Git Repositories as a Module System

Git repositories already handle versioning, identity, and distribution. A new tool called git from turns them into a lightweight module system by letting you pull specific files or directories without downloading the entire repo or using a full package manager. No central registry required. You specify a Git URL, filter paths with --include or --exclude, and copy to a target directory. This solves a common pain: distributing configs, templates, or fixtures without npm, pip, or Cargo overhead.

Package managers excel at dependency graphs with thousands of interconnected crates—npm’s registry hosts over 2 million packages, pip over 500,000—but they demand manifests, publishing workflows, and accounts. For simpler needs like dotfiles, shared test data, or AI agent skills (e.g., Anthropic’s Claude Code prompts), that’s excessive. You end up learning YAML formats and CI pipelines for what amounts to cp -r. Git sidesteps this: every repo has a unique URL as its name, commit hashes or tags for versions, signed commits for authorship verification, and a browsable tree. git from adds selective extraction.

How It Works

Install via Cargo—cargo install git-from—since it’s Rust-based. Basic usage pulls a slice shallowly, without full history:

$ git from https://github.com/anthropics/skills --include skills/skill-creator --target .claude

This clones only the skills/skill-creator directory into .claude. Combine filters for precision: --include "*.yaml" --exclude "docs/*". It respects Git refs like --ref v1.2.3 or branches. Output mirrors the source tree structure under the target.

Source repos can define defaults in a .gitfrom file at the root. This TOML-like config saves CLI flags:

[default]
include = ["configs/*.yaml", "scripts/"]
exclude = ["tests/*"]
perform = "./install.sh"

Consumers run git from <url> to apply defaults, overriding as needed. No new format to learn—it’s just serialized arguments. Publishers signal intent without forcing a rigid schema.

The killer feature is --perform, a post-copy Bash hook. After files land, it runs a command: fix permissions, generate configs, or install deps. Example for a dev environment repo:

$ git from https://git.example.com/dx-team/dev-env \
  --include "research/*" \
  --include "review/*" \
  --perform "./setup.sh"

setup.sh might symlink binaries, chmod +x scripts, or pip install -r requirements.txt. This elevates file copying to a proper install step.

Implications and Trade-offs

This matters for teams distributing internal tools. A security team shares audit scripts: pull only scans/ without exposing sensitive docs. Dotfiles users sync selective configs across machines—git from ~/dotfiles --include .vimrc --target ~. AI devs grab specific prompts from repos like Anthropic’s skills library, avoiding bloat. No registry means no downtime risks like npm’s 2024 outages or PyPI typosquatting attacks (over 100 malicious packages removed last year).

Decentralized by design: anyone publishes via public Git. Version via tags—pin to --ref v2.0. Signed commits add trust; verify with git verify-commit. But skepticism applies. Discoverability suffers—no search like crates.io. No automatic dep resolution; if your slice needs external libs, handle manually. Security risks loom: arbitrary URLs could pull malware. Always use HTTPS, check commit signatures, and audit --perform scripts. Shallow clones mitigate some history attacks, but not foolproof.

Compared to alternatives, it wins on simplicity. Submodules embed full repos (too heavy). Sparse-checkout requires full clone first. Tools like curl | bash lack versioning. For scale, it complements registries: use Cargo for libs, git from for assets. Early days—launched mid-2024 by Anthropic devs—but Rust’s ecosystem suggests longevity. Teams with private GitHub/GitLab already have the infra.

Bottom line: git from strips away package manager ceremony for file-centric distribution. It leverages Git’s ubiquity (1.4 billion repos on GitHub alone) without reinventing wheels. Use it to cut workflow friction, but pair with verification for production. If your “modules” are mostly static files, this decentralizes and lightens your stack.