bug(graph): read-only Cypher validator rejects valid read queries that mention load, set, update or insert as identifiers #1511

utils/cypher_readonly.py:6-23, matched as \bKEYWORD\b at :58

The forbidden-keyword list mixes genuine Cypher write clauses with SQL statements Cypher does not have (INSERT, UPDATE, COPY, TRUNCATE, GRANT, REVOKE, ALTER) and with ordinary words that appear constantly as labels, property keys and aliases (LOAD, SET).

Because matching is \bKEYWORD\b over the whole query, any read query that merely mentions one is rejected:

$ .venv/bin/python -c "
from codegraphcontext.utils.cypher_readonly import is_read_only_cypher as r
for q in ['MATCH (n:Module) RETURN n.load ORDER BY n.load',
          'MATCH (n) WHERE n.update > 5 RETURN n',
          'MATCH (n) RETURN n.name AS set',
          'MATCH (n:Insert) RETURN count(n)']:
    print(f'allowed={r(q)}  {q}')
"
allowed=False  MATCH (n:Module) RETURN n.load ORDER BY n.load
allowed=False  MATCH (n) WHERE n.update > 5 RETURN n
allowed=False  MATCH (n) RETURN n.name AS set
allowed=False  MATCH (n:Insert) RETURN count(n)

All four are read-only. n.load is a plausible property on a Module node; AS set is a plausible alias; Insert is a plausible class name in any codebase that models SQL.

Why it matters

execute_cypher_query is the documented expert fallback for agents that need something the typed tools don't cover. Rejecting valid reads pushes the agent into retry loops with no way to phrase the query that works, and the rejection message names keywords the user never wrote as a clause.

Suggested fix

Match write clauses by position rather than bare word presence — a keyword only starts a write when it appears where a clause can begin, not after a . (property access), not after AS (alias), and not as a label/rel-type. Dropping the SQL-only words (INSERT, UPDATE, TRUNCATE, GRANT, REVOKE) costs nothing, since Cypher has no such statements — though note COPY and ALTER are currently asserted in tests/unit/utils/test_cypher_readonly.py:13-14, so that test encodes the present policy and would need revisiting alongside.

Related: #1233 (audit logging for rejections) would make this class of false rejection visible.

_{Reproduced with the snippet above. Distinct from the literal/comment-ordering bypass fixed in #1508.}