junegunn/fzfcli-tool

Audited after reading 69k tokens across 30 files.

fzf is the command-line fuzzy finder: the single Go binary that turned interactive filtering into a shell primitive, with first-class integrations for four shells, Vim, and tmux ^[1]. The question this audit set out to answer is whether a 13-year-old tool run essentially by one person can still be trusted as a daily dependency. The code answers louder than the bus factor does.

What holds up:

• The engineering behind the speed claim is real. "Millions of items in milliseconds" is backed by hand-written AVX2 and NEON assembly with fuzz tests in CI, slab allocators reused across matcher threads, and per-chunk query-bitmap caches — measured design, not README bravado ^[39][11][7].
• The test harness treats the terminal as the API. A tmux-driven Ruby suite simulates real keystrokes, mouse clicks, and ANSI state across bash, zsh, fish, and Nushell on every push, alongside Go unit and fuzz tests — which is why an 8,700-line terminal core stays shippable ^[24][26].
• Releases get unusual care for a solo project. Signed tags, a human-approved release gate, version-consistency checks across six files, macOS signing and notarization, and a security policy that has handled and credited real vulnerability reports ^[27][29][30].

The main knocks:

• Everything rests on one maintainer. Two people account for 80% of 3,687 commits, and there is no CONTRIBUTING file or contributor documentation to grow a successor — external patches merge in half a day, but nobody else could run this project tomorrow ^[2][35].
• The issue tracker has a fast front door and a full warehouse. First responses land within hours, yet 83% of open issues have sat untouched for six months and no triage automation exists — report a bug and you will be heard quickly, but the long tail is where feature requests go to rest ^[3][44].
• The core concentrates in two giant files. terminal.go carries 8,711 lines at the highest measured complexity and options.go another 4,000; both are well-tested through the public surface, but the wall a new contributor faces sharpens the single-maintainer risk rather than softening it ^[4][2].

Adopt without hesitation — and hope junegunn never gets bored.

skim is the closest Rust drop-in; nucleo embeds the matching algorithm as a library; lf and broot cover the file-navigation niche.