From 4be527a69b4cecc801e23009a63c8d3301b84f2d Mon Sep 17 00:00:00 2001
From: Laxman Reddy <141967714+laileni-aws@users.noreply.github.com>
Date: Tue, 17 Mar 2026 14:53:48 -0700
Subject: [PATCH 01/23] fix: amazon q ignores rules for other os, so adding
 fallback (#2663)

---
 .../context/additionalContextProvider.test.ts | 160 ++++++++++++++++++
 .../context/additionalContextProvider.ts      |  68 +++++++-
 2 files changed, 227 insertions(+), 1 deletion(-)

diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/additionalContextProvider.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/additionalContextProvider.test.ts
index e6742fee1b..c841c994bc 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/additionalContextProvider.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/additionalContextProvider.test.ts
@@ -791,6 +791,166 @@ describe('AdditionalContextProvider', () => {
         })
     })
 
+    describe('filesystem fallback for rules', () => {
+        it('should use filesystem fallback when LocalProjectContextController fails', async () => {
+            const mockWorkspaceFolder = {
+                uri: URI.file('/workspace').toString(),
+                name: 'test',
+            }
+            sinon.stub(workspaceUtils, 'getWorkspaceFolderPaths').returns(['/workspace'])
+            const triggerContext: TriggerContext = {
+                workspaceFolder: mockWorkspaceFolder,
+            }
+
+            // Mock fs.exists to return true for rules directory and the rule file
+            fsExistsStub.callsFake((pathStr: string) => {
+                if (
+                    pathStr.includes(path.join('.amazonq', 'rules')) ||
+                    pathStr === path.join('/workspace', '.amazonq', 'rules', 'my-rule.md')
+                ) {
+                    return Promise.resolve(true)
+                }
+                return Promise.resolve(false)
+            })
+            fsReadDirStub.resolves([{ name: 'my-rule.md', isFile: () => true, isDirectory: () => false }])
+
+            // Make LocalProjectContextController fail (simulating vecLib not available)
+            localProjectContextControllerInstanceStub.restore()
+            sinon.stub(LocalProjectContextController, 'getInstance').rejects(new Error('vecLib not available'))
+
+            // Mock readFile to return rule content
+            const fsReadFileStub = sinon.stub()
+            fsReadFileStub.resolves('Always use TypeScript strict mode')
+            testFeatures.workspace.fs.readFile = fsReadFileStub
+
+            const result = await provider.getAdditionalContext(triggerContext, '')
+
+            // The filesystem fallback should have loaded the rule
+            assert.strictEqual(result.length, 1)
+            assert.strictEqual(result[0].type, 'rule')
+            assert.strictEqual(result[0].innerContext, 'Always use TypeScript strict mode')
+            assert.strictEqual(result[0].name, 'my-rule')
+        })
+
+        it('should use filesystem fallback when getContextCommandPrompt returns empty', async () => {
+            const mockWorkspaceFolder = {
+                uri: URI.file('/workspace').toString(),
+                name: 'test',
+            }
+            sinon.stub(workspaceUtils, 'getWorkspaceFolderPaths').returns(['/workspace'])
+            const triggerContext: TriggerContext = {
+                workspaceFolder: mockWorkspaceFolder,
+            }
+
+            // Mock fs.exists to return true for rules directory and the rule file
+            fsExistsStub.callsFake((pathStr: string) => {
+                if (
+                    pathStr.includes(path.join('.amazonq', 'rules')) ||
+                    pathStr === path.join('/workspace', '.amazonq', 'rules', 'rule1.md')
+                ) {
+                    return Promise.resolve(true)
+                }
+                return Promise.resolve(false)
+            })
+            fsReadDirStub.resolves([{ name: 'rule1.md', isFile: () => true, isDirectory: () => false }])
+
+            // LocalProjectContextController is available but returns empty results
+            // (simulating vecLib initialized but not functioning for context prompts)
+            getContextCommandPromptStub.resolves([])
+
+            // Mock readFile to return rule content via filesystem fallback
+            const fsReadFileStub = sinon.stub()
+            fsReadFileStub.resolves('Follow coding standards')
+            testFeatures.workspace.fs.readFile = fsReadFileStub
+
+            const result = await provider.getAdditionalContext(triggerContext, '')
+
+            // The filesystem fallback should have loaded the rule
+            assert.strictEqual(result.length, 1)
+            assert.strictEqual(result[0].type, 'rule')
+            assert.strictEqual(result[0].innerContext, 'Follow coding standards')
+        })
+
+        it('should NOT use filesystem fallback when getContextCommandPrompt returns results', async () => {
+            const mockWorkspaceFolder = {
+                uri: URI.file('/workspace').toString(),
+                name: 'test',
+            }
+            sinon.stub(workspaceUtils, 'getWorkspaceFolderPaths').returns(['/workspace'])
+            const triggerContext: TriggerContext = {
+                workspaceFolder: mockWorkspaceFolder,
+            }
+
+            fsExistsStub.callsFake((pathStr: string) => {
+                if (pathStr.includes(path.join('.amazonq', 'rules'))) {
+                    return Promise.resolve(true)
+                }
+                return Promise.resolve(false)
+            })
+            fsReadDirStub.resolves([{ name: 'rule1.md', isFile: () => true, isDirectory: () => false }])
+
+            // LocalProjectContextController returns valid results (normal path)
+            getContextCommandPromptStub
+                .onFirstCall()
+                .resolves([])
+                .onSecondCall()
+                .resolves([
+                    {
+                        name: 'Test Rule',
+                        description: 'Test Description',
+                        content: 'Content from indexing library',
+                        filePath: '/workspace/.amazonq/rules/rule1.md',
+                        relativePath: '.amazonq/rules/rule1.md',
+                        startLine: 1,
+                        endLine: 10,
+                    },
+                ])
+
+            // Mock readFile - should NOT be called since indexing library works
+            const fsReadFileStub = sinon.stub()
+            fsReadFileStub.resolves('Content from filesystem')
+            testFeatures.workspace.fs.readFile = fsReadFileStub
+
+            const result = await provider.getAdditionalContext(triggerContext, '')
+
+            assert.strictEqual(result.length, 1)
+            // Should use content from the indexing library, not filesystem
+            assert.strictEqual(result[0].innerContext, 'Content from indexing library')
+        })
+
+        it('should handle filesystem read errors gracefully in fallback', async () => {
+            const mockWorkspaceFolder = {
+                uri: URI.file('/workspace').toString(),
+                name: 'test',
+            }
+            sinon.stub(workspaceUtils, 'getWorkspaceFolderPaths').returns(['/workspace'])
+            const triggerContext: TriggerContext = {
+                workspaceFolder: mockWorkspaceFolder,
+            }
+
+            fsExistsStub.callsFake((pathStr: string) => {
+                if (pathStr.includes(path.join('.amazonq', 'rules'))) {
+                    return Promise.resolve(true)
+                }
+                return Promise.resolve(false)
+            })
+            fsReadDirStub.resolves([{ name: 'rule1.md', isFile: () => true, isDirectory: () => false }])
+
+            // Make LocalProjectContextController fail
+            localProjectContextControllerInstanceStub.restore()
+            sinon.stub(LocalProjectContextController, 'getInstance').rejects(new Error('vecLib not available'))
+
+            // Make readFile fail too
+            const fsReadFileStub = sinon.stub()
+            fsReadFileStub.rejects(new Error('Permission denied'))
+            testFeatures.workspace.fs.readFile = fsReadFileStub
+
+            // Should not throw, just return empty results
+            const result = await provider.getAdditionalContext(triggerContext, '')
+            assert.strictEqual(result.length, 0)
+        })
+    })
+
     describe('convertRulesToRulesFolders', () => {
         it('should convert workspace rules to folders structure', () => {
             sinon.stub(workspaceUtils, 'getWorkspaceFolderPaths').returns(['/workspace'])
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/additionalContextProvider.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/additionalContextProvider.ts
index 163dce921d..95370fb402 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/additionalContextProvider.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/additionalContextProvider.ts
@@ -107,6 +107,60 @@ export class AdditionalContextProvider {
             }
         }
     }
+    /**
+     * Filesystem fallback for reading context command prompts when the local indexing library
+     * (vecLib) is not available. Reads file contents directly from the filesystem.
+     *
+     * This ensures that rules in .amazonq/rules, README.md, AmazonQ.md, and other context files
+     * are still loaded even when the indexing library fails to initialize (e.g., in certain
+     * remote development environments like Red Hat OpenShift Dev Spaces).
+     *
+     * @param contextCommandItems The context command items to read content for
+     * @returns Array of AdditionalContextPrompt with file contents read from disk
+     */
+    private async readContextCommandPromptsFromFilesystem(
+        contextCommandItems: ContextCommandItem[]
+    ): Promise<AdditionalContextPrompt[]> {
+        const prompts: AdditionalContextPrompt[] = []
+
+        for (const item of contextCommandItems) {
+            try {
+                // The item.id contains the full file path for workspace rules
+                const filePath = item.id
+                if (!filePath) {
+                    continue
+                }
+
+                const fileExists = await this.features.workspace.fs.exists(filePath)
+                if (!fileExists) {
+                    continue
+                }
+
+                const content = await this.features.workspace.fs.readFile(filePath, { encoding: 'utf-8' })
+                const fileName = path.basename(filePath, promptFileExtension)
+
+                prompts.push({
+                    filePath: filePath,
+                    relativePath: item.relativePath,
+                    content: content,
+                    name: fileName,
+                    description: '',
+                    startLine: -1,
+                    endLine: -1,
+                })
+            } catch (error) {
+                this.features.logging.warn(`Failed to read context file from filesystem: ${item.id}: ${error}`)
+            }
+        }
+
+        if (prompts.length > 0) {
+            this.features.logging.info(
+                `Filesystem fallback: successfully loaded ${prompts.length} context file(s) directly from disk`
+            )
+        }
+
+        return prompts
+    }
 
     /**
      * Resolves a resource URI (file://relative or file:///absolute) against a workspace folder.
@@ -484,7 +538,19 @@ export class AdditionalContextProvider {
             promptContextPrompts = await localProjectContextController.getContextCommandPrompt(promptContextCommands)
             pinnedContextPrompts = await localProjectContextController.getContextCommandPrompt(pinnedContextCommands)
         } catch (error) {
-            // do nothing
+            this.features.logging.info(
+                `LocalProjectContextController unavailable, using filesystem fallback for context: ${error}`
+            )
+        }
+
+        // Filesystem fallback: if LocalProjectContextController returned empty results but we have
+        // context commands to process, read the file contents directly from the filesystem.
+        // This handles environments where the local indexing library (vecLib) is not available.
+        if (promptContextPrompts.length === 0 && promptContextCommands.length > 0) {
+            promptContextPrompts = await this.readContextCommandPromptsFromFilesystem(promptContextCommands)
+        }
+        if (pinnedContextPrompts.length === 0 && pinnedContextCommands.length > 0) {
+            pinnedContextPrompts = await this.readContextCommandPromptsFromFilesystem(pinnedContextCommands)
         }
 
         const contextEntry: AdditionalContentEntryAddition[] = []

From 7d71d0a38d1e9adbb29210fff1c2b6b5e6d7d120 Mon Sep 17 00:00:00 2001
From: chungjac <chungjac@amazon.com>
Date: Tue, 17 Mar 2026 15:35:36 -0700
Subject: [PATCH 02/23] feat: add cwsprChatHasWorkspaceContext metric to
 amazonq_addMessage event (#2665) (#2668)

Add a dedicated boolean metric to distinguish @workspace usage from
regular folder context in telemetry. Previously both were counted
under cwsprChatFolderContextCount with no way to differentiate.

The metric is true when the user uses @workspace (inline or pinned),
false otherwise. Wired through the existing triggerContext.hasWorkspace
flag into the telemetry pipeline.

Co-authored-by: aws-toolkit-automation <43144436+aws-toolkit-automation@users.noreply.github.com>
---
 .../src/language-server/agenticChat/agenticChatController.ts    | 1 +
 .../language-server/chat/telemetry/chatTelemetryController.ts   | 1 +
 .../src/shared/telemetry/telemetryService.test.ts               | 2 ++
 .../src/shared/telemetry/telemetryService.ts                    | 2 ++
 server/aws-lsp-codewhisperer/src/shared/telemetry/types.ts      | 1 +
 5 files changed, 7 insertions(+)

diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
index 0cc836fe5b..139410933a 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
@@ -3535,6 +3535,7 @@ export class AgenticChatController implements ChatHandlers {
         if (triggerContext.contextInfo) {
             metric.mergeWith({
                 cwsprChatHasContextList: triggerContext.documentReference?.filePaths?.length ? true : false,
+                cwsprChatHasWorkspaceContext: triggerContext.hasWorkspace ?? false,
                 cwsprChatFolderContextCount: triggerContext.contextInfo.contextCount.folderContextCount,
                 cwsprChatFileContextCount: triggerContext.contextInfo.contextCount.fileContextCount,
                 cwsprChatRuleContextCount: triggerContext.contextInfo.contextCount.activeRuleContextCount,
diff --git a/server/aws-lsp-codewhisperer/src/language-server/chat/telemetry/chatTelemetryController.ts b/server/aws-lsp-codewhisperer/src/language-server/chat/telemetry/chatTelemetryController.ts
index 5209e0f6e1..b86c51e448 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/chat/telemetry/chatTelemetryController.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/chat/telemetry/chatTelemetryController.ts
@@ -338,6 +338,7 @@ export class ChatTelemetryController {
                 chatConversationType: metric.cwsprChatConversationType,
                 chatActiveEditorImportCount: metric.cwsprChatActiveEditorImportCount,
                 cwsprChatHasContextList: metric.cwsprChatHasContextList,
+                cwsprChatHasWorkspaceContext: metric.cwsprChatHasWorkspaceContext,
                 cwsprChatFolderContextCount: metric.cwsprChatFolderContextCount,
                 cwsprChatFileContextCount: metric.cwsprChatFileContextCount,
                 cwsprChatRuleContextCount: metric.cwsprChatRuleContextCount,
diff --git a/server/aws-lsp-codewhisperer/src/shared/telemetry/telemetryService.test.ts b/server/aws-lsp-codewhisperer/src/shared/telemetry/telemetryService.test.ts
index 32536f73fd..66f81af680 100644
--- a/server/aws-lsp-codewhisperer/src/shared/telemetry/telemetryService.test.ts
+++ b/server/aws-lsp-codewhisperer/src/shared/telemetry/telemetryService.test.ts
@@ -775,6 +775,7 @@ describe('TelemetryService', () => {
                 },
                 {
                     cwsprChatHasContextList: true,
+                    cwsprChatHasWorkspaceContext: false,
                     cwsprChatFolderContextCount: 0,
                     cwsprChatFileContextCount: 0,
                     cwsprChatRuleContextCount: 0,
@@ -844,6 +845,7 @@ describe('TelemetryService', () => {
                     experimentName: undefined,
                     userVariation: undefined,
                     cwsprChatHasContextList: true,
+                    cwsprChatHasWorkspaceContext: false,
                     cwsprChatFolderContextCount: 0,
                     cwsprChatFileContextCount: 0,
                     cwsprChatRuleContextCount: 0,
diff --git a/server/aws-lsp-codewhisperer/src/shared/telemetry/telemetryService.ts b/server/aws-lsp-codewhisperer/src/shared/telemetry/telemetryService.ts
index 861333d302..f7c93b6f14 100644
--- a/server/aws-lsp-codewhisperer/src/shared/telemetry/telemetryService.ts
+++ b/server/aws-lsp-codewhisperer/src/shared/telemetry/telemetryService.ts
@@ -563,6 +563,7 @@ export class TelemetryService {
             chatConversationType: ChatConversationType
             chatActiveEditorImportCount?: number
             cwsprChatHasContextList: boolean
+            cwsprChatHasWorkspaceContext?: boolean
             cwsprChatFolderContextCount: number
             cwsprChatFileContextCount: number
             cwsprChatFileContextLength: number
@@ -616,6 +617,7 @@ export class TelemetryService {
                     cwsprChatActiveEditorImportCount: additionalParams.chatActiveEditorImportCount,
                     codewhispererCustomizationArn: params.customizationArn,
                     cwsprChatHasContextList: additionalParams.cwsprChatHasContextList,
+                    cwsprChatHasWorkspaceContext: additionalParams.cwsprChatHasWorkspaceContext,
                     cwsprChatFolderContextCount: additionalParams.cwsprChatFolderContextCount,
                     cwsprChatFileContextCount: additionalParams.cwsprChatFileContextCount,
                     cwsprChatRuleContextCount: additionalParams.cwsprChatRuleContextCount,
diff --git a/server/aws-lsp-codewhisperer/src/shared/telemetry/types.ts b/server/aws-lsp-codewhisperer/src/shared/telemetry/types.ts
index 743842aef1..3429d4a898 100644
--- a/server/aws-lsp-codewhisperer/src/shared/telemetry/types.ts
+++ b/server/aws-lsp-codewhisperer/src/shared/telemetry/types.ts
@@ -319,6 +319,7 @@ export type AddMessageEvent = {
 
     // context related metrics
     cwsprChatHasContextList?: boolean
+    cwsprChatHasWorkspaceContext?: boolean
     cwsprChatFolderContextCount?: number
     cwsprChatFileContextCount?: number
     cwsprChatFileContextLength?: number

From 73b27f13911a8a8ee652567b1f8e19ecd0a880b2 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 17 Mar 2026 15:47:40 -0700
Subject: [PATCH 03/23] chore(release): release packages from branch main
 (#2657)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 .release-please-manifest.json             |  2 +-
 package-lock.json                         |  2 +-
 server/aws-lsp-codewhisperer/CHANGELOG.md | 14 ++++++++++++++
 server/aws-lsp-codewhisperer/package.json |  2 +-
 4 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index ea80eec3eb..62c154cd04 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -2,7 +2,7 @@
     "chat-client": "0.1.50",
     "core/aws-lsp-core": "0.0.21",
     "server/aws-lsp-antlr4": "0.1.25",
-    "server/aws-lsp-codewhisperer": "0.0.109",
+    "server/aws-lsp-codewhisperer": "0.0.110",
     "server/aws-lsp-json": "0.1.26",
     "server/aws-lsp-partiql": "0.0.23",
     "server/aws-lsp-yaml": "0.1.26"
diff --git a/package-lock.json b/package-lock.json
index 6176bf64f9..92ff66e849 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -31062,7 +31062,7 @@
         },
         "server/aws-lsp-codewhisperer": {
             "name": "@aws/lsp-codewhisperer",
-            "version": "0.0.109",
+            "version": "0.0.110",
             "bundleDependencies": [
                 "@amzn/codewhisperer",
                 "@amzn/codewhisperer-runtime",
diff --git a/server/aws-lsp-codewhisperer/CHANGELOG.md b/server/aws-lsp-codewhisperer/CHANGELOG.md
index bb58ee808b..a4d8f32f16 100644
--- a/server/aws-lsp-codewhisperer/CHANGELOG.md
+++ b/server/aws-lsp-codewhisperer/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.0.110](https://github.com/aws/language-servers/compare/lsp-codewhisperer/v0.0.109...lsp-codewhisperer/v0.0.110) (2026-03-17)
+
+
+### Features
+
+* add cwsprChatHasWorkspaceContext metric to amazonq_addMessage event ([#2665](https://github.com/aws/language-servers/issues/2665)) ([#2668](https://github.com/aws/language-servers/issues/2668)) ([7d71d0a](https://github.com/aws/language-servers/commit/7d71d0a38d1e9adbb29210fff1c2b6b5e6d7d120))
+
+
+### Bug Fixes
+
+* amazon q ignores rules for other os, so adding fallback ([#2663](https://github.com/aws/language-servers/issues/2663)) ([4be527a](https://github.com/aws/language-servers/commit/4be527a69b4cecc801e23009a63c8d3301b84f2d))
+* deduplicate rules in multi workspace mode ([#2660](https://github.com/aws/language-servers/issues/2660)) ([c8022fe](https://github.com/aws/language-servers/commit/c8022feb7637c64f71330856ecb3cb96096dccb7))
+* rules created in default file is not working ([#2652](https://github.com/aws/language-servers/issues/2652)) ([#2655](https://github.com/aws/language-servers/issues/2655)) ([b380e97](https://github.com/aws/language-servers/commit/b380e97051251a0ead0a7bc3314f8850f14073ac))
+
 ## [0.0.109](https://github.com/aws/language-servers/compare/lsp-codewhisperer/v0.0.108...lsp-codewhisperer/v0.0.109) (2026-03-10)
 
 
diff --git a/server/aws-lsp-codewhisperer/package.json b/server/aws-lsp-codewhisperer/package.json
index 73f302b005..5fd0e3119e 100644
--- a/server/aws-lsp-codewhisperer/package.json
+++ b/server/aws-lsp-codewhisperer/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@aws/lsp-codewhisperer",
-    "version": "0.0.109",
+    "version": "0.0.110",
     "description": "CodeWhisperer Language Server",
     "main": "out/index.js",
     "repository": {

From 35174fd2996e2fe34a51cffc2c7b70425cdd8133 Mon Sep 17 00:00:00 2001
From: invictus <149003065+ashishrp-aws@users.noreply.github.com>
Date: Wed, 18 Mar 2026 16:07:13 -0700
Subject: [PATCH 04/23] chore: bump agentic version: 1.62.0 (#2671)

Co-authored-by: aws-toolkit-automation <>
---
 app/aws-lsp-codewhisperer-runtimes/src/version.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/aws-lsp-codewhisperer-runtimes/src/version.json b/app/aws-lsp-codewhisperer-runtimes/src/version.json
index b7720c4d41..d93890028e 100644
--- a/app/aws-lsp-codewhisperer-runtimes/src/version.json
+++ b/app/aws-lsp-codewhisperer-runtimes/src/version.json
@@ -1,3 +1,3 @@
 {
-    "agenticChat": "1.61.0"
+    "agenticChat": "1.62.0"
 }

From d26edb7dfd321122515373e0d08b757f6e367561 Mon Sep 17 00:00:00 2001
From: Will Lo <96078566+Will-ShaoHua@users.noreply.github.com>
Date: Fri, 27 Mar 2026 14:25:50 -0700
Subject: [PATCH 05/23] fix: cache subscription status to prevent excessive
 CreateSubscriptionToken API calls (#2680)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: cache subscription status to prevent excessive CreateSubscriptionToken API calls

setPaidTierMode() was calling getSubscriptionStatus() (which invokes
CreateSubscriptionToken) on every tab add and tab change event, even
though the subscription status rarely changes during a session.

With the upcoming Kiro/Stripe integration requiring a lower throttle
limit (0.25 TPS), these redundant calls would cause both unnecessary
and legitimate requests to be throttled.

Now, when setPaidTierMode() is called without an explicit mode, it
reuses the cached #paidTierMode if already known, and only calls the
API on the first invocation when the status is still unknown.

Resolves: V1880021966

* test: add test

* fix: deduplicate concurrent getSubscriptionStatus calls with a stored promise

The previous cache only helped after the first getSubscriptionStatus()
resolved. If multiple tabs opened before that promise settled, each would
see #paidTierMode as falsy and fire its own API call — the burst this fix
is meant to prevent.

Store the in-flight promise in #subscriptionStatusPromise so all concurrent
setPaidTierMode(!mode) callers attach to the same request. The promise is
cleared on error (allowing a retry) and alongside #paidTierMode on
configuration updates.

Also adds a test that verifies 5 rapid tab-adds result in only one API call.
---
 .../agenticChat/agenticChatController.test.ts | 70 +++++++++++++++++++
 .../agenticChat/agenticChatController.ts      | 65 ++++++++++-------
 2 files changed, 110 insertions(+), 25 deletions(-)

diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.test.ts
index 2cc7a2903e..fe32f4402c 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.test.ts
@@ -389,6 +389,76 @@ describe('AgenticChatController', () => {
         sinon.assert.calledTwice(emitConversationMetricStub)
     })
 
+    describe('setPaidTierMode caching', () => {
+        let getCodewhispererServiceStub: sinon.SinonStub
+        let getSubscriptionStatusStub: sinon.SinonStub
+
+        beforeEach(() => {
+            getSubscriptionStatusStub = sinon.stub().resolves({ status: 'none' })
+            getCodewhispererServiceStub = sinon
+                .stub(AmazonQTokenServiceManager.prototype, 'getCodewhispererService')
+                .returns({ getSubscriptionStatus: getSubscriptionStatusStub } as any)
+        })
+
+        afterEach(() => {
+            getCodewhispererServiceStub.restore()
+        })
+
+        it('calls getSubscriptionStatus on first tab add', async () => {
+            chatController.onTabAdd({ tabId: mockTabId })
+            // Allow the async getSubscriptionStatus call to resolve
+            await new Promise(resolve => setTimeout(resolve, 0))
+            sinon.assert.calledOnce(getSubscriptionStatusStub)
+        })
+
+        it('does not call getSubscriptionStatus on subsequent tab adds after status is cached', async () => {
+            chatController.onTabAdd({ tabId: mockTabId })
+            await new Promise(resolve => setTimeout(resolve, 0))
+            sinon.assert.calledOnce(getSubscriptionStatusStub)
+
+            getSubscriptionStatusStub.resetHistory()
+            chatController.onTabAdd({ tabId: 'tab-2' })
+            await new Promise(resolve => setTimeout(resolve, 0))
+            sinon.assert.notCalled(getSubscriptionStatusStub)
+        })
+
+        it('does not call getSubscriptionStatus on tab change after status is cached', async () => {
+            chatController.onTabAdd({ tabId: mockTabId })
+            await new Promise(resolve => setTimeout(resolve, 0))
+            sinon.assert.calledOnce(getSubscriptionStatusStub)
+
+            getSubscriptionStatusStub.resetHistory()
+            chatController.onTabChange({ tabId: mockTabId })
+            await new Promise(resolve => setTimeout(resolve, 0))
+            sinon.assert.notCalled(getSubscriptionStatusStub)
+        })
+
+        it('caches paidtier status when subscription is active', async () => {
+            getSubscriptionStatusStub.resolves({ status: 'active' })
+            chatController.onTabAdd({ tabId: mockTabId })
+            await new Promise(resolve => setTimeout(resolve, 0))
+
+            getSubscriptionStatusStub.resetHistory()
+            chatController.onTabAdd({ tabId: 'tab-2' })
+            await new Promise(resolve => setTimeout(resolve, 0))
+            sinon.assert.notCalled(getSubscriptionStatusStub)
+        })
+
+        it('deduplicates concurrent calls: multiple tabs opened before the first promise settles fire only one API call', async () => {
+            // Fire 5 tab-adds synchronously before the promise resolves.
+            chatController.onTabAdd({ tabId: 'tab-1' })
+            chatController.onTabAdd({ tabId: 'tab-2' })
+            chatController.onTabAdd({ tabId: 'tab-3' })
+            chatController.onTabAdd({ tabId: 'tab-4' })
+            chatController.onTabAdd({ tabId: 'tab-5' })
+
+            // Let all pending microtasks/macrotasks settle.
+            await new Promise(resolve => setTimeout(resolve, 0))
+
+            sinon.assert.calledOnce(getSubscriptionStatusStub)
+        })
+    })
+
     it('onTabRemove unsets tab id if current tab is removed and emits metrics', () => {
         chatController.onTabAdd({ tabId: mockTabId })
 
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
index 139410933a..fa122fc0bb 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
@@ -278,6 +278,7 @@ export class AgenticChatController implements ChatHandlers {
     #toolUseLatencies: Array<{ toolName: string; toolUseId: string; latency: number }> = []
     #mcpEventHandler: McpEventHandler
     #paidTierMode: PaidTierMode | undefined
+    #subscriptionStatusPromise: Promise<void> | undefined
     #origin: Origin
     #activeUserTracker: ActiveUserTracker
 
@@ -4261,31 +4262,44 @@ export class AgenticChatController implements ChatHandlers {
         } else if (mode === 'freetier-limit' && mode !== this.#paidTierMode) {
             this.showFreeTierLimitMsgOnClient(tabId)
         } else if (!mode) {
-            // Note: intentionally async.
-            this.#serviceManager
-                ?.getCodewhispererService()
-                .getSubscriptionStatus(true)
-                .then(o => {
-                    this.#log(`setPaidTierMode: getSubscriptionStatus: ${o.status} ${o.encodedVerificationUrl}`)
-                    this.setPaidTierMode(tabId, o.status !== 'none' ? 'paidtier' : 'freetier')
-                })
-                .catch(err => {
-                    this.#log(`setPaidTierMode: getSubscriptionStatus failed: ${(err as Error).message}`)
-                    const isAccessDenied = (err as Error).name === 'AccessDeniedException'
-                    const message = isAccessDenied
-                        ? `To increase your limit, subscribe to a Kiro subscription. Choose the right [plan](https://kiro.dev/pricing/) and log in to [app.kiro.dev](https://app.kiro.dev/signin), pick the plan, and once active, you should be able to continue and use Q and Kiro services with the new limits. If you have questions, refer to our [FAQs](https://aws.amazon.com/q/developer/faqs/?p=qdev&z=subnav&loc=8#general)`
-                        : `setPaidTierMode: getSubscriptionStatus failed: ${fmtError(err)}`
-                    this.#features.lsp.window
-                        .showMessage({
-                            message,
-                            type: MessageType.Error,
-                        })
-                        .catch(e => {
-                            this.#log(`setPaidTierMode: showMessage failed: ${(e as Error).message}`)
-                        })
-                })
-            // mode = isFreeTierUser ? 'freetier' : 'paidtier'
-            return
+            // Use cached status if already known, to avoid excessive CreateSubscriptionToken calls.
+            if (this.#paidTierMode) {
+                mode = this.#paidTierMode
+            } else {
+                // Deduplicate in-flight requests: if a getSubscriptionStatus call is already
+                // in progress (e.g. multiple tabs opened before the first promise settles),
+                // reuse the same promise instead of firing additional API calls.
+                if (!this.#subscriptionStatusPromise) {
+                    this.#subscriptionStatusPromise =
+                        this.#serviceManager
+                            ?.getCodewhispererService()
+                            .getSubscriptionStatus(true)
+                            .then(o => {
+                                this.#log(
+                                    `setPaidTierMode: getSubscriptionStatus: ${o.status} ${o.encodedVerificationUrl}`
+                                )
+                                this.setPaidTierMode(tabId, o.status !== 'none' ? 'paidtier' : 'freetier')
+                            })
+                            .catch(err => {
+                                // Clear the promise so the next call can retry.
+                                this.#subscriptionStatusPromise = undefined
+                                this.#log(`setPaidTierMode: getSubscriptionStatus failed: ${(err as Error).message}`)
+                                const isAccessDenied = (err as Error).name === 'AccessDeniedException'
+                                const message = isAccessDenied
+                                    ? `To increase your limit, subscribe to a Kiro subscription. Choose the right [plan](https://kiro.dev/pricing/) and log in to [app.kiro.dev](https://app.kiro.dev/signin), pick the plan, and once active, you should be able to continue and use Q and Kiro services with the new limits. If you have questions, refer to our [FAQs](https://aws.amazon.com/q/developer/faqs/?p=qdev&z=subnav&loc=8#general)`
+                                    : `setPaidTierMode: getSubscriptionStatus failed: ${fmtError(err)}`
+                                this.#features.lsp.window
+                                    .showMessage({
+                                        message,
+                                        type: MessageType.Error,
+                                    })
+                                    .catch(e => {
+                                        this.#log(`setPaidTierMode: showMessage failed: ${(e as Error).message}`)
+                                    })
+                            }) ?? Promise.resolve()
+                }
+                return
+            }
         }
 
         this.#paidTierMode = mode
@@ -4764,6 +4778,7 @@ export class AgenticChatController implements ChatHandlers {
 
         // Force a service request to get current Q user subscription status.
         this.#paidTierMode = undefined
+        this.#subscriptionStatusPromise = undefined
     }
 
     #getTools(session: ChatSessionService) {

From 4ff5ab0e6ab4bf1659ffdb07a72bba4d6c358339 Mon Sep 17 00:00:00 2001
From: invictus <149003065+ashishrp-aws@users.noreply.github.com>
Date: Sun, 29 Mar 2026 22:51:47 -0700
Subject: [PATCH 06/23] feat(amazonq): align mcp oauth client with mcp sdk auth
 patterns (#2679)

* feat(amazonq): align mcp oauth client with mcp sdk auth patterns

* fix(amazonq): log errors in OAuth discovery catch blocks instead of silently swallowing
---
 .../tools/mcp/mcpOauthClient.test.ts          | 422 +++++++++++++++++-
 .../agenticChat/tools/mcp/mcpOauthClient.ts   | 310 ++++++++-----
 2 files changed, 618 insertions(+), 114 deletions(-)

diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpOauthClient.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpOauthClient.test.ts
index ea711319a5..75b24cf8b1 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpOauthClient.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpOauthClient.test.ts
@@ -31,6 +31,7 @@ const fakeWorkspace = {
         readFile: async (_path: string) => Buffer.from('{}'),
         writeFile: async (_path: string, _d: any) => {},
         mkdir: async (_dir: string, _opts: any) => {},
+        rm: async (_path: string) => {},
     },
 } as any
 
@@ -63,7 +64,6 @@ function stubHttpServer(): void {
         ;(srv as any).address = () => ({ address: '127.0.0.1', port: 12345, family: 'IPv4' })
         ;(srv as any).listen = (_port?: any, _host?: any, _backlog?: any, cb?: any) => {
             if (typeof cb === 'function') cb()
-            // simulate async readiness like a real server
             process.nextTick(() => srv.emit('listening'))
             return srv
         }
@@ -94,6 +94,330 @@ describe('OAuthClient helpers', () => {
     })
 })
 
