u/kuaythrone

Five major supply chain attacks in two weeks, including LiteLLM and axios. We install most of these without thinking twice.

We built yoink, an AI agent that removes complex dependencies you only use for a handful of functions, by reimplementing only what you need, so you don't need to worry about supply chain attacks anymore.

Andrej Karpathy recently called for re-evaluating the belief that "dependencies are good". OpenAI's harness engineering article echoed this: agents reason better from reimplemented functionality they have full visibility into than from opaque public libraries.

yoink makes this capability accessible to anyone.

It is a Claude Code plugin with a three-step skill-based workflow:

1. /setup clones the target repo and scaffolds a replacement package.
2. /curate-tests generates tests verified against the original tests' expectation.
3. /decompose determines dependencies to keep or decompose based on principles such as "keeping foundational primitives regardless of how narrow they are used" and implements iteratively using ralph until all tests pass.

We used Claude Code's plugin system as a proxy framework for programming agents for long-horizon tasks while building yoink. They provide the file documentation structure to organise skills, agents, and hooks in a way that systematically directs Claude Code across multi-phase execution steps via progressive disclosure. We built a custom linter to enforce additional documentation standards so it is easier to reason about the interactions between skills and agents. It feels like the principles of type design can help inform future frameworks for multi-phase workflows.

What's next:

• A core benefit of established packages is ongoing maintenance: security patches, bug fixes, and version bumps. The next iteration of yoink will explore how to track upstream changes and update yoinked code accordingly.
• One issue we foresee is fair attribution. With AI coding and the need to internalize dependencies, yoinking will become commonplace, and we will need a new way to attribute references.
• Only Python is supported now, but TypeScript and Rust support are underway.

Our current plugin is nowhere near optimal. Agents occasionally get too eager and run tests they were explicitly instructed not to; agents sometimes wander off-course and start exploring files that have nothing to do with the task.

We are excited to discover better methods to keep agents focused and on track, especially when tasks become longer and more complex.

Five major supply chain attacks in two weeks, including LiteLLM and axios. We install most of these without thinking twice.

We built yoink, an AI agent that removes complex dependencies you only use for a handful of functions, by reimplementing only what you need.

Andrej Karpathy recently called for re-evaluating the belief that "dependencies are good". OpenAI's harness engineering article echoed this: agents reason better from reimplemented functionality they have full visibility into, over opaque third-party libraries.

yoink makes this capability accessible to anyone.

It is a Claude Code plugin with a three-step skill-based workflow:

1. /setup clones the target repo and scaffolds a replacement package.
2. /curate-tests generates tests verified against the original tests' expectation.
3. /decompose determines dependencies to keep or decompose based on principles such as "keeping foundational primitives regardless of how narrow they are used". They are implemented iteratively until all tests pass using ralph.

We used Claude Code's plugin system as a proxy framework for programming agents for long-horizon tasks while building yoink. They provide the file documentation structure to organise skills, agents, and hooks in a way that systematically directs Claude Code across multi-phase execution steps via progressive disclosure.

What's next:

• A core benefit of established packages is ongoing maintenance: security patches, bug fixes, and version bumps. The next iteration of yoink will explore how to track upstream changes and update yoinked code accordingly.
• One issue we foresee is fair attribution. With AI coding and the need to internalize dependencies, yoinking will become commonplace, and we will need a new way to attribute references.
• Only Python is supported now, but support for TypeScript and Rust is already underway.