Categories / junegunn/fzf / evidence
fzf is the de-facto standard interactive fuzzy filter for the Unix pipeline: a single Go binary that turns any line-oriented input into a fast interactive selection UI, plus a mature ecosystem of shell, editor, and multiplexer integrations.
Every file the judge opened, why it chose them, and how much it read. Citations [n] on the audit page resolve here.
| # | Path | Why it was chosen | Mode | Tokens |
|---|---|---|---|---|
| [1] | README.md | first read; purpose, install paths, usage claims | FULL | 10.5k |
| [2] | (recon) | structural map | MAP | 3.4k |
| [3] | (github api) | issue/PR/release/community signals via scripts/health.ts | PROBE | 0.3k |
| [4] | (static analysis) | complexity/churn/dup/CVE/secret/smell battery via scripts/static-review.ts | PROBE | 0.4k |
| [5] | main.go | entry point; embedded shell scripts via go:embed | FULL | 0.6k |
| [6] | src/core.go | central event coordination loop, reload/denylist/revision machinery | FULL | 4.3k |
| [7] | src/matcher.go | parallel scan workers, merger cache, cancel-safe scan | FULL | 1.6k |
| [8] | src/merger.go | k-way merge of per-worker sorted results | FULL | 1.1k |
| [9] | src/chunklist.go | chunked item storage, snapshot semantics, --tail trimming | FULL | 0.9k |
| [10] | src/cache.go | per-chunk query bitmap cache with prefix/suffix search | FULL | 0.5k |
| [11] | src/algo/algo.go | scoring design doc + FuzzyMatchV1/V2 Smith-Waterman variant, slab allocation, ASCII fast path | FULL | 7.1k |
| [12] | src/pattern.go | extended-search term parsing, cacheability rules, direct-algo fast path | FULL | 3.4k |
| [13] | src/reader.go | stdin/command/walker ingestion; symlink-ancestor traversal guard | FULL | 2.4k |
| [14] | src/result.go | rank points, tiebreak criteria, radix sort | FULL | 2.5k |
| [15] | src/ansi.go | hand-rolled ANSI/OSC-8 parser replacing regex for speed | FULL | 3.3k |
| [16] | src/tokenizer.go | nth-expression parsing and awk-style tokenization | FULL | 1.9k |
| [17] | src/server.go | --listen HTTP API; constant-time key compare, size caps | FULL | 1.7k |
| [18] | src/item.go | 56-byte item layout | FULL | 0.4k |
| [19] | src/util/eventbox.go | condvar event coordination primitive | FULL | 0.5k |
| [20] | src/history.go | history file handling, 0600 perms | FULL | 0.5k |
| [21] | src/terminal.go | giant-file corollary: Loop + render loop + preview goroutines (lines 6155-6605) + function map; located via outline and hotspot table | PARTIAL | 3.7k |
| [22] | src/options.go | giant-file corollary: ParseOptions + validateOptions tail (3860-3996) + survey of all 70 parse-error strings via grep | PARTIAL | 1.4k |
| [23] | src/algo/algo_test.go | mandatory test read: scoring assertions incl long-string and normalize edges | FULL | 2.4k |
| [24] | test/lib/common.rb | mandatory test read: tmux e2e harness — 4 shells, mouse SGR simulation, ANSI bg parsing | FULL | 2.7k |
| [25] | test/test_core.rb | e2e coverage style sample (first 300 lines of 2957) | PARTIAL | 2.8k |
| [26] | .github/workflows/linux.yml | mandatory CI read: lint + unit + fuzz + install --all + tmux integration across shells | FULL | 0.4k |
| [27] | .github/workflows/release.yml | mandatory release read: tag-triggered, environment gate, version-consistency checks, signing env | FULL | 0.6k |
| [28] | .goreleaser.yml | release config: multi-platform builds, macOS notarization, deb packages | FULL | 0.8k |
| [29] | RELEASE.md | documented release runbook with signed tags and dry-run path | FULL | 0.4k |
| [30] | SECURITY.md | security reporting policy | FULL | 0.3k |
| [31] | go.mod | direct dependency list, 7 mainstream deps | FULL | 0.1k |