+describe('OAuthClient.selectAuthMethod()', () => {
+    const selectAuthMethod = (reg: any, meta?: any) => (OAuthClient as any).selectAuthMethod(reg, meta)
+
+    it('prefers token_endpoint_auth_method from DCR when no server-supported list', () => {
+        const reg = { client_id: 'c', client_secret: 's', token_endpoint_auth_method: 'client_secret_basic' }
+        expect(selectAuthMethod(reg)).to.equal('client_secret_basic')
+    })
+
+    it('prefers token_endpoint_auth_method from DCR when it is in server-supported list', () => {
+        const reg = { client_id: 'c', client_secret: 's', token_endpoint_auth_method: 'client_secret_post' }
+        const meta = { token_endpoint_auth_methods_supported: ['client_secret_post', 'client_secret_basic'] }
+        expect(selectAuthMethod(reg, meta)).to.equal('client_secret_post')
+    })
+
+    it('ignores DCR method when not in server-supported list, picks best supported', () => {
+        const reg = { client_id: 'c', client_secret: 's', token_endpoint_auth_method: 'none' }
+        const meta = { token_endpoint_auth_methods_supported: ['client_secret_basic'] }
+        expect(selectAuthMethod(reg, meta)).to.equal('client_secret_basic')
+    })
+
+    it('picks client_secret_basic over client_secret_post when both supported', () => {
+        const reg = { client_id: 'c', client_secret: 's' }
+        const meta = { token_endpoint_auth_methods_supported: ['client_secret_post', 'client_secret_basic'] }
+        expect(selectAuthMethod(reg, meta)).to.equal('client_secret_basic')
+    })
+
+    it('picks none when no secret and server supports it', () => {
+        const reg = { client_id: 'c' }
+        const meta = { token_endpoint_auth_methods_supported: ['none', 'client_secret_basic'] }
+        expect(selectAuthMethod(reg, meta)).to.equal('none')
+    })
+
+    it('defaults to client_secret_post when secret present and no server metadata', () => {
+        const reg = { client_id: 'c', client_secret: 's' }
+        expect(selectAuthMethod(reg)).to.equal('client_secret_post')
+    })
+
+    it('defaults to none when no secret and no server metadata', () => {
+        const reg = { client_id: 'c' }
+        expect(selectAuthMethod(reg)).to.equal('none')
+    })
+})
+
+describe('OAuthClient.applyAuth()', () => {
+    const applyAuth = (method: string, reg: any, headers: any, params: any) =>
+        (OAuthClient as any).applyAuth(method, reg, headers, params)
+
+    it('client_secret_basic sets Authorization header with base64 credentials', () => {
+        const headers: Record<string, string> = {}
+        const params: Record<string, string> = {}
+        const reg = { client_id: 'myid', client_secret: 'mysecret' }
+        applyAuth('client_secret_basic', reg, headers, params)
+
+        const expected = `Basic ${Buffer.from('myid:mysecret').toString('base64')}`
+        expect(headers['authorization']).to.equal(expected)
+        expect(params).to.not.have.property('client_id')
+    })
+
+    it('client_secret_basic throws when no client_secret', () => {
+        const reg = { client_id: 'myid' }
+        expect(() => applyAuth('client_secret_basic', reg, {}, {})).to.throw(
+            'client_secret_basic requires a client_secret'
+        )
+    })
+
+    it('client_secret_post puts client_id and client_secret in params', () => {
+        const headers: Record<string, string> = {}
+        const params: Record<string, string> = {}
+        const reg = { client_id: 'myid', client_secret: 'mysecret' }
+        applyAuth('client_secret_post', reg, headers, params)
+
+        expect(params.client_id).to.equal('myid')
+        expect(params.client_secret).to.equal('mysecret')
+        expect(headers).to.not.have.property('authorization')
+    })
+
+    it('none puts only client_id in params', () => {
+        const headers: Record<string, string> = {}
+        const params: Record<string, string> = {}
+        const reg = { client_id: 'myid', client_secret: 'mysecret' }
+        applyAuth('none', reg, headers, params)
+
+        expect(params.client_id).to.equal('myid')
+        expect(params).to.not.have.property('client_secret')
+        expect(headers).to.not.have.property('authorization')
+    })
+})
+
+describe('OAuthClient.discoverAS()', () => {
+    let fetchStub: sinon.SinonStub
+
+    beforeEach(() => {
+        sinon.restore()
+        OAuthClient.initialize(fakeWorkspace, fakeLogger as any, fakeLsp)
+        fetchStub = sinon.stub(OAuthClient as any, 'fetchCompat')
+    })
+
+    afterEach(() => sinon.restore())
+
+    it('discovers via RFC 9728 Protected Resource Metadata', async () => {
+        const prmResponse = {
+            resource: 'https://mcp.example.com/mcp',
+            authorization_servers: ['https://auth.example.com'],
+            scopes_supported: ['mcp:connect'],
+        }
+        const asMeta = {
+            authorization_endpoint: 'https://auth.example.com/authorize',
+            token_endpoint: 'https://auth.example.com/token',
+            registration_endpoint: 'https://auth.example.com/register',
+        }
+
+        fetchStub.callsFake(async (url: string) => {
+            if (url.includes('.well-known/oauth-protected-resource')) {
+                return { ok: true, json: async () => prmResponse }
+            }
+            if (url.includes('.well-known/oauth-authorization-server')) {
+                return { ok: true, json: async () => asMeta }
+            }
+            return { ok: false, status: 404, text: async () => 'Not Found' }
+        })
+
+        const result = await (OAuthClient as any).discoverAS(new URL('https://mcp.example.com/mcp'))
+        expect(result.authorization_endpoint).to.equal('https://auth.example.com/authorize')
+        expect(result.token_endpoint).to.equal('https://auth.example.com/token')
+        // scopes_supported should be carried from PRM since AS meta doesn't have them
+        expect(result.scopes_supported).to.deep.equal(['mcp:connect'])
+    })
+
+    it('falls back to well-known endpoints when PRM is not available', async () => {
+        const asMeta = {
+            authorization_endpoint: 'https://example.com/authorize',
+            token_endpoint: 'https://example.com/token',
+        }
+
+        fetchStub.callsFake(async (url: string) => {
+            if (url.includes('.well-known/oauth-protected-resource')) {
+                return { ok: false, status: 404 }
+            }
+            if (url.includes('.well-known/oauth-authorization-server')) {
+                // HEAD returns no www-authenticate
+                if (url === 'https://example.com/mcp') {
+                    return { ok: true, status: 200, headers: { get: () => '' } }
+                }
+                return { ok: true, json: async () => asMeta }
+            }
+            // HEAD request
+            if (!url.includes('.well-known')) {
+                return { ok: true, status: 200, headers: { get: () => '' } }
+            }
+            return { ok: false, status: 404, text: async () => '' }
+        })
+
+        const result = await (OAuthClient as any).discoverAS(new URL('https://example.com/mcp'))
+        expect(result.authorization_endpoint).to.equal('https://example.com/authorize')
+    })
+
+    it('falls back to static endpoints when all discovery fails', async () => {
+        fetchStub.rejects(new Error('network error'))
+
+        const result = await (OAuthClient as any).discoverAS(new URL('https://example.com/mcp'))
+        expect(result.authorization_endpoint).to.equal('https://example.com/mcp/authorize')
+        expect(result.token_endpoint).to.equal('https://example.com/mcp/access_token')
+    })
+
+    it('carries scopes from PRM when AS metadata lacks them', async () => {
+        const prmResponse = {
+            resource: 'https://mcp.example.com/mcp',
+            authorization_servers: ['https://auth.example.com'],
+            scopes_supported: ['custom:scope'],
+        }
+        const asMeta = {
+            authorization_endpoint: 'https://auth.example.com/authorize',
+            token_endpoint: 'https://auth.example.com/token',
+            // no scopes_supported
+        }
+
+        fetchStub.callsFake(async (url: string) => {
+            if (url.includes('.well-known/oauth-protected-resource')) {
+                return { ok: true, json: async () => prmResponse }
+            }
+            if (url.includes('.well-known/oauth-authorization-server')) {
+                return { ok: true, json: async () => asMeta }
+            }
+            return { ok: false, status: 404, text: async () => '' }
+        })
+
+        const result = await (OAuthClient as any).discoverAS(new URL('https://mcp.example.com/mcp'))
+        expect(result.scopes_supported).to.deep.equal(['custom:scope'])
+    })
+})
+
+describe('OAuthClient.obtainClient()', () => {
+    let fetchStub: sinon.SinonStub
+
+    beforeEach(() => {
+        sinon.restore()
+        OAuthClient.initialize(fakeWorkspace, fakeLogger as any, fakeLsp)
+        fetchStub = sinon.stub(OAuthClient as any, 'fetchCompat')
+        sinon.stub(fakeWorkspace.fs, 'exists').resolves(false)
+        sinon.stub(fakeWorkspace.fs, 'readFile').resolves(Buffer.from('{}'))
+        sinon.stub(fakeWorkspace.fs, 'writeFile').resolves()
+        sinon.stub(fakeWorkspace.fs, 'mkdir').resolves()
+    })
+
+    afterEach(() => sinon.restore())
+
+    it('sends DCR without token_endpoint_auth_method or scope in body', async () => {
+        const dcrResponse = {
+            client_id: 'new_id',
+            client_secret: 'new_secret',
+            client_secret_expires_at: 0,
+            token_endpoint_auth_method: 'client_secret_basic',
+            scope: 'mcp:connect',
+        }
+
+        let capturedBody: any
+        fetchStub.callsFake(async (_url: string, init: any) => {
+            capturedBody = JSON.parse(init.body)
+            return { ok: true, json: async () => dcrResponse }
+        })
+
+        const meta = {
+            authorization_endpoint: 'https://auth.example.com/authorize',
+            token_endpoint: 'https://auth.example.com/token',
+            registration_endpoint: 'https://auth.example.com/register',
+        }
+
+        const reg = await (OAuthClient as any).obtainClient(
+            meta,
+            '/tmp/test.registration.json',
+            ['mcp:connect'],
+            'http://localhost:12345/oauth/callback'
+        )
+
+        // DCR body should NOT contain token_endpoint_auth_method or scope
+        expect(capturedBody).to.not.have.property('token_endpoint_auth_method')
+        expect(capturedBody).to.not.have.property('scope')
+        expect(capturedBody.client_name).to.equal('kiro')
+        expect(capturedBody.redirect_uris).to.deep.equal(['http://localhost:12345/oauth/callback'])
+
+        // Registration should capture token_endpoint_auth_method from response
+        expect(reg.client_id).to.equal('new_id')
+        expect(reg.client_secret).to.equal('new_secret')
+        expect(reg.token_endpoint_auth_method).to.equal('client_secret_basic')
+    })
+
+    it('throws when AS does not support dynamic registration', async () => {
+        const meta = {
+            authorization_endpoint: 'https://auth.example.com/authorize',
+            token_endpoint: 'https://auth.example.com/token',
+            // no registration_endpoint
+        }
+
+        try {
+            await (OAuthClient as any).obtainClient(meta, '/tmp/test.json', [], 'http://localhost:12345/oauth/callback')
+            expect.fail('should have thrown')
+        } catch (e: any) {
+            expect(e.message).to.include('does not support dynamic registration')
+        }
+    })
+})
+
+describe('OAuthClient.discoverProtectedResourceMetadata()', () => {
+    let fetchStub: sinon.SinonStub
+
+    beforeEach(() => {
+        sinon.restore()
+        OAuthClient.initialize(fakeWorkspace, fakeLogger as any, fakeLsp)
+        fetchStub = sinon.stub(OAuthClient as any, 'fetchCompat')
+    })
+
+    afterEach(() => sinon.restore())
+
+    it('tries path-aware URL first for servers with a path', async () => {
+        const prmData = { resource: 'https://mcp.example.com/mcp', authorization_servers: ['https://auth.example.com'] }
+        const urlsCalled: string[] = []
+
+        fetchStub.callsFake(async (url: string) => {
+            urlsCalled.push(url)
+            if (url === 'https://mcp.example.com/.well-known/oauth-protected-resource/mcp') {
+                return { ok: true, json: async () => prmData }
+            }
+            return { ok: false, status: 404 }
+        })
+
+        const result = await (OAuthClient as any).discoverProtectedResourceMetadata(
+            new URL('https://mcp.example.com/mcp')
+        )
+        expect(result).to.deep.equal(prmData)
+        expect(urlsCalled[0]).to.equal('https://mcp.example.com/.well-known/oauth-protected-resource/mcp')
+    })
+
+    it('falls back to root URL when path-aware fails', async () => {
+        const prmData = { resource: 'https://mcp.example.com/mcp', authorization_servers: ['https://auth.example.com'] }
+        const urlsCalled: string[] = []
+
+        fetchStub.callsFake(async (url: string) => {
+            urlsCalled.push(url)
+            if (url === 'https://mcp.example.com/.well-known/oauth-protected-resource') {
+                return { ok: true, json: async () => prmData }
+            }
+            return { ok: false, status: 404 }
+        })
+
+        const result = await (OAuthClient as any).discoverProtectedResourceMetadata(
+            new URL('https://mcp.example.com/mcp')
+        )
+        expect(result).to.deep.equal(prmData)
+        expect(urlsCalled).to.include('https://mcp.example.com/.well-known/oauth-protected-resource/mcp')
+        expect(urlsCalled).to.include('https://mcp.example.com/.well-known/oauth-protected-resource')
+    })
+
+    it('sends MCP-Protocol-Version header', async () => {
+        let capturedHeaders: any
+        fetchStub.callsFake(async (_url: string, init: any) => {
+            capturedHeaders = init?.headers
+            return { ok: false, status: 404 }
+        })
+
+        await (OAuthClient as any).discoverProtectedResourceMetadata(new URL('https://example.com/'))
+        expect(capturedHeaders?.['MCP-Protocol-Version']).to.equal('2025-03-26')
+    })
+})
+
 describe('OAuthClient getValidAccessToken()', () => {
     const now = Date.now()
 
@@ -115,7 +439,7 @@ describe('OAuthClient getValidAccessToken()', () => {
         }
         const cachedReg = {
             client_id: 'cid',
-            redirect_uri: 'http://localhost:12345',
+            redirect_uri: 'http://localhost:12345/oauth/callback',
         }
 
         stubFileSystem(cachedToken, cachedReg)
@@ -126,4 +450,98 @@ describe('OAuthClient getValidAccessToken()', () => {
         expect(token).to.equal('cached_access')
         expect((fakeLsp.window.showDocument as sinon.SinonStub).called).to.be.false
     })
+
+    it('returns undefined in silent mode when no cached token', async () => {
+        stubFileSystem()
+
+        const token = await OAuthClient.getValidAccessToken(new URL('https://api.example.com/mcp'), {
+            interactive: false,
+        })
+        expect(token).to.be.undefined
+    })
+
+    it('uses scopes from discovery metadata when available', async () => {
+        const expiredToken = {
+            access_token: 'expired',
+            expires_in: 1,
+            obtained_at: now - 10_000,
+        }
+        stubFileSystem(expiredToken)
+
+        const meta = {
+            authorization_endpoint: 'https://auth.example.com/authorize',
+            token_endpoint: 'https://auth.example.com/token',
+            registration_endpoint: 'https://auth.example.com/register',
+            scopes_supported: ['mcp:connect'],
+        }
+
+        sinon.stub(OAuthClient as any, 'discoverAS').resolves(meta)
+
+        const dcrResponse = {
+            client_id: 'cid',
+            client_secret: 'csecret',
+            client_secret_expires_at: 0,
+            token_endpoint_auth_method: 'client_secret_basic',
+        }
+        sinon.stub(OAuthClient as any, 'obtainClient').resolves({
+            client_id: 'cid',
+            client_secret: 'csecret',
+            redirect_uri: 'http://localhost:12345/oauth/callback',
+            token_endpoint_auth_method: 'client_secret_basic',
+        })
+
+        const tokenResponse = {
+            access_token: 'new_token',
+            expires_in: 3600,
+            token_type: 'bearer',
+        }
+        const pkceStub = sinon.stub(OAuthClient as any, 'pkceGrant').resolves({
+            ...tokenResponse,
+            obtained_at: Date.now(),
+        })
+
+        const token = await OAuthClient.getValidAccessToken(new URL('https://api.example.com/mcp'), {
+            interactive: true,
+        })
+
+        expect(token).to.equal('new_token')
+        // Verify scopes passed to pkceGrant are from discovery metadata
+        const scopesArg = pkceStub.firstCall.args[3]
+        expect(scopesArg).to.deep.equal(['mcp:connect'])
+    })
+
+    it('falls back to OIDC scopes when discovery has no scopes_supported', async () => {
+        const expiredToken = {
+            access_token: 'expired',
+            expires_in: 1,
+            obtained_at: now - 10_000,
+        }
+        stubFileSystem(expiredToken)
+
+        const meta = {
+            authorization_endpoint: 'https://auth.example.com/authorize',
+            token_endpoint: 'https://auth.example.com/token',
+            registration_endpoint: 'https://auth.example.com/register',
+            // no scopes_supported
+        }
+
+        sinon.stub(OAuthClient as any, 'discoverAS').resolves(meta)
+        sinon.stub(OAuthClient as any, 'obtainClient').resolves({
+            client_id: 'cid',
+            redirect_uri: 'http://localhost:12345/oauth/callback',
+        })
+
+        const pkceStub = sinon.stub(OAuthClient as any, 'pkceGrant').resolves({
+            access_token: 'new_token',
+            expires_in: 3600,
+            obtained_at: Date.now(),
+        })
+
+        await OAuthClient.getValidAccessToken(new URL('https://api.example.com/mcp'), {
+            interactive: true,
+        })
+
+        const scopesArg = pkceStub.firstCall.args[3]
+        expect(scopesArg).to.deep.equal(['openid', 'offline_access'])
+    })
 })
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpOauthClient.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpOauthClient.ts
index 82851a2fb9..62f84606c9 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpOauthClient.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpOauthClient.ts
@@ -5,7 +5,6 @@
 
 import * as crypto from 'crypto'
 import * as path from 'path'
-import { spawn } from 'child_process'
 import { URL, URLSearchParams } from 'url'
 import * as http from 'http'
 import * as os from 'os'
@@ -22,6 +21,8 @@ interface Meta {
     authorization_endpoint: string
     token_endpoint: string
     registration_endpoint?: string
+    scopes_supported?: string[]
+    token_endpoint_auth_methods_supported?: string[]
 }
 
 interface Registration {
@@ -29,6 +30,7 @@ interface Registration {
     client_secret?: string
     expires_at?: number
     redirect_uri: string
+    token_endpoint_auth_method?: string
 }
 
 export class OAuthClient {
@@ -55,20 +57,18 @@ export class OAuthClient {
         const regPath = path.join(this.cacheDir, `${key}.registration.json`)
         const tokPath = path.join(this.cacheDir, `${key}.token.json`)
 
-        // ===== Silent branch: try cached token, then refresh, never opens a browser =====
+        // Silent branch: try cached token, then refresh, never opens a browser
         if (!interactive) {
-            // 1) cached access token
             const cachedTok = await this.read<Token>(tokPath)
             if (cachedTok) {
                 const expiry = cachedTok.obtained_at + cachedTok.expires_in * 1000
                 if (Date.now() < expiry) {
-                    this.logger.info(`OAuth: using still-valid cached token (silent)`)
+                    this.logger.info('OAuth: using still-valid cached token (silent)')
                     return cachedTok.access_token
                 }
-                this.logger.info(`OAuth: cached token expired → try refresh (silent)`)
+                this.logger.info('OAuth: cached token expired, trying refresh (silent)')
             }
 
-            // 2) refresh-token grant (if we have registration and refresh token)
             const savedReg = await this.read<Registration>(regPath)
             if (cachedTok?.refresh_token && savedReg) {
                 try {
@@ -76,32 +76,28 @@ export class OAuthClient {
                     const refreshed = await this.refreshGrant(meta, savedReg, mcpBase, cachedTok.refresh_token)
                     if (refreshed) {
                         await this.write(tokPath, refreshed)
-                        this.logger.info(`OAuth: refresh grant succeeded (silent)`)
+                        this.logger.info('OAuth: refresh grant succeeded (silent)')
                         return refreshed.access_token
                     }
-                    this.logger.info(`OAuth: refresh grant did not succeed (silent)`)
                 } catch (e) {
                     this.logger.warn(`OAuth: silent refresh failed — ${e instanceof Error ? e.message : String(e)}`)
                 }
             }
 
-            // 3) no token in silent mode → caller should surface auth-required UI
             return undefined
         }
 
-        // ===== Interactive branch: may open a browser (PKCE) =====
-        // 1) Spin up (or reuse) loopback server + redirect URI
+        // Interactive branch: may open a browser (PKCE)
         let server: http.Server | null = null
         let redirectUri: string
         const savedReg = await this.read<Registration>(regPath)
         if (savedReg) {
             const port = Number(new URL(savedReg.redirect_uri).port)
-            const normalized = `http://127.0.0.1:${port}`
+            const normalized = `http://localhost:${port}/oauth/callback`
             server = http.createServer()
             try {
-                await this.listen(server, port, '127.0.0.1')
+                await this.listen(server, port, 'localhost')
                 redirectUri = normalized
-                this.logger.info(`OAuth: reusing redirect URI ${redirectUri}`)
             } catch (e: any) {
                 if (e.code === 'EADDRINUSE') {
                     try {
@@ -109,71 +105,51 @@ export class OAuthClient {
                     } catch {
                         /* ignore */
                     }
-                    this.logger.warn(`Port ${port} in use; falling back to new random port`)
+                    this.logger.warn(`OAuth: port ${port} in use, falling back to new random port`)
                     ;({ server, redirectUri } = await this.buildCallbackServer())
-                    this.logger.info(`OAuth: new redirect URI ${redirectUri}`)
                     await this.workspace.fs.rm(regPath)
                 } else {
                     throw e
                 }
             }
         } else {
-            const created = await this.buildCallbackServer()
-            server = created.server
-            redirectUri = created.redirectUri
-            this.logger.info(`OAuth: new redirect URI ${redirectUri}`)
+            ;({ server, redirectUri } = await this.buildCallbackServer())
         }
 
         try {
-            // 2) Try still-valid cached access_token
             const cached = await this.read<Token>(tokPath)
             if (cached) {
                 const expiry = cached.obtained_at + cached.expires_in * 1000
                 if (Date.now() < expiry) {
-                    this.logger.info(`OAuth: using still-valid cached token`)
+                    this.logger.info('OAuth: using still-valid cached token')
                     return cached.access_token
                 }
-                this.logger.info(`OAuth: cached token expired → try refresh`)
             }
 
-            // 3) Discover AS metadata
-            let meta: Meta
-            try {
-                meta = await this.discoverAS(mcpBase)
-            } catch (e: any) {
-                throw new Error(`OAuth discovery failed: ${e?.message ?? String(e)}`)
-            }
+            const meta = await this.discoverAS(mcpBase)
 
-            // 4) Register (or reuse) a dynamic client
-            const scopes = ['openid', 'offline_access']
-            let reg: Registration
-            try {
-                reg = await this.obtainClient(meta, regPath, scopes, redirectUri)
-            } catch (e: any) {
-                throw new Error(`OAuth client registration failed: ${e?.message ?? String(e)}`)
-            }
+            // Use scopes from discovery metadata, fall back to OIDC defaults
+            const scopes =
+                meta.scopes_supported && meta.scopes_supported.length > 0
+                    ? meta.scopes_supported
+                    : ['openid', 'offline_access']
+
+            const reg = await this.obtainClient(meta, regPath, scopes, redirectUri)
 
-            // 5) Refresh-token grant (one shot)
-            const attemptedRefresh = !!cached?.refresh_token
+            // Try refresh-token grant first
             if (cached?.refresh_token) {
                 const refreshed = await this.refreshGrant(meta, reg, mcpBase, cached.refresh_token)
                 if (refreshed) {
                     await this.write(tokPath, refreshed)
-                    this.logger.info(`OAuth: refresh grant succeeded`)
+                    this.logger.info('OAuth: refresh grant succeeded')
                     return refreshed.access_token
                 }
-                this.logger.info(`OAuth: refresh grant failed`)
             }
 
-            // 6) PKCE interactive flow
-            try {
-                const fresh = await this.pkceGrant(meta, reg, mcpBase, scopes, redirectUri, server)
-                await this.write(tokPath, fresh)
-                return fresh.access_token
-            } catch (e: any) {
-                const suffix = attemptedRefresh ? ' after refresh attempt' : ''
-                throw new Error(`OAuth authorization (PKCE) failed${suffix}: ${e?.message ?? String(e)}`)
-            }
+            // PKCE interactive flow
+            const fresh = await this.pkceGrant(meta, reg, mcpBase, scopes, redirectUri, server)
+            await this.write(tokPath, fresh)
+            return fresh.access_token
         } finally {
             if (server) {
                 await new Promise<void>(res => server!.close(() => res()))
@@ -181,59 +157,125 @@ export class OAuthClient {
         }
     }
 
-    /** Spin up a one‑time HTTP listener on localhost:randomPort */
+    /** Spin up a one-time HTTP listener on localhost:randomPort */
     private static async buildCallbackServer(): Promise<{ server: http.Server; redirectUri: string }> {
         const server = http.createServer()
-        await this.listen(server, 0, '127.0.0.1')
+        await this.listen(server, 0, 'localhost')
         const port = (server.address() as any).port as number
-        return { server, redirectUri: `http://127.0.0.1:${port}` }
+        return { server, redirectUri: `http://localhost:${port}/oauth/callback` }
     }
 
-    /** Discover OAuth endpoints by HEAD/WWW‑Authenticate, well‑known, or fallback */
+    /**
+     * Discover OAuth endpoints using the following chain (aligned with MCP SDK):
+     * 1. RFC 9728 Protected Resource Metadata
+     * 2. WWW-Authenticate header resource_metadata link
+     * 3. RFC 8414 / OIDC well-known endpoints on the resource server
+     * 4. Fallback to synthesized static endpoints
+     */
     private static async discoverAS(rs: URL): Promise<Meta> {
-        // a) HEAD → WWW‑Authenticate → resource_metadata
+        // Step 1: RFC 9728 Protected Resource Metadata
+        try {
+            const prm = await this.discoverProtectedResourceMetadata(rs)
+            if (prm) {
+                const asUrl = prm.authorization_servers?.[0]
+                if (asUrl) {
+                    const asMeta = await this.discoverAuthorizationServerMetadata(new URL(asUrl))
+                    if (asMeta) {
+                        if (!asMeta.scopes_supported && prm.scopes_supported) {
+                            asMeta.scopes_supported = prm.scopes_supported
+                        }
+                        return asMeta
+                    }
+                }
+            }
+        } catch (e) {
+            this.logger.info(`OAuth: RFC 9728 discovery failed — ${e instanceof Error ? e.message : String(e)}`)
+        }
+
+        // Step 2: HEAD → WWW-Authenticate → resource_metadata link
         try {
-            this.logger.info('MCP OAuth: attempting discovery via WWW-Authenticate header')
             const h = await this.fetchCompat(rs.toString(), { method: 'HEAD' })
             const header = h.headers.get('www-authenticate') || ''
             const m = /resource_metadata=(?:"([^"]+)"|([^,\s]+))/i.exec(header)
             if (m) {
                 const metaUrl = new URL(m[1] || m[2], rs).toString()
-                this.logger.info(`OAuth: resource_metadata → ${metaUrl}`)
                 const raw = await this.json<any>(metaUrl)
                 return await this.fetchASFromResourceMeta(raw, metaUrl)
             }
-        } catch {
-            this.logger.info('MCP OAuth: no resource_metadata found in WWW-Authenticate header')
+        } catch (e) {
+            this.logger.info(`OAuth: WWW-Authenticate discovery failed — ${e instanceof Error ? e.message : String(e)}`)
         }
 
-        // b) well‑known on resource host
-        this.logger.info('MCP OAuth: attempting discovery via well-known endpoints')
-        const probes = [
-            new URL('.well-known/oauth-authorization-server', rs).toString(),
-            new URL('.well-known/openid-configuration', rs).toString(),
-            `${rs.origin}/.well-known/oauth-authorization-server`,
-            `${rs.origin}/.well-known/openid-configuration`,
-        ]
-        for (const url of probes) {
-            try {
-                this.logger.info(`MCP OAuth: probing well-known endpoint → ${url}`)
-                return await this.json<Meta>(url)
-            } catch (error) {
-                this.logger.info(`OAuth: well-known endpoint probe failed for ${url}`)
-            }
+        // Step 3: Well-known endpoints on the resource server
+        const asMeta = await this.discoverAuthorizationServerMetadata(new URL('/', rs))
+        if (asMeta) {
+            return asMeta
         }
 
-        // c) fallback to static OAuth2 endpoints
+        // Step 4: Fallback to static endpoints
         const base = (rs.origin + rs.pathname).replace(/\/+$/, '')
-        this.logger.warn(`OAuth: all discovery attempts failed, synthesizing endpoints from ${base}`)
+        this.logger.warn(`OAuth: all discovery failed, synthesizing endpoints from ${base}`)
         return {
             authorization_endpoint: `${base}/authorize`,
             token_endpoint: `${base}/access_token`,
         }
     }
 
-    /** Follow `authorization_server(s)` in resource_metadata JSON */
+    /**
+     * RFC 9728: Discover OAuth Protected Resource Metadata.
+     * Tries path-aware URL first, then root fallback.
+     */
+    private static async discoverProtectedResourceMetadata(rs: URL): Promise<any | undefined> {
+        const pathname = rs.pathname.endsWith('/') ? rs.pathname.slice(0, -1) : rs.pathname
+        const urlsToTry = [new URL(`/.well-known/oauth-protected-resource${pathname}`, rs.origin).toString()]
+        if (pathname && pathname !== '/') {
+            urlsToTry.push(new URL('/.well-known/oauth-protected-resource', rs.origin).toString())
+        }
+
+        for (const url of urlsToTry) {
+            try {
+                const resp = await this.fetchCompat(url, {
+                    headers: { 'MCP-Protocol-Version': '2025-03-26' },
+                })
+                if (resp.ok) {
+                    return await resp.json()
+                }
+            } catch {
+                // Try next URL
+            }
+        }
+        return undefined
+    }
+
+    /**
+     * Discover Authorization Server Metadata via RFC 8414 and OIDC Discovery.
+     * Matches the MCP SDK's buildDiscoveryUrls pattern.
+     */
+    private static async discoverAuthorizationServerMetadata(asUrl: URL): Promise<Meta | undefined> {
+        const pathname = asUrl.pathname.endsWith('/') ? asUrl.pathname.slice(0, -1) : asUrl.pathname
+        const hasPath = pathname !== '' && pathname !== '/'
+
+        const urlsToTry: string[] = []
+        if (!hasPath) {
+            urlsToTry.push(new URL('/.well-known/oauth-authorization-server', asUrl.origin).toString())
+            urlsToTry.push(new URL('/.well-known/openid-configuration', asUrl.origin).toString())
+        } else {
+            urlsToTry.push(new URL(`/.well-known/oauth-authorization-server${pathname}`, asUrl.origin).toString())
+            urlsToTry.push(new URL(`/.well-known/openid-configuration${pathname}`, asUrl.origin).toString())
+            urlsToTry.push(new URL(`${pathname}/.well-known/openid-configuration`, asUrl.origin).toString())
+        }
+
+        for (const url of urlsToTry) {
+            try {
+                return await this.json<Meta>(url)
+            } catch {
+                // Try next URL
+            }
+        }
+        return undefined
+    }
+
+    /** Follow authorization_server(s) in resource_metadata JSON */
     private static async fetchASFromResourceMeta(raw: any, metaUrl: string): Promise<Meta> {
         let asBase = raw.authorization_server
         if (!asBase && Array.isArray(raw.authorization_servers)) {
@@ -243,7 +285,6 @@ export class OAuthClient {
             throw new Error(`resource_metadata at ${metaUrl} lacked authorization_server(s)`)
         }
 
-        // Attempt both OAuth‑AS and OIDC well‑known
         for (const p of ['.well-known/oauth-authorization-server', '.well-known/openid-configuration']) {
             try {
                 return await this.json<Meta>(new URL(p, asBase).toString())
@@ -251,7 +292,6 @@ export class OAuthClient {
                 // next
             }
         }
-        // fallback to static OAuth2 endpoints
         this.logger.warn(`OAuth: no well-known on ${asBase}, falling back to static endpoints`)
         return {
             authorization_endpoint: `${asBase}/authorize`,
@@ -263,12 +303,12 @@ export class OAuthClient {
     private static async obtainClient(
         meta: Meta,
         file: string,
-        scopes: string[],
+        _scopes: string[],
         redirectUri: string
     ): Promise<Registration> {
         const existing = await this.read<Registration>(file)
         if (existing && (!existing.expires_at || existing.expires_at * 1000 > Date.now())) {
-            this.logger.info(`OAuth: reusing client_id ${existing.client_id}`)
+            this.logger.info(`OAuth: reusing cached client_id ${existing.client_id}`)
             return existing
         }
 
@@ -276,12 +316,11 @@ export class OAuthClient {
             throw new Error('OAuth: AS does not support dynamic registration')
         }
 
+        // Let the server decide token_endpoint_auth_method and scope
         const body = {
-            client_name: 'AWS MCP LSP',
+            client_name: 'kiro',
             grant_types: ['authorization_code', 'refresh_token'],
             response_types: ['code'],
-            token_endpoint_auth_method: 'none',
-            scope: scopes.join(' '),
             redirect_uris: [redirectUri],
         }
         const resp: any = await this.json(meta.registration_endpoint, {
@@ -295,28 +334,33 @@ export class OAuthClient {
             client_secret: resp.client_secret,
             expires_at: resp.client_secret_expires_at,
             redirect_uri: redirectUri,
+            token_endpoint_auth_method: resp.token_endpoint_auth_method,
         }
         await this.write(file, reg)
         return reg
     }
 
-    /** Try one refresh_token grant; returns new Token or `undefined` */
+    /** Try one refresh_token grant; returns new Token or undefined */
     private static async refreshGrant(
         meta: Meta,
         reg: Registration,
         rs: URL,
         refresh: string
     ): Promise<Token | undefined> {
-        const form = new URLSearchParams({
+        const formParams: Record<string, string> = {
             grant_type: 'refresh_token',
             refresh_token: refresh,
-            client_id: reg.client_id,
             resource: rs.toString(),
-        })
+        }
+        const headers: Record<string, string> = { 'content-type': 'application/x-www-form-urlencoded' }
+
+        const authMethod = this.selectAuthMethod(reg, meta)
+        this.applyAuth(authMethod, reg, headers, formParams)
+
         const res = await this.fetchCompat(meta.token_endpoint, {
             method: 'POST',
-            headers: { 'content-type': 'application/x-www-form-urlencoded' },
-            body: form,
+            headers,
+            body: new URLSearchParams(formParams),
         })
         if (!res.ok) {
             const msg = await res.text().catch(() => '')
@@ -337,12 +381,11 @@ export class OAuthClient {
         server: http.Server
     ): Promise<Token> {
         const DEFAULT_PKCE_TIMEOUT_MS = 90_000
-        // a) generate PKCE params
+
         const verifier = this.b64url(crypto.randomBytes(32))
         const challenge = this.b64url(crypto.createHash('sha256').update(verifier).digest())
         const state = this.b64url(crypto.randomBytes(16))
 
