mrkeyoor.com_
Sun 27 Sept 17:35 UTC
Dev Toolsevaluationupdated 27 Sept 2026

navi review

Navi is a terminal picker for executable cheatsheets. It lets you search a remembered task, fill command arguments from dynamic suggestions, and either run the result or insert it into a shell through a widget.

Verdict

Our navi run installed 97 packages, built in 42 seconds, and passed all 52 tests, making it easy to trial and easy to remove. Use it with cheatsheets you wrote or reviewed, especially as a shell widget that lets you inspect the final command. Do not treat downloaded cheat repositories as passive documentation while the open variable-interpolation injection report is unresolved.

We ran it

Lab card: what happened when we ran naviScreenshot of navi (github.com/denisidoro/navi)
Install✓ · 18s97 packages
Build✓ · 42s
Tests✓ · 19s52 passed · 0 failed of 52 (cargo test)
Repo119 files~4,021 lines of source · 0.3 MB · 3 CI workflows · tests dir

Answers from our run

Does navi build from source?

Dependencies installed in 18 seconds (97 packages), and the build succeeded in 42 seconds. We cloned commit 7389f95 into a clean Debian container with 3 CPUs and no project-specific setup.

Do navi's tests pass?

Yes: 52 of 52 passed when we ran the project's own test command (cargo test). Some failures need services or credentials a bare container does not have.

Who should not use navi?

Anyone who plans to import untrusted cheatsheets casually: cheat entries are executable, and open issue 1037 reports shell injection through unescaped suggested variable values.

What are the alternatives to navi?

tldr pages, cheat, cheat.sh. Our navi run installed 97 packages, built in 42 seconds, and passed all 52 tests, making it easy to trial and easy to remove.

Setup5/518-second install, 42-second build, and all tests passed
Docs5/5Syntax, widgets, scripting, config, and package caveats are covered
Community4/517,657 stars and September 2026 pull request activity
Maturity3/5Stable CLI with 52 passing tests; injection report remains open

Who it’s for

Developers and operators who repeatedly look up long commands but still want to inspect them before use.
Teams willing to maintain a small, reviewed repository of their own command recipes.
Terminal users who want searchable snippets inside Bash, Zsh, Fish, Nushell, PowerShell, or Tmux.
Shell scripters who need reusable command templates with prompted or prefilled variables.

Who it’s NOT for

Anyone who plans to import untrusted cheatsheets casually: cheat entries are executable, and open issue 1037 reports shell injection through unescaped suggested variable values.
Users who only want short, read-only command examples: tldr pages carry less execution risk and need no custom .cheat syntax.
Windows users expecting a zero-config Chocolatey install: the installation guide says to create config.yaml and set the shell command to PowerShell.
People who want selection to be read-only by default: open issue 893 notes that the normal picker executes the chosen snippet, while shell widgets are the documented route for editing first.
Workflows depending on flawless tldr import: open issue 1042 reports a tealdeer integration failure on navi 2.24.0.

Setup reality

Our sandbox installed 97 Rust packages in 18 seconds. The build succeeded in 42 seconds, and Cargo passed all 52 tests in 19 seconds. The checkout was only 0.3 MB, with 119 files and roughly 4,021 lines of source.

Navi needs no account or hosted service. It uses fzf or skim for the picker, reads local .cheat files, and can import repositories or tldr-style material. Homebrew and GitHub release binaries are the two official distribution paths; other packages are community maintained.

Shell integration evaluates generated widget code in your startup file. Cheatsheet variable commands also run to produce suggestions. Review both the tool integration and every imported cheat source, especially while the open variable-escaping report remains unresolved.

Executable cheatsheets replace repeated command lookup

Navi gives a terminal user a searchable list of tasks rather than a directory of prose. Pick "change branch," choose a branch from a generated list, and the stored template becomes a real Git command. A .cheat file can contain tags, descriptions, executable lines, and variable definitions whose own shell commands produce suggestions. This works well for commands that are used often enough to matter but not often enough to memorize.

The tool is compact. Our checkout contained 119 files, roughly 4,021 lines of source, and occupied 0.3 MB before dependencies. It can run as a standalone picker, a Ctrl+G shell widget, a Tmux widget, or a scripting component. The widget path is especially useful because it puts the selected command into normal shell history and lets you edit it before execution. Bash, Zsh, Fish, Nushell, and PowerShell integrations are documented.