| [32] | CHANGELOG.md | 0.74.x + 0.73.x sections: cadence, security fix credit, contributor attribution | PARTIAL | 1.8k |
| [33] | install | setup-friction path: arg parsing, binary validation, XDG support (first 120 lines) | PARTIAL | 1.0k |
| [34] | .editorconfig, .github/labeler.yml, .github/workflows/linux.yml | probe for setup_friction | PROBE | 0.3k |
| [35] | (no hits) | probe for openness | PROBE | 0.0k |
| [36] | src/algo/algo_test.go | probe for maturity | PROBE | 0.2k |
| [37] | src/terminal.go | probe for maturity | PROBE | 0.2k |
| [38] | src/matcher.go, src/merger.go, src/terminal_test.go, src/util/atexit.go | probe for maturity | PROBE | 0.2k |
| [39] | src/algo/SIMD.md | probe for hype_substance | PROBE | 0.3k |
| [40] | test/test_core.rb | probe for hype_substance | PROBE | 0.1k |
| [41] | plugin/fzf.vim | probe for supply_chain | PROBE | 0.3k |
| [42] | src/functions.go, src/result_x86.go, src/util/chars.go | probe for maturity | PROBE | 0.3k |
| [43] | test/test_layout.rb | probe for ergonomics | PROBE | 0.1k |
| [44] | .goreleaser.yml, .rubocop.yml, BUILD.md, CHANGELOG.md | probe for issue_health | PROBE | 0.5k |
| [45] | src/options.go, src/reader.go, src/terminal.go, src/terminal_test.go | probe for maturity | PROBE | 0.3k |
| 153 files mapped · 25 full, 5 partial · 12 probes answered | 68.6k | |||
Raw signals behind the scores. Source tags: COMPUTED derived from the clone · API GitHub/registry data · JUDGE model estimate
Every judgment on the audit page, mapped to what backs it.
| Claim | Backed by | Kind |
|---|---|---|
| The README speed claim is substantiated: hand-written AVX2/NEON assembly for two-byte search with CI fuzz coverage, slab allocators reused across matcher partitions, and per-chunk query-bitmap caches. | simd-fuzz src-algo src-matcher src-cache | VERIFICATION |
| The e2e suite drives a real tmux terminal across bash, zsh, fish, and Nushell, simulating keystrokes, SGR mouse clicks, and parsing ANSI state — internals are exercised through the public terminal surface. | test-common-rb ci-linux | OBSERVATION |
| Releases are tag-triggered with a human-approved environment gate, version-consistency checks across six files, macOS signing + notarization, and signed tags per the documented runbook. | ci-release goreleaser release-md | VERIFICATION |
| No CONTRIBUTING file or contributor documentation exists anywhere in the repository. | contributing-absent | VERIFICATION |
| 83% of open issues are stale beyond 180 days and no stale-management automation exists, despite a 0.1-day median first response. | health stale-issue-policy | MEASUREMENT |
| Production code contains exactly two panic sites, both unreachable-invariant guards; unsafe usage is confined to six sites of deliberate zero-copy/rank-compare optimization. | panic-usage unsafe-usage | VERIFICATION |
| The install script is exercised on every CI run via './install --all' before the integration suite. | ci-linux | VERIFICATION |
| A recent DoS-class report (O(n^2) HTTP body accumulation in --listen) was fixed and credited to external researchers, consistent with the SECURITY.md process working in practice. | changelog-recent security-md | OBSERVATION |
How much of the repository this audit actually covered, who probably wrote it, and how heavy it is — informational, never part of the grade.
structure mapped: 153/153 files · read in full: 25 · partial: 5 · probes answered: 12
13-year organic commit history with a consistent single-author style
hand-written SIMD assembly and inlined-lowercase micro-optimizations dated to Go 1.4 era comments
design-rationale comment blocks that reference personal file-system measurements