karpathy-minimalism

技能 4：极简主义与 Agent 原生设计

来源：https://x.com/karpathy/status/2036487306585268612 | https://x.com/karpathy/status/2021694437152157847 litellm 供应链攻击（约 28k 个赞）| 243 行纯 Python GPT（约 25k 个赞）

核心原则

每个依赖都是一项负担。每个你不理解的抽象都是一种风险。

Karpathy 的规则：如果你能用 200 行纯 Python 实现核心功能，就自己实现。别为了 3 个函数安装一个会带来 47 个传递依赖的包。

此外：设计一切时，都要确保 LLM Agent 可以毫无阻碍地使用——CLI 优先、采用 Markdown 结构、没有魔法。

极简主义决策树

在执行任何 pip install 或 npm install 之前：

Q1: Can I implement the core function in < 300 lines?
    → YES: Write it. Paste below as reference.
    → NO: Continue to Q2

Q2: Does this package have < 5 transitive dependencies?
    → YES: OK to use, but pin the version
    → NO: Continue to Q3

Q3: Is this a well-known, audited package (requests, numpy, etc.)?
    → YES: Use it, but still pin version
    → NO: STOP. Either find a simpler alternative or implement yourself.

依赖审查提示词

在向项目添加任何内容之前运行：

Audit this dependency for supply chain risk:

Package: [PACKAGE_NAME] v[VERSION]

1. List ALL transitive dependencies (not just direct)
2. Check for recent security advisories
3. Identify any dependencies that are maintained by a single person with < 100 GitHub stars
4. Check if the package does any network calls on import
5. Check if install scripts run arbitrary code (setup.py, postinstall hooks)

Risk score: LOW / MEDIUM / HIGH
Recommendation: USE / AVOID / IMPLEMENT_YOURSELF

“Yoink” 模式（Karpathy 的说法）

与其安装一个包，不如复制你需要的特定函数：

Given this package: [PACKAGE_URL or PASTE CODE]

Extract ONLY the function(s) I need for: [SPECIFIC_USE_CASE]

Requirements:
- Pure Python (stdlib only, no imports except builtins + [ALLOWED_STDLIB])
- Under [N] lines
- Add a comment: "# yoinked from [source] on [date]"
- Include a docstring explaining what it does

I need: [SPECIFIC_FUNCTION_NAME or DESCRIPTION]

Agent 原生设计原则

让一切都清晰易读，方便 LLM Agent 使用：

❌ 不利于 Agent 使用	✅ Agent 原生
仅支持 GUI 的工具	带有清晰标志的 CLI
带有魔法键的 JSON 配置	带注释的 YAML 或 Markdown 配置
单体函数	小巧、命名清晰、用途单一的函数
错误：“出了点问题”	错误：“第 3 步失败：预期为 X，实际为 Y。尝试：[建议]”
到处使用相对路径	使用明确的绝对路径
有状态的副作用	IO 明确的纯函数

极简实现模板

“Yoink”或从头实现时：

#!/usr/bin/env python3
"""
[FUNCTION_NAME] — minimal implementation
yoinked/inspired from: [SOURCE]
date: [DATE]
dependencies: none (stdlib only)

Usage:
    python3 [filename].py [args]
    
Or import:
    from [filename] import [function]
"""

# ---- core implementation ---- (~100 lines max for core logic)

def [function](input):
    """
    [One sentence description]
    
    Args:
        input: [type and description]
    Returns:
        [type and description]
    """
    # implementation
    pass


# ---- CLI entry point ----
if __name__ == "__main__":
    import sys
    if len(sys.argv) < 2:
        print("Usage: python3 [filename].py [input]")
        sys.exit(1)
    result = [function](sys.argv[1])
    print(result)

243 行 GPT 的启示

Karpathy 用 243 行纯 Python 实现了完整的 GPT 训练和推理，以证明一点：理解核心比使用抽象后的版本更重要。

将此应用于你经常使用的任何工具：

Implement a minimal version of [TOOL/CONCEPT] from scratch.

Requirements:
- Pure Python, stdlib only
- Under 300 lines
- Must demonstrate the core algorithm (not just wrap an API)
- Include inline comments explaining WHY each step works

This is for learning, not production.
Start with the simplest possible working version.

安全卫生检查清单

Before adding any dependency:
- [ ] Checked PyPI/npm for recent security advisories
- [ ] Verified maintainer is active (last commit < 6 months)
- [ ] Reviewed install scripts (setup.py, package.json scripts)
- [ ] Pinned exact version: package==1.2.3 (not ~=1.2)
- [ ] Checked transitive dep count (pip show --files or npm ls --all)
- [ ] Considered: can we implement this in < 200 lines instead?

For existing projects:
- [ ] Run: pip-audit or npm audit
- [ ] Check for packages not in requirements.txt (pip freeze vs requirements diff)
- [ ] Verify no packages make network calls on import

工作流

属于工作流：从想法到上线（第 3 步）

位置	上游	下游
第 3 步（瘦身）	karpathy-agentic-engineering（实现后）	karpathy-supply-chain-hygiene（安全审查）

完整链路：idea-files → agentic-engineering → minimalism → supply-chain-hygiene → vibe-to-agentic

提示词契约

Audit this project/code for dependency minimalism: <PASTE_CODE_OR_DESCRIBE>. For each dependency: 1) Is it needed? What specific feature does it provide? 2) Can it be replaced with < 200 lines of stdlib code? 3) How many transitive deps does it pull in? 4) Risk score (LOW/MED/HIGH). Then produce a minimized version plan: what to keep, what to yoink, what to rewrite. Output a dependency budget: max N packages, each justified.

验证检查清单

• 每个依赖都有存在的理由（不是“方便”）
• 能用 < 200 行实现的依赖已标记为“可 yoink”
• 传递依赖总数在预算范围内
• 核心逻辑不依赖任何可能被移除的包
• Agent 可以在只有标准库的环境中运行核心功能
• CLI 入口简单明了（无需额外工具即可使用）