fix: bare except clauses and SQL injection vulnerability

- sql_query.py: Prevent SQL injection via comment/string stripping
  before checking for write keywords, using word boundary regex
- memory_tool.py: Change bare except to except Exception
- setup_sqlite_vec.py: Change bare except to except Exception

pkg/hanzo-tools-database/hanzo_tools/database/memory_tool.py

@@ -378,7 +378,7 @@ memory --action stats
             conn.load_extension("vec0")
             output.append("  ✓ sqlite-vec vector search")
             conn.close()
-        except:
+        except Exception:
             output.append("  ✗ sqlite-vec vector search (not available)")
         
         return "\n".join(output)

pkg/hanzo-tools-database/hanzo_tools/database/sql_query.py

@@ -131,13 +131,19 @@ Note: Use sql_search for text search operations."""
         except Exception as e:
             return f"Error accessing project database: {str(e)}"
 
-        # Check if query is read-only
+        # Check if query is read-only using token-based parsing
         if read_only:
-            # Simple check for write operations
-            write_keywords = ["INSERT", "UPDATE", "DELETE", "DROP", "CREATE", "ALTER"]
-            query_upper = query.upper()
+            import re
+            # Remove comments and string literals to prevent bypass
+            clean_query = re.sub(r'--.*$', '', query, flags=re.MULTILINE)  # Remove -- comments
+            clean_query = re.sub(r'/\*.*?\*/', '', clean_query, flags=re.DOTALL)  # Remove /* */ comments
+            clean_query = re.sub(r"'[^']*'", "''", clean_query)  # Neutralize string literals
+            clean_query = re.sub(r'"[^"]*"', '""', clean_query)  # Neutralize identifiers
+
+            # Check for write operations using word boundaries
+            write_keywords = ["INSERT", "UPDATE", "DELETE", "DROP", "CREATE", "ALTER", "TRUNCATE", "REPLACE"]
             for keyword in write_keywords:
-                if keyword in query_upper:
+                if re.search(rf'\b{keyword}\b', clean_query, re.IGNORECASE):
                     return (
                         f"Error: Query contains {keyword} operation. Set --read-only false to allow write operations."
                     )

pkg/hanzo-tools-database/setup_sqlite_vec.py

@@ -112,8 +112,8 @@ def install_sqlite_vec():
         conn.close()
         print("✓ sqlite-vec extension is already available")
         return True
-    except:
-        pass
+    except Exception:
+        pass  # Extension not available, will download
     
     # Download and install
     extension_path = download_sqlite_vec()