-        // b) build authorize URL + launch browser
         const authz = new URL(meta.authorization_endpoint)
         authz.search = new URLSearchParams({
             client_id: reg.client_id,
@@ -352,12 +395,11 @@ export class OAuthClient {
             resource: rs.toString(),
             scope: scopes.join(' '),
             redirect_uri: redirectUri,
-            state: state,
+            state,
         }).toString()
 
         await this.lsp.window.showDocument({ uri: authz.toString(), external: true })
 
-        // c) wait for code on our loopback
         const waitForFlow = new Promise<{ code: string; rxState: string; err?: string; errDesc?: string }>(resolve => {
             server.on('request', (req, res) => {
                 const u = new URL(req.url || '/', redirectUri)
@@ -380,19 +422,23 @@ export class OAuthClient {
         }
         if (!code || rxState !== state) throw new Error('Invalid authorization response (state mismatch)')
 
-        // d) exchange code for token
-        const form2 = new URLSearchParams({
+        // Exchange code for token using the auth method from DCR
+        const tokenParams: Record<string, string> = {
             grant_type: 'authorization_code',
             code,
             code_verifier: verifier,
-            client_id: reg.client_id,
             redirect_uri: redirectUri,
             resource: rs.toString(),
-        })
+        }
+        const tokenHeaders: Record<string, string> = { 'content-type': 'application/x-www-form-urlencoded' }
+
+        const authMethod = this.selectAuthMethod(reg, meta)
+        this.applyAuth(authMethod, reg, tokenHeaders, tokenParams)
+
         const res2 = await this.fetchCompat(meta.token_endpoint, {
             method: 'POST',
-            headers: { 'content-type': 'application/x-www-form-urlencoded' },
-            body: form2,
+            headers: tokenHeaders,
+            body: new URLSearchParams(tokenParams),
         })
         if (!res2.ok) {
             const txt = await res2.text().catch(() => '')
@@ -402,7 +448,7 @@ export class OAuthClient {
         return { ...(tk as object), obtained_at: Date.now() } as Token
     }
 
-    /** Fetch + error‑check + parse JSON */
+    /** Fetch + error-check + parse JSON */
     private static async json<T>(url: string, init?: RequestInit): Promise<T> {
         const r = await this.fetchCompat(url, init)
         if (!r.ok) {
@@ -430,7 +476,7 @@ export class OAuthClient {
         await this.workspace.fs.writeFile(file, JSON.stringify(obj, null, 2), { mode: 0o600 })
     }
 
-    /** SHA‑256 of resourceServer URL → hex key */
+    /** SHA-256 of resourceServer URL → hex key */
     private static computeKey(rs: URL): string {
         return crypto
             .createHash('sha256')
@@ -438,7 +484,7 @@ export class OAuthClient {
             .digest('hex')
     }
 
-    /** RFC‑7636 base64url without padding */
+    /** RFC-7636 base64url without padding */
     private static b64url(buf: Buffer): string {
         return buf.toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_')
     }
@@ -447,10 +493,54 @@ export class OAuthClient {
     private static readonly cacheDir = path.join(os.homedir(), '.aws', 'sso', 'cache')
 
     /**
-     * Await server.listen() but reject if it emits 'error' (eg EADDRINUSE),
-     * so callers can handle it immediately instead of hanging.
+     * Select the client authentication method, matching the MCP SDK's selectClientAuthMethod logic.
+     * Priority: token_endpoint_auth_method from DCR > server-supported methods > defaults.
      */
-    private static listen(server: http.Server, port: number, host: string = '127.0.0.1'): Promise<void> {
+    private static selectAuthMethod(reg: Registration, meta?: Meta): string {
+        const hasSecret = !!reg.client_secret
+        const supported = meta?.token_endpoint_auth_methods_supported ?? []
+
+        if (reg.token_endpoint_auth_method) {
+            if (supported.length === 0 || supported.includes(reg.token_endpoint_auth_method)) {
+                return reg.token_endpoint_auth_method
+            }
+        }
+
+        if (supported.length > 0) {
+            if (hasSecret && supported.includes('client_secret_basic')) return 'client_secret_basic'
+            if (hasSecret && supported.includes('client_secret_post')) return 'client_secret_post'
+            if (supported.includes('none')) return 'none'
+        }
+
+        return hasSecret ? 'client_secret_post' : 'none'
+    }
+
+    /** Apply client authentication to headers and params based on the selected method. */
+    private static applyAuth(
+        method: string,
+        reg: Registration,
+        headers: Record<string, string>,
+        params: Record<string, string>
+    ): void {
+        switch (method) {
+            case 'client_secret_basic':
+                if (!reg.client_secret) throw new Error('client_secret_basic requires a client_secret')
+                headers['authorization'] =
+                    `Basic ${Buffer.from(`${reg.client_id}:${reg.client_secret}`).toString('base64')}`
+                break
+            case 'client_secret_post':
+                params.client_id = reg.client_id
+                if (reg.client_secret) params.client_secret = reg.client_secret
+                break
+            case 'none':
+            default:
+                params.client_id = reg.client_id
+                break
+        }
+    }
+
+    /** Await server.listen() with error rejection for immediate handling. */
+    private static listen(server: http.Server, port: number, host: string = 'localhost'): Promise<void> {
         return new Promise((resolve, reject) => {
             const onListening = () => {
                 server.off('error', onError)
@@ -466,16 +556,12 @@ export class OAuthClient {
         })
     }
 
-    /**
-     * Fetch compatibility: use global fetch on Node >= 18, otherwise dynamically import('node-fetch').
-     * Using Function('return import(...)') avoids downleveling to require() in CJS builds.
-     */
+    /** Fetch compatibility: use global fetch on Node >= 18, otherwise dynamically import('node-fetch'). */
     private static async fetchCompat(url: string, init?: RequestInit): Promise<any> {
         const globalObj = globalThis as any
         if (typeof globalObj.fetch === 'function') {
             return globalObj.fetch(url as any, init as any)
         }
-        // Dynamic import of ESM node-fetch (only when global fetch is unavailable)
         const mod = await (Function('return import("node-fetch")')() as Promise<any>)
         const f = mod.default ?? mod
         return f(url as any, init as any)

From 8a615faf27c6b519045263f5bddf0bfe98f609e0 Mon Sep 17 00:00:00 2001
From: invictus <149003065+ashishrp-aws@users.noreply.github.com>
Date: Mon, 30 Mar 2026 22:49:58 -0700
Subject: [PATCH 07/23] revert: undo revert of fix for tool permissions in
 allowed paths per tool (#2601) (#2683) (#2684)

---
 .../agenticChat/agenticChatController.ts      |  2 +-
 .../agenticChat/tools/executeBash.test.ts     | 34 +++++++
 .../agenticChat/tools/executeBash.ts          | 16 +++-
 .../agenticChat/tools/fileSearch.ts           |  7 +-
 .../agenticChat/tools/fsRead.ts               |  7 +-
 .../agenticChat/tools/fsReplace.ts            |  7 +-
 .../agenticChat/tools/fsWrite.ts              |  7 +-
 .../agenticChat/tools/listDirectory.ts        |  4 +-
 .../agenticChat/tools/toolShared.test.ts      | 96 +++++++++++++------
 .../agenticChat/tools/toolShared.ts           | 32 ++++---
 .../chat/chatSessionService.test.ts           | 54 +++++++----
 .../chat/chatSessionService.ts                | 18 ++--
 12 files changed, 204 insertions(+), 80 deletions(-)

diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
index fa122fc0bb..5ea3c51782 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
@@ -2181,7 +2181,7 @@ export class AgenticChatController implements ChatHandlers {
                 // After approval, add the path to the approved paths in the session
                 const inputPath = (toolUse.input as any)?.path || (toolUse.input as any)?.cwd
                 if (inputPath) {
-                    session.addApprovedPath(inputPath)
+                    session.addApprovedPath(inputPath, toolUse.name)
                 }
 
                 const ws = this.#getWritableStream(chatResultStream, toolUse)
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/executeBash.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/executeBash.test.ts
index bb59afe6a4..279c87603e 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/executeBash.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/executeBash.test.ts
@@ -123,6 +123,40 @@ describe('ExecuteBash Tool', () => {
         )
     })
 
+    it('requires acceptance for curl with pipe (curl | bash pattern)', async () => {
+        const execBash = new ExecuteBash(features)
+        const result = await execBash.requiresAcceptance({ command: 'curl -sSL https://example.com/install.sh | bash' })
+
+        assert.equal(result.requiresAcceptance, true, 'curl | bash should require acceptance')
+        assert.equal(result.commandCategory, 2, 'Should be classified as Destructive')
+        assert.ok(result.warning?.includes('Downloading and piping to shell execution is dangerous'))
+    })
+
+    it('requires acceptance for wget with pipe (wget | sh pattern)', async () => {
+        const execBash = new ExecuteBash(features)
+        const result = await execBash.requiresAcceptance({ command: 'wget -O- https://example.com/script.sh | sh' })
+
+        assert.equal(result.requiresAcceptance, true, 'wget | sh should require acceptance')
+        assert.equal(result.commandCategory, 2, 'Should be classified as Destructive')
+        assert.ok(result.warning?.includes('Downloading and piping to shell execution is dangerous'))
+    })
+
+    it('requires acceptance for curl without pipe (mutate command)', async () => {
+        const execBash = new ExecuteBash(features)
+        const result = await execBash.requiresAcceptance({ command: 'curl -o file.txt https://example.com/file.txt' })
+
+        assert.equal(result.requiresAcceptance, true, 'curl is a mutate command and should require acceptance')
+        assert.equal(result.commandCategory, 1, 'Should be classified as Mutate')
+    })
+
+    it('requires acceptance for wget without pipe (mutate command)', async () => {
+        const execBash = new ExecuteBash(features)
+        const result = await execBash.requiresAcceptance({ command: 'wget https://example.com/file.txt' })
+
+        assert.equal(result.requiresAcceptance, true, 'wget is a mutate command and should require acceptance')
+        assert.equal(result.commandCategory, 1, 'Should be classified as Mutate')
+    })
+
     it('requires acceptance for path traversal in ls command (bug bounty P347698138)', async () => {
         const execBash = new ExecuteBash(features)
         // The exact attack pattern from the bug report: double traversal to confuse validation
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/executeBash.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/executeBash.ts
index 40b55a198b..6533cf2cd4 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/executeBash.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/executeBash.ts
@@ -37,6 +37,7 @@ export const commandCategories = new Map<string, CommandCategory>([
     // Mutable commands
     ['chmod', CommandCategory.Mutate],
     ['curl', CommandCategory.Mutate],
+    ['wget', CommandCategory.Mutate],
     ['mount', CommandCategory.Mutate],
     ['umount', CommandCategory.Mutate],
     ['systemctl', CommandCategory.Mutate],
@@ -176,7 +177,7 @@ export class ExecuteBash {
 
     public async requiresAcceptance(
         params: ExecuteBashParams,
-        approvedPaths?: Set<string>
+        approvedPaths?: Map<string, Set<string>>
     ): Promise<CommandValidation> {
         try {
             // On Windows, pre-check the raw command for backslash-based traversal patterns
@@ -246,7 +247,7 @@ export class ExecuteBash {
                         }
 
                         // Check if the path is already approved
-                        if (approvedPaths && isPathApproved(fullPath, approvedPaths)) {
+                        if (approvedPaths && isPathApproved(fullPath, 'executeBash', approvedPaths)) {
                             continue
                         }
 
@@ -295,6 +296,15 @@ export class ExecuteBash {
                 const command = cmdArgs[0]
                 const category = commandCategories.get(command)
 
+                // Special case: curl/wget with pipes should be treated as destructive (curl | bash pattern)
+                if ((command === 'curl' || command === 'wget') && params.command.includes('|')) {
+                    return {
+                        requiresAcceptance: true,
+                        warning: 'WARNING: Downloading and piping to shell execution is dangerous:\n\n',
+                        commandCategory: CommandCategory.Destructive,
+                    }
+                }
+
                 // Update the highest command category if current command has higher risk
                 if (category === CommandCategory.Destructive) {
                     highestCommandCategory = CommandCategory.Destructive
@@ -330,7 +340,7 @@ export class ExecuteBash {
             // Finally, check if the cwd is outside the workspace
             if (params.cwd) {
                 // Check if the cwd is already approved
-                if (!(approvedPaths && isPathApproved(params.cwd, approvedPaths))) {
+                if (!(approvedPaths && isPathApproved(params.cwd, 'executeBash', approvedPaths))) {
                     const workspaceFolders = getWorkspaceFolderPaths(this.workspace)
 
                     // If there are no workspace folders, we can't validate the path
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/fileSearch.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/fileSearch.ts
index 37d11afe4f..23f62a3a87 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/fileSearch.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/fileSearch.ts
@@ -48,8 +48,11 @@ export class FileSearch {
         return
     }
 
-    public async requiresAcceptance(params: FileSearchParams, approvedPaths?: Set<string>): Promise<CommandValidation> {
-        return requiresPathAcceptance(params.path, this.workspace, this.logging, approvedPaths)
+    public async requiresAcceptance(
+        params: FileSearchParams,
+        approvedPaths?: Map<string, Set<string>>
+    ): Promise<CommandValidation> {
+        return requiresPathAcceptance(params.path, 'fileSearch', this.workspace, this.logging, approvedPaths)
     }
 
     public async invoke(params: FileSearchParams, token?: CancellationToken): Promise<InvokeOutput> {
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/fsRead.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/fsRead.ts
index f322e570ee..e1c46b93da 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/fsRead.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/fsRead.ts
@@ -40,10 +40,13 @@ export class FsRead {
         }
     }
 
-    public async requiresAcceptance(params: FsReadParams, approvedPaths?: Set<string>): Promise<CommandValidation> {
+    public async requiresAcceptance(
+        params: FsReadParams,
+        approvedPaths?: Map<string, Set<string>>
+    ): Promise<CommandValidation> {
         // Check acceptance for all paths in the array
         for (const path of params.paths) {
-            const validation = await requiresPathAcceptance(path, this.workspace, this.logging, approvedPaths)
+            const validation = await requiresPathAcceptance(path, 'fsRead', this.workspace, this.logging, approvedPaths)
             if (validation.requiresAcceptance) {
                 return validation
             }
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/fsReplace.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/fsReplace.ts
index 691fe7fd31..e0a0edbc85 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/fsReplace.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/fsReplace.ts
@@ -57,8 +57,11 @@ export class FsReplace {
         }
     }
 
-    public async requiresAcceptance(params: FsReplaceParams, approvedPaths?: Set<string>): Promise<CommandValidation> {
-        return requiresPathAcceptance(params.path, this.workspace, this.logging, approvedPaths)
+    public async requiresAcceptance(
+        params: FsReplaceParams,
+        approvedPaths?: Map<string, Set<string>>
+    ): Promise<CommandValidation> {
+        return requiresPathAcceptance(params.path, 'fsReplace', this.workspace, this.logging, approvedPaths)
     }
 
     private async handleReplace(params: ReplaceParams, sanitizedPath: string): Promise<void> {
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/fsWrite.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/fsWrite.ts
index e319d360a1..a60d3699b3 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/fsWrite.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/fsWrite.ts
@@ -94,8 +94,11 @@ export class FsWrite {
         updateWriter.releaseLock()
     }
 
-    public async requiresAcceptance(params: FsWriteParams, approvedPaths?: Set<string>): Promise<CommandValidation> {
-        return requiresPathAcceptance(params.path, this.workspace, this.logging, approvedPaths)
+    public async requiresAcceptance(
+        params: FsWriteParams,
+        approvedPaths?: Map<string, Set<string>>
+    ): Promise<CommandValidation> {
+        return requiresPathAcceptance(params.path, 'fsWrite', this.workspace, this.logging, approvedPaths)
     }
 
     private async handleCreate(params: CreateParams, sanitizedPath: string): Promise<void> {
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/listDirectory.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/listDirectory.ts
index 859b8049ae..94cd3fdc12 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/listDirectory.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/listDirectory.ts
@@ -53,9 +53,9 @@ export class ListDirectory {
 
     public async requiresAcceptance(
         params: ListDirectoryParams,
-        approvedPaths?: Set<string>
+        approvedPaths?: Map<string, Set<string>>
     ): Promise<CommandValidation> {
-        return requiresPathAcceptance(params.path, this.workspace, this.logging, approvedPaths)
+        return requiresPathAcceptance(params.path, 'listDirectory', this.workspace, this.logging, approvedPaths)
     }
 
     public async invoke(params: ListDirectoryParams, token?: CancellationToken): Promise<InvokeOutput> {
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/toolShared.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/toolShared.test.ts
index db12220186..59e04c1647 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/toolShared.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/toolShared.test.ts
@@ -14,39 +14,39 @@ import { Context } from 'mocha'
 describe('toolShared', () => {
     describe('isPathApproved', () => {
         it('should return false if approvedPaths is undefined', () => {
-            assert.strictEqual(isPathApproved('/test/path', undefined), false)
+            assert.strictEqual(isPathApproved('/test/path', 'testTool', undefined), false)
         })
 
         it('should return false if approvedPaths is empty', () => {
-            assert.strictEqual(isPathApproved('/test/path', new Set()), false)
+            assert.strictEqual(isPathApproved('/test/path', 'testTool', new Map()), false)
         })
 
-        it('should return true if the exact path is in approved paths', () => {
-            const approvedPaths = new Set(['/test/path'])
+        it('should return true if the exact path is approved for the specific tool', () => {
+            const approvedPaths = new Map([['testTool', new Set(['/test/path'])]])
             const filePath = '/test/path'
 
-            assert.strictEqual(isPathApproved(filePath, approvedPaths), true)
+            assert.strictEqual(isPathApproved(filePath, 'testTool', approvedPaths), true)
         })
 
         it('should return true if a path is a parent folder', () => {
-            const approvedPaths = new Set(['/test'])
+            const approvedPaths = new Map([['testTool', new Set(['/test'])]])
             const filePath = '/test/path/file.js'
 
-            assert.strictEqual(isPathApproved(filePath, approvedPaths), true)
+            assert.strictEqual(isPathApproved(filePath, 'testTool', approvedPaths), true)
         })
 
         it('should handle paths with trailing slashes', () => {
-            const approvedPaths = new Set(['/test/'])
+            const approvedPaths = new Map([['testTool', new Set(['/test/'])]])
             const filePath = '/test/path/file.js'
 
-            assert.strictEqual(isPathApproved(filePath, approvedPaths), true)
+            assert.strictEqual(isPathApproved(filePath, 'testTool', approvedPaths), true)
         })
 
         it('should handle paths without trailing slashes', () => {
-            const approvedPaths = new Set(['/test'])
+            const approvedPaths = new Map([['testTool', new Set(['/test'])]])
             const filePath = '/test/path/file.js'
 
-            assert.strictEqual(isPathApproved(filePath, approvedPaths), true)
+            assert.strictEqual(isPathApproved(filePath, 'testTool', approvedPaths), true)
         })
 
         it('should normalize Windows-style paths', function (this: Context) {
@@ -56,45 +56,45 @@ describe('toolShared', () => {
                 return
             }
 
-            const approvedPaths = new Set(['C:/test'])
+            const approvedPaths = new Map([['testTool', new Set(['C:/test'])]])
             const filePath = 'C:\\test\\path\\file.js'
 
-            assert.strictEqual(isPathApproved(filePath, approvedPaths), true)
+            assert.strictEqual(isPathApproved(filePath, 'testTool', approvedPaths), true)
         })
 
         it('should match normalized paths with different trailing slashes', () => {
             // Test with trailing slash in approvedPaths but not in filePath
-            const approvedPaths = new Set(['/test/path/'])
+            const approvedPaths = new Map([['testTool', new Set(['/test/path/'])]])
             const filePath = '/test/path'
 
             // For this test, we need to manually add both paths to the Set
             // since the function doesn't automatically normalize trailing slashes for exact matches
-            approvedPaths.add('/test/path')
+            approvedPaths.get('testTool')?.add('/test/path')
 
-            assert.strictEqual(isPathApproved(filePath, approvedPaths), true)
+            assert.strictEqual(isPathApproved(filePath, 'testTool', approvedPaths), true)
 
             // Test with trailing slash in filePath but not in approvedPaths
-            const approvedPaths2 = new Set(['/test/path'])
+            const approvedPaths2 = new Map([['testTool', new Set(['/test/path'])]])
             const filePath2 = '/test/path/'
 
             // For this test, we need to manually add both paths to the Set
-            approvedPaths2.add('/test/path/')
+            approvedPaths2.get('testTool')!.add('/test/path/')
 
-            assert.strictEqual(isPathApproved(filePath2, approvedPaths2), true)
+            assert.strictEqual(isPathApproved(filePath2, 'testTool', approvedPaths2), true)
         })
 
         it('should work with multiple approved paths', () => {
-            const approvedPaths = new Set(['/path1', '/path2', '/path3/subdir'])
+            const approvedPaths = new Map([['testTool', new Set(['/path1', '/path2', '/path3/subdir'])]])
             const filePath = '/path3/subdir/file.js'
 
-            assert.strictEqual(isPathApproved(filePath, approvedPaths), true)
+            assert.strictEqual(isPathApproved(filePath, 'testTool', approvedPaths), true)
         })
 
         it('should respect case sensitivity appropriately', function (this: Context) {
             // This test depends on the platform's case sensitivity
             // On Windows (case-insensitive), '/Test/Path' should match '/test/path'
             // On Unix (case-sensitive), they should not match
-            const approvedPaths = new Set(['/Test/Path'])
+            const approvedPaths = new Map([['testTool', new Set(['/Test/Path'])]])
             const filePath = '/test/path'
 
             if (process.platform === 'win32') {
@@ -104,23 +104,23 @@ describe('toolShared', () => {
                 isParentFolderStub.returns(true)
 
                 try {
-                    assert.strictEqual(isPathApproved(filePath, approvedPaths), true)
+                    assert.strictEqual(isPathApproved(filePath, 'testTool', approvedPaths), true)
                 } finally {
                     isParentFolderStub.restore()
                 }
             } else {
                 // On Unix, paths are case-sensitive
                 const isParent = workspaceUtils.isParentFolder('/Test/Path', filePath)
-                assert.strictEqual(isPathApproved(filePath, approvedPaths), isParent)
+                assert.strictEqual(isPathApproved(filePath, 'testTool', approvedPaths), isParent)
             }
         })
 
         it('should handle root directory as approved path', () => {
             const rootDir = path.parse('/some/file.js').root // Should be '/'
-            const approvedPaths = new Set([rootDir])
+            const approvedPaths = new Map([['testTool', new Set([rootDir])]])
             const filePath = '/some/file.js'
 
-            assert.strictEqual(isPathApproved(filePath, approvedPaths), true)
+            assert.strictEqual(isPathApproved(filePath, 'testTool', approvedPaths), true)
         })
 
         it('should handle mixed path separators', function (this: Context) {
@@ -131,10 +131,10 @@ describe('toolShared', () => {
             }
 
             // Unix path in approvedPaths, Windows path in filePath
-            const approvedPaths = new Set(['/test/path'])
+            const approvedPaths = new Map([['testTool', new Set(['/test/path'])]])
             const filePath = '/test\\path\\file.js'
 
-            assert.strictEqual(isPathApproved(filePath, approvedPaths), true)
+            assert.strictEqual(isPathApproved(filePath, 'testTool', approvedPaths), true)
         })
     })
 
@@ -202,13 +202,14 @@ describe('toolShared', () => {
 
         it('should return requiresAcceptance=false if path is already approved', async () => {
             const filePath = '/some/path/file.js'
-            const approvedPaths = new Set(['/some/path'])
+            const approvedPaths = new Map([['testTool', new Set(['/some/path'])]])
 
             // Make isPathApproved return true
             isPathApprovedStub.returns(true)
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging'],
                 approvedPaths
@@ -228,6 +229,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -250,6 +252,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -275,6 +278,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -295,6 +299,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -315,6 +320,7 @@ describe('toolShared', () => {
             // This should not throw even though logging is undefined
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 undefined as unknown as Features['logging']
             )
@@ -330,6 +336,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -342,6 +349,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -359,6 +367,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -375,6 +384,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'listDirectory',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -388,6 +398,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -401,6 +412,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -414,6 +426,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -427,6 +440,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -440,6 +454,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -455,6 +470,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -469,6 +485,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -483,6 +500,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -495,6 +513,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -510,6 +529,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -523,6 +543,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -536,6 +557,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -549,6 +571,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -564,6 +587,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -579,6 +603,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -594,6 +619,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -608,6 +634,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -623,6 +650,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -637,6 +665,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -651,6 +680,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -665,6 +695,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -682,6 +713,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -699,6 +731,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -716,6 +749,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -734,6 +768,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -751,6 +786,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -768,6 +804,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
@@ -781,6 +818,7 @@ describe('toolShared', () => {
 
             const result = await requiresPathAcceptance(
                 filePath,
+                'testTool',
                 mockWorkspace,
                 mockLogging as unknown as Features['logging']
             )
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/toolShared.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/toolShared.ts
index 3dbfa3bb88..81ede54582 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/toolShared.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/toolShared.ts
@@ -50,21 +50,27 @@ export enum OutputKind {
 }
 
 /**
- * Checks if a path has already been approved
+ * Checks if a path has already been approved for a specific tool
  * @param path The path to check
- * @param approvedPaths Set of approved paths
- * @returns True if the path or any parent directory has been approved
+ * @param toolName The name of the tool requesting access
+ * @param approvedPaths Map of tool names to their approved paths
+ * @returns True if the path or any parent directory has been approved for this tool
  */
-export function isPathApproved(filePath: string, approvedPaths?: Set<string>): boolean {
+export function isPathApproved(filePath: string, toolName: string, approvedPaths?: Map<string, Set<string>>): boolean {
     if (!approvedPaths || approvedPaths.size === 0) {
         return false
     }
 
+    const toolPaths = approvedPaths.get(toolName)
+    if (!toolPaths || toolPaths.size === 0) {
+        return false
+    }
+
     // Normalize path separators for consistent comparison
     const normalizedFilePath = filePath.replace(/\\\\/g, '/')
 
-    // Check if the exact path is approved (try both original and normalized)
-    if (approvedPaths.has(filePath) || approvedPaths.has(normalizedFilePath)) {
+    // Check if the exact path is approved for this tool
+    if (toolPaths.has(filePath) || toolPaths.has(normalizedFilePath)) {
         return true
     }
 
@@ -72,7 +78,7 @@ export function isPathApproved(filePath: string, approvedPaths?: Set<string>): b
     const rootDir = path.parse(filePath).root.replace(/\\\\/g, '/')
 
     // Check if any approved path is a parent of the file path using isParentFolder
-    for (const approvedPath of approvedPaths) {
+    for (const approvedPath of toolPaths) {
         const normalizedApprovedPath = approvedPath.replace(/\\\\/g, '/')
 
         // Check using the isParentFolder utility
@@ -105,24 +111,26 @@ export function isPathApproved(filePath: string, approvedPaths?: Set<string>): b
  * If the path has already been approved (in approvedPaths), returns false.
  *
  * @param path The file path to check
- * @param lsp The LSP feature to get workspace folders
+ * @param toolName The name of the tool requesting access
+ * @param workspace The workspace feature to get workspace folders
  * @param logging Optional logging feature for better error reporting
- * @param approvedPaths Optional set of paths that have already been approved
+ * @param approvedPaths Optional map of tool names to their approved paths
  * @returns CommandValidation object with requiresAcceptance flag
  */
 export async function requiresPathAcceptance(
     inputPath: string,
+    toolName: string,
     workspace: Features['workspace'],
     logging: Features['logging'],
-    approvedPaths?: Set<string>
+    approvedPaths?: Map<string, Set<string>>
 ): Promise<CommandValidation> {
     try {
         // Canonicalize the path first to resolve any ".." traversal sequences.
         // This prevents bypasses like "/workspace/../../etc" appearing to be in-workspace.
         const canonicalPath = path.resolve(inputPath)
 
-        // First check if the path is already approved
-        if (isPathApproved(canonicalPath, approvedPaths)) {
+        // Then check if the path is already approved for this specific tool
+        if (isPathApproved(canonicalPath, toolName, approvedPaths)) {
             return { requiresAcceptance: false }
         }
 
diff --git a/server/aws-lsp-codewhisperer/src/language-server/chat/chatSessionService.test.ts b/server/aws-lsp-codewhisperer/src/language-server/chat/chatSessionService.test.ts
index 6cc86b31c6..51e15f1a78 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/chat/chatSessionService.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/chat/chatSessionService.test.ts
@@ -259,24 +259,26 @@ describe('Chat Session Service', () => {
             chatSessionService = new ChatSessionService()
         })
 
-        it('should initialize with an empty set of approved paths', () => {
+        it('should initialize with an empty map of approved paths', () => {
             const approvedPaths = chatSessionService.approvedPaths
             assert.strictEqual(approvedPaths.size, 0)
-            assert.ok(approvedPaths instanceof Set)
+            assert.ok(approvedPaths instanceof Map)
         })
 
         it('should add a path to approved paths', () => {
             const testPath = '/test/path/file.js'
-            chatSessionService.addApprovedPath(testPath)
+            const toolName = 'testTool'
+            chatSessionService.addApprovedPath(testPath, toolName)
 
             const approvedPaths = chatSessionService.approvedPaths
             assert.strictEqual(approvedPaths.size, 1)
-            assert.ok(approvedPaths.has(testPath))
+            assert.ok(approvedPaths.has(toolName))
+            assert.ok(approvedPaths.get(toolName)!.has(testPath))
         })
 
         it('should not add empty paths', () => {
-            chatSessionService.addApprovedPath('')
-            chatSessionService.addApprovedPath(undefined as unknown as string)
+            chatSessionService.addApprovedPath('', 'testTool')
+            chatSessionService.addApprovedPath(undefined as unknown as string, 'testTool')
 
             const approvedPaths = chatSessionService.approvedPaths
             assert.strictEqual(approvedPaths.size, 0)
@@ -285,47 +287,61 @@ describe('Chat Session Service', () => {
         it('should normalize Windows-style paths', () => {
             const windowsPath = 'C:\\Users\\test\\file.js'
             const normalizedPath = 'C:/Users/test/file.js'
+            const toolName = 'testTool'
 
-            chatSessionService.addApprovedPath(windowsPath)
+            chatSessionService.addApprovedPath(windowsPath, toolName)
 
             const approvedPaths = chatSessionService.approvedPaths
             assert.strictEqual(approvedPaths.size, 1)
-            assert.ok(approvedPaths.has(normalizedPath))
-            assert.ok(!approvedPaths.has(windowsPath))
+            assert.ok(approvedPaths.has(toolName))
+            assert.ok(approvedPaths.get(toolName)!.has(normalizedPath))
+            assert.ok(!approvedPaths.get(toolName)!.has(windowsPath))
         })
 
         it('should handle multiple paths correctly', () => {
             const paths = ['/path/one/file.js', '/path/two/file.js', 'C:\\path\\three\\file.js']
+            const toolName = 'testTool'
 
-            paths.forEach(p => chatSessionService.addApprovedPath(p))
+            paths.forEach(p => chatSessionService.addApprovedPath(p, toolName))
 
             const approvedPaths = chatSessionService.approvedPaths
-            assert.strictEqual(approvedPaths.size, 3)
-            assert.ok(approvedPaths.has(paths[0]))
-            assert.ok(approvedPaths.has(paths[1]))
-            assert.ok(approvedPaths.has('C:/path/three/file.js'))
+            assert.strictEqual(approvedPaths.size, 1)
+            assert.ok(approvedPaths.has(toolName))
+            const toolPaths = approvedPaths.get(toolName)!
+            assert.strictEqual(toolPaths.size, 3)
+            assert.ok(toolPaths.has(paths[0]))
+            assert.ok(toolPaths.has(paths[1]))
+            assert.ok(toolPaths.has('C:/path/three/file.js'))
         })
 
         it('should not add duplicate paths', () => {
             const testPath = '/test/path/file.js'
+            const toolName = 'testTool'
 
-            chatSessionService.addApprovedPath(testPath)
-            chatSessionService.addApprovedPath(testPath)
+            chatSessionService.addApprovedPath(testPath, toolName)
+            chatSessionService.addApprovedPath(testPath, toolName)
 
             const approvedPaths = chatSessionService.approvedPaths
             assert.strictEqual(approvedPaths.size, 1)
+            assert.ok(approvedPaths.has(toolName))
+            const toolPaths = approvedPaths.get(toolName)!
+            assert.strictEqual(toolPaths.size, 1)
         })
 
         it('should treat normalized paths as the same path', () => {
             const unixPath = '/test/path/file.js'
             const windowsPath = '/test\\path\\file.js'
+            const toolName = 'testTool'
 
-            chatSessionService.addApprovedPath(unixPath)
-            chatSessionService.addApprovedPath(windowsPath)
+            chatSessionService.addApprovedPath(unixPath, toolName)
+            chatSessionService.addApprovedPath(windowsPath, toolName)
 
             const approvedPaths = chatSessionService.approvedPaths
             assert.strictEqual(approvedPaths.size, 1)
-            assert.ok(approvedPaths.has(unixPath))
+            assert.ok(approvedPaths.has(toolName))
+            const toolPaths = approvedPaths.get(toolName)!
+            assert.strictEqual(toolPaths.size, 1)
+            assert.ok(toolPaths.has(unixPath))
         })
     })
 
diff --git a/server/aws-lsp-codewhisperer/src/language-server/chat/chatSessionService.ts b/server/aws-lsp-codewhisperer/src/language-server/chat/chatSessionService.ts
index 8f1db91187..716bd2a7c7 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/chat/chatSessionService.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/chat/chatSessionService.ts
@@ -44,7 +44,7 @@ export class ChatSessionService {
     > = new Map()
     #currentUndoAllId?: string
     // Map to store approved paths to avoid repeated validation
-    #approvedPaths: Set<string> = new Set<string>()
+    #approvedPaths: Map<string, Set<string>> = new Map<string, Set<string>>()
     #serviceManager?: AmazonQBaseServiceManager
     #logging?: Logging
     #origin?: Origin
@@ -113,24 +113,30 @@ export class ChatSessionService {
     }
 
     /**
-     * Gets the set of approved paths for this session
+     * Gets the map of approved paths for this session
      */
-    public get approvedPaths(): Set<string> {
+    public get approvedPaths(): Map<string, Set<string>> {
         return this.#approvedPaths
     }
 
