diff --git a/agent/nodes/thinker.py b/agent/nodes/thinker.py
index 17b9f20..2f48581 100644
--- a/agent/nodes/thinker.py
+++ b/agent/nodes/thinker.py
@@ -63,11 +63,13 @@ You can combine text + code + controls in one response.
                     continue
             return (tool_name, "\n".join(code_lines)) if code_lines else None
 
-        block_match = re.search(r'```(?:python|py|sql|sqlite|sh|bash|tool_code)?\s*\n(.*?)```', text, re.DOTALL)
+        block_match = re.search(r'```(python|py|sql|sqlite|sh|bash|tool_code)?\s*\n(.*?)```', text, re.DOTALL)
         if block_match:
-            code = block_match.group(1).strip()
+            lang = (block_match.group(1) or "").lower()
+            code = block_match.group(2).strip()
             if code and len(code.split("\n")) > 0:
-                if "```sql" in text or "```sqlite" in text or ("SELECT" in code.upper() and "CREATE" in code.upper()):
+                # Only wrap raw SQL blocks — never re-wrap python that happens to contain SQL keywords
+                if lang in ("sql", "sqlite"):
                     wrapped = f'''import sqlite3
 conn = sqlite3.connect("/tmp/cog_db.sqlite")
 cursor = conn.cursor()