Crush — Dependencies#

Module info#

  • Module: github.com/charmbracelet/crush
  • Go version: 1.26.2
  • Direct dependencies: 73
  • Indirect dependencies: ~145 (go.sum has 624 lines, ≈312 unique modules at 2 lines each)

Dependency categories#

Core infrastructure#

  • charm.land/bubbletea/v2 v2.0.6 — the TUI event loop; the entire UI is built on BubbleTea’s Elm-like model
  • charm.land/lipgloss/v2 v2.0.3 — terminal styling and layout primitives (borders, colors, flex layout)
  • charm.land/glamour/v2 v2.0.0 — Markdown rendering in the terminal (renders AI responses)
  • charm.land/bubbles/v2 v2.1.0 — reusable TUI components (inputs, viewports, spinners, etc.)
  • charm.land/catwalk v0.38.0 — Charm’s AI model abstraction layer (provider-agnostic model config)
  • charm.land/fang/v2 v2.0.1 — CLI flag/config binding, Charm’s alternative to Viper
  • charm.land/fantasy v0.22.0 — Charm’s theming/palette system used for consistent UI coloring
  • charm.land/log/v2 v2.0.0 — structured logging (wraps slog with Charm styling)
  • github.com/spf13/cobra v1.10.2 — CLI command tree (entry point is a cobra command)
  • github.com/joho/godotenv v1.5.1 — loads .env files on startup (autoloaded via blank import in main.go)
  • github.com/denisbrodbeck/machineid v1.0.1 — stable machine identifier for analytics/telemetry
  • github.com/posthog/posthog-go v1.12.1 — product analytics event tracking (usage telemetry)
  • gopkg.in/natefinch/lumberjack.v2 v2.2.1 — rotating log file support
  • go.uber.org/goleak v1.3.0 — goroutine leak detector (used in tests)

Networking / HTTP#

  • github.com/charmbracelet/openai-go v0.0.0-20260319145158-d0740cc34266 — Charmbracelet’s fork/extension of the OpenAI Go SDK; used for OpenAI, Groq, Ollama, Azure, and other OpenAI-compatible providers
  • github.com/charmbracelet/anthropic-sdk-go v0.0.0-20260223140439-63879b0b8dab (indirect but key) — Charmbracelet’s fork of the Anthropic Go SDK; used for Claude models
  • google.golang.org/genai v1.54.0 (indirect) — Google Generative AI SDK for Gemini
  • github.com/aws/aws-sdk-go-v2 (suite, indirect) — AWS SDK v2 for Amazon Bedrock integration
  • github.com/Azure/azure-sdk-for-go/sdk/azcore (indirect) — Azure SDK core for Azure OpenAI
  • github.com/modelcontextprotocol/go-sdk v1.5.0 — official MCP SDK for tool/resource protocol
  • github.com/sourcegraph/jsonrpc2 v0.2.1 — JSON-RPC 2.0 over pipes/sockets; used for LSP communication
  • github.com/swaggo/http-swagger/v2 v2.0.2 — Swagger UI handler served on the Unix socket REST API
  • github.com/swaggo/swag v1.16.6 — generates OpenAPI spec from Go annotation comments
  • github.com/Microsoft/go-winio v0.6.2 — Windows named pipe support (the Windows equivalent of the Unix socket server)
  • golang.org/x/net v0.53.0 — extended networking (HTTP/2, WebSocket helpers)
  • github.com/gorilla/websocket v1.5.3 (indirect) — WebSocket transport (via MCP or HTTP streaming)
  • google.golang.org/grpc v1.80.0 (indirect) — gRPC used internally by the Google AI SDK

