## Summary
- add a default-on Experiments setting to block unsafe npm packages with
Socket Firewall
- wrap shared add-dependency installs in sfw when available and
bootstrap sfw via npm install -g sfw when it is missing
- surface firewall bootstrap warnings through build-mode approvals and
local-agent add_dependency flows, with tests for the new setting and
install path

## Test plan
- npm run fmt && npm run lint:fix && npm run ts
- npm test

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3152"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Will Chen <7344640+wwwillchen@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>