Dynamic variables save typing and also run code

A cheat such as git checkout <branch> can populate its argument by running git branch and passing the output through fzf or skim. Variables can depend on other variables, select a column, map displayed values, accept multiple choices, or use preview commands. Cheats can also extend shared contexts and hold multiline snippets. That is enough structure to build a small operations menu without writing a new terminal application.

The same mechanism creates Navi's sharpest risk. Open issue 1037 reports that a selected suggestion is inserted into the command string without shell escaping. The reporter used a crafted filename returned by a suggestion command and caused an extra command to execute. Pull request 1038 proposes escaping variable values, but it was still open on September 27, 2026. Until that lands and is released, a downloaded cheat repository and the data its suggestion commands read both belong inside your trust boundary.

What happened when we ran it

Our unprivileged Debian sandbox installed 97 Rust packages in 18 seconds. The build completed in 42 seconds with no reported compiler failure. Cargo tests then finished in 19 seconds with 52 passed and 0 failed out of 52. The repository has three CI workflow files and a tests directory, while a Dockerfile is absent. A small local terminal binary has little reason to require a container image.

Those results came from commit 7389f95 on 3 CPUs and 12 GB of RAM. They establish that the checked-out Rust project compiled and its available Cargo suite passed in our environment. They do not test every third-party cheatsheet, shell configuration, package-manager build, or command a user might execute. Navi's core can be correct while an imported recipe still deletes the wrong file or interpolates hostile output.

The clean 52-test result makes the base tool a low-effort trial. Installation is available through Homebrew, Cargo, release archives, and several platform package managers. The project only calls Homebrew and GitHub release binaries official; the rest are maintained by their respective communities. Windows users taking the Chocolatey route must create the Navi config file and set the shell command to PowerShell before expecting the documented behavior.

A private cheat repository is the safest useful setup

Navi offers featured repositories, Git imports, tldr conversion, cheat.sh material, and automatic updates. That makes discovery convenient, but auto-updating executable recipes is a stronger act than refreshing documentation. For a team, a better operating model is a pinned internal repository with review on every change. Keep recipes narrow, display dangerous arguments clearly, and use the shell widget when a command deserves one last inspection.

Read-only alternatives remain useful. Tldr pages give short examples for common commands without Navi's executable variable system. cheat emphasizes personal reference sheets and search. Cheat.sh provides wide terminal lookup through a service. Navi earns its place when dynamic local context matters, such as selecting a real branch, container, host, or file from the current machine. If you only need to remember a flag, the executable layer adds risk without much return.

Current code activity is stronger than the release date suggests

GitHub recorded the last push on September 20, 2026, with 17,657 stars, 571 forks, and 111 combined issues and pull requests when fetched. Recent Fish fixes and documentation pull requests show ongoing work, so the January 2025 date on v2.24.0 is not evidence that the project is abandoned. It does mean source changes and the latest tagged binaries are separated by a long interval.

Two open reports deserve attention before standardizing it across a team. Issue 1042 says tldr integration with tealdeer fails on Windows in navi 2.24.0. Issue 893 asks how to select a normal-mode snippet without executing it, reinforcing the practical value of the editable widget flow. With 52 passing tests and a 42-second build, Navi is technically easy to adopt. The real adoption work is deciding which command authors and suggestion sources you are prepared to trust.

Alternatives

ProjectWhat it isPick it when
tldr pages gh↗A community collection of concise examples for command-line programs.pick this instead when you want readable examples without executable variables or a personal recipe format.
cheatA Go command for creating, tagging, searching, and viewing personal cheatsheets.pick this instead when plain reference sheets matter more than an interactive argument picker.
cheat.shA terminal-friendly service that aggregates community command examples.pick this instead when broad lookup coverage matters more than private executable recipes.

What people are saying

  1. [github-trending] denisidoro/navi

Sources

  1. navi repository
  2. navi installation guide
  3. navi cheatsheet syntax
  4. Variable interpolation injection report
  5. tldr integration issue
  6. navi 2.24.0 release

More dev tools reviews

exodium · Submarine · Madeira · mitmproxy · fx · qmk_firmware · the whole board →