     /**
      * Adds a path to the approved paths list for this session
      * @param filePath The absolute path to add
+     * @param toolName The name of the tool that should have access to this path
      */
-    public addApprovedPath(filePath: string): void {
-        if (!filePath) {
+    public addApprovedPath(filePath: string, toolName: string): void {
+        if (!filePath || !toolName) {
             return
         }
 
         // Normalize path separators for consistent comparison
         const normalizedPath = filePath.replace(/\\/g, '/')
-        this.#approvedPaths.add(normalizedPath)
+
+        if (!this.#approvedPaths.has(toolName)) {
+            this.#approvedPaths.set(toolName, new Set<string>())
+        }
+
+        this.#approvedPaths.get(toolName)!.add(normalizedPath)
     }
 
     constructor(serviceManager?: AmazonQBaseServiceManager, lsp?: Features['lsp'], logging?: Logging) {

From 86aa1aeebd866a720f13918ad462465c79aee256 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 1 Apr 2026 11:46:07 -0700
Subject: [PATCH 08/23] chore(release): release packages from branch main
 (#2681)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 .release-please-manifest.json             |  2 +-
 package-lock.json                         |  2 +-
 server/aws-lsp-codewhisperer/CHANGELOG.md | 17 +++++++++++++++++
 server/aws-lsp-codewhisperer/package.json |  2 +-
 4 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 62c154cd04..e6fd570777 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -2,7 +2,7 @@
     "chat-client": "0.1.50",
     "core/aws-lsp-core": "0.0.21",
     "server/aws-lsp-antlr4": "0.1.25",
-    "server/aws-lsp-codewhisperer": "0.0.110",
+    "server/aws-lsp-codewhisperer": "0.0.111",
     "server/aws-lsp-json": "0.1.26",
     "server/aws-lsp-partiql": "0.0.23",
     "server/aws-lsp-yaml": "0.1.26"
diff --git a/package-lock.json b/package-lock.json
index 92ff66e849..80168d3166 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -31062,7 +31062,7 @@
         },
         "server/aws-lsp-codewhisperer": {
             "name": "@aws/lsp-codewhisperer",
-            "version": "0.0.110",
+            "version": "0.0.111",
             "bundleDependencies": [
                 "@amzn/codewhisperer",
                 "@amzn/codewhisperer-runtime",
diff --git a/server/aws-lsp-codewhisperer/CHANGELOG.md b/server/aws-lsp-codewhisperer/CHANGELOG.md
index a4d8f32f16..daeaf3e9de 100644
--- a/server/aws-lsp-codewhisperer/CHANGELOG.md
+++ b/server/aws-lsp-codewhisperer/CHANGELOG.md
@@ -1,5 +1,22 @@
 # Changelog
 
+## [0.0.111](https://github.com/aws/language-servers/compare/lsp-codewhisperer/v0.0.110...lsp-codewhisperer/v0.0.111) (2026-03-31)
+
+
+### Features
+
+* **amazonq:** align mcp oauth client with mcp sdk auth patterns ([#2679](https://github.com/aws/language-servers/issues/2679)) ([4ff5ab0](https://github.com/aws/language-servers/commit/4ff5ab0e6ab4bf1659ffdb07a72bba4d6c358339))
+
+
+### Bug Fixes
+
+* cache subscription status to prevent excessive CreateSubscriptionToken API calls ([#2680](https://github.com/aws/language-servers/issues/2680)) ([d26edb7](https://github.com/aws/language-servers/commit/d26edb7dfd321122515373e0d08b757f6e367561))
+
+
+### Reverts
+
+* undo revert of fix for tool permissions in allowed paths per tool ([#2601](https://github.com/aws/language-servers/issues/2601)) ([#2683](https://github.com/aws/language-servers/issues/2683)) ([#2684](https://github.com/aws/language-servers/issues/2684)) ([8a615fa](https://github.com/aws/language-servers/commit/8a615faf27c6b519045263f5bddf0bfe98f609e0))
+
 ## [0.0.110](https://github.com/aws/language-servers/compare/lsp-codewhisperer/v0.0.109...lsp-codewhisperer/v0.0.110) (2026-03-17)
 
 
diff --git a/server/aws-lsp-codewhisperer/package.json b/server/aws-lsp-codewhisperer/package.json
index 5fd0e3119e..727525cc0c 100644
--- a/server/aws-lsp-codewhisperer/package.json
+++ b/server/aws-lsp-codewhisperer/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@aws/lsp-codewhisperer",
-    "version": "0.0.110",
+    "version": "0.0.111",
     "description": "CodeWhisperer Language Server",
     "main": "out/index.js",
     "repository": {

From 263d342ad6a2690c74eff396fdb3621432d1a383 Mon Sep 17 00:00:00 2001
From: Will Lo <96078566+Will-ShaoHua@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:43:58 -0700
Subject: [PATCH 09/23] chore: bump agentic version: 1.63.0 (#2686)

Co-authored-by: aws-toolkit-automation <>
---
 app/aws-lsp-codewhisperer-runtimes/src/version.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/aws-lsp-codewhisperer-runtimes/src/version.json b/app/aws-lsp-codewhisperer-runtimes/src/version.json
index d93890028e..43968ed1d6 100644
--- a/app/aws-lsp-codewhisperer-runtimes/src/version.json
+++ b/app/aws-lsp-codewhisperer-runtimes/src/version.json
@@ -1,3 +1,3 @@
 {
-    "agenticChat": "1.62.0"
+    "agenticChat": "1.63.0"
 }

From f8dec9a65b7e72e78e5e16cbbfd470b2d69e75b0 Mon Sep 17 00:00:00 2001
From: Will Lo <96078566+Will-ShaoHua@users.noreply.github.com>
Date: Tue, 7 Apr 2026 11:31:22 -0700
Subject: [PATCH 10/23] perf(amazonq): context command performance (#2682)

* perf(amazonq): cap context command payload and throttle indexing updates

- Cap context commands sent to webview at 10,000 items
- Throttle onIndexingInProgressChanged with 500ms coalescing
- Cache full item list before applying cap for reuse
- Add preservation property-based tests
- Update unit tests for throttle behavior

* chore: error

* fix: newly added files are not be loaded

* fix: bugfix

* perf: handle context commands in server

* perf: add server-side filtering for context commands in large repos

* chore: bump language-server-runtimes, runtimes-types, and mynah-ui

* chore: remove redundant debug log

* fix: filter out externally deleted files from context command results

Files deleted outside the IDE (e.g. git revert/checkout) were not
removed from the cached context commands because LSP workspace file
operation events only fire for IDE-initiated deletions. Add an
fs.existsSync check when returning results to the client so stale
entries are excluded regardless of how the file was removed.

* chore: remove debug logs from context commands and indexing paths

* fix: scope filterContextCommandsResponse to requesting tab

Previously, filter responses updated contextCommands in all tabs,
causing a search in one tab to overwrite the default list in others.
Track the originating tabId and scope the store update accordingly.

* fix: address PR review feedback for context command filtering
---
 chat-client/package.json                      |   6 +-
 chat-client/src/client/chat.ts                |   9 +
 chat-client/src/client/messager.ts            |   6 +
 chat-client/src/client/mynahUi.test.ts        |   1 +
 chat-client/src/client/mynahUi.ts             |  31 +++
 chat-client/src/contracts/serverContracts.ts  |   4 +
 package-lock.json                             |  69 ++++-
 server/aws-lsp-codewhisperer/package.json     |   3 +-
 .../agenticChat/agenticChatController.ts      |   1 +
 ...ntextCommandsProvider.preservation.test.ts | 250 ++++++++++++++++++
 .../context/contextCommandsProvider.test.ts   |  13 +-
 .../context/contextCommandsProvider.ts        | 125 ++++++++-
 .../language-server/chat/chatController.ts    |   1 +
 13 files changed, 495 insertions(+), 24 deletions(-)
 create mode 100644 server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.preservation.test.ts

diff --git a/chat-client/package.json b/chat-client/package.json
index 81d62b2393..7deb22e579 100644
--- a/chat-client/package.json
+++ b/chat-client/package.json
@@ -25,9 +25,9 @@
     },
     "dependencies": {
         "@aws/chat-client-ui-types": "0.1.68",
-        "@aws/language-server-runtimes": "^0.3.14",
-        "@aws/language-server-runtimes-types": "^0.1.63",
-        "@aws/mynah-ui": "^4.39.2"
+        "@aws/language-server-runtimes": "^0.3.16",
+        "@aws/language-server-runtimes-types": "^0.1.64",
+        "@aws/mynah-ui": "^4.40.0"
     },
     "devDependencies": {
         "@types/jsdom": "^21.1.6",
diff --git a/chat-client/src/client/chat.ts b/chat-client/src/client/chat.ts
index 58519d96ef..ad88f42489 100644
--- a/chat-client/src/client/chat.ts
+++ b/chat-client/src/client/chat.ts
@@ -108,6 +108,9 @@ import {
     OPEN_FILE_DIALOG_METHOD,
     OpenFileDialogResult,
     EXECUTE_SHELL_COMMAND_SHORTCUT_METHOD,
+    FILTER_CONTEXT_COMMANDS_REQUEST_METHOD,
+    FilterContextCommandsParams,
+    FilterContextCommandsResult,
 } from '@aws/language-server-runtimes-types'
 import { ConfigTexts, MynahUIDataModel, MynahUITabStoreModel } from '@aws/mynah-ui'
 import { ServerMessage, TELEMETRY, TelemetryParams } from '../contracts/serverContracts'
@@ -215,6 +218,9 @@ export const createChat = (
             case CONTEXT_COMMAND_NOTIFICATION_METHOD:
                 mynahApi.sendContextCommands(message.params as ContextCommandParams)
                 break
+            case FILTER_CONTEXT_COMMANDS_REQUEST_METHOD:
+                mynahApi.filterContextCommandsResponse(message.params as FilterContextCommandsResult)
+                break
             case PINNED_CONTEXT_NOTIFICATION_METHOD:
                 mynahApi.sendPinnedContext(message.params as PinnedContextParams)
                 break
@@ -512,6 +518,9 @@ export const createChat = (
         onFilesDropped: (params: { tabId: string; files: FileList; insertPosition: number }) => {
             sendMessageToClient({ command: FILES_DROPPED, params: params })
         },
+        filterContextCommands: (params: FilterContextCommandsParams) => {
+            sendMessageToClient({ command: FILTER_CONTEXT_COMMANDS_REQUEST_METHOD, params })
+        },
     }
 
     const messager = new Messager(chatApi)
diff --git a/chat-client/src/client/messager.ts b/chat-client/src/client/messager.ts
index 9472881b87..9bc1fbfcaf 100644
--- a/chat-client/src/client/messager.ts
+++ b/chat-client/src/client/messager.ts
@@ -28,6 +28,7 @@ import {
     CreatePromptParams,
     FeedbackParams,
     FileClickParams,
+    FilterContextCommandsParams,
     FilterValue,
     FollowUpClickParams,
     GetSerializedChatResult,
@@ -112,6 +113,7 @@ export interface OutboundChatApi {
     onListAvailableModels(params: ListAvailableModelsParams): void
     onOpenFileDialogClick(params: OpenFileDialogParams): void
     onFilesDropped(params: { tabId: string; files: FileList; insertPosition: number }): void
+    filterContextCommands(params: FilterContextCommandsParams): void
 }
 
 export class Messager {
@@ -297,4 +299,8 @@ export class Messager {
     onFilesDropped = (params: { tabId: string; files: FileList; insertPosition: number }): void => {
         this.chatApi.onFilesDropped(params)
     }
+
+    onFilterContextCommands = (params: FilterContextCommandsParams): void => {
+        this.chatApi.filterContextCommands(params)
+    }
 }
diff --git a/chat-client/src/client/mynahUi.test.ts b/chat-client/src/client/mynahUi.test.ts
index 1f9f6c4e57..c7b0e0daa6 100644
--- a/chat-client/src/client/mynahUi.test.ts
+++ b/chat-client/src/client/mynahUi.test.ts
@@ -78,6 +78,7 @@ describe('MynahUI', () => {
             onListAvailableModels: sinon.stub(),
             onOpenFileDialogClick: sinon.stub(),
             onFilesDropped: sinon.stub(),
+            filterContextCommands: sinon.stub(),
         }
 
         messager = new Messager(outboundChatApi)
diff --git a/chat-client/src/client/mynahUi.ts b/chat-client/src/client/mynahUi.ts
index 7c330ea739..07326aafb1 100644
--- a/chat-client/src/client/mynahUi.ts
+++ b/chat-client/src/client/mynahUi.ts
@@ -36,6 +36,7 @@ import {
     RuleClickResult,
     SourceLinkClickParams,
     ListAvailableModelsResult,
+    FilterContextCommandsResult,
     ExecuteShellCommandParams,
 } from '@aws/language-server-runtimes-types'
 import {
@@ -100,6 +101,7 @@ export interface InboundChatApi {
     addSelectedFilesToContext(params: OpenFileDialogParams): void
     sendPinnedContext(params: PinnedContextParams): void
     listAvailableModels(params: ListAvailableModelsResult): void
+    filterContextCommandsResponse(params: FilterContextCommandsResult): void
 }
 
 type ContextCommandGroups = MynahUIDataModel['contextCommands']
@@ -321,6 +323,7 @@ export const createMynahUi = (
     let disclaimerCardActive = !disclaimerAcknowledged
     let programmingModeCardActive = !pairProgrammingCardAcknowledged
     let contextCommandGroups: ContextCommandGroups | undefined
+    let lastFilterTabId: string | undefined
 
     let chatEventHandlers: ChatEventHandler = {
         onCodeInsertToCursorPosition(
@@ -809,6 +812,10 @@ export const createMynahUi = (
         defaults: {
             store: tabFactory.createTab(false),
         },
+        onContextCommandFilter: (tabId, searchTerm) => {
+            lastFilterTabId = tabId
+            messager.onFilterContextCommands({ tabId, searchTerm })
+        },
         config: {
             maxTabs: 10,
             test: true,
@@ -1449,6 +1456,29 @@ ${params.message}`,
         })
     }
 
+    const filterContextCommandsResponse = (params: FilterContextCommandsResult) => {
+        if (!lastFilterTabId) return
+
+        const filtered = params.contextCommandGroups.map(group => ({
+            ...group,
+            commands: toContextCommands(group.commands),
+        }))
+
+        mynahUi.updateStore(lastFilterTabId, {
+            contextCommands: [
+                ...filtered,
+                ...(featureConfig?.get('highlightCommand')
+                    ? [
+                          {
+                              groupName: 'Additional commands',
+                              commands: [toMynahContextCommand(featureConfig.get('highlightCommand'))],
+                          },
+                      ]
+                    : []),
+            ],
+        })
+    }
+
     const addSelectedFilesToContext = (params: OpenFileDialogResult) => {
         if (params.errorMessage) {
             mynahUi.notify({
@@ -1605,6 +1635,7 @@ ${params.message}`,
         ruleClicked: ruleClicked,
         listAvailableModels: listAvailableModels,
         addSelectedFilesToContext: addSelectedFilesToContext,
+        filterContextCommandsResponse: filterContextCommandsResponse,
     }
 
     return [mynahUi, api]
diff --git a/chat-client/src/contracts/serverContracts.ts b/chat-client/src/contracts/serverContracts.ts
index af4675706b..93ba77513e 100644
--- a/chat-client/src/contracts/serverContracts.ts
+++ b/chat-client/src/contracts/serverContracts.ts
@@ -49,6 +49,8 @@ import {
     PINNED_CONTEXT_REMOVE_NOTIFICATION_METHOD,
     PinnedContextParams,
     LIST_AVAILABLE_MODELS_REQUEST_METHOD,
+    FILTER_CONTEXT_COMMANDS_REQUEST_METHOD,
+    FilterContextCommandsParams,
 } from '@aws/language-server-runtimes-types'
 
 export const TELEMETRY = 'telemetry/event'
@@ -83,6 +85,7 @@ export type ServerMessageCommand =
     | typeof PINNED_CONTEXT_REMOVE_NOTIFICATION_METHOD
     | typeof LIST_AVAILABLE_MODELS_REQUEST_METHOD
     | typeof OPEN_FILE_DIALOG_METHOD
+    | typeof FILTER_CONTEXT_COMMANDS_REQUEST_METHOD
 
 export interface ServerMessage {
     command: ServerMessageCommand
@@ -119,3 +122,4 @@ export type ServerMessageParams =
     | ListRulesParams
     | PinnedContextParams
     | OpenFileDialogParams
+    | FilterContextCommandsParams
diff --git a/package-lock.json b/package-lock.json
index 80168d3166..cbb16508b0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -255,9 +255,9 @@
             "license": "Apache-2.0",
             "dependencies": {
                 "@aws/chat-client-ui-types": "0.1.68",
-                "@aws/language-server-runtimes": "^0.3.14",
-                "@aws/language-server-runtimes-types": "^0.1.63",
-                "@aws/mynah-ui": "^4.39.2"
+                "@aws/language-server-runtimes": "^0.3.16",
+                "@aws/language-server-runtimes-types": "^0.1.64",
+                "@aws/mynah-ui": "^4.40.0"
             },
             "devDependencies": {
                 "@types/jsdom": "^21.1.6",
@@ -4506,12 +4506,12 @@
             }
         },
         "node_modules/@aws/language-server-runtimes": {
-            "version": "0.3.15",
-            "resolved": "https://registry.npmjs.org/@aws/language-server-runtimes/-/language-server-runtimes-0.3.15.tgz",
-            "integrity": "sha512-72Ip/eKqNP02CWHROQTu47NKg2x1AibON63WvDabqXSL1EgUt7nq6as44fwyFW1iSrtIe6Ao9/Odqgp/SpZS7w==",
+            "version": "0.3.16",
+            "resolved": "https://registry.npmjs.org/@aws/language-server-runtimes/-/language-server-runtimes-0.3.16.tgz",
+            "integrity": "sha512-i5Rlnq1VUWpihGyd65o5gRqA8rxnkWZkx0WLsBCpuD9Lpztscwq2Si6f1dhhKK59905nG/xNE1xvRVAlXxc0IA==",
             "license": "Apache-2.0",
             "dependencies": {
-                "@aws/language-server-runtimes-types": "^0.1.63",
+                "@aws/language-server-runtimes-types": "^0.1.64",
                 "@opentelemetry/api": "^1.9.0",
                 "@opentelemetry/api-logs": "^0.200.0",
                 "@opentelemetry/core": "^2.0.0",
@@ -4535,9 +4535,9 @@
             }
         },
         "node_modules/@aws/language-server-runtimes-types": {
-            "version": "0.1.63",
-            "resolved": "https://registry.npmjs.org/@aws/language-server-runtimes-types/-/language-server-runtimes-types-0.1.63.tgz",
-            "integrity": "sha512-0Aeh0rQF4nOWXB0IlvroBoldlDaXsMvrZ4Ec3zgaU8wqlnh+WSDJiVPTgB1zCqPbDNybZxh7Z8nGh133hxk+FA==",
+            "version": "0.1.64",
+            "resolved": "https://registry.npmjs.org/@aws/language-server-runtimes-types/-/language-server-runtimes-types-0.1.64.tgz",
+            "integrity": "sha512-IlolDHTp1A0TbZ0EIMyWlEUvpmgbAnJDFHjXouiGF62qIw265EnZFcV71+Xu/kS5DX6lsigQ8oBCMET8pRsiHA==",
             "license": "Apache-2.0",
             "dependencies": {
                 "vscode-languageserver-textdocument": "^1.0.12",
@@ -4633,9 +4633,9 @@
             "link": true
         },
         "node_modules/@aws/mynah-ui": {
-            "version": "4.39.2",
-            "resolved": "https://registry.npmjs.org/@aws/mynah-ui/-/mynah-ui-4.39.2.tgz",
-            "integrity": "sha512-IP+wnU+TwtSVdEFm/IHd9ZY5xWnndbHqZjelnZIRFGFNninKXxSol94ZroN9F3czzhYqr2rcgL8Ti6j3otrQeQ==",
+            "version": "4.40.0",
+            "resolved": "https://registry.npmjs.org/@aws/mynah-ui/-/mynah-ui-4.40.0.tgz",
+            "integrity": "sha512-KDUcm4P9j734Xxm08yIr2E6pLXZ0Ist1YdYO6ysohO9rJLpdckhDvrYRIE5OnaHRxCUHrBliWCW0AVvegKsIhA==",
             "hasInstallScript": true,
             "license": "Apache License 2.0",
             "dependencies": {
@@ -18045,6 +18045,46 @@
                 "url": "https://github.com/sponsors/sindresorhus"
             }
         },
+        "node_modules/fast-check": {
+            "version": "4.6.0",
+            "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-4.6.0.tgz",
+            "integrity": "sha512-h7H6Dm0Fy+H4ciQYFxFjXnXkzR2kr9Fb22c0UBpHnm59K2zpr2t13aPTHlltFiNT6zuxp6HMPAVVvgur4BLdpA==",
+            "dev": true,
+            "funding": [
+                {
+                    "type": "individual",
+                    "url": "https://github.com/sponsors/dubzzz"
+                },
+                {
+                    "type": "opencollective",
+                    "url": "https://opencollective.com/fast-check"
+                }
+            ],
+            "license": "MIT",
+            "dependencies": {
+                "pure-rand": "^8.0.0"
+            },
+            "engines": {
+                "node": ">=12.17.0"
+            }
+        },
+        "node_modules/fast-check/node_modules/pure-rand": {
+            "version": "8.4.0",
+            "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-8.4.0.tgz",
+            "integrity": "sha512-IoM8YF/jY0hiugFo/wOWqfmarlE6J0wc6fDK1PhftMk7MGhVZl88sZimmqBBFomLOCSmcCCpsfj7wXASCpvK9A==",
+            "dev": true,
+            "funding": [
+                {
+                    "type": "individual",
+                    "url": "https://github.com/sponsors/dubzzz"
+                },
+                {
+                    "type": "opencollective",
+                    "url": "https://opencollective.com/fast-check"
+                }
+            ],
+            "license": "MIT"
+        },
         "node_modules/fast-deep-equal": {
             "version": "3.1.3",
             "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -31082,7 +31122,7 @@
                 "@aws-sdk/util-arn-parser": "^3.723.0",
                 "@aws-sdk/util-retry": "^3.374.0",
                 "@aws/chat-client-ui-types": "0.1.68",
-                "@aws/language-server-runtimes": "^0.3.14",
+                "@aws/language-server-runtimes": "^0.3.16",
                 "@aws/lsp-core": "^0.0.21",
                 "@modelcontextprotocol/sdk": "^1.23.0",
                 "@mozilla/readability": "^0.6.0",
@@ -31129,6 +31169,7 @@
                 "assert": "^2.1.0",
                 "c8": "^10.1.2",
                 "copyfiles": "^2.4.1",
+                "fast-check": "^4.6.0",
                 "mock-fs": "^5.2.0",
                 "sinon": "^19.0.2",
                 "ts-loader": "^9.4.4",
diff --git a/server/aws-lsp-codewhisperer/package.json b/server/aws-lsp-codewhisperer/package.json
index 727525cc0c..5d429c62bd 100644
--- a/server/aws-lsp-codewhisperer/package.json
+++ b/server/aws-lsp-codewhisperer/package.json
@@ -38,7 +38,7 @@
         "@aws-sdk/util-arn-parser": "^3.723.0",
         "@aws-sdk/util-retry": "^3.374.0",
         "@aws/chat-client-ui-types": "0.1.68",
-        "@aws/language-server-runtimes": "^0.3.14",
+        "@aws/language-server-runtimes": "^0.3.16",
         "@aws/lsp-core": "^0.0.21",
         "@modelcontextprotocol/sdk": "^1.23.0",
         "@mozilla/readability": "^0.6.0",
@@ -85,6 +85,7 @@
         "assert": "^2.1.0",
         "c8": "^10.1.2",
         "copyfiles": "^2.4.1",
+        "fast-check": "^4.6.0",
         "mock-fs": "^5.2.0",
         "sinon": "^19.0.2",
         "ts-loader": "^9.4.4",
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
index 5ea3c51782..ebd415e5af 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
@@ -254,6 +254,7 @@ type ChatHandlers = Omit<
     | 'onPinnedContextAdd'
     | 'onPinnedContextRemove'
     | 'onOpenFileDialog'
+    | 'onFilterContextCommands'
     | 'onListAvailableModels'
     | 'sendSubscriptionDetails'
     | 'onSubscriptionUpgrade'
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.preservation.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.preservation.test.ts
new file mode 100644
index 0000000000..5494b8c884
--- /dev/null
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.preservation.test.ts
@@ -0,0 +1,250 @@
+/**
+ * Preservation Property-Based Tests — Context Commands Provider Small Payload Behavior
+ *
+ * These tests capture the OBSERVED behavior of processContextCommandUpdate and
+ * mapContextCommandItems on unfixed code for non-buggy inputs (small payloads).
+ * They must PASS on unfixed code to confirm baseline behavior that must be preserved.
+ *
+ * **Validates: Requirements 3.2, 3.3, 3.5, 3.6**
+ */
+import * as fc from 'fast-check'
+import * as sinon from 'sinon'
+import { ContextCommandsProvider } from './contextCommandsProvider'
+import { TestFeatures } from '@aws/language-server-runtimes/testing'
+import * as chokidar from 'chokidar'
+import { ContextCommandItem } from 'local-indexing'
+import { LocalProjectContextController } from '../../../shared/localProjectContextController'
+
+/** Arbitrary for ContextCommandItem type */
+const contextItemTypeArb = fc.constantFrom('file' as const, 'folder' as const)
+
+/** Arbitrary for a single ContextCommandItem (file or folder) */
+const contextCommandItemArb = fc
+    .tuple(
+        fc.constantFrom('/workspace/project1', '/workspace/project2', '/workspace/myapp'),
+        contextItemTypeArb,
+        fc
+            .tuple(
+                fc.constantFrom('src', 'lib', 'test', 'docs', 'utils'),
+                fc.constantFrom('index', 'main', 'helper', 'config', 'service'),
+                fc.constantFrom('.ts', '.js', '.json', '.md')
+            )
+            .map(([dir, name, ext]) => `${dir}/${name}${ext}`),
+        fc.uuid()
+    )
+    .map(
+        ([workspaceFolder, type, relativePath, id]): ContextCommandItem => ({
+            workspaceFolder,
+            type,
+            relativePath,
+            id,
+        })
+    )
+
+/** Arbitrary for a small list of context command items (<1,000) */
+const smallContextItemsArb = fc.array(contextCommandItemArb, { minLength: 0, maxLength: 200 })
+
+describe('Preservation: Context Commands Provider Small Payload Behavior', () => {
+    let provider: ContextCommandsProvider
+    let testFeatures: TestFeatures
+    let sendContextCommandsSpy: sinon.SinonStub
+
+    beforeEach(() => {
+        sinon.stub(chokidar, 'watch').returns({
+            on: sinon.stub(),
+            close: sinon.stub(),
+        } as unknown as chokidar.FSWatcher)
+
+        testFeatures = new TestFeatures()
+        testFeatures.workspace.fs.exists = sinon.stub().resolves(false)
+        testFeatures.workspace.fs.readdir = sinon.stub().resolves([])
+
+        sinon.stub(LocalProjectContextController, 'getInstance').resolves({
+            onContextItemsUpdated: sinon.stub(),
+            onIndexingInProgressChanged: sinon.stub(),
+        } as any)
+
+        provider = new ContextCommandsProvider(
+            testFeatures.logging,
+            testFeatures.chat,
+            testFeatures.workspace,
+            testFeatures.lsp
+        )
+        sinon.stub(provider, 'registerPromptFileWatcher').resolves()
+
+        // testFeatures.chat.sendContextCommands is already a stub, so wrap it with a spy
+        sendContextCommandsSpy = testFeatures.chat.sendContextCommands as unknown as sinon.SinonStub
+    })
+
+    afterEach(() => {
+        sinon.restore()
+    })
+
+    /**
+     * **Validates: Requirements 3.2, 3.3**
+     *
+     * Property 2d: For all context item lists with <1,000 items,
+     * mapContextCommandItems correctly categorizes items into Files, Folders,
+     * and Code groups, and all items are present in the output.
+     */
+    it('mapContextCommandItems categorizes all small payload items correctly', async () => {
+        await fc.assert(
+            fc.asyncProperty(smallContextItemsArb, async items => {
+                const result = await provider.mapContextCommandItems(items)
+
+                // Result should have exactly one top-level group
+                if (result.length !== 1) return false
+
+                const topCommands = result[0].commands ?? []
+
+                // Find the Files, Folders, and Code command groups
+                const filesCmd = topCommands.find(cmd => cmd.command === 'Files')
+                const foldersCmd = topCommands.find(cmd => cmd.command === 'Folders')
+                const codeCmd = topCommands.find(cmd => cmd.command === 'Code')
+
+                if (!filesCmd || !foldersCmd || !codeCmd) return false
+
+                const fileChildren = filesCmd.children?.[0]?.commands ?? []
+                const folderChildren = foldersCmd.children?.[0]?.commands ?? []
+                const codeChildren = codeCmd.children?.[0]?.commands ?? []
+
+                // Count expected items by type
+                const expectedFiles = items.filter(i => i.type === 'file').length
+                const expectedFolders = items.filter(i => i.type === 'folder').length
+                const expectedCode = items.filter(i => i.type === 'code').length
+
+                // Files group has +1 for the "Active File" command
+                if (fileChildren.length !== expectedFiles + 1) return false
+                if (folderChildren.length !== expectedFolders) return false
+                if (codeChildren.length !== expectedCode) return false
+
+                return true
+            }),
+            { numRuns: 30 }
+        )
+    })
+
+    /**
+     * **Validates: Requirements 3.2**
+     *
+     * Property 2e: For all valid context item selections, processContextCommandUpdate
+     * sends the full payload to the webview via chat.sendContextCommands and caches items.
+     */
+    it('processContextCommandUpdate sends all items and caches them for small payloads', async () => {
+        await fc.assert(
+            fc.asyncProperty(smallContextItemsArb, async items => {
+                sendContextCommandsSpy.resetHistory()
+
+                await provider.processContextCommandUpdate(items)
+
+                // sendContextCommands should be called exactly once
+                if (sendContextCommandsSpy.callCount !== 1) return false
+
+                // The sent payload should contain contextCommandGroups
+                const sentPayload = sendContextCommandsSpy.firstCall.args[0]
+                if (!sentPayload.contextCommandGroups) return false
+
+                // Cached items should match the input
+                const cached = (provider as any).cachedContextCommands
+                if (cached !== items) return false
+
+                return true
+            }),
+            { numRuns: 30 }
+        )
+    })
+
+    /**
+     * **Validates: Requirements 3.5**
+     *
+     * Property 2f: For all tab types in ['cwc', 'unknown', 'welcome'],
+     * context commands are distributed to those tabs.
+     *
+     * This tests the tab distribution logic by verifying that the
+     * onContextCommandDataReceived callback (which is the consumer of
+     * processContextCommandUpdate's output) correctly filters tab types.
+     *
+     * We test the filtering logic directly since the actual callback is in
+     * the VSCode extension (main.ts) and requires a full UI setup.
+     */
+    it('tab type filtering correctly identifies eligible tabs', () => {
+        const eligibleTabTypes = ['cwc', 'unknown', 'welcome']
+        const ineligibleTabTypes = ['featuredev', 'gumby', 'agentWalkthrough', 'review', '']
+
+        fc.assert(
+            fc.property(
+                fc.constantFrom(...eligibleTabTypes),
+                fc.constantFrom(...ineligibleTabTypes),
+                (eligibleType, ineligibleType) => {
+                    // The tab distribution logic from main.ts:
+                    // if (['cwc', 'unknown', 'welcome'].includes(tabType))
+                    const isEligible = (tabType: string) => ['cwc', 'unknown', 'welcome'].includes(tabType)
+
+                    // Eligible types should pass the filter
+                    if (!isEligible(eligibleType)) return false
+
+                    // Ineligible types should not pass the filter
+                    if (isEligible(ineligibleType)) return false
+
+                    return true
+                }
+            ),
+            { numRuns: 30 }
+        )
+    })
+
+    /**
+     * **Validates: Requirements 3.6**
+     *
+     * Property 2g: For all valid context item selections, the selected item's
+     * data is preserved through the mapContextCommandItems transformation —
+     * the item's id, description, and route are maintained so that selection
+     * can correctly insert the item into prompt input.
+     */
+    it('mapContextCommandItems preserves item identity for selection', async () => {
+        await fc.assert(
+            fc.asyncProperty(smallContextItemsArb, async items => {
+                if (items.length === 0) return true
+
+                const result = await provider.mapContextCommandItems(items)
+                const topCommands = result[0].commands ?? []
+
+                const filesCmd = topCommands.find(cmd => cmd.command === 'Files')
+                const foldersCmd = topCommands.find(cmd => cmd.command === 'Folders')
+
+                const fileChildren = filesCmd?.children?.[0]?.commands ?? []
+                const folderChildren = foldersCmd?.children?.[0]?.commands ?? []
+
+                // Check that each file item preserves its identity
+                for (const item of items.filter(i => i.type === 'file')) {
+                    const mapped = fileChildren.find(cmd => cmd.id === item.id)
+                    if (!mapped) return false
+                    // Route should contain workspace folder and relative path
+                    if (
+                        !mapped.route ||
+                        mapped.route[0] !== item.workspaceFolder ||
+                        mapped.route[1] !== item.relativePath
+                    ) {
+                        return false
+                    }
+                }
+
+                // Check that each folder item preserves its identity
+                for (const item of items.filter(i => i.type === 'folder')) {
+                    const mapped = folderChildren.find(cmd => cmd.id === item.id)
+                    if (!mapped) return false
+                    if (
+                        !mapped.route ||
+                        mapped.route[0] !== item.workspaceFolder ||
+                        mapped.route[1] !== item.relativePath
+                    ) {
+                        return false
+                    }
+                }
+
+                return true
+            }),
+            { numRuns: 30 }
+        )
+    })
+})
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.test.ts
index a65962a632..bbea092987 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.test.ts
@@ -1,4 +1,4 @@
-import { ContextCommandsProvider } from './contextCommandsProvider'
+import { ContextCommandsProvider, INDEXING_THROTTLE_MS } from './contextCommandsProvider'
 import * as sinon from 'sinon'
 import { TestFeatures } from '@aws/language-server-runtimes/testing'
 import * as chokidar from 'chokidar'
@@ -107,7 +107,8 @@ describe('ContextCommandsProvider', () => {
     })
 
     describe('onIndexingInProgressChanged', () => {
-        it('should update workspacePending and call processContextCommandUpdate when indexing status changes', async () => {
+        it('should update workspacePending and call processContextCommandUpdate after throttle window', async () => {
+            const clock = sinon.useFakeTimers()
             let capturedCallback: ((indexingInProgress: boolean) => void) | undefined
 
             const mockController = {
@@ -127,7 +128,15 @@ describe('ContextCommandsProvider', () => {
 
             capturedCallback?.(true)
 