Data / Storage#

  • github.com/ncruces/go-sqlite3 v0.34.0 — CGo-free SQLite3 driver via WASM; primary database backend
  • modernc.org/sqlite v1.50.0 — alternative CGo-free SQLite driver (used as fallback or for different build targets)
  • github.com/pressly/goose/v3 v3.27.1 — database schema migrations (SQL migration files)
  • github.com/tidwall/gjson v1.18.0 — fast JSON path query (reading nested JSON without full unmarshal)
  • github.com/tidwall/sjson v1.2.5 — fast JSON set/delete path operations
  • github.com/qjebbs/go-jsons v1.0.0-alpha.5 — JSON merge/manipulation utilities
  • github.com/invopop/jsonschema v0.14.0 — generates JSON Schema from Go types (used for tool/config schema)
  • gopkg.in/yaml.v3 v3.0.1 — YAML parsing for config files
  • github.com/itchyny/gojq v0.12.19 — pure-Go jq implementation; used for JSON data transformation
  • github.com/go-git/go-git/v5 v5.18.0 — pure-Go Git client; used to read repo metadata, diff, blame

Shell / Process Execution#

  • mvdan.cc/sh/v3 v3.13.1 — pure-Go POSIX shell interpreter; used to run shell tool commands from the AI
  • mvdan.cc/sh/moreinterp v0.0.0-20250902163504-3cf4fd5717a5 — extended shell interpreter (builtins, process control)

Text / Rendering#

  • github.com/JohannesKaufmann/html-to-markdown v1.6.0 — converts HTML to Markdown for AI context extraction
  • github.com/PuerkitoBio/goquery v1.12.0 — jQuery-like HTML scraping (used with html-to-markdown)
  • github.com/alecthomas/chroma/v2 v2.23.1 — syntax highlighting (used by Glamour and diff rendering)
  • github.com/aymanbagabas/go-udiff v0.4.1 — unified diff generation/parsing
  • github.com/dustin/go-humanize v1.0.1 — human-readable sizes, dates, counts in the UI
  • github.com/rivo/uniseg v0.4.7 — Unicode segmentation (cluster-aware string operations in terminal)
  • github.com/clipperhouse/displaywidth v0.11.0 — display width of Unicode strings (terminal alignment)
  • github.com/clipperhouse/uax29/v2 v2.7.0 — Unicode segmentation per UAX #29 (word breaking)
  • github.com/sahilm/fuzzy v0.1.1 — fuzzy string matching (used in file picker / search UI)
  • github.com/yuin/goldmark v1.7.8 (indirect) — Markdown parser underpinning Glamour

Media / Clipboard#

  • github.com/atotto/clipboard v0.1.4 — cross-platform clipboard read/write
  • github.com/aymanbagabas/go-nativeclipboard v0.1.3 — native clipboard using OS-specific APIs
  • github.com/disintegration/imaging v1.6.2 — image resizing/processing (likely for inline image display)
  • github.com/jordanella/go-ansi-paintbrush v0.0.0-20240728195301-b7ad996ecf3d — ANSI art rendering
  • github.com/charmbracelet/ultraviolet v0.0.0-20260416155717-489999b90468 — Charm’s inline image/media library

Utilities#

  • github.com/bmatcuk/doublestar/v4 v4.10.0 — glob pattern matching (used in file include/exclude rules)
  • github.com/charlievieth/fastwalk v1.0.14 — fast concurrent directory walker
  • github.com/google/uuid v1.6.0 — UUID generation for session/workspace IDs
  • github.com/MakeNowJust/heredoc v1.0.0 — heredoc-style string literals for embedded text
  • github.com/nxadm/tail v1.4.11 — file tail (watching log files in real-time)
  • github.com/gen2brain/beeep v0.11.2 — desktop notifications when long tasks complete
  • github.com/zeebo/xxh3 v1.1.0 — fast non-cryptographic hash (content hashing for caching)
  • github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c — open URLs in the default browser
  • charm.land/x/vcr v0.1.1 — HTTP VCR cassette recording (replays HTTP responses in tests)

Testing#

  • github.com/stretchr/testify v1.11.1 — assertion library (assert, require, mock)
  • go.uber.org/goleak v1.3.0 — goroutine leak detection in tests
  • charm.land/x/vcr v0.1.1 — HTTP recording/replaying for integration tests against AI APIs
  • github.com/charmbracelet/x/exp/golden v0.0.0-20250806222409-83e3a29d542f — golden file testing for TUI snapshot tests

