## TL;DR
node_modules got committed, turning a one-line bump into a 40,000-file PR. Remove the directory from git tracking, add it to .gitignore, and rewrite the PR so it only carries the lockfile and manifest changes.

## Error
```text
agent committed node_modules by accident  -  the upgrade PR was 40,000 files
```

## Steps
1. Confirm the scope: check the PR file list for node_modules paths.
   Expected output: The bulk of the diff is node_modules content.
2. Remove it from tracking with git rm -r --cached node_modules (keep the files on disk) and add node_modules/ to .gitignore.
   Expected output: git status no longer lists the directory.
3. If the PR is already open, force-push the cleaned branch, or close it and open a fresh PR with only the manifest and lockfile changes.
   Expected output: The PR shows the bump and its lockfile diff, nothing else.
4. Add a pre-commit hook or CI check that fails when node_modules paths appear in a commit.
   Expected output: The accident cannot repeat silently.
5. Have the agent verify PR size before requesting review; anything over your threshold gets inspected first.
   Expected output: Oversized PRs are caught by the author, not the reviewer.

## When to use
- A PR suddenly contains thousands of unexpected files
- The diff is dominated by node_modules
- You are setting up guardrails for agent-committed changes

## When not to use
- A large diff from a lockfile regeneration; that is expected churn
- Vendored dependencies committed on purpose; that is a policy choice
- Binary asset PRs with legitimately many files

### Variant phrasings
#### upgrade PR has 40000 files all in node_modules
#### node_modules committed to git by accident
#### remove node_modules from a pull request

## Why it happens
The agent ran npm install in a repo without a .gitignore (or with a stale one), then committed everything. Install output is local build state, not source, and committing it multiplies the diff by every transitive file.

## Edge cases
- If node_modules was committed on main long ago, removing it rewrites history for everyone; coordinate the cleanup.
- Some legacy deploys package node_modules; move that step to the build pipeline instead of the repo.
- git rm --cached leaves the directory on disk, so local dev keeps working.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_TsN7P4Y-PejCDZ6-kGLtUA