+            // Not called yet — still within throttle window
+            sinon.assert.notCalled(processUpdateSpy)
+
+            // Advance past the throttle window
+            clock.tick(INDEXING_THROTTLE_MS)
+
             sinon.assert.calledWith(processUpdateSpy, [])
+
+            clock.restore()
         })
     })
 
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.ts
index 367afebd05..3f9a3cb0be 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.ts
@@ -1,6 +1,12 @@
+import * as fs from 'fs'
 import * as path from 'path'
 import { FSWatcher, watch } from 'chokidar'
-import { ContextCommand, ContextCommandGroup } from '@aws/language-server-runtimes/protocol'
+import {
+    ContextCommand,
+    ContextCommandGroup,
+    FilterContextCommandsParams,
+    FilterContextCommandsResult,
+} from '@aws/language-server-runtimes/protocol'
 import { Disposable } from 'vscode-languageclient/node'
 import { Chat, Logging, Lsp, Workspace } from '@aws/language-server-runtimes/server-interface'
 import { getCodeSymbolDescription, getUserPromptsDirectory, promptFileExtension } from './contextUtils'
@@ -9,6 +15,54 @@ import { LocalProjectContextController } from '../../../shared/localProjectConte
 import { URI } from 'vscode-uri'
 import { activeFileCmd } from './additionalContextProvider'
 
+/**
+ * Throttle window (in ms) for coalescing rapid `onIndexingInProgressChanged`
+ * callbacks.  When indexing status toggles rapidly (e.g. true→false→true),
+ * only the final state triggers a `processContextCommandUpdate` call after
+ * this delay elapses with no further changes.
+ */
+export const INDEXING_THROTTLE_MS = 500
+
+/**
+ * Maximum items in the initial `sendContextCommands` push.
+ * The client shows these when the user presses `@` before typing.
+ * Server-side filtering (onFilterContextCommands) searches the full set.
+ */
+export const CONTEXT_COMMAND_PAYLOAD_CAP = 1000
+
+/** Maximum number of items returned by a single filter request. */
+export const MAX_FILTER_RESULTS = 1000
+
+/**
+ * Score a candidate string against a search term.
+ * Mirrors the scoring tiers used by mynah-ui's filterQuickPickItems:
+ *   exact=100, prefix=80, word-start=60, contains=40, no-match=0
+ */
+export function calculateItemScore(text: string, searchTerm: string): number {
+    const normalizedText = text.toLowerCase()
+    const normalizedTerm = searchTerm.toLowerCase()
+
+    if (normalizedText === normalizedTerm) return 100
+    if (normalizedText.startsWith(normalizedTerm)) return 80
+    if (normalizedText.split(/[\s/\\._\-]/).some(word => word.startsWith(normalizedTerm))) return 60
+    if (normalizedText.includes(normalizedTerm)) return 40
+    return 0
+}
+
+/**
+ * Return the display name used by the picker for a given context command item.
+ * Files/folders → basename of relativePath, code → symbol name.
+ */
+function getDisplayName(item: ContextCommandItem): string {
+    if (item.symbol) return item.symbol.name
+    return path.basename(item.relativePath)
+}
+
+/** Check whether the underlying file/folder still exists on disk. */
+function existsOnDisk(item: ContextCommandItem): boolean {
+    return fs.existsSync(path.join(item.workspaceFolder, item.relativePath))
+}
+
 export class ContextCommandsProvider implements Disposable {
     private promptFileWatcher?: FSWatcher
     private cachedContextCommands?: ContextCommandItem[]
@@ -18,6 +72,8 @@ export class ContextCommandsProvider implements Disposable {
     private filesAndFoldersFailed = false
     private workspacePending = true
     private initialStateSent = false
+    /** Handle for the pending indexing-change throttle timer */
+    private indexingThrottleTimer?: ReturnType<typeof setTimeout>
     constructor(
         private readonly logging: Logging,
         private readonly chat: Chat,
@@ -28,6 +84,7 @@ export class ContextCommandsProvider implements Disposable {
         this.registerContextCommandHandler().catch(e =>
             this.logging.error(`Error registering context command handler: ${e}`)
         )
+        this.registerFilterHandler()
     }
 
     onReady() {
@@ -48,7 +105,23 @@ export class ContextCommandsProvider implements Disposable {
             controller.onIndexingInProgressChanged = (indexingInProgress: boolean) => {
                 if (this.workspacePending !== indexingInProgress) {
                     this.workspacePending = indexingInProgress
-                    void this.processContextCommandUpdate(this.cachedContextCommands ?? [])
+
+                    // Coalesce rapid indexing status toggles: cancel any pending
+                    // throttle timer and start a new one.  Only the final state
+                    // after the throttle window triggers processContextCommandUpdate.
+                    if (this.indexingThrottleTimer !== undefined) {
+                        clearTimeout(this.indexingThrottleTimer)
+                    }
+                    this.indexingThrottleTimer = setTimeout(async () => {
+                        this.indexingThrottleTimer = undefined
+                        try {
+                            const items = await controller.getContextCommandItems()
+                            await this.processContextCommandUpdate(items)
+                        } catch (e) {
+                            this.logging.error(`Error fetching context command items: ${e}`)
+                            void this.processContextCommandUpdate(this.cachedContextCommands ?? [])
+                        }
+                    }, INDEXING_THROTTLE_MS)
                 }
             }
         } catch (e) {
@@ -105,10 +178,51 @@ export class ContextCommandsProvider implements Disposable {
         }
     }
 
+    private registerFilterHandler() {
+        this.chat.onFilterContextCommands(
+            async (params: FilterContextCommandsParams): Promise<FilterContextCommandsResult> => {
+                const items = this.cachedContextCommands ?? []
+                const searchTerm = params.searchTerm?.trim() ?? ''
+
+                if (!searchTerm) {
+                    const mapped = await this.mapContextCommandItems(items.filter(existsOnDisk))
+                    return { contextCommandGroups: mapped }
+                }
+
+                // Score every cached item and keep only matches (score > 0).
+                const scored: { score: number; item: ContextCommandItem }[] = []
+                for (let i = 0; i < items.length; i++) {
+                    const displayName = getDisplayName(items[i])
+                    const score = calculateItemScore(displayName, searchTerm)
+                    if (score > 0) {
+                        scored.push({ score, item: items[i] })
+                    }
+                }
+
+                scored.sort((a, b) => b.score - a.score || getDisplayName(a.item).localeCompare(getDisplayName(b.item)))
+                const filtered = scored
+                    .filter(s => existsOnDisk(s.item))
+                    .slice(0, MAX_FILTER_RESULTS)
+                    .map(s => s.item)
+                this.logging.log(
+                    `onFilterContextCommands: searchTerm="${searchTerm}", matched=${scored.length}, returning=${filtered.length}`
+                )
+                const mapped = await this.mapContextCommandItems(filtered)
+                return { contextCommandGroups: mapped }
+            }
+        )
+    }
+
     async processContextCommandUpdate(items: ContextCommandItem[]) {
-        const allItems = await this.mapContextCommandItems(items)
-        this.chat.sendContextCommands({ contextCommandGroups: allItems })
         this.cachedContextCommands = items
+
+        // Cap the push payload — the client's existing code dispatches
+        // onFilterContextCommands when the user types, which searches
+        // the full cached set server-side (no cap).
+        const capped = items.filter(existsOnDisk).slice(0, CONTEXT_COMMAND_PAYLOAD_CAP)
+
+        const allItems = await this.mapContextCommandItems(capped)
+        this.chat.sendContextCommands({ contextCommandGroups: allItems })
     }
 
     async mapContextCommandItems(items: ContextCommandItem[]): Promise<ContextCommandGroup[]> {
@@ -260,6 +374,9 @@ export class ContextCommandsProvider implements Disposable {
     }
 
     dispose() {
+        if (this.indexingThrottleTimer !== undefined) {
+            clearTimeout(this.indexingThrottleTimer)
+        }
         void this.promptFileWatcher?.close()
     }
 }
diff --git a/server/aws-lsp-codewhisperer/src/language-server/chat/chatController.ts b/server/aws-lsp-codewhisperer/src/language-server/chat/chatController.ts
index 996ce53afa..7c8f13a802 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/chat/chatController.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/chat/chatController.ts
@@ -77,6 +77,7 @@ type ChatHandlers = Omit<
     | 'onPinnedContextAdd'
     | 'onPinnedContextRemove'
     | 'onOpenFileDialog'
+    | 'onFilterContextCommands'
     | 'onListAvailableModels'
     | 'sendSubscriptionDetails'
     | 'onSubscriptionUpgrade'

From e2e0b2cd56dbe48f462064d0d0a5cc8397975be7 Mon Sep 17 00:00:00 2001
From: Will Lo <96078566+Will-ShaoHua@users.noreply.github.com>
Date: Tue, 7 Apr 2026 11:38:26 -0700
Subject: [PATCH 11/23] fix: correct URI mapping in onDidRenameFiles handler
 (#2688)

---
 .../localProjectContext/localProjectContextServer.ts          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/aws-lsp-codewhisperer/src/language-server/localProjectContext/localProjectContextServer.ts b/server/aws-lsp-codewhisperer/src/language-server/localProjectContext/localProjectContextServer.ts
index 9cff865038..ac96094354 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/localProjectContext/localProjectContextServer.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/localProjectContext/localProjectContextServer.ts
@@ -121,9 +121,9 @@ export const LocalProjectContextServer =
             try {
                 const oldPaths = VSCWindowsOverride
                     ? event.files.map(file => URI.file(file.oldUri).fsPath)
-                    : event.files.map(file => URI.parse(file.newUri).fsPath)
+                    : event.files.map(file => URI.parse(file.oldUri).fsPath)
                 const newPaths = VSCWindowsOverride
-                    ? event.files.map(file => URI.file(file.oldUri).fsPath)
+                    ? event.files.map(file => URI.file(file.newUri).fsPath)
                     : event.files.map(file => URI.parse(file.newUri).fsPath)
 
                 await localProjectContextController.updateIndexAndContextCommand(oldPaths, false)

From c87485f2d68c93f714a197f4f3954da63341df4e Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 7 Apr 2026 12:59:12 -0700
Subject: [PATCH 12/23] chore(release): release packages from branch main
 (#2689)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 .release-please-manifest.json             |  4 ++--
 chat-client/CHANGELOG.md                  |  7 +++++++
 chat-client/package.json                  |  2 +-
 package-lock.json                         |  4 ++--
 server/aws-lsp-codewhisperer/CHANGELOG.md | 12 ++++++++++++
 server/aws-lsp-codewhisperer/package.json |  2 +-
 6 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index e6fd570777..9ae14a3a11 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,8 +1,8 @@
 {
-    "chat-client": "0.1.50",
+    "chat-client": "0.1.51",
     "core/aws-lsp-core": "0.0.21",
     "server/aws-lsp-antlr4": "0.1.25",
-    "server/aws-lsp-codewhisperer": "0.0.111",
+    "server/aws-lsp-codewhisperer": "0.0.112",
     "server/aws-lsp-json": "0.1.26",
     "server/aws-lsp-partiql": "0.0.23",
     "server/aws-lsp-yaml": "0.1.26"
diff --git a/chat-client/CHANGELOG.md b/chat-client/CHANGELOG.md
index 8c24851c95..4f1a36ac13 100644
--- a/chat-client/CHANGELOG.md
+++ b/chat-client/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.1.51](https://github.com/aws/language-servers/compare/chat-client/v0.1.50...chat-client/v0.1.51) (2026-04-07)
+
+
+### Performance Improvements
+
+* **amazonq:** context command performance ([#2682](https://github.com/aws/language-servers/issues/2682)) ([f8dec9a](https://github.com/aws/language-servers/commit/f8dec9a65b7e72e78e5e16cbbfd470b2d69e75b0))
+
 ## [0.1.50](https://github.com/aws/language-servers/compare/chat-client/v0.1.49...chat-client/v0.1.50) (2026-03-10)
 
 
diff --git a/chat-client/package.json b/chat-client/package.json
index 7deb22e579..95924656f3 100644
--- a/chat-client/package.json
+++ b/chat-client/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@aws/chat-client",
-    "version": "0.1.50",
+    "version": "0.1.51",
     "description": "AWS Chat Client",
     "main": "out/index.js",
     "repository": {
diff --git a/package-lock.json b/package-lock.json
index cbb16508b0..15d1787c65 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -251,7 +251,7 @@
         },
         "chat-client": {
             "name": "@aws/chat-client",
-            "version": "0.1.50",
+            "version": "0.1.51",
             "license": "Apache-2.0",
             "dependencies": {
                 "@aws/chat-client-ui-types": "0.1.68",
@@ -31102,7 +31102,7 @@
         },
         "server/aws-lsp-codewhisperer": {
             "name": "@aws/lsp-codewhisperer",
-            "version": "0.0.111",
+            "version": "0.0.112",
             "bundleDependencies": [
                 "@amzn/codewhisperer",
                 "@amzn/codewhisperer-runtime",
diff --git a/server/aws-lsp-codewhisperer/CHANGELOG.md b/server/aws-lsp-codewhisperer/CHANGELOG.md
index daeaf3e9de..059db3379a 100644
--- a/server/aws-lsp-codewhisperer/CHANGELOG.md
+++ b/server/aws-lsp-codewhisperer/CHANGELOG.md
@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.0.112](https://github.com/aws/language-servers/compare/lsp-codewhisperer/v0.0.111...lsp-codewhisperer/v0.0.112) (2026-04-07)
+
+
+### Bug Fixes
+
+* correct URI mapping in onDidRenameFiles handler ([#2688](https://github.com/aws/language-servers/issues/2688)) ([e2e0b2c](https://github.com/aws/language-servers/commit/e2e0b2cd56dbe48f462064d0d0a5cc8397975be7))
+
+
+### Performance Improvements
+
+* **amazonq:** context command performance ([#2682](https://github.com/aws/language-servers/issues/2682)) ([f8dec9a](https://github.com/aws/language-servers/commit/f8dec9a65b7e72e78e5e16cbbfd470b2d69e75b0))
+
 ## [0.0.111](https://github.com/aws/language-servers/compare/lsp-codewhisperer/v0.0.110...lsp-codewhisperer/v0.0.111) (2026-03-31)
 
 
diff --git a/server/aws-lsp-codewhisperer/package.json b/server/aws-lsp-codewhisperer/package.json
index 5d429c62bd..269aabbfa8 100644
--- a/server/aws-lsp-codewhisperer/package.json
+++ b/server/aws-lsp-codewhisperer/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@aws/lsp-codewhisperer",
-    "version": "0.0.111",
+    "version": "0.0.112",
     "description": "CodeWhisperer Language Server",
     "main": "out/index.js",
     "repository": {

From 67b15f725b92f824688f2e480ff0a01112b02bbe Mon Sep 17 00:00:00 2001
From: Will Lo <96078566+Will-ShaoHua@users.noreply.github.com>
Date: Fri, 10 Apr 2026 10:47:17 -0700
Subject: [PATCH 13/23] chore: merge agentic version 1.64.0 (#2694)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* chore: bump agentic version: 1.64.0

* fix: reserve folder budget in initial context command cap (#2693)

* fix: reserve folder budget in initial context command cap

The initial sendContextCommands push is capped at 1000 items, but the
flat slice(0, 1000) starves folders when files dominate the list. In
large repos (212k+ items), the first 1000 are almost all files, so
@Folder shows no children until the user types a search term.

Partition items by type and reserve 10% of the cap budget for folders
before filling the rest with files and code symbols. This ensures
@Folder always has children on first load. The filter handler already
searches the full uncapped cache, so this only affects the initial push.

* test: add folder budget tests for processContextCommandUpdate

Verify that the initial context command cap reserves slots for folders:
- folders are included when items exceed the cap
- all folders included when fewer than budget
- total items don't exceed CONTEXT_COMMAND_PAYLOAD_CAP
- small payloads pass through unchanged

* fix: apply cap to empty-search filter response to preserve @Folder

When onFilterContextCommands fires with an empty searchTerm (user
navigated back or cleared search), the handler was returning ALL
cached items (212k+) with no cap. This massive response overwrote
the tab's contextCommands store, and subsequent @Folder clicks
showed an empty list because the store structure was inconsistent.

Apply the same cap+budget logic as processContextCommandUpdate so
the empty-search response matches the initial push structure.

* refactor: remove stale context command cache, always pull fresh from indexer

The cachedContextCommands field was a separate copy of the indexer's
data that could get out of sync — causing @Folder to show empty after
searches overwrote the store, and stale items to persist after file
operations.

Remove the cache entirely. The indexer (local-indexing) is the single
source of truth. The filter handler now calls getFreshItems() on every
request, and processContextCommandUpdate receives items directly from
the indexer callbacks. The cap+budget logic is extracted into capItems()
and shared between the initial push and the empty-search filter path.

* fix: restore base context commands on empty filter instead of round-tripping

After a search filtered the context commands, the store held the
filtered set. Subsequent @Folder/@File clicks read from this stale
store and showed only the previous search results.

When onContextCommandFilter fires with an empty searchTerm (user
cleared search or navigated back), restore contextCommandGroups
directly to the store instead of sending a request to the server.
This keeps the store consistent with the base set and avoids the
round-trip latency.

* fix: prevent sendContextCommands from resetting active filter tab

sendContextCommands is a server push that fires on indexing changes
and overwrites contextCommands for ALL tabs. This reset the picker
while the user was browsing @Folder/@File sub-menus, causing the
6-10 second snap-back to the main menu.

Skip the store update for tabs with an active filter session
(lastFilterTabId). Clear the guard on tab change, tab remove,
and chat prompt submission so it doesn't persist.

* fix: restore base contextCommands after filter response via microtask

filterContextCommandsResponse updates the store with filtered results
so the picker's store listener can refresh. But this left the store
with stale filtered data, causing @Folder/@File to show previous
search results on subsequent navigation.

After updating the store for the picker, schedule a microtask to
restore contextCommandGroups (the base set) back to the store. The
picker captures filtered items synchronously during updateStore, so
the microtask restore doesn't affect the current display but ensures
sub-menu navigation reads from the full base set.

* fix: restore filterContextCommandsResponse store update

Now that mynah-ui preserves baseContextCommands separately from the
store's contextCommands, the filter response can safely update the
store again. The picker uses the filtered data for display while
sub-menu navigation reads from the base snapshot.

* chore: patch

* test: cover getFreshItems and registerFilterHandler empty-search

- 3 tests for getFreshItems: getInstance reject, getContextCommandItems
  reject, success path.
- 2 tests for registerFilterHandler empty-search path: applies capItems
  folder budget when called with empty searchTerm and when called with
  a whitespace-only searchTerm.

* fix: reserve code symbol budget in capItems

The previous capItems partitioned items into folders vs nonFolders,
where nonFolders included both files AND code symbols sharing the same
900-slot budget. In file-heavy repos (e.g. Linux kernel: 212k+ items)
files dominate the input order so code symbols are silently dropped
from the initial picker view, even though typing a search term still
finds them via the non-empty filter path.

Replace the 2-way partition with a 3-way 10/10/80 split (folders /
code / files). Slack from an under-filled folder or code budget flows
into the file budget via the subtraction below.

Mirrors the existing folder-budget fix pattern. Add 5 tests:
- code symbols included when items exceed cap
- all code symbols preserved when fewer than budget
- 100/100/800 split when all three categories overflow
- code not starved when files come first in input (regression case)
- empty-search filter handler also reserves the code budget

* fix: bump context command payload cap from 1000 to 2000

Double both CONTEXT_COMMAND_PAYLOAD_CAP and MAX_FILTER_RESULTS so the
initial picker view and the typed-search filter response can return up
to 2000 items each. The 10/10/80 budget split now yields 200 folders /
200 code / 1600 files instead of 100 / 100 / 800.

The bottleneck under load is fs.existsSync over the full ~212k indexer
item set, not the cap; doubling the cap adds <50KB to the LSP payload
and a few ms to map/render but is otherwise negligible. mynah-ui's
DetailedListWrapper virtualizes by visible block, so 2x items don't
add proportional render cost.

Update all 8 affected test assertions to the new expected counts.

* chore: bump @aws/mynah-ui to ^4.40.1

Pulls in the latest mynah-ui patch release. See
https://github.com/aws/mynah-ui/releases/tag/v4.40.1

* fix: switch capItems split to 500/500/1000 (25/25/50)

Folders and code symbols each get 25% of the cap (500), files get 50%
(1000). Previously the 10/10/80 split (200/200/1600) tilted heavily
toward files; the new split gives folders and code symbols a fair
share of the initial picker view in folder- and symbol-rich repos.

This only affects the **empty-search** picker view (no search term).
The non-empty filter path still scores against the full fresh indexer
set in registerFilterHandler — typing a search term will find any
folder, file, or code symbol regardless of whether it fit into the cap.

Test inputs scaled up to 600-800 per category so the new 500-slot
budget is actually exercised. All 24 tests pass.

* test: drop stale cachedContextCommands assertion in preservation test

The property-based test 'processContextCommandUpdate sends all items
and caches them for small payloads' has been failing in CI since
commit 79e6e7594 (refactor: remove stale context command cache, always
pull fresh from indexer). That refactor deleted the
cachedContextCommands field, but this preservation test still asserted
that (provider as any).cachedContextCommands === items, which now
always evaluates to undefined !== items and fails on the empty-array
counterexample.

Drop the cache assertion. The test now verifies the still-meaningful
contract: processContextCommandUpdate dispatches exactly one
sendContextCommands call with a contextCommandGroups payload.

Local repro: npx mocha --require ts-node/register
'src/language-server/agenticChat/context/contextCommandsProvider*.test.ts'
→ 28 passing.

---------

Co-authored-by: aws-toolkit-automation <>
---
 .../src/version.json                          |   2 +-
 chat-client/package.json                      |   2 +-
 chat-client/src/client/mynahUi.ts             |  30 +-
 package-lock.json                             |   8 +-
 ...ntextCommandsProvider.preservation.test.ts |  15 +-
 .../context/contextCommandsProvider.test.ts   | 358 +++++++++++++++++-
 .../context/contextCommandsProvider.ts        |  58 ++-
 7 files changed, 433 insertions(+), 40 deletions(-)

diff --git a/app/aws-lsp-codewhisperer-runtimes/src/version.json b/app/aws-lsp-codewhisperer-runtimes/src/version.json
index 43968ed1d6..430db61483 100644
--- a/app/aws-lsp-codewhisperer-runtimes/src/version.json
+++ b/app/aws-lsp-codewhisperer-runtimes/src/version.json
@@ -1,3 +1,3 @@
 {
-    "agenticChat": "1.63.0"
+    "agenticChat": "1.64.0"
 }
diff --git a/chat-client/package.json b/chat-client/package.json
index 95924656f3..d6dcc0c496 100644
--- a/chat-client/package.json
+++ b/chat-client/package.json
@@ -27,7 +27,7 @@
         "@aws/chat-client-ui-types": "0.1.68",
         "@aws/language-server-runtimes": "^0.3.16",
         "@aws/language-server-runtimes-types": "^0.1.64",
-        "@aws/mynah-ui": "^4.40.0"
+        "@aws/mynah-ui": "^4.40.1"
     },
     "devDependencies": {
         "@types/jsdom": "^21.1.6",
diff --git a/chat-client/src/client/mynahUi.ts b/chat-client/src/client/mynahUi.ts
index 07326aafb1..731fffb4d7 100644
--- a/chat-client/src/client/mynahUi.ts
+++ b/chat-client/src/client/mynahUi.ts
@@ -813,8 +813,12 @@ export const createMynahUi = (
             store: tabFactory.createTab(false),
         },
         onContextCommandFilter: (tabId, searchTerm) => {
+            // Always forward to the server. Server pulls fresh items from
+            // the indexer on every request (no client-side cache), so the
+            // empty-term case (@ press) returns a fresh capped list and
+            // non-empty terms return the scored top matches.
             lastFilterTabId = tabId
-            messager.onFilterContextCommands({ tabId, searchTerm })
+            messager.onFilterContextCommands({ tabId, searchTerm: searchTerm ?? '' })
         },
         config: {
             maxTabs: 10,
@@ -1439,19 +1443,21 @@ ${params.message}`,
             commands: toContextCommands(group.commands),
         }))
 
+        const commandsWithHighlight = [
+            ...(contextCommandGroups || []),
+            ...(featureConfig?.get('highlightCommand')
+                ? [
+                      {
+                          groupName: 'Additional commands',
+                          commands: [toMynahContextCommand(featureConfig.get('highlightCommand'))],
+                      },
+                  ]
+                : []),
+        ]
+
         Object.keys(mynahUi.getAllTabs()).forEach(tabId => {
             mynahUi.updateStore(tabId, {
-                contextCommands: [
-                    ...(contextCommandGroups || []),
-                    ...(featureConfig?.get('highlightCommand')
-                        ? [
-                              {
-                                  groupName: 'Additional commands',
-                                  commands: [toMynahContextCommand(featureConfig.get('highlightCommand'))],
-                              },
-                          ]
-                        : []),
-                ],
+                contextCommands: commandsWithHighlight,
             })
         })
     }
diff --git a/package-lock.json b/package-lock.json
index 15d1787c65..5a47697e47 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -257,7 +257,7 @@
                 "@aws/chat-client-ui-types": "0.1.68",
                 "@aws/language-server-runtimes": "^0.3.16",
                 "@aws/language-server-runtimes-types": "^0.1.64",
-                "@aws/mynah-ui": "^4.40.0"
+                "@aws/mynah-ui": "^4.40.1"
             },
             "devDependencies": {
                 "@types/jsdom": "^21.1.6",
@@ -4633,9 +4633,9 @@
             "link": true
         },
         "node_modules/@aws/mynah-ui": {
-            "version": "4.40.0",
-            "resolved": "https://registry.npmjs.org/@aws/mynah-ui/-/mynah-ui-4.40.0.tgz",
-            "integrity": "sha512-KDUcm4P9j734Xxm08yIr2E6pLXZ0Ist1YdYO6ysohO9rJLpdckhDvrYRIE5OnaHRxCUHrBliWCW0AVvegKsIhA==",
+            "version": "4.40.1",
+            "resolved": "https://registry.npmjs.org/@aws/mynah-ui/-/mynah-ui-4.40.1.tgz",
+            "integrity": "sha512-4Dj1ESywJWlwjGjI/yxjC8Ba4ilrGt5oU4YUjZg+TMj/k6ihNIDyK/3w3BMPyWryhH6N/MkgMKn4IiAknBQv1Q==",
             "hasInstallScript": true,
             "license": "Apache License 2.0",
             "dependencies": {
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.preservation.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.preservation.test.ts
index 5494b8c884..5fbc63b540 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.preservation.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.preservation.test.ts
@@ -128,9 +128,16 @@ describe('Preservation: Context Commands Provider Small Payload Behavior', () =>
      * **Validates: Requirements 3.2**
      *
      * Property 2e: For all valid context item selections, processContextCommandUpdate
-     * sends the full payload to the webview via chat.sendContextCommands and caches items.
+     * dispatches exactly one chat.sendContextCommands call with a contextCommandGroups
+     * payload.
+     *
+     * Note: the prior version of this test also asserted that items were cached on
+     * `cachedContextCommands`. That field was removed in `refactor: remove stale
+     * context command cache, always pull fresh from indexer` — the server now pulls
+     * fresh items from the indexer on every request instead of caching, so the
+     * assertion was deleted.
      */
-    it('processContextCommandUpdate sends all items and caches them for small payloads', async () => {
+    it('processContextCommandUpdate dispatches a single sendContextCommands payload for small payloads', async () => {
         await fc.assert(
             fc.asyncProperty(smallContextItemsArb, async items => {
                 sendContextCommandsSpy.resetHistory()
@@ -144,10 +151,6 @@ describe('Preservation: Context Commands Provider Small Payload Behavior', () =>
                 const sentPayload = sendContextCommandsSpy.firstCall.args[0]
                 if (!sentPayload.contextCommandGroups) return false
 
