[sureshpaulchamy]

With coding agents, npm install can become a side effect of "make the tests pass." That feels like a very different risk model.