Fix Neo4j Cypher injection in BaseBot.write_to_graph

[askmy-stack]

Summary

• property_name was built from self.name via an f-string and interpolated directly into the Cypher query text (Neo4j has no parameterized syntax for property names, only values), so a bot name containing Cypher metacharacters (backticks, braces, semicolons, etc.) could break out of the intended s.<property> position and run arbitrary graph operations.
• All current bot names (runway, pmf, pivot, term, obituary, investor, acqui, accelerator) are hardcoded lowercase words, so this isn't exploitable today, but nothing enforced that invariant — this closes the gap defensively.
• Added a strict identifier allowlist (^[a-z][a-z0-9_]*$) that property_name must match before it's used in the query; raises ValueError instead of running the query if it doesn't.

Test plan

• pytest tests/test_bots -q — 28 passed (includes 8 new tests for write_to_graph).
• New tests cover: the happy path (expected query/params), skipping when neo4j isn't configured, and rejection of several Cypher-injection payloads (backtick/brace breakout, semicolon, embedded space, uppercase, empty string) with no query executed.
• ruff check passes on changed files.
• Note: pytest tests -q has 37 pre-existing failures unrelated to this change (they require a live Postgres connection unavailable in this sandbox); all other tests (175) pass.

Fixes #35

Made with Cursor