-                // Cached items should match the input
-                const cached = (provider as any).cachedContextCommands
-                if (cached !== items) return false
-
                 return true
             }),
             { numRuns: 30 }
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.test.ts
index bbea092987..811f3d4cf2 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.test.ts
@@ -1,5 +1,6 @@
-import { ContextCommandsProvider, INDEXING_THROTTLE_MS } from './contextCommandsProvider'
+import { ContextCommandsProvider, CONTEXT_COMMAND_PAYLOAD_CAP, INDEXING_THROTTLE_MS } from './contextCommandsProvider'
 import * as sinon from 'sinon'
+import * as fs from 'fs'
 import { TestFeatures } from '@aws/language-server-runtimes/testing'
 import * as chokidar from 'chokidar'
 import { ContextCommandItem } from 'local-indexing'
@@ -186,4 +187,359 @@ describe('ContextCommandsProvider', () => {
             sinon.assert.match(foldersCmd?.disabledText, undefined)
         })
     })
+
+    describe('processContextCommandUpdate folder budget', () => {
+        let sendContextCommandsSpy: sinon.SinonStub
+        let existsSyncStub: sinon.SinonStub
+
+        function makeItem(type: 'file' | 'folder', index: number): ContextCommandItem {
+            return {
+                workspaceFolder: '/workspace',
+                type,
+                relativePath: type === 'folder' ? `dir${index}` : `file${index}.ts`,
+                id: `${type}-${index}`,
+            }
+        }
+
+        beforeEach(() => {
+            sendContextCommandsSpy = testFeatures.chat.sendContextCommands as unknown as sinon.SinonStub
+            existsSyncStub = sinon.stub(fs, 'existsSync').returns(true)
+        })
+
+        it('should include folders in capped payload when items exceed cap', async () => {
+            const folders = Array.from({ length: 600 }, (_, i) => makeItem('folder', i))
+            const files = Array.from({ length: 2000 }, (_, i) => makeItem('file', i))
+            const items = [...files, ...folders]
+
+            await provider.processContextCommandUpdate(items)
+
+            sinon.assert.calledOnce(sendContextCommandsSpy)
+            const sent = sendContextCommandsSpy.firstCall.args[0]
+            const topCommands = sent.contextCommandGroups[0].commands
+            const folderChildren = topCommands.find((c: any) => c.command === 'Folders')?.children?.[0]?.commands ?? []
+            const fileChildren = topCommands.find((c: any) => c.command === 'Files')?.children?.[0]?.commands ?? []
+
+            // Folders should be present (budget = ceil(2000 * 0.25) = 500)
+            sinon.assert.match(folderChildren.length, 500)
+            // Files fill the remaining budget (2000 - 500 = 1500), plus the "Active File" command
+            sinon.assert.match(fileChildren.length, 1501)
+        })
+
+        it('should include all folders when fewer than budget', async () => {
+            const folders = Array.from({ length: 5 }, (_, i) => makeItem('folder', i))
+            const files = Array.from({ length: 2000 }, (_, i) => makeItem('file', i))
+            const items = [...files, ...folders]
+
+            await provider.processContextCommandUpdate(items)
+
+            const sent = sendContextCommandsSpy.firstCall.args[0]
+            const topCommands = sent.contextCommandGroups[0].commands
+            const folderChildren = topCommands.find((c: any) => c.command === 'Folders')?.children?.[0]?.commands ?? []
+            const fileChildren = topCommands.find((c: any) => c.command === 'Files')?.children?.[0]?.commands ?? []
+
+            // All 5 folders included
+            sinon.assert.match(folderChildren.length, 5)
+            // Remaining budget: 2000 - 5 = 1995, plus "Active File"
+            sinon.assert.match(fileChildren.length, 1996)
+        })
+
+        it('should not exceed cap total', async () => {
+            const folders = Array.from({ length: 800 }, (_, i) => makeItem('folder', i))
+            const files = Array.from({ length: 2000 }, (_, i) => makeItem('file', i))
+            const items = [...files, ...folders]
+
+            await provider.processContextCommandUpdate(items)
+
+            const sent = sendContextCommandsSpy.firstCall.args[0]
+            const topCommands = sent.contextCommandGroups[0].commands
+            const folderChildren = topCommands.find((c: any) => c.command === 'Folders')?.children?.[0]?.commands ?? []
+            const fileChildren = topCommands.find((c: any) => c.command === 'Files')?.children?.[0]?.commands ?? []
+
+            // Folder budget capped at ceil(2000 * 0.25) = 500
+            sinon.assert.match(folderChildren.length, 500)
+            // Total items (excluding "Active File") should not exceed CONTEXT_COMMAND_PAYLOAD_CAP
+            const totalItems = folderChildren.length + (fileChildren.length - 1) // subtract Active File
+            sinon.assert.match(totalItems <= CONTEXT_COMMAND_PAYLOAD_CAP, true)
+        })
+
+        it('should work normally when items are under cap', async () => {
+            const folders = Array.from({ length: 10 }, (_, i) => makeItem('folder', i))
+            const files = Array.from({ length: 50 }, (_, i) => makeItem('file', i))
+            const items = [...files, ...folders]
+
+            await provider.processContextCommandUpdate(items)
+
+            const sent = sendContextCommandsSpy.firstCall.args[0]
+            const topCommands = sent.contextCommandGroups[0].commands
+            const folderChildren = topCommands.find((c: any) => c.command === 'Folders')?.children?.[0]?.commands ?? []
+            const fileChildren = topCommands.find((c: any) => c.command === 'Files')?.children?.[0]?.commands ?? []
+
+            // All items included when under cap
+            sinon.assert.match(folderChildren.length, 10)
+            sinon.assert.match(fileChildren.length, 51) // 50 + Active File
+        })
+    })
+
+    describe('processContextCommandUpdate code budget', () => {
+        let sendContextCommandsSpy: sinon.SinonStub
+        let existsSyncStub: sinon.SinonStub
+
+        function makeFile(index: number): ContextCommandItem {
+            return {
+                workspaceFolder: '/workspace',
+                type: 'file',
+                relativePath: `file${index}.ts`,
+                id: `file-${index}`,
+            }
+        }
+
+        function makeFolder(index: number): ContextCommandItem {
+            return {
+                workspaceFolder: '/workspace',
+                type: 'folder',
+                relativePath: `dir${index}`,
+                id: `folder-${index}`,
+            }
+        }
+
+        function makeCode(index: number): ContextCommandItem {
+            return {
+                workspaceFolder: '/workspace',
+                type: 'code',
+                relativePath: `file${index}.ts`,
+                id: `code-${index}`,
+                symbol: {
+                    kind: 'Function',
+                    name: `func${index}`,
+                    range: {
+                        start: { line: 0, column: 0 },
+                        end: { line: 10, column: 0 },
+                    },
+                },
+            } as ContextCommandItem
+        }
+
+        beforeEach(() => {
+            sendContextCommandsSpy = testFeatures.chat.sendContextCommands as unknown as sinon.SinonStub
+            existsSyncStub = sinon.stub(fs, 'existsSync').returns(true)
+        })
+
+        it('should include code symbols in capped payload when items exceed cap', async () => {
+            const code = Array.from({ length: 600 }, (_, i) => makeCode(i))
+            const files = Array.from({ length: 2000 }, (_, i) => makeFile(i))
+            // Files first in input order to mirror typical indexer output (files
+            // scanned before AST symbol extraction).
+            const items = [...files, ...code]
+
+            await provider.processContextCommandUpdate(items)
+
+            const sent = sendContextCommandsSpy.firstCall.args[0]
+            const topCommands = sent.contextCommandGroups[0].commands
+            const codeChildren = topCommands.find((c: any) => c.command === 'Code')?.children?.[0]?.commands ?? []
+            const fileChildren = topCommands.find((c: any) => c.command === 'Files')?.children?.[0]?.commands ?? []
+
+            // Code budget = ceil(2000 * 0.25) = 500
+            sinon.assert.match(codeChildren.length, 500)
+            // Files fill the remaining budget (2000 - 500 = 1500), plus the "Active File" command
+            sinon.assert.match(fileChildren.length, 1501)
+        })
+
+        it('should include all code symbols when fewer than budget', async () => {
+            const code = Array.from({ length: 5 }, (_, i) => makeCode(i))
+            const files = Array.from({ length: 2000 }, (_, i) => makeFile(i))
+            const items = [...files, ...code]
+
+            await provider.processContextCommandUpdate(items)
+
+            const sent = sendContextCommandsSpy.firstCall.args[0]
+            const topCommands = sent.contextCommandGroups[0].commands
+            const codeChildren = topCommands.find((c: any) => c.command === 'Code')?.children?.[0]?.commands ?? []
+            const fileChildren = topCommands.find((c: any) => c.command === 'Files')?.children?.[0]?.commands ?? []
+
+            // All 5 code symbols included
+            sinon.assert.match(codeChildren.length, 5)
+            // File budget grows to absorb the slack: 2000 - 5 = 1995, plus Active File
+            sinon.assert.match(fileChildren.length, 1996)
+        })
+
+        it('should split 500/500/1000 when folders, code, and files all exceed budget', async () => {
+            const folders = Array.from({ length: 800 }, (_, i) => makeFolder(i))
+            const code = Array.from({ length: 800 }, (_, i) => makeCode(i))
+            const files = Array.from({ length: 3000 }, (_, i) => makeFile(i))
+            const items = [...files, ...folders, ...code]
+
+            await provider.processContextCommandUpdate(items)
+
+            const sent = sendContextCommandsSpy.firstCall.args[0]
+            const topCommands = sent.contextCommandGroups[0].commands
+            const folderChildren = topCommands.find((c: any) => c.command === 'Folders')?.children?.[0]?.commands ?? []
+            const codeChildren = topCommands.find((c: any) => c.command === 'Code')?.children?.[0]?.commands ?? []
+            const fileChildren = topCommands.find((c: any) => c.command === 'Files')?.children?.[0]?.commands ?? []
+
+            sinon.assert.match(folderChildren.length, 500)
+            sinon.assert.match(codeChildren.length, 500)
+            sinon.assert.match(fileChildren.length, 1001) // 1000 + Active File
+
+            // Total non-active items must not exceed CONTEXT_COMMAND_PAYLOAD_CAP
+            const totalItems = folderChildren.length + codeChildren.length + (fileChildren.length - 1)
+            sinon.assert.match(totalItems <= CONTEXT_COMMAND_PAYLOAD_CAP, true)
+        })
+
+        it('should not starve code symbols when files come first in input', async () => {
+            // This is the regression case: pre-fix, the flat slice(0, 1800) on
+            // nonFolders consumed the entire budget with files (which appear
+            // first in typical indexer output) and dropped all code symbols.
+            const files = Array.from({ length: 5000 }, (_, i) => makeFile(i))
+            const code = Array.from({ length: 50 }, (_, i) => makeCode(i))
+            const items = [...files, ...code]
+
+            await provider.processContextCommandUpdate(items)
+
+            const sent = sendContextCommandsSpy.firstCall.args[0]
+            const topCommands = sent.contextCommandGroups[0].commands
+            const codeChildren = topCommands.find((c: any) => c.command === 'Code')?.children?.[0]?.commands ?? []
+
+            // All 50 code symbols should appear regardless of where they sit
+            // in the input array.
+            sinon.assert.match(codeChildren.length, 50)
+        })
+    })
+
+    describe('getFreshItems', () => {
+        it('should return empty array and log when LocalProjectContextController.getInstance rejects', async () => {
+            ;(LocalProjectContextController.getInstance as sinon.SinonStub).rejects(new Error('boom'))
+            const errorSpy = testFeatures.logging.error as unknown as sinon.SinonStub
+
+            const result = await (provider as any).getFreshItems()
+
+            sinon.assert.match(result.length, 0)
+            sinon.assert.calledOnce(errorSpy)
+        })
+
+        it('should return empty array and log when getContextCommandItems rejects', async () => {
+            ;(LocalProjectContextController.getInstance as sinon.SinonStub).resolves({
+                getContextCommandItems: sinon.stub().rejects(new Error('indexer down')),
+            } as any)
+            const errorSpy = testFeatures.logging.error as unknown as sinon.SinonStub
+
+            const result = await (provider as any).getFreshItems()
+
+            sinon.assert.match(result.length, 0)
+            sinon.assert.calledOnce(errorSpy)
+        })
+
+        it('should return items from controller on success', async () => {
+            const fakeItems: ContextCommandItem[] = [
+                { workspaceFolder: '/workspace', type: 'file', relativePath: 'a.ts', id: 'a' },
+            ]
+            ;(LocalProjectContextController.getInstance as sinon.SinonStub).resolves({
+                getContextCommandItems: sinon.stub().resolves(fakeItems),
+            } as any)
+
+            const result = await (provider as any).getFreshItems()
+
+            sinon.assert.match(result.length, 1)
+            sinon.assert.match(result[0].id, 'a')
+        })
+    })
+
+    describe('registerFilterHandler empty-search path', () => {
+        let existsSyncStub: sinon.SinonStub
+
+        function makeItem(type: 'file' | 'folder', index: number): ContextCommandItem {
+            return {
+                workspaceFolder: '/workspace',
+                type,
+                relativePath: type === 'folder' ? `dir${index}` : `file${index}.ts`,
+                id: `${type}-${index}`,
+            }
+        }
+
+        beforeEach(() => {
+            existsSyncStub = sinon.stub(fs, 'existsSync').returns(true)
+        })
+
+        it('should apply capItems folder budget when filter handler called with empty searchTerm', async () => {
+            const folders = Array.from({ length: 600 }, (_, i) => makeItem('folder', i))
+            const files = Array.from({ length: 2000 }, (_, i) => makeItem('file', i))
+            ;(LocalProjectContextController.getInstance as sinon.SinonStub).resolves({
+                getContextCommandItems: sinon.stub().resolves([...files, ...folders]),
+            } as any)
+
+            // Register a fresh filter handler so the new stubbed controller is used.
+            ;(provider as any).registerFilterHandler()
+
+            const onFilterStub = testFeatures.chat.onFilterContextCommands as unknown as sinon.SinonStub
+            // The handler is the most recently-registered one (initial registration
+            // happens in the constructor with the placeholder controller stub).
+            const handler = onFilterStub.lastCall.args[0]
+            const result = await handler({ searchTerm: '' })
+
+            const topCommands = result.contextCommandGroups[0].commands
+            const folderChildren = topCommands.find((c: any) => c.command === 'Folders')?.children?.[0]?.commands ?? []
+            const fileChildren = topCommands.find((c: any) => c.command === 'Files')?.children?.[0]?.commands ?? []
+
+            // Folder budget = ceil(2000 * 0.25) = 500
+            sinon.assert.match(folderChildren.length, 500)
+            // Files fill the remaining 1500 + the "Active File" command
+            sinon.assert.match(fileChildren.length, 1501)
+        })
+
+        it('should also apply capItems when searchTerm is whitespace-only', async () => {
+            const folders = Array.from({ length: 800 }, (_, i) => makeItem('folder', i))
+            const files = Array.from({ length: 3000 }, (_, i) => makeItem('file', i))
+            ;(LocalProjectContextController.getInstance as sinon.SinonStub).resolves({
+                getContextCommandItems: sinon.stub().resolves([...files, ...folders]),
+            } as any)
+            ;(provider as any).registerFilterHandler()
+
+            const onFilterStub = testFeatures.chat.onFilterContextCommands as unknown as sinon.SinonStub
+            const handler = onFilterStub.lastCall.args[0]
+            const result = await handler({ searchTerm: '   ' })
+
+            const topCommands = result.contextCommandGroups[0].commands
+            const folderChildren = topCommands.find((c: any) => c.command === 'Folders')?.children?.[0]?.commands ?? []
+
+            // Whitespace trims to empty → folder budget enforced
+            sinon.assert.match(folderChildren.length, 500)
+        })
+
+        it('should reserve a code budget on the empty-search path', async () => {
+            const folders = Array.from({ length: 800 }, (_, i) => makeItem('folder', i))
+            const files = Array.from({ length: 3000 }, (_, i) => makeItem('file', i))
+            const code = Array.from({ length: 800 }, (_, i) => ({
+                workspaceFolder: '/workspace',
+                type: 'code' as const,
+                relativePath: `file${i}.ts`,
+                id: `code-${i}`,
+                symbol: {
+                    kind: 'Function',
+                    name: `func${i}`,
+                    range: {
+                        start: { line: 0, column: 0 },
+                        end: { line: 10, column: 0 },
+                    },
+                },
+            })) as ContextCommandItem[]
+            ;(LocalProjectContextController.getInstance as sinon.SinonStub).resolves({
+                // Files first to mirror typical indexer output.
+                getContextCommandItems: sinon.stub().resolves([...files, ...folders, ...code]),
+            } as any)
+            ;(provider as any).registerFilterHandler()
+
+            const onFilterStub = testFeatures.chat.onFilterContextCommands as unknown as sinon.SinonStub
+            const handler = onFilterStub.lastCall.args[0]
+            const result = await handler({ searchTerm: '' })
+
+            const topCommands = result.contextCommandGroups[0].commands
+            const folderChildren = topCommands.find((c: any) => c.command === 'Folders')?.children?.[0]?.commands ?? []
+            const codeChildren = topCommands.find((c: any) => c.command === 'Code')?.children?.[0]?.commands ?? []
+            const fileChildren = topCommands.find((c: any) => c.command === 'Files')?.children?.[0]?.commands ?? []
+
+            // 500 / 500 / 1000 split (+ 1 Active File pseudo-command in the Files group)
+            sinon.assert.match(folderChildren.length, 500)
+            sinon.assert.match(codeChildren.length, 500)
+            sinon.assert.match(fileChildren.length, 1001)
+        })
+    })
 })
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.ts
index 3f9a3cb0be..cc7c3d12f6 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.ts
@@ -28,10 +28,10 @@ export const INDEXING_THROTTLE_MS = 500
  * The client shows these when the user presses `@` before typing.
  * Server-side filtering (onFilterContextCommands) searches the full set.
  */
-export const CONTEXT_COMMAND_PAYLOAD_CAP = 1000
+export const CONTEXT_COMMAND_PAYLOAD_CAP = 2000
 
 /** Maximum number of items returned by a single filter request. */
-export const MAX_FILTER_RESULTS = 1000
+export const MAX_FILTER_RESULTS = 2000
 
 /**
  * Score a candidate string against a search term.
@@ -65,7 +65,6 @@ function existsOnDisk(item: ContextCommandItem): boolean {
 
 export class ContextCommandsProvider implements Disposable {
     private promptFileWatcher?: FSWatcher
-    private cachedContextCommands?: ContextCommandItem[]
     private codeSymbolsPending = true
     private codeSymbolsFailed = false
     private filesAndFoldersPending = true
@@ -119,7 +118,7 @@ export class ContextCommandsProvider implements Disposable {
                             await this.processContextCommandUpdate(items)
                         } catch (e) {
                             this.logging.error(`Error fetching context command items: ${e}`)
-                            void this.processContextCommandUpdate(this.cachedContextCommands ?? [])
+                            void this.processContextCommandUpdate([])
                         }
                     }, INDEXING_THROTTLE_MS)
                 }
@@ -137,11 +136,11 @@ export class ContextCommandsProvider implements Disposable {
         })
 
         this.promptFileWatcher.on('add', async () => {
-            await this.processContextCommandUpdate(this.cachedContextCommands ?? [])
+            await this.processContextCommandUpdate(await this.getFreshItems())
         })
 
         this.promptFileWatcher.on('unlink', async () => {
-            await this.processContextCommandUpdate(this.cachedContextCommands ?? [])
+            await this.processContextCommandUpdate(await this.getFreshItems())
         })
     }
 
@@ -181,11 +180,12 @@ export class ContextCommandsProvider implements Disposable {
     private registerFilterHandler() {
         this.chat.onFilterContextCommands(
             async (params: FilterContextCommandsParams): Promise<FilterContextCommandsResult> => {
-                const items = this.cachedContextCommands ?? []
+                const items = await this.getFreshItems()
                 const searchTerm = params.searchTerm?.trim() ?? ''
 
                 if (!searchTerm) {
-                    const mapped = await this.mapContextCommandItems(items.filter(existsOnDisk))
+                    const capped = this.capItems(items.filter(existsOnDisk))
+                    const mapped = await this.mapContextCommandItems(capped)
                     return { contextCommandGroups: mapped }
                 }
 
@@ -213,14 +213,42 @@ export class ContextCommandsProvider implements Disposable {
         )
     }
 
-    async processContextCommandUpdate(items: ContextCommandItem[]) {
-        this.cachedContextCommands = items
+    /**
+     * Cap items with reserved budgets for folders and code symbols so neither
+     * is starved by file-heavy repos. Default split is 25/25/50 (folders /
+     * code / files); slack from an under-filled folder or code budget flows
+     * automatically into the file budget via the subtraction below.
+     *
+     * NOTE: this only affects the **empty-search** picker view (initial open).
+     * The non-empty filter path scores every item in the full indexer set —
+     * a search term will find a code symbol or file regardless of whether it
+     * fit into the cap.
+     */
+    private capItems(items: ContextCommandItem[]): ContextCommandItem[] {
+        const folders = items.filter(i => i.type === 'folder')
+        const code = items.filter(i => i.type === 'code')
+        const files = items.filter(i => i.type === 'file')
+        const folderBudget = Math.min(folders.length, Math.ceil(CONTEXT_COMMAND_PAYLOAD_CAP * 0.25))
+        const codeBudget = Math.min(code.length, Math.ceil(CONTEXT_COMMAND_PAYLOAD_CAP * 0.25))
+        const fileBudget = CONTEXT_COMMAND_PAYLOAD_CAP - folderBudget - codeBudget
+        return [...folders.slice(0, folderBudget), ...code.slice(0, codeBudget), ...files.slice(0, fileBudget)]
+    }
 
-        // Cap the push payload — the client's existing code dispatches
-        // onFilterContextCommands when the user types, which searches
-        // the full cached set server-side (no cap).
-        const capped = items.filter(existsOnDisk).slice(0, CONTEXT_COMMAND_PAYLOAD_CAP)
+    /**
+     * Pull fresh items from the indexer. Returns empty array on failure.
+     */
+    private async getFreshItems(): Promise<ContextCommandItem[]> {
+        try {
+            const controller = await LocalProjectContextController.getInstance()
+            return await controller.getContextCommandItems()
+        } catch (e) {
+            this.logging.error(`Error fetching fresh context command items: ${e}`)
+            return []
+        }
+    }
 
+    async processContextCommandUpdate(items: ContextCommandItem[]) {
+        const capped = this.capItems(items.filter(existsOnDisk))
         const allItems = await this.mapContextCommandItems(capped)
         this.chat.sendContextCommands({ contextCommandGroups: allItems })
     }
@@ -357,7 +385,7 @@ export class ContextCommandsProvider implements Disposable {
         } catch (error) {
             this.codeSymbolsFailed = true
             this.codeSymbolsPending = false
-            await this.processContextCommandUpdate(this.cachedContextCommands ?? [])
+            await this.processContextCommandUpdate([])
             throw error
         }
     }

From dcd78298766d09902ba51cb12547780f518d48a9 Mon Sep 17 00:00:00 2001
From: Will Lo <96078566+Will-ShaoHua@users.noreply.github.com>
Date: Fri, 17 Apr 2026 09:41:53 -0700
Subject: [PATCH 14/23] fix: guard workspaceFolderManager null reference in
 updateConfiguration (#2695)

Add null check for workspaceFolderManager at the top of updateConfiguration()
to prevent TypeError when didChangeConfiguration fires before onInitialized
completes. Also add diagnostic logging for config update flow.

Context: V2160933004
---
 .../workspaceContext/workspaceContextServer.ts      | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/server/aws-lsp-codewhisperer/src/language-server/workspaceContext/workspaceContextServer.ts b/server/aws-lsp-codewhisperer/src/language-server/workspaceContext/workspaceContextServer.ts
index 62119088da..6361b87c44 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/workspaceContext/workspaceContextServer.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/workspaceContext/workspaceContextServer.ts
@@ -142,8 +142,18 @@ export const WorkspaceContextServer = (): Server => features => {
 
     const updateConfiguration = async () => {
         try {
+            // Guard: workspaceFolderManager may not be initialized yet if didChangeConfiguration
+            // fires before onInitialized completes (race condition observed in V2160933004)
+            if (!workspaceFolderManager) {
+                logging.log(`updateConfiguration called before workspaceFolderManager initialized, skipping`)
+                return
+            }
+
             const clientInitializParams = safeGet(lsp.getClientInitializeParams())
             const extensionName = clientInitializParams.initializationOptions?.aws?.clientInfo?.extension.name
+            logging.log(
+                `updateConfiguration: extensionName=${extensionName}, isSupportedExtension=${isSupportedExtension}`
+            )
             if (extensionName === 'AmazonQ-For-VSCode') {
                 const amazonQSettings = (await lsp.workspace.getConfiguration('amazonQ'))?.['server-sideContext']
                 isOptedIn = amazonQSettings || false
@@ -165,6 +175,9 @@ export const WorkspaceContextServer = (): Server => features => {
             logging.log(`Workspace context server opt-in flag is: ${isOptedIn}`)
 
             if (!isOptedIn) {
+                logging.log(
+                    `User opted out, clearing workspace resources. isWorkflowInitialized=${isWorkflowInitialized}`
+                )
                 isWorkflowInitialized = false
                 fileUploadJobManager?.dispose()
                 dependencyEventBundler?.dispose()

From ae7d3fcd26f57d6cc5d3d26dd5ec79983c4103df Mon Sep 17 00:00:00 2001
From: chungjac <chungjac@amazon.com>
Date: Tue, 21 Apr 2026 14:01:04 -0700
Subject: [PATCH 15/23] fix: deprecate @workspace vector search + fix @folder
 files not appearing in context (#2698)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: remove @workspace from context commands menu (#2669)

* fix: clean up @workspace dead code after removing from context menu (#2670)

* fix: remove @workspace from context commands menu

* fix: clean up @workspace dead code after removing from context menu

* fix: remove onIndexingInProgressChanged test

* chore: remove remaining @workspace / vector search dead code (#2687)

Remove all code paths related to @workspace (vector/semantic search) that
were left after the initial UI removal. This includes:

- localProjectContextController: remove queryVectorIndex, isIndexingEnabled,
  enableIndexing, GPU/worker thread/cache dir config, onIndexingInProgressChanged,
  buildIndex('all'). buildIndex now always uses 'default' (repomap only).
- configurationUtils: remove enableLocalIndexing, enableGpuAcceleration,
  indexWorkerThreads, indexCacheDirPath from config types and defaults
- localProjectContextServer: remove dead config params passed to init()
- triggerContext: remove extractProjectContext and @workspace check
- chatTelemetryController/telemetryService: remove cwsprChatHasWorkspaceContext
- Delete codeSearch.ts (never registered in toolServer, always dead code)
- Update corresponding test files

* fix: typed `@folder` context not showing files in collapsible list + fix merge conflicts (#2696)

* perf(amazonq): context command performance (#2682)

* perf(amazonq): cap context command payload and throttle indexing updates

- Cap context commands sent to webview at 10,000 items
- Throttle onIndexingInProgressChanged with 500ms coalescing
- Cache full item list before applying cap for reuse
- Add preservation property-based tests
- Update unit tests for throttle behavior

* chore: error

* fix: newly added files are not be loaded

* fix: bugfix

* perf: handle context commands in server

* perf: add server-side filtering for context commands in large repos

* chore: bump language-server-runtimes, runtimes-types, and mynah-ui

* chore: remove redundant debug log

* fix: filter out externally deleted files from context command results

Files deleted outside the IDE (e.g. git revert/checkout) were not
removed from the cached context commands because LSP workspace file
operation events only fire for IDE-initiated deletions. Add an
fs.existsSync check when returning results to the client so stale
entries are excluded regardless of how the file was removed.

* chore: remove debug logs from context commands and indexing paths

* fix: scope filterContextCommandsResponse to requesting tab

Previously, filter responses updated contextCommands in all tabs,
causing a search in one tab to overwrite the default list in others.
Track the originating tabId and scope the store update accordingly.

* fix: address PR review feedback for context command filtering

* fix: correct URI mapping in onDidRenameFiles handler (#2688)

* chore(release): release packages from branch main (#2689)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* chore: merge agentic version 1.64.0 (#2694)

* chore: bump agentic version: 1.64.0

* fix: reserve folder budget in initial context command cap (#2693)

* fix: reserve folder budget in initial context command cap

The initial sendContextCommands push is capped at 1000 items, but the
flat slice(0, 1000) starves folders when files dominate the list. In
large repos (212k+ items), the first 1000 are almost all files, so
@Folder shows no children until the user types a search term.

Partition items by type and reserve 10% of the cap budget for folders
before filling the rest with files and code symbols. This ensures
@Folder always has children on first load. The filter handler already
searches the full uncapped cache, so this only affects the initial push.

* test: add folder budget tests for processContextCommandUpdate

Verify that the initial context command cap reserves slots for folders:
- folders are included when items exceed the cap
- all folders included when fewer than budget
- total items don't exceed CONTEXT_COMMAND_PAYLOAD_CAP
- small payloads pass through unchanged

* fix: apply cap to empty-search filter response to preserve @Folder

When onFilterContextCommands fires with an empty searchTerm (user
navigated back or cleared search), the handler was returning ALL
cached items (212k+) with no cap. This massive response overwrote
the tab's contextCommands store, and subsequent @Folder clicks
showed an empty list because the store structure was inconsistent.

Apply the same cap+budget logic as processContextCommandUpdate so
the empty-search response matches the initial push structure.

* refactor: remove stale context command cache, always pull fresh from indexer

The cachedContextCommands field was a separate copy of the indexer's
data that could get out of sync — causing @Folder to show empty after
searches overwrote the store, and stale items to persist after file
operations.

Remove the cache entirely. The indexer (local-indexing) is the single
source of truth. The filter handler now calls getFreshItems() on every
request, and processContextCommandUpdate receives items directly from
the indexer callbacks. The cap+budget logic is extracted into capItems()
and shared between the initial push and the empty-search filter path.

* fix: restore base context commands on empty filter instead of round-tripping

After a search filtered the context commands, the store held the
filtered set. Subsequent @Folder/@File clicks read from this stale
store and showed only the previous search results.

When onContextCommandFilter fires with an empty searchTerm (user
cleared search or navigated back), restore contextCommandGroups
directly to the store instead of sending a request to the server.
This keeps the store consistent with the base set and avoids the
round-trip latency.

* fix: prevent sendContextCommands from resetting active filter tab

sendContextCommands is a server push that fires on indexing changes
and overwrites contextCommands for ALL tabs. This reset the picker
while the user was browsing @Folder/@File sub-menus, causing the
6-10 second snap-back to the main menu.

Skip the store update for tabs with an active filter session
(lastFilterTabId). Clear the guard on tab change, tab remove,
and chat prompt submission so it doesn't persist.

* fix: restore base contextCommands after filter response via microtask

filterContextCommandsResponse updates the store with filtered results
so the picker's store listener can refresh. But this left the store
with stale filtered data, causing @Folder/@File to show previous
search results on subsequent navigation.

After updating the store for the picker, schedule a microtask to
restore contextCommandGroups (the base set) back to the store. The
picker captures filtered items synchronously during updateStore, so
the microtask restore doesn't affect the current display but ensures
sub-menu navigation reads from the full base set.

* fix: restore filterContextCommandsResponse store update

Now that mynah-ui preserves baseContextCommands separately from the
store's contextCommands, the filter response can safely update the
store again. The picker uses the filtered data for display while
sub-menu navigation reads from the base snapshot.

* chore: patch

* test: cover getFreshItems and registerFilterHandler empty-search

- 3 tests for getFreshItems: getInstance reject, getContextCommandItems
  reject, success path.
- 2 tests for registerFilterHandler empty-search path: applies capItems
  folder budget when called with empty searchTerm and when called with
  a whitespace-only searchTerm.

* fix: reserve code symbol budget in capItems

The previous capItems partitioned items into folders vs nonFolders,
where nonFolders included both files AND code symbols sharing the same
900-slot budget. In file-heavy repos (e.g. Linux kernel: 212k+ items)
files dominate the input order so code symbols are silently dropped
from the initial picker view, even though typing a search term still
finds them via the non-empty filter path.

Replace the 2-way partition with a 3-way 10/10/80 split (folders /
code / files). Slack from an under-filled folder or code budget flows
into the file budget via the subtraction below.

Mirrors the existing folder-budget fix pattern. Add 5 tests:
- code symbols included when items exceed cap
- all code symbols preserved when fewer than budget
- 100/100/800 split when all three categories overflow
- code not starved when files come first in input (regression case)
- empty-search filter handler also reserves the code budget

* fix: bump context command payload cap from 1000 to 2000

Double both CONTEXT_COMMAND_PAYLOAD_CAP and MAX_FILTER_RESULTS so the
initial picker view and the typed-search filter response can return up
to 2000 items each. The 10/10/80 budget split now yields 200 folders /
200 code / 1600 files instead of 100 / 100 / 800.

The bottleneck under load is fs.existsSync over the full ~212k indexer
item set, not the cap; doubling the cap adds <50KB to the LSP payload
and a few ms to map/render but is otherwise negligible. mynah-ui's
DetailedListWrapper virtualizes by visible block, so 2x items don't
add proportional render cost.

Update all 8 affected test assertions to the new expected counts.

* chore: bump @aws/mynah-ui to ^4.40.1

Pulls in the latest mynah-ui patch release. See
https://github.com/aws/mynah-ui/releases/tag/v4.40.1

* fix: switch capItems split to 500/500/1000 (25/25/50)

Folders and code symbols each get 25% of the cap (500), files get 50%
(1000). Previously the 10/10/80 split (200/200/1600) tilted heavily
toward files; the new split gives folders and code symbols a fair
share of the initial picker view in folder- and symbol-rich repos.

This only affects the **empty-search** picker view (no search term).
The non-empty filter path still scores against the full fresh indexer
set in registerFilterHandler — typing a search term will find any
folder, file, or code symbol regardless of whether it fit into the cap.

Test inputs scaled up to 600-800 per category so the new 500-slot
budget is actually exercised. All 24 tests pass.

* test: drop stale cachedContextCommands assertion in preservation test

The property-based test 'processContextCommandUpdate sends all items
and caches them for small payloads' has been failing in CI since
commit 79e6e7594 (refactor: remove stale context command cache, always
pull fresh from indexer). That refactor deleted the
cachedContextCommands field, but this preservation test still asserted
that (provider as any).cachedContextCommands === items, which now
always evaluates to undefined !== items and fails on the empty-array
counterexample.

Drop the cache assertion. The test now verifies the still-meaningful
contract: processContextCommandUpdate dispatches exactly one
sendContextCommands call with a contextCommandGroups payload.

Local repro: npx mocha --require ts-node/register
'src/language-server/agenticChat/context/contextCommandsProvider*.test.ts'
→ 28 passing.

---------

Co-authored-by: aws-toolkit-automation <>

* fix: typed @folder context not showing files in collapsible list

When typing @folder (non-pinned), the expanded file entries were not
appearing in the context list. The ordering logic looked up the folder
path in docMap, but docMap is keyed by individual file paths. Added a
fallback for folder items that matches all child file entries by path
prefix.

Pinned @folder was unaffected because it bypasses the docMap lookup.

* chore: fix prettier formatting

---------

Co-authored-by: Will Lo <96078566+Will-ShaoHua@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* fix: rebuild qserver zips with stripped indexing library (#2672)

Remove ONNX, faiss, and CodeSage model from qserver bundles. The indexing
library no longer contains vector/semantic search code since @workspace is
being removed. Each qserver zip drops from ~100MB to ~2.9MB.

@file, @folder, @code continue to work (tree-sitter + BM25).
All 5 platform zips are now identical (no native binaries).

