Investigate SHOW command usage and CypherQueryFilter scope

[Copilot]

Addresses review feedback on PR #473 regarding whether SHOW commands should be blocked in CypherQueryFilter and how internal SHOW usage would be affected.

Investigation Results

The codebase uses SHOW CONSTRAINTS in one location:

• tests/phpunit/Persistence/Neo4j/Neo4jConstraintUpdaterTest.php:36

These queries do not go through CypherQueryFilter. The filter only applies to user-provided queries from the {{#cypher:}} parser function in CypherRawParserFunction. Internal queries call runReadQuery() directly on Neo4jQueryStore, bypassing the filter entirely.

Implications

Adding SHOW to the blocked keywords would:

• Block user queries through the parser function
• Leave internal system usage unaffected (no exemption needed)

// CypherRawParserFunction.php - Filter applied here
if ( !$this->queryFilter->isReadQuery( $cypherQuery ) ) {
    return $this->formatError( ... );
}

// Neo4jQueryStore.php - Internal queries bypass filter
public function runReadQuery( string $cypher ): SummarizedResult {
    return $this->readOnlyClient->readTransaction( ... );
}

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.