docs(mcpx): list all eleven direct Go modules, not nine (#1883)

pkgs/mcpx/docs/dependencies.md

@@ -5,7 +5,7 @@ something breaks without it.
 
 ## Go libraries
 
-**Nine**, and `pkgs/mcpx/package.nix` states the trade for each one beside
+**Eleven**, and `pkgs/mcpx/package.nix` states the trade for each one beside
 the `vendorHash` that pays for them.
 
 | module                                     | what it is for                                                                                                                                               |
@@ -14,16 +14,20 @@ the `vendorHash` that pays for them.
 | `github.com/charmbracelet/bubbletea`       | the full-screen browser, `mcpx tui`                                                                                                                          |
 | `github.com/charmbracelet/bubbles`         | its widgets                                                                                                                                                  |
 | `github.com/charmbracelet/lipgloss`        | its layout                                                                                                                                                   |
+| `github.com/mattn/go-runewidth`            | the cell width of a rune, for the browser's columns and truncation: wide East Asian characters, combining marks and emoji take one or two cells, and the arithmetic has to match the terminal rather than the byte count |
 | `gopkg.in/yaml.v3`                         | OpenAPI documents, which are published as YAML as often as JSON, and which one you get is not the caller's choice                                            |
 | `github.com/santhosh-tekuri/jsonschema/v6` | the JSON Schema validator (`internal/schemaval`): tool input/output schemas and elicitation schemas are checked with a real validator, not by hand           |
 | `github.com/tetratelabs/wazero`            | the WebAssembly runtime: wasm tooling and the embeddings worker run without a cgo toolchain                                                                  |
 | `golang.org/x/sys`                         | the OS-specific syscalls the standard library does not expose (peer credentials on the daemon socket, process groups)                                        |
+| `golang.org/x/net`                         | `publicsuffix` and `idna` at the elicitation answer review (`internal/cli/elicit.go`): the registrable domain under a URL about to be answered, plus both host forms and a punycode warning (#1678) |
 | `tailscale.com`                            | the tsnet identity transport (#1967): the daemon embeds a Tailscale node and is reachable by its tailnet identity, still as a pure-Go `CGO_ENABLED=0` binary |
 
 The three `charmbracelet` modules are one decision, not three: they cost about
 1.2 MB in the stripped binary and replace raw terminal handling -- escape
 sequences, resize, a redraw loop -- which is the kind of code that is never
-finished and never correct on every terminal.
+finished and never correct on every terminal. `go-runewidth` is that decision's
+measuring stick: a rune is one or two cells wide, and truncation has to agree
+with the terminal rather than with `len()`.
 
 Everything else -- the MCP client, the JSON-RPC framing, the process pools,
 the JSON Schema to TypeScript compiler, the HTTP API and the CLI -- is

pkgs/mcpx/package.nix

@@ -47,7 +47,7 @@ buildGo127Module {
       !(base == "bin" || base == "result" || lib.hasPrefix "result-" base || base == "mcpx-client.ts");
   };
 
-  # Five direct Go dependencies.
+  # Eleven direct Go dependencies.
   #
   # modernc.org/sqlite backs the log index. It is a pure-Go translation rather
   # than the usual mattn driver, because a cgo driver would make this
@@ -58,11 +58,30 @@ buildGo127Module {
   # 1.2 MB in the stripped binary and replace what would otherwise be raw
   # terminal handling: escape sequences, resize, and a redraw loop. That is
   # the kind of code that is never finished and never correct on every
-  # terminal.
+  # terminal. mattn/go-runewidth supplies the cell arithmetic that browser
+  # needs: wide characters and emoji take two cells, and truncation has to
+  # agree with the terminal.
   #
   # gopkg.in/yaml.v3 reads OpenAPI documents, which are published as YAML as
   # often as JSON and which one you get is not the caller's choice.
   #
+  # santhosh-tekuri/jsonschema/v6 is a real JSON Schema validator for tool
+  # input/output and elicitation schemas, rather than hand-rolled checks.
+  #
+  # tetratelabs/wazero runs wasm tooling and the embeddings worker without a
+  # cgo toolchain, keeping the pure-Go build.
+  #
+  # golang.org/x/sys exposes the OS-specific syscalls the standard library
+  # does not: peer credentials on the daemon socket, and process groups.
+  #
+  # golang.org/x/net carries publicsuffix and idna for the elicitation answer
+  # review: the registrable domain under a URL about to be answered, plus both
+  # host forms and a punycode warning (#1678).
+  #
+  # tailscale.com is the tsnet identity transport (#1967): the daemon embeds a
+  # Tailscale node and is reachable by its tailnet identity, still as a pure-Go
+  # CGO_ENABLED=0 binary.
+  #
   # Everything else -- the MCP client, the process pools, the JSON Schema to
   # TypeScript compiler, the CLI -- is standard library.
   vendorHash = "sha256-S5qXMMhYBghhjqQvzMARYliC9Dtvu+QJBTUsgpLl2TA=";