实

- **软件包键:** cask:truetree
- **软件包管理器:** Homebrew Cask
- **软件包管理器页面:** <https://formulae.brew.sh/cask/truetree>
- **版本:** 0.8
- **来源摘要:** Command-line tool for pstree-like output
- **主页:** <https://themittenmac.com/the-truetree-concept/>
- **仓库:** <https://github.com/themittenmac/TrueTree>
- **上游文档:** <https://themittenmac.com/the-truetree-concept/>
- **源码归档:** <https://github.com/themittenmac/TrueTree/releases/download/V0.8/TrueTree.zip>
- **已生成:** 2026-08-04T22:13:35+00:00

## 可执行文件

- TrueTree (二进制)
- TrueTree (别名)

## 安装行为

- post-install 钩子: 未定义
- Bottle: 不可用

## 版本和新鲜度

- 页面生成时间: 2026-08-04
- 管理器版本: 0.8
- 本地数据: OK
- 上游仓库: https://github.com/themittenmac/TrueTree
- 信息: No package-manager update timestamp was available.
- 信息: No cached GitHub release or tag data was available.
## 项目历史与用法

TrueTree is a small macOS command-line process-tree utility aimed at incident responders and threat hunters who need a more useful process ancestry view than ordinary PID/PPID output.

### 项目历史

The project grew out of Jaron Bradley's February 2020 write-up of the 'TrueTree' concept: on macOS, launchd and XPC often make ordinary process trees look flat or misleading, so the tool uses additional operating-system process metadata to reconstruct more helpful ancestry.

Its README later documented platform drift: after macOS 11 introduced runningboardd behavior that changed parentage observations, TrueTree was updated to use Application Services for some true-parent discovery while accepting that some terminated parents can no longer be recovered.

### 采用历史

TrueTree appears to have remained a specialist macOS security tool rather than a broad Unix replacement for pstree. Its Homebrew cask packaging made a compiled release easy to install on analyst Macs, while the GitHub project stayed compact and focused.

### 使用方式

The tool is used from a root shell to print an enhanced process tree, optionally showing timestamps, parent-data sources, network information, or a standard PID/PPID tree for comparison.

In package-manager culture it is the kind of niche binary that belongs in a forensic or IR workstation bootstrap list: install it with Homebrew, run it during macOS triage, and compare its output with ps, Activity Monitor, and launchctl procinfo.

### 为什么软件包爱好者会关心

TrueTree matters to package nerds because it packages a very macOS-specific diagnostic idea as a single CLI. It is not a general-purpose process viewer; its value is that Homebrew users can install a purpose-built process-ancestry helper without compiling an Xcode project.

### 时间线

- 2020: The TrueTree concept is published for macOS threat hunting and incident response.
- 2024: GitHub shows TrueTree 0.8 as the latest release.

### Related projects

- pstree and ps provide the traditional Unix process-tree baseline that TrueTree compares itself against.
- launchctl procinfo is the macOS source of several parentage clues described in the project write-up.

### 来源

- <https://github.com/themittenmac/TrueTree>
- <https://themittenmac.com/the-truetree-concept/>


## 安全说明

没有找到 truetree 的匹配本地密钥处理 manifest。软件包元数据仍在此发布，以便未来覆盖拥有稳定的软件包 URL。


## 源数据库详情

- **Source Database:** Homebrew cask API
- **Tap:** homebrew/cask
- **Full Token:** truetree
- **Names:** TrueTree
- **Artifacts:** Binary: 1, Target: 1
- **Deprecated:** no
- **Disabled:** no


## 相关链接

- [Homebrew Cask packages](https://pkg.so/zh-hans/homebrew-cask-packages/) - Generated from Homebrew Cask package-manager metadata.
- [Homebrew Cask binaries](https://pkg.so/zh-hans/homebrew-cask-binaries/) - Cask artifact metadata includes a binary.

## Combined YAML source

View the package source record on GitHub. [combined/truetree.yml](https://github.com/mxcl/pkgdb/blob/main/combined/truetree.yml)


## 来源

- pkg.so package database
- package-page enrichment
- curated package history
- package version freshness
- pkgdb category and tag curation
- package relationship graph
- cross-ecosystem install command graph