fix: narrow bash manifest-write detection to actual write targets

[algomaster99]

Summary

looksLikeManifestWrite's regex checks only required a known manifest name and a write construct (redirect, tee, sed -i, etc.) to both appear somewhere in the bash command string, not that the write construct's target was actually the manifest. That produced false positives on commands that merely read or mentioned a manifest without writing to it, e.g. a read with a stderr redirect elsewhere in the command, or a manifest named in an unrelated later shell clause than the actual write.

Before / after

# before
$ echo '{"tool_name":"Bash","tool_input":{"command":"cat package.json 2>/dev/null"}}' | ./yul
# exit 2, blocks the read as if it were a write

# after
$ echo '{"tool_name":"Bash","tool_input":{"command":"cat package.json 2>/dev/null"}}' | ./yul
# exit 0, passes through

Change

redirectToManifestRE and writeConstructToManifestRE now require the manifest name to sit at the write construct's own target position, scoped to the same shell clause (stops at ;, &&, ||, |, newlines) so a write in one clause can't match a manifest name that only appears in a different clause.

Added regression cases to TestLooksLikeManifestWrite covering both the false-positive fixes and confirming genuine manifest writes (heredocs, in-place edits, multi-source moves, relative directory prefixes) still block correctly.

🤖 Generated with Claude Code