---------

Co-authored-by: Will Lo <96078566+Will-ShaoHua@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: aws-toolkit-automation <43144436+aws-toolkit-automation@users.noreply.github.com>
---
 .../_bundle-assets/qserver-darwin-arm64.zip   |   4 +-
 .../_bundle-assets/qserver-darwin-x64.zip     |   4 +-
 .../_bundle-assets/qserver-linux-arm64.zip    |   4 +-
 .../_bundle-assets/qserver-linux-x64.zip      |   4 +-
 .../_bundle-assets/qserver-win32-x64.zip      |   4 +-
 .../agenticChat/agenticChatController.test.ts |  60 +-----
 .../agenticChat/agenticChatController.ts      |   1 -
 .../context/additionalContextProvider.test.ts |  21 --
 .../context/additionalContextProvider.ts      |  18 +-
 .../context/agenticChatTriggerContext.ts      |  99 +--------
 ...ntextCommandsProvider.preservation.test.ts |   1 -
 .../context/contextCommandsProvider.test.ts   |  37 +---
 .../context/contextCommandsProvider.ts        |  44 +---
 .../agenticChat/tools/codeSearch.test.ts      | 171 ---------------
 .../agenticChat/tools/codeSearch.ts           | 194 ------------------
 .../chat/contexts/triggerContext.ts           |  39 +---
 .../chat/contexts/triggerContexts.test.ts     |  22 --
 .../chat/telemetry/chatTelemetryController.ts |   1 -
 .../localProjectContextServer.ts              |  10 -
 .../configurationUtils.test.ts                |  17 +-
 .../configurationUtils.ts                     |  12 --
 .../localProjectContextController.test.ts     | 147 +------------
 .../shared/localProjectContextController.ts   |  88 +-------
 .../shared/telemetry/telemetryService.test.ts |   2 -
 .../src/shared/telemetry/telemetryService.ts  |   2 -
 25 files changed, 49 insertions(+), 957 deletions(-)
 delete mode 100644 server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/codeSearch.test.ts
 delete mode 100644 server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/codeSearch.ts

diff --git a/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-darwin-arm64.zip b/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-darwin-arm64.zip
index 6f0038c9d7..8e6a8bbb8f 100644
--- a/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-darwin-arm64.zip
+++ b/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-darwin-arm64.zip
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:09b75b788854e2c2f08b9fa73c671e476f7e20b8284521f544ea7f2e2c82d3fa
-size 96549602
+oid sha256:f59a63572dbadb648fe60741b41d929cbd2735a72312fedd07dc37bf9b9a78e8
+size 3080924
diff --git a/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-darwin-x64.zip b/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-darwin-x64.zip
index 709c9d1052..8e6a8bbb8f 100644
--- a/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-darwin-x64.zip
+++ b/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-darwin-x64.zip
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:f13048f6989d01f8a5b8d9743ca2efa023cc4ae0c05efcd4fc0cb22f4b2dd5c3
-size 98233434
+oid sha256:f59a63572dbadb648fe60741b41d929cbd2735a72312fedd07dc37bf9b9a78e8
+size 3080924
diff --git a/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-linux-arm64.zip b/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-linux-arm64.zip
index d47ede8677..8e6a8bbb8f 100644
--- a/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-linux-arm64.zip
+++ b/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-linux-arm64.zip
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:6e119ae06538b7bfe7ce0050d88909c64989b10c481477e24bdd6ab9f6152846
-size 102483123
+oid sha256:f59a63572dbadb648fe60741b41d929cbd2735a72312fedd07dc37bf9b9a78e8
+size 3080924
diff --git a/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-linux-x64.zip b/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-linux-x64.zip
index 5aeec68248..8e6a8bbb8f 100644
--- a/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-linux-x64.zip
+++ b/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-linux-x64.zip
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:8aea05af87c620a7be4cb58b4b9b1a579e5726b1eb3682e55c42302ff19d853d
-size 114470426
+oid sha256:f59a63572dbadb648fe60741b41d929cbd2735a72312fedd07dc37bf9b9a78e8
+size 3080924
diff --git a/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-win32-x64.zip b/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-win32-x64.zip
index 1d3937e552..8e6a8bbb8f 100644
--- a/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-win32-x64.zip
+++ b/app/aws-lsp-codewhisperer-runtimes/_bundle-assets/qserver-win32-x64.zip
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:aafb3ef97fca6ba0369f7bfc48b5846e2b4f4fdec0014aae58be70f49cc42116
-size 113755807
+oid sha256:f59a63572dbadb648fe60741b41d929cbd2735a72312fedd07dc37bf9b9a78e8
+size 3080924
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.test.ts
index fe32f4402c..a6bcc00404 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.test.ts
@@ -257,11 +257,7 @@ describe('AgenticChatController', () => {
         } as any // Using 'as any' to prevent type errors when the Agent interface is updated with new methods
 
         additionalContextProviderStub = sinon.stub(AdditionalContextProvider.prototype, 'getAdditionalContext')
-        additionalContextProviderStub.callsFake(async (triggerContext, _, context: ContextCommand[]) => {
-            // When @workspace is in the context, set hasWorkspace flag
-            if (context && context.some(item => item.command === '@workspace')) {
-                triggerContext.hasWorkspace = true
-            }
+        additionalContextProviderStub.callsFake(async () => {
             return []
         })
         // @ts-ignore
@@ -1415,60 +1411,6 @@ describe('AgenticChatController', () => {
                 extractDocumentContextStub.restore()
             })
 
-            it('parses relevant document and includes as requestInput if @workspace context is included', async () => {
-                const localProjectContextController = new LocalProjectContextController('client-name', [], logging)
-                const mockRelevantDocs = [
-                    { filePath: '/test/1.ts', content: 'text', id: 'id-1', index: 0, vec: [1] },
-                    { filePath: '/test/2.ts', content: 'text2', id: 'id-2', index: 0, vec: [1] },
-                ]
-
-                sinon.stub(LocalProjectContextController, 'getInstance').resolves(localProjectContextController)
-                sinon.stub(localProjectContextController, 'isIndexingEnabled').returns(true)
-                sinon.stub(localProjectContextController, 'queryVectorIndex').resolves(mockRelevantDocs)
-
-                await chatController.onChatPrompt(
-                    {
-                        tabId: 'tab',
-                        prompt: {
-                            prompt: '@workspace help me understand this code',
-                            escapedPrompt: '@workspace help me understand this code',
-                        },
-                        context: [{ command: '@workspace' }],
-                    },
-                    mockCancellationToken
-                )
-
-                const calledRequestInput: GenerateAssistantResponseCommandInput =
-                    generateAssistantResponseStub.firstCall.firstArg
-
-                assert.deepStrictEqual(
-                    calledRequestInput.conversationState?.currentMessage?.userInputMessage?.userInputMessageContext
-                        ?.editorState,
-                    {
-                        workspaceFolders: [],
-                        relevantDocuments: [
-                            {
-                                endLine: -1,
-                                path: '/test/1.ts',
-                                relativeFilePath: '1.ts',
-                                startLine: -1,
-                                text: 'text',
-                                type: ContentType.WORKSPACE,
-                            },
-                            {
-                                endLine: -1,
-                                path: '/test/2.ts',
-                                relativeFilePath: '2.ts',
-                                startLine: -1,
-                                text: 'text2',
-                                type: ContentType.WORKSPACE,
-                            },
-                        ],
-                        useRelevantDocuments: true,
-                    }
-                )
-            })
-
             it('leaves cursorState as undefined if cursorState is not passed', async () => {
                 const documentContextObject = {
                     programmingLanguage: 'typescript',
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
index ebd415e5af..a3384faf17 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
@@ -3537,7 +3537,6 @@ export class AgenticChatController implements ChatHandlers {
         if (triggerContext.contextInfo) {
             metric.mergeWith({
                 cwsprChatHasContextList: triggerContext.documentReference?.filePaths?.length ? true : false,
-                cwsprChatHasWorkspaceContext: triggerContext.hasWorkspace ?? false,
                 cwsprChatFolderContextCount: triggerContext.contextInfo.contextCount.folderContextCount,
                 cwsprChatFileContextCount: triggerContext.contextInfo.contextCount.fileContextCount,
                 cwsprChatRuleContextCount: triggerContext.contextInfo.contextCount.activeRuleContextCount,
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/additionalContextProvider.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/additionalContextProvider.test.ts
index c841c994bc..3be50a289e 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/additionalContextProvider.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/additionalContextProvider.test.ts
@@ -326,27 +326,6 @@ describe('AdditionalContextProvider', () => {
             assert.strictEqual(triggerContext.cursorState, undefined)
         })
 
-        it('should set hasWorkspace flag when @workspace is present', async () => {
-            const mockWorkspaceFolder = {
-                uri: URI.file('/workspace').toString(),
-                name: 'test',
-            }
-            sinon.stub(workspaceUtils, 'getWorkspaceFolderPaths').returns(['/workspace'])
-            const triggerContext: TriggerContext = {
-                workspaceFolder: mockWorkspaceFolder,
-            }
-
-            const workspaceContext = [{ id: '@workspace', command: 'Workspace', label: 'folder' }]
-            ;(chatHistoryDb.getPinnedContext as sinon.SinonStub).returns(workspaceContext)
-
-            fsExistsStub.resolves(false)
-            getContextCommandPromptStub.resolves([])
-
-            await provider.getAdditionalContext(triggerContext, 'tab1')
-
-            assert.strictEqual(triggerContext.hasWorkspace, true)
-        })
-
         it('should count context types correctly', async () => {
             const mockWorkspaceFolder = {
                 uri: URI.file('/workspace').toString(),
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/additionalContextProvider.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/additionalContextProvider.ts
index 95370fb402..60a880a956 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/additionalContextProvider.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/additionalContextProvider.ts
@@ -436,9 +436,6 @@ export class AdditionalContextProvider {
             contextInfo = contextInfo.filter(item => item.id !== ACTIVE_EDITOR_CONTEXT_ID)
         }
 
-        if (contextInfo.some(item => item.id === '@workspace')) {
-            triggerContext.hasWorkspace = true
-        }
         // Handle code symbol ID mismatches between indexing sessions
         // When a workspace is re-indexed, code symbols receive new IDs
         // If a pinned symbol's ID is no longer found in the current index:
@@ -609,8 +606,19 @@ export class AdditionalContextProvider {
                 const image = imageMap.get(item.description)
                 if (image) ordered.push(image)
             } else {
-                const doc = item.route ? docMap.get(path.join(...item.route)) : undefined
-                if (doc) ordered.push(doc)
+                const itemPath = item.route ? path.join(...item.route) : undefined
+                if (itemPath) {
+                    const doc = docMap.get(itemPath)
+                    if (doc) {
+                        ordered.push(doc)
+                    } else if (item.label === 'folder') {
+                        // Folder expands into multiple file entries — match all children
+                        const children = docEntries.filter(
+                            entry => !entry.pinned && entry.path.startsWith(itemPath + path.sep)
+                        )
+                        ordered.push(...children)
+                    }
+                }
             }
         }
         // Append pinned context entries (docs and images)
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/agenticChatTriggerContext.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/agenticChatTriggerContext.ts
index 8d9c19c13a..3b9efadc94 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/agenticChatTriggerContext.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/agenticChatTriggerContext.ts
@@ -14,6 +14,7 @@ import {
     EnvState,
     Origin,
     ImageBlock,
+    RelevantTextDocument,
 } from '@amzn/codewhisperer-streaming'
 import {
     BedrockTools,
@@ -22,18 +23,15 @@ import {
     InlineChatParams,
     FileList,
     TextDocument,
-    OPEN_WORKSPACE_INDEX_SETTINGS_BUTTON_ID,
 } from '@aws/language-server-runtimes/server-interface'
 import { Features } from '../../types'
 import { DocumentContext, DocumentContextExtractor } from '../../chat/contexts/documentContext'
 import { workspaceUtils } from '@aws/lsp-core'
 import { URI } from 'vscode-uri'
-import { LocalProjectContextController } from '../../../shared/localProjectContextController'
 import * as path from 'path'
-import { RelevantTextDocument } from '@amzn/codewhisperer-streaming'
 import { languageByExtension } from '../../../shared/languageDetection'
 import { AgenticChatResultStream } from '../agenticChatResultStream'
-import { ContextInfo, mergeFileLists, mergeRelevantTextDocuments } from './contextUtils'
+import { ContextInfo } from './contextUtils'
 import { WorkspaceFolderManager } from '../../workspaceContext/workspaceFolderManager'
 import { getRelativePathWithWorkspaceFolder } from '../../workspaceContext/util'
 import { ChatCommandInput } from '../../../shared/streamingClientService'
@@ -47,7 +45,6 @@ export interface TriggerContext extends Partial<DocumentContext> {
      * Represents the context transparency list displayed at the top of the assistant response.
      */
     documentReference?: FileList
-    hasWorkspace?: boolean
 }
 export type LineInfo = { startLine: number; endLine: number }
 
@@ -178,7 +175,6 @@ export class AgenticChatTriggerContext {
         const { prompt } = params
         const workspaceFolders = workspaceUtils.getWorkspaceFolderPaths(this.#workspace).slice(0, maxWorkspaceFolders)
         const defaultEditorState = { workspaceFolders }
-        const hasWorkspace = triggerContext.hasWorkspace
 
         // prompt.prompt is what user typed in the input, should be sent to backend
         // prompt.escapedPrompt is HTML serialized string, which should only be used for UI.
@@ -190,10 +186,6 @@ export class AgenticChatTriggerContext {
             promptContent = promptContent.replace(/\*\*@sage\*\*/g, '@sage')
         }
 
-        if (hasWorkspace) {
-            promptContent = promptContent?.replace(/\*\*@workspace\*\*/, '')
-        }
-
         // Append remote workspaceId if it exists
         // Only append workspaceId to GenerateCompletions when WebSocket client is connected
         const remoteWsFolderManager = WorkspaceFolderManager.getInstance()
@@ -204,15 +196,7 @@ export class AgenticChatTriggerContext {
             undefined
         this.#logging.info(`remote workspaceId: ${workspaceId}`)
 
-        // Get workspace documents if @workspace is used
-        let relevantDocuments = hasWorkspace
-            ? await this.#getRelevantDocuments(promptContent ?? '', chatResultStream)
-            : []
-
-        const workspaceFileList = mergeRelevantTextDocuments(relevantDocuments)
-        triggerContext.documentReference = triggerContext.documentReference
-            ? mergeFileLists(triggerContext.documentReference, workspaceFileList)
-            : workspaceFileList
+        const relevantDocuments: RelevantTextDocumentAddition[] = []
         // Add @context in prompt to relevantDocuments
         if (additionalContent) {
             for (const item of additionalContent.filter(item => !item.pinned)) {
@@ -444,81 +428,4 @@ export class AgenticChatTriggerContext {
 
         return [...uris]
     }
-
-    async #getRelevantDocuments(
-        prompt: string,
-        chatResultStream?: AgenticChatResultStream
-    ): Promise<RelevantTextDocumentAddition[]> {
-        const localProjectContextController = await LocalProjectContextController.getInstance()
-        if (!localProjectContextController.isIndexingEnabled() && chatResultStream) {
-            await chatResultStream.writeResultBlock({
-                body: `To add your workspace as context, enable local indexing in your IDE settings. After enabling, add @workspace to your question, and I'll generate a response using your workspace as context.`,
-                buttons: [
-                    {
-                        id: OPEN_WORKSPACE_INDEX_SETTINGS_BUTTON_ID,
-                        text: 'Open settings',
-                        icon: 'external',
-                        keepCardAfterClick: false,
-                        status: 'info',
-                    },
-                ],
-            })
-            return []
-        }
-
-        let relevantTextDocuments = await this.#queryRelevantDocuments(prompt, localProjectContextController)
-        relevantTextDocuments = relevantTextDocuments.filter(doc => doc.text && doc.text.length > 0)
-        for (const relevantDocument of relevantTextDocuments) {
-            if (relevantDocument.text && relevantDocument.text.length > workspaceChunkMaxSize) {
-                relevantDocument.text = relevantDocument.text.substring(0, workspaceChunkMaxSize)
-                this.#logging.debug(`Truncating @workspace chunk: ${relevantDocument.relativeFilePath} `)
-            }
-        }
-
-        return relevantTextDocuments
-    }
-
-    async #queryRelevantDocuments(
-        prompt: string,
-        localProjectContextController: LocalProjectContextController
-    ): Promise<RelevantTextDocumentAddition[]> {
-        try {
-            const chunks = await localProjectContextController.queryVectorIndex({ query: prompt })
-            const relevantTextDocuments: RelevantTextDocumentAddition[] = []
-            if (!chunks) {
-                return relevantTextDocuments
-            }
-
-            for (const chunk of chunks) {
-                const text = chunk.context ?? chunk.content
-                const baseDocument = {
-                    text,
-                    path: chunk.filePath,
-                    relativeFilePath: chunk.relativePath ?? path.basename(chunk.filePath),
-                    startLine: chunk.startLine ?? -1,
-                    endLine: chunk.endLine ?? -1,
-                }
-
-                if (chunk.programmingLanguage && chunk.programmingLanguage !== 'unknown') {
-                    relevantTextDocuments.push({
-                        ...baseDocument,
-                        programmingLanguage: {
-                            languageName: chunk.programmingLanguage,
-                        },
-                        type: ContentType.WORKSPACE,
-                    })
-                } else {
-                    relevantTextDocuments.push({
-                        ...baseDocument,
-                        type: ContentType.WORKSPACE,
-                    })
-                }
-            }
-
-            return relevantTextDocuments
-        } catch (e) {
-            this.#logging.error(`Error querying query vector index to get relevant documents: ${e}`)
-            return []
-        }
-    }
 }
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.preservation.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.preservation.test.ts
index 5fbc63b540..c37a3d7359 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.preservation.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.preservation.test.ts
@@ -61,7 +61,6 @@ describe('Preservation: Context Commands Provider Small Payload Behavior', () =>
 
         sinon.stub(LocalProjectContextController, 'getInstance').resolves({
             onContextItemsUpdated: sinon.stub(),
-            onIndexingInProgressChanged: sinon.stub(),
         } as any)
 
         provider = new ContextCommandsProvider(
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.test.ts
index 811f3d4cf2..9d942ca453 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.test.ts
@@ -1,4 +1,4 @@
-import { ContextCommandsProvider, CONTEXT_COMMAND_PAYLOAD_CAP, INDEXING_THROTTLE_MS } from './contextCommandsProvider'
+import { ContextCommandsProvider, CONTEXT_COMMAND_PAYLOAD_CAP } from './contextCommandsProvider'
 import * as sinon from 'sinon'
 import * as fs from 'fs'
 import { TestFeatures } from '@aws/language-server-runtimes/testing'
@@ -26,7 +26,6 @@ describe('ContextCommandsProvider', () => {
 
         sinon.stub(LocalProjectContextController, 'getInstance').resolves({
             onContextItemsUpdated: sinon.stub(),
-            onIndexingInProgressChanged: sinon.stub(),
         } as any)
 
         provider = new ContextCommandsProvider(
@@ -107,40 +106,6 @@ describe('ContextCommandsProvider', () => {
         })
     })
 
-    describe('onIndexingInProgressChanged', () => {
-        it('should update workspacePending and call processContextCommandUpdate after throttle window', async () => {
-            const clock = sinon.useFakeTimers()
-            let capturedCallback: ((indexingInProgress: boolean) => void) | undefined
-
-            const mockController = {
-                onContextItemsUpdated: sinon.stub(),
-                set onIndexingInProgressChanged(callback: (indexingInProgress: boolean) => void) {
-                    capturedCallback = callback
-                },
-            }
-
-            const processUpdateSpy = sinon.spy(provider, 'processContextCommandUpdate')
-            ;(LocalProjectContextController.getInstance as sinon.SinonStub).resolves(mockController as any)
-
-            // Set initial state to false so condition is met
-            ;(provider as any).workspacePending = false
-
-            await (provider as any).registerContextCommandHandler()
-
-            capturedCallback?.(true)
-
-            // Not called yet — still within throttle window
-            sinon.assert.notCalled(processUpdateSpy)
-
-            // Advance past the throttle window
-            clock.tick(INDEXING_THROTTLE_MS)
-
-            sinon.assert.calledWith(processUpdateSpy, [])
-
-            clock.restore()
-        })
-    })
-
     describe('setFilesAndFoldersFailed', () => {
         it('should set filesAndFoldersFailed to true and filesAndFoldersPending to false', () => {
             provider.setFilesAndFoldersFailed(true)
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.ts
index cc7c3d12f6..770262e60b 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/context/contextCommandsProvider.ts
@@ -15,14 +15,6 @@ import { LocalProjectContextController } from '../../../shared/localProjectConte
 import { URI } from 'vscode-uri'
 import { activeFileCmd } from './additionalContextProvider'
 
-/**
- * Throttle window (in ms) for coalescing rapid `onIndexingInProgressChanged`
- * callbacks.  When indexing status toggles rapidly (e.g. true→false→true),
- * only the final state triggers a `processContextCommandUpdate` call after
- * this delay elapses with no further changes.
- */
-export const INDEXING_THROTTLE_MS = 500
-
 /**
  * Maximum items in the initial `sendContextCommands` push.
  * The client shows these when the user presses `@` before typing.
@@ -69,10 +61,7 @@ export class ContextCommandsProvider implements Disposable {
     private codeSymbolsFailed = false
     private filesAndFoldersPending = true
     private filesAndFoldersFailed = false
-    private workspacePending = true
     private initialStateSent = false
-    /** Handle for the pending indexing-change throttle timer */
-    private indexingThrottleTimer?: ReturnType<typeof setTimeout>
     constructor(
         private readonly logging: Logging,
         private readonly chat: Chat,
@@ -101,28 +90,6 @@ export class ContextCommandsProvider implements Disposable {
             controller.onContextItemsUpdated = async contextItems => {
                 await this.processContextCommandUpdate(contextItems)
             }
-            controller.onIndexingInProgressChanged = (indexingInProgress: boolean) => {
-                if (this.workspacePending !== indexingInProgress) {
-                    this.workspacePending = indexingInProgress
-
-                    // Coalesce rapid indexing status toggles: cancel any pending
-                    // throttle timer and start a new one.  Only the final state
-                    // after the throttle window triggers processContextCommandUpdate.
-                    if (this.indexingThrottleTimer !== undefined) {
-                        clearTimeout(this.indexingThrottleTimer)
-                    }
-                    this.indexingThrottleTimer = setTimeout(async () => {
-                        this.indexingThrottleTimer = undefined
-                        try {
-                            const items = await controller.getContextCommandItems()
-                            await this.processContextCommandUpdate(items)
-                        } catch (e) {
-                            this.logging.error(`Error fetching context command items: ${e}`)
-                            void this.processContextCommandUpdate([])
-                        }
-                    }, INDEXING_THROTTLE_MS)
-                }
-            }
         } catch (e) {
             this.logging.warn(`Error processing context command update: ${e}`)
         }
@@ -319,13 +286,7 @@ export class ContextCommandsProvider implements Disposable {
             placeholder: 'Select an image file',
         }
 
-        const workspaceCmd: ContextCommand = {
-            command: '@workspace',
-            id: '@workspace',
-            description: 'Reference all code in workspace',
-            disabledText: this.workspacePending ? 'pending' : undefined,
-        }
-        const commands = [workspaceCmd, folderCmdGroup, fileCmdGroup, codeCmdGroup, promptCmdGroup]
+        const commands = [folderCmdGroup, fileCmdGroup, codeCmdGroup, promptCmdGroup]
 
         if (imageContextEnabled) {
             commands.push(imageCmdGroup)
@@ -402,9 +363,6 @@ export class ContextCommandsProvider implements Disposable {
     }
 
     dispose() {
-        if (this.indexingThrottleTimer !== undefined) {
-            clearTimeout(this.indexingThrottleTimer)
-        }
         void this.promptFileWatcher?.close()
     }
 }
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/codeSearch.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/codeSearch.test.ts
deleted file mode 100644
index 0488346778..0000000000
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/codeSearch.test.ts
+++ /dev/null
@@ -1,171 +0,0 @@
-import * as assert from 'assert'
-import { CodeSearch, CodeSearchOutput } from './codeSearch'
-import { testFolder } from '@aws/lsp-core'
-import * as path from 'path'
-import * as fs from 'fs/promises'
-import { TestFeatures } from '@aws/language-server-runtimes/testing'
-import { Features } from '@aws/language-server-runtimes/server-interface/server'
-import { LocalProjectContextController } from '../../../shared/localProjectContextController'
-import { Chunk } from 'local-indexing'
-import { stub, restore, SinonStub } from 'sinon'
-
-describe('CodeSearch Tool', () => {
-    let tempFolder: testFolder.TestFolder
-    let testFeatures: TestFeatures
-    let mockLocalProjectContextController: Partial<LocalProjectContextController>
-    let getInstanceStub: SinonStub
-
-    before(async () => {
-        testFeatures = new TestFeatures()
-        testFeatures.workspace.fs.exists = path =>
-            fs.access(path).then(
-                () => true,
-                () => false
-            )
-        tempFolder = await testFolder.TestFolder.create()
-
-        mockLocalProjectContextController = {
-            isEnabled: true,
-            queryVectorIndex: stub().resolves([]),
-        }
-
-        // Stub the getInstance method
-        getInstanceStub = stub(LocalProjectContextController, 'getInstance').resolves(
-            mockLocalProjectContextController as LocalProjectContextController
-        )
-    })
-
-    after(async () => {
-        await tempFolder.delete()
-        restore() // Restore all stubbed methods
-    })
-
-    it('invalidates empty query', async () => {
-        const codeSearch = new CodeSearch(testFeatures)
-        await assert.rejects(
-            codeSearch.validate({ query: '' }),
-            /Code search query cannot be empty/i,
-            'Expected an error about empty query'
-        )
-    })
-
-    it('returns empty results when no matches found', async () => {
-        const codeSearch = new CodeSearch(testFeatures)
-        const result = await codeSearch.invoke({ query: 'nonexistent code' })
-
-        assert.strictEqual(result.output.kind, 'text')
-        assert.strictEqual(result.output.content, 'No code matches found for code search.')
-    })
-
-    it('returns formatted results when matches found', async () => {
-        // Create mock chunks that would be returned from vector search
-        const mockChunks: Chunk[] = [
-            {
-                content: 'function testFunction() { return true; }',
-                filePath: path.join(tempFolder.path, 'test.js'),
-                relativePath: 'test.js',
-                startLine: 1,
-                endLine: 3,
-                programmingLanguage: 'javascript',
-                id: '',
-                index: 0,
-                vec: [],
-            },
-        ]
-
-        // Configure the mock to return our test chunks
-        ;(mockLocalProjectContextController.queryVectorIndex as SinonStub).resolves(mockChunks)
-
-        const codeSearch = new CodeSearch(testFeatures)
-        const result = await codeSearch.invoke({ query: 'testFunction' })
-
-        assert.strictEqual(result.output.kind, 'json')
-        const content = result.output.content as CodeSearchOutput[]
-        assert.strictEqual(Array.isArray(content), true)
-        assert.strictEqual(content.length, 1)
-        assert.strictEqual(content[0].text, 'function testFunction() { return true; }')
-        assert.strictEqual(content[0].relativeFilePath, 'test.js')
-        assert.strictEqual(content[0].startLine, 1)
-        assert.strictEqual(content[0].endLine, 3)
-        assert.strictEqual(content[0].programmingLanguage?.languageName, 'javascript')
-    })
-
-    it('handles chunks without programming language', async () => {
-        // Create mock chunks without programming language
-        const mockChunks: Chunk[] = [
-            {
-                content: 'Some plain text content',
-                filePath: path.join(tempFolder.path, 'readme.txt'),
-                relativePath: 'readme.txt',
-                startLine: 1,
-                endLine: 1,
-                id: '',
-                index: 0,
-                vec: [],
-            },
-        ]
-
-        // Configure the mock to return our test chunks
-        ;(mockLocalProjectContextController.queryVectorIndex as SinonStub).resolves(mockChunks)
-
-        const codeSearch = new CodeSearch(testFeatures)
-        const result = await codeSearch.invoke({ query: 'plain text' })
-
-        assert.strictEqual(result.output.kind, 'json')
-        const content = result.output.content as CodeSearchOutput[]
-        assert.strictEqual(content.length, 1)
-        assert.strictEqual(content[0].text, 'Some plain text content')
-        assert.strictEqual(content[0].relativeFilePath, 'readme.txt')
-        assert.strictEqual(content[0].programmingLanguage, undefined)
-    })
-
-    it('uses default workspace folder when path not provided', async () => {
-        const codeSearch = new CodeSearch(testFeatures)
-        await codeSearch.invoke({ query: 'test query' })
-
-        // Verify that queryVectorIndex was called
-        assert.strictEqual((mockLocalProjectContextController.queryVectorIndex as SinonStub).called, true)
-    })
-
-    it('handles errors from LocalProjectContextController', async () => {
-        // Configure the mock to throw an error
-        ;(mockLocalProjectContextController.queryVectorIndex as SinonStub).rejects(new Error('Test error'))
-
-        const codeSearch = new CodeSearch(testFeatures)
-        await assert.rejects(
-            codeSearch.invoke({ query: 'error test' }),
-            /Failed to perform code search/,
-            'Expected an error when vector search fails'
-        )
-    })
-
-    it('provides correct queue description', async () => {
-        const codeSearch = new CodeSearch(testFeatures)
-
-        // Create a mock WritableStream
-        let capturedDescription = ''
-        const mockWriter = {
-            write: async (content: string) => {
-                capturedDescription = content
-                return Promise.resolve()
-            },
-            close: async () => Promise.resolve(),
-            releaseLock: () => {},
-        }
-        const mockStream = {
-            getWriter: () => mockWriter,
-        } as unknown as WritableStream
-
-        await codeSearch.queueDescription({ query: 'test query' }, mockStream, true)
-        assert.strictEqual(capturedDescription, 'Performing code search for "test query" in ')
-    })
-
-    it('returns correct tool specification', () => {
-        const codeSearch = new CodeSearch(testFeatures)
-        const spec = codeSearch.getSpec()
-
-        assert.strictEqual(spec.name, 'codeSearch')
-        assert.ok(spec.description.includes('Find snippets of code'))
-        assert.deepStrictEqual(spec.inputSchema.required, ['query'])
-    })
-})
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/codeSearch.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/codeSearch.ts
deleted file mode 100644
index 167175e71b..0000000000
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/codeSearch.ts
+++ /dev/null
@@ -1,194 +0,0 @@
-import { CommandValidation, InvokeOutput, requiresPathAcceptance, validatePath } from './toolShared'
-import { Features } from '@aws/language-server-runtimes/server-interface/server'
-import { getWorkspaceFolderPaths } from '@aws/lsp-core/out/util/workspaceUtils'
-import { LocalProjectContextController } from '../../../shared/localProjectContextController'
-import { Chunk } from 'local-indexing'
-import { RelevantTextDocument } from '@amzn/codewhisperer-streaming'
-import { LineInfo } from '../context/agenticChatTriggerContext'
-import path = require('path')
-
-export interface CodeSearchParams {
-    query: string
-}
-
-export type CodeSearchOutput = RelevantTextDocument & LineInfo
-
-export class CodeSearch {
-    private readonly logging: Features['logging']
-    private readonly workspace: Features['workspace']
-    private readonly lsp: Features['lsp']
-    constructor(features: Pick<Features, 'logging' | 'workspace' | 'lsp'>) {
-        this.logging = features.logging
-        this.workspace = features.workspace
-        this.lsp = features.lsp
-    }
-
-    public async validate(params: CodeSearchParams): Promise<void> {
-        if (!params.query || params.query.trim().length === 0) {
-            throw new Error('Code search query cannot be empty.')
-        }
-        const searchPath = this.getOrSetSearchPath()
-
-        if (searchPath) {
-            await validatePath(searchPath, this.workspace.fs.exists)
-        }
-    }
-
-    public async queueDescription(params: CodeSearchParams, updates: WritableStream, requiresAcceptance: boolean) {
-        const writer = updates.getWriter()
-        const closeWriter = async (w: WritableStreamDefaultWriter) => {
-            await w.close()
-            w.releaseLock()
-        }
-        if (!requiresAcceptance) {
-            await writer.write('')
-            await closeWriter(writer)
-            return
-        }
-
-        const path = this.getOrSetSearchPath()
-        await writer.write(`Performing code search for "${params.query}" in ${path}`)
-        await closeWriter(writer)
-    }
-
-    public async invoke(params: CodeSearchParams): Promise<InvokeOutput> {
-        const path = this.getOrSetSearchPath()
-
-        try {
-            const results = await this.executeCodeSearch(params.query)
-            return this.createOutput(
-                !results || results.length === 0 ? 'No code matches found for code search.' : results
-            )
-        } catch (error: any) {
-            this.logging.error(
-                `Failed to perform code search for "${params.query}" in workspace "${path}": ${error.message || error}`
-            )
-            throw new Error(
-                `Failed to perform code search for "${params.query}" in workspace"${path}": ${error.message || error}`
-            )
-        }
-    }
-
-    private getOrSetSearchPath(path?: string): string {
-        let searchPath = ''
-        if (path && path.trim().length !== 0) {
-            searchPath = path
-        } else {
-            // Handle optional path parameter
-            // Use current workspace folder as default if path is not provided
-            const workspaceFolders = getWorkspaceFolderPaths(this.workspace)
-            if (workspaceFolders && workspaceFolders.length !== 0) {
-                this.logging.debug(`Using default workspace folder: ${workspaceFolders[0]}`)
-                searchPath = workspaceFolders[0]
-            }
-        }
-        return searchPath
-    }
-
-    private async executeCodeSearch(query: string): Promise<CodeSearchOutput[]> {
-        this.logging.info(`Executing code search for "${query}" in "${path}"`)
-        const localProjectContextController = await LocalProjectContextController.getInstance()
-
-        if (!localProjectContextController.isEnabled) {
-            this.logging.warn(`Error during code search: local project context controller is disabled`)
-            throw new Error(`Error during code search: Amazon Q Workspace Index disabled,
-                 please update the configuration to enable Amazon Q workspace Index`)
-        }
-        try {
-            // TODO: we need to handle the validation of workspace indexing status once localProjectContextController support
-            // check the indexing status.
-            // Use the localProjectContextController to query the vector index
-            const searchResults = await localProjectContextController.queryVectorIndex({ query: query })
-            const sanitizedSearchResults = this.parseChunksToCodeSearchOutput(searchResults)
-            this.logging.info(`Code searched succeed with num of results: "${sanitizedSearchResults.length}"`)
-            return sanitizedSearchResults
-        } catch (error: any) {
-            this.logging.error(`Error during code search: ${error.message || error}`)
-            throw error
-        }
-    }
-
-    /**
-     * Parses chunks from vector index search into CodeSearchOutput format
-     * Based on the queryRelevantDocuments method pattern
-     */
-    private parseChunksToCodeSearchOutput(chunks: Chunk[]): CodeSearchOutput[] {
-        const codeSearchResults: CodeSearchOutput[] = []
-        if (!chunks) {
-            return codeSearchResults
-        }
-
-        for (const chunk of chunks) {
-            // Extract content and context
-            const text = chunk.content || ''
-            const relativeFilePath = chunk.relativePath ?? path.basename(chunk.filePath)
-
-            // Extract line information
-            const startLine = chunk.startLine ?? -1
-            const endLine = chunk.endLine ?? -1
-
-            // Create the base search result
-            const baseSearchResult = {
-                text,
-                relativeFilePath,
-                startLine,
-                endLine,
-            }
-
-            // Add programming language information if available
-            if (chunk.programmingLanguage && chunk.programmingLanguage !== 'unknown') {
-                codeSearchResults.push({
-                    ...baseSearchResult,
-                    programmingLanguage: {
-                        languageName: chunk.programmingLanguage,
-                    },
-                })
-            } else {
-                codeSearchResults.push(baseSearchResult)
-            }
-        }
-
-        return codeSearchResults
-    }
-
-    private createOutput(content: string | any[]): InvokeOutput {
-        if (typeof content === 'string') {
-            return {
-                output: {
-                    kind: 'text',
-                    content: content,
-                },
-            }
-        } else {
-            return {
-                output: {
-                    kind: 'json',
-                    content: content,
-                },
-            }
-        }
-    }
-
-    public getSpec() {
-        return {
-            name: 'codeSearch',
-            description:
-                "Find snippets of code from the codebase most relevant to the search query.\nThis is a semantic search tool, so the query should ask for something semantically matching what is needed.\nUnless there is a clear reason to use your own search query, please just reuse the user's exact query with their wording.\nTheir exact wording/phrasing can often be helpful for the semantic search query. Keeping the same exact question format can also be helpful.",
-            inputSchema: {
-                type: 'object',
-                properties: {
-                    query: {
-                        type: 'string',
-                        description: 'The search query to find relevant code.',
-                    },
-                    explanation: {
-                        type: 'string',
-                        description:
-                            'One sentence explanation as to why this tool is being used, and how it contributes to the goal',
-                    },
-                },
-                required: ['query'],
-            },
-        } as const
-    }
-}
diff --git a/server/aws-lsp-codewhisperer/src/language-server/chat/contexts/triggerContext.ts b/server/aws-lsp-codewhisperer/src/language-server/chat/contexts/triggerContext.ts
index 3d843a9ce3..98ca46983b 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/chat/contexts/triggerContext.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/chat/contexts/triggerContext.ts
@@ -4,8 +4,7 @@ import { BedrockTools, ChatParams, CursorState, InlineChatParams } from '@aws/la
 import { Features } from '../../types'
 import { DocumentContext, DocumentContextExtractor } from './documentContext'
 import { SendMessageCommandInput } from '../../../shared/streamingClientService'
-import { LocalProjectContextController } from '../../../shared/localProjectContextController'
-import { convertChunksToRelevantTextDocuments } from '../tools/relevantTextDocuments'
+
 import { AmazonQBaseServiceManager as AmazonQServiceManager } from '../../../shared/amazonQServiceManager/BaseAmazonQServiceManager'
 
 export interface TriggerContext extends Partial<DocumentContext> {
@@ -35,17 +34,11 @@ export class QChatTriggerContext {
     async getNewTriggerContext(params: ChatParams | InlineChatParams): Promise<TriggerContext> {
         const documentContext: DocumentContext | undefined = await this.extractDocumentContext(params)
 
-        const useRelevantDocuments =
-            'context' in params
-                ? params.context?.some(context => typeof context !== 'string' && context.command === '@workspace')
-                : false
-        let relevantDocuments = useRelevantDocuments ? await this.extractProjectContext(params.prompt.prompt) : []
-
         return {
             ...documentContext,
             userIntent: this.#guessIntentFromPrompt(params.prompt.prompt),
-            useRelevantDocuments,
-            relevantDocuments,
+            useRelevantDocuments: false,
+            relevantDocuments: [],
         }
     }
 
@@ -134,32 +127,6 @@ export class QChatTriggerContext {
             : undefined
     }
 