Stdlib reliance#

Crush uses stdlib heavily alongside its many third-party deps. Key stdlib packages observed:

  • log/slog — structured logging (the app wraps it with charm.land/log/v2 for styling)
  • database/sql — database interface (used with the SQLite drivers)
  • net/http — HTTP server for the Unix socket REST API
  • context — pervasive context propagation throughout
  • sync — mutexes and WaitGroups for concurrent agent coordination
  • os, io, path/filepath — file system operations

The ratio of stdlib to third-party is moderate: the UI layer is almost entirely third-party (Charm stack), while the internal business logic (agent coordination, shell, session) mixes stdlib and targeted third-party packages.

Shared dependencies#

Dependencies that appear across many of the 50 analyzed projects (connection points for the book):

  • github.com/spf13/cobra — the dominant Go CLI framework, used by ~60%+ of projects in the set
  • gopkg.in/yaml.v3 — near-universal YAML config parsing
  • github.com/stretchr/testify — the de facto test assertion library
  • github.com/google/uuid — ubiquitous for ID generation
  • golang.org/x/sync — extended concurrency primitives (errgroup, etc.)
  • github.com/alecthomas/chroma/v2 — syntax highlighting (also used by Hugo, Gitea, etc.)
  • github.com/go-git/go-git/v5 — pure-Go git (also used by Gitea and others)
  • golang.org/x/net, golang.org/x/sys, golang.org/x/text — extended stdlib, near-universal

What’s unique to Crush / Charmbracelet projects: the charm.land/* domain imports. These are Charm’s private-domain packages (BubbleTea v2, Lipgloss v2, etc.) that are not used by any other project in the 50-project set.

Vendoring#

No vendor/ directory is present. Crush uses the standard Go module proxy. The CGo-free SQLite choices (ncruces/go-sqlite3 via WASM and modernc.org/sqlite) suggest deliberate avoidance of CGo, which aligns with not needing to vendor C sources.

Notable dependency decisions#

  1. Forked Anthropic and OpenAI SDKs instead of upstream: Crush uses charmbracelet/openai-go and charmbracelet/anthropic-sdk-go rather than the official openai/openai-go and anthropic-ai/sdk-go. This is a deliberate fork — likely to add streaming behavior, custom retry logic, or Catwalk model abstraction support. This means Crush can break with upstream SDK changes or lag behind new API features.

  2. Two SQLite drivers simultaneously: Both ncruces/go-sqlite3 (WASM-based) and modernc.org/sqlite (transpiled C) are direct/indirect deps. Both are CGo-free alternatives to the classic mattn/go-sqlite3. The dual presence suggests either build-tag-conditional selection or that one is a transitive dep via a library. Either way, the choice to avoid CGo entirely is principled — it simplifies cross-compilation and removes the C toolchain requirement.

  3. Pure-Go shell interpreter (mvdan.cc/sh): Rather than executing shell commands via os/exec, Crush embeds a full POSIX shell interpreter. This gives the AI agent safe, controlled shell execution with introspection — the agent can parse the shell script before running it, sandbox it, or modify behavior. This is a significant architectural choice that enables safer agentic tool use.

  4. No Viper for configuration: Despite being the dominant config library in the Go ecosystem and used extensively in this project set, Crush uses charm.land/fang/v2 (Charm’s own config/flag binder). This is a conscious ecosystem loyalty decision — keeping config in the Charm stack.

  5. MCP as a first-class protocol dependency: modelcontextprotocol/go-sdk is a direct dep at v1.5.0, not an afterthought. Treating MCP as a first-class infrastructure dependency (alongside LSP) signals that Crush is designed to be a protocol-compliant AI tool ecosystem participant, not just a standalone assistant.

  6. PostHog analytics in a developer tool: posthog/posthog-go for telemetry is notable in a developer tool that likely attracts privacy-conscious users. This is disclosed in the README, but it’s an unusual choice compared to no-analytics peers in the set.

Backward Crush — Structure Crush — Architecture Forward