[hezelin-work]

Problem

Changes to workspace configuration files did not ask for approval.

Solution

Ask before fsWrite or fsReplace modifies files in the .amazonq, .vscode, or .git folders of the workspace, including the files that links in them and .git files point to, the AmazonQ.md rules file, or the global Amazon Q configuration when the workspace includes it. Memory bank generation can still write its own files.

Behavior change: the agent now asks before editing files such as .vscode/settings.json or AmazonQ.md.

Testing: added unit tests.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[laileni-aws]

Blocking: the memory bank exemption can pre-approve a write outside the workspace

#withMemoryBankFiles adds the resolved memory bank paths to approvedPaths. If .amazonq/rules/memory-bank (or a parent folder) resolves outside the workspace, the outside path is in the approved set. requiresPathAcceptance then returns requiresAcceptance: false, and the outside-of-workspace prompt is skipped. Without this PR, the same write asks for approval.

I checked this on the merge preview (4a1ba797) with a local test that I did not push. The test takes the approved map that the controller builds and calls the real FsWrite.requiresAcceptance. In the test, .amazonq/rules/memory-bank links to a temp folder outside the workspace:

• During memory bank generation: requiresAcceptance: false, and the target is <outside>/product.md.
• The same write without the exemption: requiresAcceptance: true.

Suggested fix: add a memory bank path only when its resolved path is inside the canonical workspace folder (workspaceUtils.isInWorkspace). Otherwise leave it out, so the normal check runs. Please also add a linked-folder test, like the ones in configFileBoundary.test.ts.

Non-blocking: exact-path approval on Windows

approvedPaths?.get(toolName)?.has(canonicalPath) compares the raw path, but addApprovedPath stores paths with / separators. On Windows, the agent asks again on every write to a config file that the user already approved. isPathExactlyApproved from #2952 fixes this, as does the separator normalization in isPathApproved. This PR and #2952 conflict in toolShared.ts and agenticChatController.test.ts, so you can make the change during the rebase.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 97.60000% with 9 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...rc/language-server/agenticChat/tools/toolShared.ts	97.17%	7 Missing and 1 partial ⚠️
...nguage-server/agenticChat/agenticChatController.ts	98.75%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[hezelin-work]

Thanks @laileni-aws — both are addressed.

• Memory bank: a memory bank file is pre-approved only when it resolves to that same file inside the workspace folder, and otherwise the normal check runs. The linked-folder tests are with the other memory bank tests in agenticChatController.test.ts.
• Windows: the config-file check now matches an exact approval regardless of path-separator style, with a test in configFileBoundary.test.ts.

Since your review I also made the memory bank flag per request rather than per session, and the root AmazonQ.md and the global Amazon Q configuration (when the workspace includes it) now prompt as well.