fix: catch outdated version pins via package-manager CLI

[algomaster99]

Summary

The Bash branch of runHook only caught manifest bypasses that looked like a direct file rewrite (looksLikeManifestWrite: redirects, tee, sed -i, cp/mv, ...). It didn't recognize a package manager's own CLI syntax for pinning an exact version, which writes the manifest just as directly:

• go get module@v1.2.3
• npm install/add/i pkg@1.2.3 (also pnpm/yarn)
• pip/pip3/poetry/uv install/add pkg==1.2.3
• cargo add crate@1.2.3

These commands exited 0 with no outdated-dependency check at all, so Claude could pin a stale version through the CLI and never see it flagged - found while investigating a benchmark rep (go-top-03-go-spew, hook condition) where go get github.com/davecgh/go-spew@v1.1.0 slipped through despite the hook being active.

A bare install/get with no version, or one pinned to a range (pkg@^1.2.3, pkg@latest, pip install pkg>=1.0), is left alone - there's nothing outdated to flag yet, or nothing exact for a resolver to check.

parsePkgManagerPin extracts the ecosystem/name/version out of a matched command, and checkPkgManagerPin resolves that package's actual latest release the same way the Write/Edit path does - reusing pins.Diff - and only blocks when the pin is genuinely outdated, reporting the correct version in the same name current -> latest format Write/Edit already uses. A pin that's already at latest passes through untouched rather than always being redirected to Write/Edit.

Before / after

$ echo '{"tool_name":"Bash","tool_input":{"command":"go get github.com/davecgh/go-spew@v1.1.0"}}' | ./yul
# before: exit 0, silent
# after:
outdated dependency pinned via package manager CLI, use this version instead:
  github.com/davecgh/go-spew  v1.1.0 -> v1.1.1
$ echo $?
2

$ echo '{"tool_name":"Bash","tool_input":{"command":"go get github.com/davecgh/go-spew@v1.1.1"}}' | ./yul
# already latest: exit 0, silent, same as before
$ echo $?
0

🤖 Generated with Claude Code