-    async extractProjectContext(query?: string): Promise<RelevantTextDocument[]> {
-        if (query) {
-            try {
-                let enableWorkspaceContext = true
-
-                if (this.amazonQServiceManager) {
-                    const config = this.amazonQServiceManager.getConfiguration()
-                    if (config.projectContext?.enableLocalIndexing === false) {
-                        enableWorkspaceContext = false
-                    }
-                }
-
-                if (!enableWorkspaceContext) {
-                    this.#logger.debug('Workspace context is disabled, skipping project context extraction')
-                    return []
-                }
-                const contextController = await LocalProjectContextController.getInstance()
-                const resp = await contextController.queryVectorIndex({ query })
-                return convertChunksToRelevantTextDocuments(resp)
-            } catch (e) {
-                this.#logger.error(`Failed to extract project context for chat trigger: ${e}`)
-            }
-        }
-        return []
-    }
-
     #guessIntentFromPrompt(prompt?: string): UserIntent | undefined {
         if (prompt === undefined) {
             return undefined
diff --git a/server/aws-lsp-codewhisperer/src/language-server/chat/contexts/triggerContexts.test.ts b/server/aws-lsp-codewhisperer/src/language-server/chat/contexts/triggerContexts.test.ts
index 79b33625e8..3cc6894682 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/chat/contexts/triggerContexts.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/chat/contexts/triggerContexts.test.ts
@@ -116,26 +116,4 @@ describe('QChatTriggerContext', () => {
 
         assert.deepStrictEqual(documentContext, mockDocumentContext)
     })
-
-    it('should not extract project context when workspace context is disabled', async () => {
-        amazonQServiceManager.getConfiguration.returns({
-            projectContext: {
-                enableLocalIndexing: false,
-            },
-        })
-
-        const triggerContext = new QChatTriggerContext(
-            testFeatures.workspace,
-            testFeatures.logging,
-            amazonQServiceManager
-        )
-
-        const getInstanceStub = sinon.stub(LocalProjectContextController, 'getInstance')
-
-        const result = await triggerContext.extractProjectContext('test query')
-
-        sinon.assert.notCalled(getInstanceStub)
-
-        assert.deepStrictEqual(result, [])
-    })
 })
diff --git a/server/aws-lsp-codewhisperer/src/language-server/chat/telemetry/chatTelemetryController.ts b/server/aws-lsp-codewhisperer/src/language-server/chat/telemetry/chatTelemetryController.ts
index b86c51e448..5209e0f6e1 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/chat/telemetry/chatTelemetryController.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/chat/telemetry/chatTelemetryController.ts
@@ -338,7 +338,6 @@ export class ChatTelemetryController {
                 chatConversationType: metric.cwsprChatConversationType,
                 chatActiveEditorImportCount: metric.cwsprChatActiveEditorImportCount,
                 cwsprChatHasContextList: metric.cwsprChatHasContextList,
-                cwsprChatHasWorkspaceContext: metric.cwsprChatHasWorkspaceContext,
                 cwsprChatFolderContextCount: metric.cwsprChatFolderContextCount,
                 cwsprChatFileContextCount: metric.cwsprChatFileContextCount,
                 cwsprChatRuleContextCount: metric.cwsprChatRuleContextCount,
diff --git a/server/aws-lsp-codewhisperer/src/language-server/localProjectContext/localProjectContextServer.ts b/server/aws-lsp-codewhisperer/src/language-server/localProjectContext/localProjectContextServer.ts
index ac96094354..05b69513c5 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/localProjectContext/localProjectContextServer.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/localProjectContext/localProjectContextServer.ts
@@ -22,7 +22,6 @@ export const LocalProjectContextServer =
         let amazonQServiceManager: AmazonQBaseServiceManager
         let telemetryService: TelemetryService
 
-        let localProjectContextEnabled: boolean = false
         let VSCWindowsOverride: boolean = false
 
         lsp.addInitializer((params: InitializeParams) => {
@@ -164,22 +163,13 @@ export const LocalProjectContextServer =
         const updateConfigurationHandler = async (updatedConfig: AmazonQWorkspaceConfig) => {
             logging.log('Updating configuration of local context server')
             try {
-                localProjectContextEnabled = updatedConfig.projectContext?.enableLocalIndexing === true
                 if (process.env.DISABLE_INDEXING_LIBRARY === 'true') {
                     logging.log('Skipping local project context initialization')
-                    localProjectContextEnabled = false
                 } else {
-                    logging.log(
-                        `Setting project context indexing enabled to ${updatedConfig.projectContext?.enableLocalIndexing}`
-                    )
                     await localProjectContextController.init({
-                        enableGpuAcceleration: updatedConfig?.projectContext?.enableGpuAcceleration,
-                        indexWorkerThreads: updatedConfig?.projectContext?.indexWorkerThreads,
                         ignoreFilePatterns: updatedConfig.projectContext?.localIndexing?.ignoreFilePatterns,
                         maxFileSizeMB: updatedConfig.projectContext?.localIndexing?.maxFileSizeMB,
                         maxIndexSizeMB: updatedConfig.projectContext?.localIndexing?.maxIndexSizeMB,
-                        enableIndexing: localProjectContextEnabled,
-                        indexCacheDirPath: updatedConfig.projectContext?.localIndexing?.indexCacheDirPath,
                     })
                 }
             } catch (error) {
diff --git a/server/aws-lsp-codewhisperer/src/shared/amazonQServiceManager/configurationUtils.test.ts b/server/aws-lsp-codewhisperer/src/shared/amazonQServiceManager/configurationUtils.test.ts
index 52dc9b714f..d2eb6455fd 100644
--- a/server/aws-lsp-codewhisperer/src/shared/amazonQServiceManager/configurationUtils.test.ts
+++ b/server/aws-lsp-codewhisperer/src/shared/amazonQServiceManager/configurationUtils.test.ts
@@ -21,14 +21,10 @@ describe('getAmazonQRelatedWorkspaceConfigs', () => {
             extraContext: 'some-inline-chat-context',
         },
         projectContext: {
-            enableLocalIndexing: true,
-            enableGpuAcceleration: true,
-            indexWorkerThreads: 1,
             localIndexing: {
                 ignoreFilePatterns: [],
                 maxFileSizeMB: 10,
                 maxIndexSizeMB: 2048,
-                indexCacheDirPath: undefined,
             },
         },
     }
@@ -60,9 +56,6 @@ describe('getAmazonQRelatedWorkspaceConfigs', () => {
             shareCodeWhispererContentWithAWS: MOCKED_AWS_CODEWHISPERER_SECTION.shareCodeWhispererContentWithAWS,
             sendUserWrittenCodeMetrics: MOCKED_AWS_CODEWHISPERER_SECTION.sendUserWrittenCodeMetrics,
             projectContext: {
-                enableLocalIndexing: MOCKED_AWS_Q_SECTION.projectContext.enableLocalIndexing,
-                enableGpuAcceleration: MOCKED_AWS_Q_SECTION.projectContext?.enableGpuAcceleration,
-                indexWorkerThreads: MOCKED_AWS_Q_SECTION.projectContext?.indexWorkerThreads,
                 localIndexing: MOCKED_AWS_Q_SECTION.projectContext.localIndexing,
             },
         }
@@ -112,14 +105,10 @@ describe('AmazonQConfigurationCache', () => {
             shareCodeWhispererContentWithAWS: true,
             sendUserWrittenCodeMetrics: false,
             projectContext: {
-                enableLocalIndexing: true,
-                enableGpuAcceleration: true,
-                indexWorkerThreads: 1,
                 localIndexing: {
                     ignoreFilePatterns: [],
                     maxFileSizeMB: 10,
                     maxIndexSizeMB: 2048,
-                    indexCacheDirPath: undefined,
                 },
             },
         }
@@ -136,9 +125,9 @@ describe('AmazonQConfigurationCache', () => {
         mockedQConfig.customizationArn = undefined
         mockedQConfig.inlineSuggestions = { extraContext: undefined }
         mockedQConfig.projectContext = {
-            enableLocalIndexing: false,
-            enableGpuAcceleration: false,
-            indexWorkerThreads: 0,
+            localIndexing: {
+                ignoreFilePatterns: ['*.log'],
+            },
         }
         notDeepStrictEqual(cache.getProperty('customizationArn'), mockedQConfig.customizationArn)
         notDeepStrictEqual(cache.getProperty('inlineSuggestions'), mockedQConfig.inlineSuggestions)
diff --git a/server/aws-lsp-codewhisperer/src/shared/amazonQServiceManager/configurationUtils.ts b/server/aws-lsp-codewhisperer/src/shared/amazonQServiceManager/configurationUtils.ts
index 8adb68f2d0..899a2909ef 100644
--- a/server/aws-lsp-codewhisperer/src/shared/amazonQServiceManager/configurationUtils.ts
+++ b/server/aws-lsp-codewhisperer/src/shared/amazonQServiceManager/configurationUtils.ts
@@ -75,13 +75,9 @@ interface LocalIndexConfig {
     ignoreFilePatterns?: string[] // patterns must follow .gitignore convention
     maxFileSizeMB?: number
     maxIndexSizeMB?: number
-    indexCacheDirPath?: string // defaults to homedir/.aws/amazonq/cache
 }
 
 interface QProjectContextConfig {
-    enableLocalIndexing: boolean // aws.q.projectContext.enableLocalIndexing
-    enableGpuAcceleration: boolean // aws.q.projectContext.enableGpuAcceleration
-    indexWorkerThreads: number // aws.q.projectContext.indexWorkerThreads
     localIndexing?: LocalIndexConfig
 }
 
@@ -139,14 +135,10 @@ export async function getAmazonQRelatedWorkspaceConfigs(
                     extraContext: textUtils.undefinedIfEmpty(newQConfig.inlineChat?.extraContext),
                 },
                 projectContext: {
-                    enableLocalIndexing: newQConfig.projectContext?.enableLocalIndexing === true,
-                    enableGpuAcceleration: newQConfig.projectContext?.enableGpuAcceleration === true,
-                    indexWorkerThreads: newQConfig.projectContext?.indexWorkerThreads ?? -1,
                     localIndexing: {
                         ignoreFilePatterns: newQConfig.projectContext?.localIndexing?.ignoreFilePatterns ?? [],
                         maxFileSizeMB: newQConfig.projectContext?.localIndexing?.maxFileSizeMB ?? 10,
                         maxIndexSizeMB: newQConfig.projectContext?.localIndexing?.maxIndexSizeMB ?? 2048,
-                        indexCacheDirPath: newQConfig.projectContext?.localIndexing?.indexCacheDirPath ?? undefined,
                     },
                 },
             }
@@ -202,14 +194,10 @@ export const defaultAmazonQWorkspaceConfigFactory = (): AmazonQWorkspaceConfig =
         shareCodeWhispererContentWithAWS: false,
         sendUserWrittenCodeMetrics: false,
         projectContext: {
-            enableLocalIndexing: false,
-            enableGpuAcceleration: false,
-            indexWorkerThreads: -1,
             localIndexing: {
                 ignoreFilePatterns: [],
                 maxFileSizeMB: 10,
                 maxIndexSizeMB: 2048,
-                indexCacheDirPath: undefined,
             },
         },
     }
diff --git a/server/aws-lsp-codewhisperer/src/shared/localProjectContextController.test.ts b/server/aws-lsp-codewhisperer/src/shared/localProjectContextController.test.ts
index ef73e5c20a..a11e499b30 100644
--- a/server/aws-lsp-codewhisperer/src/shared/localProjectContextController.test.ts
+++ b/server/aws-lsp-codewhisperer/src/shared/localProjectContextController.test.ts
@@ -46,8 +46,6 @@ describe('LocalProjectContextController', () => {
         vectorLibMock = {
             start: stub().resolves({
                 buildIndex: stub().resolves(),
-                clear: stub().resolves(),
-                queryVectorIndex: stub().resolves(['mockChunk1', 'mockChunk2']),
                 queryInlineProjectContext: stub().resolves(['mockContext1']),
                 updateIndexV2: stub().resolves(),
                 getContextCommandItems: stub().resolves([]),
@@ -80,7 +78,7 @@ describe('LocalProjectContextController', () => {
     describe('init', () => {
         it('should initialize vector library successfully', async () => {
             const buildIndexSpy = spy(controller, 'buildIndex')
-            await controller.init({ vectorLib: vectorLibMock, enableIndexing: true })
+            await controller.init({ vectorLib: vectorLibMock })
 
             sinonAssert.notCalled(logging.error)
             sinonAssert.called(vectorLibMock.start)
@@ -96,24 +94,13 @@ describe('LocalProjectContextController', () => {
             sinonAssert.called(logging.error)
         })
 
-        it('should call buildIndex with `default` if not enabled', async () => {
-            const buildIndexSpy = spy(controller, 'buildIndex')
-            await controller.init({ vectorLib: vectorLibMock, enableIndexing: false })
-
-            sinonAssert.notCalled(logging.error)
-            sinonAssert.called(vectorLibMock.start)
-            sinonAssert.calledOnce(buildIndexSpy)
-            sinonAssert.calledWith(buildIndexSpy, 'default')
-        })
-
-        it('should call buildIndex with `all` when enabled', async () => {
+        it('should call buildIndex on init', async () => {
             const buildIndexSpy = spy(controller, 'buildIndex')
-            await controller.init({ vectorLib: vectorLibMock, enableIndexing: true })
+            await controller.init({ vectorLib: vectorLibMock })
 
             sinonAssert.notCalled(logging.error)
             sinonAssert.called(vectorLibMock.start)
             sinonAssert.calledOnce(buildIndexSpy)
-            sinonAssert.calledWith(buildIndexSpy, 'all')
         })
     })
 
@@ -121,64 +108,16 @@ describe('LocalProjectContextController', () => {
         it('should build Index with vectorLib', async () => {
             await controller.init({ vectorLib: vectorLibMock })
             const vecLib = await vectorLibMock.start()
-            await controller.buildIndex('all')
+            await controller.buildIndex()
             sinonAssert.called(vecLib.buildIndex)
         })
     })
-
-    describe('queryVectorIndex', () => {
-        beforeEach(async () => {
-            await controller.init({ vectorLib: vectorLibMock })
-        })
-
-        it('should return empty array when vector library is not initialized', async () => {
-            sinon.stub(controller, 'isIndexingEnabled').returns(true)
-            const uninitializedController = new LocalProjectContextController(
-                'testClient',
-                mockWorkspaceFolders,
-                logging as any
-            )
-
-            const result = await uninitializedController.queryVectorIndex({ query: 'test' })
-            assert.deepStrictEqual(result, [])
-        })
-
-        it('should return empty array when indexing is disabled', async () => {
-            sinon.stub(controller, 'isIndexingEnabled').returns(false)
-            const uninitializedController = new LocalProjectContextController(
-                'testClient',
-                mockWorkspaceFolders,
-                logging as any
-            )
-
-            const result = await uninitializedController.queryVectorIndex({ query: 'test' })
-            assert.deepStrictEqual(result, [])
-        })
-
-        it('should return chunks from vector library', async () => {
-            sinon.stub(controller, 'isIndexingEnabled').returns(true)
-            const result = await controller.queryVectorIndex({ query: 'test' })
-            assert.deepStrictEqual(result, ['mockChunk1', 'mockChunk2'])
-        })
-
-        it('should handle query errors', async () => {
-            sinon.stub(controller, 'isIndexingEnabled').returns(true)
-            const vecLib = await vectorLibMock.start()
-            vecLib.queryVectorIndex.rejects(new Error('Query failed'))
-
-            const result = await controller.queryVectorIndex({ query: 'test' })
-            assert.deepStrictEqual(result, [])
-            sinonAssert.called(logging.error)
-        })
-    })
-
     describe('queryInlineProjectContext', () => {
         beforeEach(async () => {
             await controller.init({ vectorLib: vectorLibMock })
         })
 
         it('should return empty array when vector library is not initialized', async () => {
-            sinon.stub(controller, 'isIndexingEnabled').returns(true)
             const uninitializedController = new LocalProjectContextController(
                 'testClient',
                 mockWorkspaceFolders,
@@ -194,7 +133,6 @@ describe('LocalProjectContextController', () => {
         })
 
         it('should return empty array when indexing is disabled', async () => {
-            sinon.stub(controller, 'isIndexingEnabled').returns(false)
             const uninitializedController = new LocalProjectContextController(
                 'testClient',
                 mockWorkspaceFolders,
@@ -210,7 +148,6 @@ describe('LocalProjectContextController', () => {
         })
 
         it('should return context from vector library', async () => {
-            sinon.stub(controller, 'isIndexingEnabled').returns(true)
             const result = await controller.queryInlineProjectContext({
                 query: 'test',
                 filePath: 'test.java',
@@ -220,7 +157,6 @@ describe('LocalProjectContextController', () => {
         })
 
         it('should handle query errors', async () => {
-            sinon.stub(controller, 'isIndexingEnabled').returns(true)
             const vecLib = await vectorLibMock.start()
             vecLib.queryInlineProjectContext.rejects(new Error('Query failed'))
 
@@ -353,85 +289,12 @@ describe('LocalProjectContextController', () => {
         })
     })
 
-    describe('configuration options', () => {
-        let processEnvBackup: NodeJS.ProcessEnv
-
-        beforeEach(() => {
-            processEnvBackup = { ...process.env }
-        })
-
-        afterEach(() => {
-            process.env = processEnvBackup
-        })
-
-        it('should set GPU acceleration environment variable when enabled', async () => {
-            await controller.init({
-                enableGpuAcceleration: true,
-                vectorLib: vectorLibMock,
-            })
-            assert.strictEqual(process.env.Q_ENABLE_GPU, 'true')
-            sinonAssert.called(vectorLibMock.start)
-        })
-
-        it('should remove GPU acceleration environment variable when disabled', async () => {
-            process.env.Q_ENABLE_GPU = 'true'
-            await controller.init({
-                enableGpuAcceleration: false,
-                vectorLib: vectorLibMock,
-            })
-            assert.strictEqual(process.env.Q_ENABLE_GPU, undefined)
-            sinonAssert.called(vectorLibMock.start)
-        })
-
-        it('should set worker threads environment variable when specified', async () => {
-            await controller.init({
-                indexWorkerThreads: 4,
-                vectorLib: vectorLibMock,
-            })
-            assert.strictEqual(process.env.Q_WORKER_THREADS, '4')
-            sinonAssert.called(vectorLibMock.start)
-        })
-
-        it('should remove worker threads environment variable when not specified', async () => {
-            process.env.Q_WORKER_THREADS = '4'
-            await controller.init({
-                vectorLib: vectorLibMock,
-            })
-            assert.strictEqual(process.env.Q_WORKER_THREADS, undefined)
-            sinonAssert.called(vectorLibMock.start)
-        })
-
-        it('should ignore invalid worker thread counts', async () => {
-            process.env.Q_WORKER_THREADS = '4'
-            await controller.init({
-                indexWorkerThreads: 101,
-                vectorLib: vectorLibMock,
-            })
-            assert.strictEqual(process.env.Q_WORKER_THREADS, undefined)
-            sinonAssert.called(vectorLibMock.start)
-        })
-
-        it('should ignore negative worker thread counts', async () => {
-            process.env.Q_WORKER_THREADS = '4'
-            await controller.init({
-                indexWorkerThreads: -1,
-                vectorLib: vectorLibMock,
-            })
-            assert.strictEqual(process.env.Q_WORKER_THREADS, undefined)
-            sinonAssert.called(vectorLibMock.start)
-        })
-    })
-
     describe('dispose', () => {
         it('should clear and remove vector library reference', async () => {
             await controller.init({ vectorLib: vectorLibMock })
             await controller.dispose()
 
-            const vecLib = await vectorLibMock.start()
-            sinonAssert.called(vecLib.clear)
-
-            const queryResult = await controller.queryVectorIndex({ query: 'test' })
-            assert.deepStrictEqual(queryResult, [])
+            assert.strictEqual(controller.isEnabled, false)
         })
     })
 })
diff --git a/server/aws-lsp-codewhisperer/src/shared/localProjectContextController.ts b/server/aws-lsp-codewhisperer/src/shared/localProjectContextController.ts
index 527f92f3b4..0cc0495bc1 100644
--- a/server/aws-lsp-codewhisperer/src/shared/localProjectContextController.ts
+++ b/server/aws-lsp-codewhisperer/src/shared/localProjectContextController.ts
@@ -8,7 +8,6 @@ import type {
     ContextCommandItem,
     InlineProjectContext,
     QueryInlineProjectContextRequestV2,
-    QueryRequest,
     UpdateMode,
     VectorLibAPI,
 } from 'local-indexing'
@@ -41,17 +40,11 @@ export interface LocalProjectContextInitializationOptions {
     includeSymlinks?: boolean
     maxFileSizeMB?: number
     maxIndexSizeMB?: number
-    indexCacheDirPath?: string
-    enableGpuAcceleration?: boolean
-    indexWorkerThreads?: number
-    enableIndexing?: boolean
 }
 
 export class LocalProjectContextController {
     // Event handler for context items updated
     public onContextItemsUpdated: ((contextItems: ContextCommandItem[]) => Promise<void>) | undefined
-    // Event handler for when index is being built
-    public onIndexingInProgressChanged: ((enabled: boolean) => void) | undefined
     private static instance: LocalProjectContextController | undefined
 
     private workspaceFolders: WorkspaceFolder[]
@@ -59,14 +52,12 @@ export class LocalProjectContextController {
     private _contextCommandSymbolsUpdated = false
     private readonly clientName: string
     private readonly log: Logging
-    private _isIndexingEnabled: boolean = false
     private _isIndexingInProgress: boolean = false
     private ignoreFilePatterns?: string[]
     private includeSymlinks?: boolean
     private maxFileSizeMB?: number
     private maxIndexSizeMB?: number
     private respectUserGitIgnores?: boolean
-    private indexCacheDirPath: string = path.join(homedir(), '.aws', 'amazonq', 'cache')
 
     private readonly fileExtensions: string[] = Object.keys(languageByExtension)
     private readonly DEFAULT_MAX_INDEX_SIZE_MB = 2048
@@ -108,10 +99,6 @@ export class LocalProjectContextController {
         includeSymlinks = false,
         maxFileSizeMB = this.DEFAULT_MAX_FILE_SIZE_MB,
         maxIndexSizeMB = this.DEFAULT_MAX_INDEX_SIZE_MB,
-        indexCacheDirPath = path.join(homedir(), '.aws', 'amazonq', 'cache'),
-        enableGpuAcceleration = false,
-        indexWorkerThreads = 0,
-        enableIndexing = false,
     }: LocalProjectContextInitializationOptions = {}): Promise<void> {
         try {
             // update states according to configuration
@@ -120,66 +107,30 @@ export class LocalProjectContextController {
             this.maxIndexSizeMB = maxIndexSizeMB
             this.respectUserGitIgnores = respectUserGitIgnores
             this.ignoreFilePatterns = ignoreFilePatterns
-            if (indexCacheDirPath?.length > 0 && path.parse(indexCacheDirPath)) {
-                this.indexCacheDirPath = indexCacheDirPath
-            }
 
-            if (enableGpuAcceleration) {
-                process.env.Q_ENABLE_GPU = 'true'
-            } else {
-                delete process.env.Q_ENABLE_GPU
-            }
-            if (indexWorkerThreads && indexWorkerThreads > 0 && indexWorkerThreads < 100) {
-                process.env.Q_WORKER_THREADS = indexWorkerThreads.toString()
-            } else {
-                delete process.env.Q_WORKER_THREADS
-            }
-            this.log.info(
-                `Vector library initializing with GPU acceleration: ${enableGpuAcceleration}, ` +
-                    `index worker thread count: ${indexWorkerThreads}`
-            )
+            this.log.info('Initializing local project context')
 
-            // build index if vecLib was initialized but indexing was not enabled before
+            // skip re-init if vecLib already loaded
             if (this._vecLib) {
-                // if indexing is turned being on, build index with 'all' that supports vector indexing
-                if (enableIndexing && !this._isIndexingEnabled) {
-                    this.buildIndex('all').catch(e => {
-                        this.log.error(`Error building index with indexing enabled: ${e}`)
-                    })
-                }
-                // if indexing is turned being off, build index with 'default' that  does not support vector indexing
-                if (!enableIndexing && this._isIndexingEnabled) {
-                    this.buildIndex('default').catch(e => {
-                        this.log.error(`Error building index with indexing disabled: ${e}`)
-                    })
-                }
-                this._isIndexingEnabled = enableIndexing
                 return
             }
 
-            // initialize vecLib and index if needed
+            // initialize vecLib and index
             const libraryPath = this.getVectorLibraryPath()
             const vecLib = vectorLib ?? (await eval(`import("${libraryPath}")`))
             if (vecLib) {
                 try {
-                    this._vecLib = await vecLib.start(LIBRARY_DIR, this.clientName, this.indexCacheDirPath)
+                    this._vecLib = await vecLib.start(LIBRARY_DIR, this.clientName)
                 } catch (startError) {
                     this.log.warn(`Vector library start() failed (native modules may be missing): ${startError}`)
                     this.log.warn('Context commands will be unavailable')
                 }
                 if (this._vecLib) {
-                    if (enableIndexing) {
-                        this.buildIndex('all').catch(e => {
-                            this.log.error(`Error building index on init with indexing enabled: ${e}`)
-                        })
-                    } else {
-                        this.buildIndex('default').catch(e => {
-                            this.log.error(`Error building index on init with indexing disabled: ${e}`)
-                        })
-                    }
+                    this.buildIndex().catch(e => {
+                        this.log.error(`Error building index on init: ${e}`)
+                    })
                 }
                 LocalProjectContextController.instance = this
-                this._isIndexingEnabled = enableIndexing
             } else {
                 this.log.warn(`Vector library could not be imported from: ${libraryPath}`)
                 LocalProjectContextController.instance = this
@@ -219,13 +170,12 @@ export class LocalProjectContextController {
     }
 
     // public for test
-    async buildIndex(indexingType: string): Promise<void> {
+    async buildIndex(): Promise<void> {
         if (this._isIndexingInProgress) {
             return
         }
         try {
             this._isIndexingInProgress = true
-            this.onIndexingInProgressChanged?.(this._isIndexingInProgress)
             if (this._vecLib) {
                 if (!this.workspaceFolders.length) {
                     this.log.info('skip building index because no workspace folder found')
@@ -239,14 +189,13 @@ export class LocalProjectContextController {
                 )
 
                 const projectRoot = URI.parse(this.workspaceFolders.sort()[0].uri).fsPath
-                await this._vecLib?.buildIndex(sourceFiles, projectRoot, indexingType)
+                await this._vecLib?.buildIndex(sourceFiles, projectRoot, 'default')
                 this.log.info('Context index built successfully')
             }
         } catch (error) {
             this.log.error(`Error building index: ${error}`)
         } finally {
             this._isIndexingInProgress = false
-            this.onIndexingInProgressChanged?.(this._isIndexingInProgress)
         }
     }
 
@@ -285,7 +234,6 @@ export class LocalProjectContextController {
     public async queryInlineProjectContext(
         request: QueryInlineProjectContextRequestV2
     ): Promise<InlineProjectContext[]> {
-        // inline project context is available for all users regardless of local indexing enabled or disabled
         try {
             const resp = await this._vecLib?.queryInlineProjectContext(request.query, request.filePath, request.target)
             return resp ?? []
@@ -295,20 +243,6 @@ export class LocalProjectContextController {
         }
     }
 
-    public async queryVectorIndex(request: QueryRequest): Promise<Chunk[]> {
-        if (!this.isIndexingEnabled()) {
-            return []
-        }
-
-        try {
-            const resp = await this._vecLib?.queryVectorIndex(request.query)
-            return resp ?? []
-        } catch (error) {
-            this.log.error(`Error in queryVectorIndex: ${error}`)
-            return []
-        }
-    }
-
     public async getContextCommandItems(): Promise<ContextCommandItem[]> {
         if (!this._vecLib) {
             return []
@@ -397,10 +331,6 @@ export class LocalProjectContextController {
         }
     }
 
-    public isIndexingEnabled(): boolean {
-        return this._vecLib !== undefined && this._isIndexingEnabled
-    }
-
     async processWorkspaceFolders(
         workspaceFolders?: WorkspaceFolder[] | null,
         fileExtensions?: string[],
diff --git a/server/aws-lsp-codewhisperer/src/shared/telemetry/telemetryService.test.ts b/server/aws-lsp-codewhisperer/src/shared/telemetry/telemetryService.test.ts
index 66f81af680..32536f73fd 100644
--- a/server/aws-lsp-codewhisperer/src/shared/telemetry/telemetryService.test.ts
+++ b/server/aws-lsp-codewhisperer/src/shared/telemetry/telemetryService.test.ts
@@ -775,7 +775,6 @@ describe('TelemetryService', () => {
                 },
                 {
                     cwsprChatHasContextList: true,
-                    cwsprChatHasWorkspaceContext: false,
                     cwsprChatFolderContextCount: 0,
                     cwsprChatFileContextCount: 0,
                     cwsprChatRuleContextCount: 0,
@@ -845,7 +844,6 @@ describe('TelemetryService', () => {
                     experimentName: undefined,
                     userVariation: undefined,
                     cwsprChatHasContextList: true,
-                    cwsprChatHasWorkspaceContext: false,
                     cwsprChatFolderContextCount: 0,
                     cwsprChatFileContextCount: 0,
                     cwsprChatRuleContextCount: 0,
diff --git a/server/aws-lsp-codewhisperer/src/shared/telemetry/telemetryService.ts b/server/aws-lsp-codewhisperer/src/shared/telemetry/telemetryService.ts
index f7c93b6f14..861333d302 100644
--- a/server/aws-lsp-codewhisperer/src/shared/telemetry/telemetryService.ts
+++ b/server/aws-lsp-codewhisperer/src/shared/telemetry/telemetryService.ts
@@ -563,7 +563,6 @@ export class TelemetryService {
             chatConversationType: ChatConversationType
             chatActiveEditorImportCount?: number
             cwsprChatHasContextList: boolean
-            cwsprChatHasWorkspaceContext?: boolean
             cwsprChatFolderContextCount: number
             cwsprChatFileContextCount: number
             cwsprChatFileContextLength: number
@@ -617,7 +616,6 @@ export class TelemetryService {
                     cwsprChatActiveEditorImportCount: additionalParams.chatActiveEditorImportCount,
                     codewhispererCustomizationArn: params.customizationArn,
                     cwsprChatHasContextList: additionalParams.cwsprChatHasContextList,
-                    cwsprChatHasWorkspaceContext: additionalParams.cwsprChatHasWorkspaceContext,
                     cwsprChatFolderContextCount: additionalParams.cwsprChatFolderContextCount,
                     cwsprChatFileContextCount: additionalParams.cwsprChatFileContextCount,
                     cwsprChatRuleContextCount: additionalParams.cwsprChatRuleContextCount,

From 7b8595a4e638562f79d5f71dcf22b0c700490458 Mon Sep 17 00:00:00 2001
From: Laxman Reddy <141967714+laileni-aws@users.noreply.github.com>
Date: Tue, 28 Apr 2026 15:53:17 -0700
Subject: [PATCH 16/23] feat(amazonq): add consent prompt for workspace-scoped
 MCP servers (#2708)

* feat(amazonq): add consent prompt for workspace-scoped MCP servers

* fix(amazonq): suppress MCP consent re-prompts within session on deny (#2703)

* test: add consent gate tests for workspace-scoped MCP servers (#2705)

* fix: add missing closing brace in mcpManager.test.ts

* fix: use getGlobalMcpConfigPath for cross-platform path in consent gate test

* fix: addressing review feedback

---------

Co-authored-by: Aseem Sharma <aseemxs@amazon.com>
Co-authored-by: Aseem sharma <198968351+aseemxs@users.noreply.github.com>
---
 .../tools/mcp/mcpConsentStore.test.ts         | 153 ++++++++++++++++++
 .../agenticChat/tools/mcp/mcpConsentStore.ts  | 114 +++++++++++++
 .../agenticChat/tools/mcp/mcpManager.test.ts  | 147 +++++++++++++++++
 .../agenticChat/tools/mcp/mcpManager.ts       |  66 ++++++++
 4 files changed, 480 insertions(+)
 create mode 100644 server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpConsentStore.test.ts
 create mode 100644 server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpConsentStore.ts

diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpConsentStore.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpConsentStore.test.ts
new file mode 100644
index 0000000000..bea38982b5
--- /dev/null
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpConsentStore.test.ts
@@ -0,0 +1,153 @@
+/*!
+ * Copyright Amazon.com, Inc. or its affiliates.
+ * All Rights Reserved. SPDX-License-Identifier: Apache-2.0
+ */
+
+import { expect } from 'chai'
+import * as fs from 'fs'
+import * as os from 'os'
+import * as path from 'path'
+import { fingerprintServerConfig, fingerprintWorkspace, hasApproval, recordApproval } from './mcpConsentStore'
+import type { MCPServerConfig } from './mcpTypes'
+
+describe('mcpConsentStore', () => {
+    let tmpHome: string
+    let workspace: any
+    let logger: any
+
+    beforeEach(() => {
+        tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'mcpConsentTest-'))
+        workspace = {
+            fs: {
+                exists: (p: string) => Promise.resolve(fs.existsSync(p)),
+                readFile: (p: string) => Promise.resolve(Buffer.from(fs.readFileSync(p))),
+                writeFile: (p: string, d: string) => Promise.resolve(fs.writeFileSync(p, d)),
+                mkdir: (p: string, _opts: any) => Promise.resolve(fs.mkdirSync(p, { recursive: true })),
+                getUserHomeDir: () => tmpHome,
+            },
+        }
+        logger = { warn: () => {}, info: () => {}, error: () => {} }
+    })
+
+    afterEach(() => {
+        fs.rmSync(tmpHome, { recursive: true, force: true })
+    })
+
+    describe('fingerprintServerConfig', () => {
+        it('is deterministic for identical config', () => {
+            const cfg: MCPServerConfig = { command: 'sh', args: ['-c', 'echo hi'] }
+            expect(fingerprintServerConfig(cfg)).to.equal(fingerprintServerConfig({ ...cfg }))
+        })
+
+        it('differs when command changes', () => {
+            const a: MCPServerConfig = { command: 'sh', args: ['-c', 'echo hi'] }
+            const b: MCPServerConfig = { command: 'bash', args: ['-c', 'echo hi'] }
+            expect(fingerprintServerConfig(a)).to.not.equal(fingerprintServerConfig(b))
+        })
+
+        it('differs when args change', () => {
+            const a: MCPServerConfig = { command: 'sh', args: ['-c', 'echo hi'] }
+            const b: MCPServerConfig = { command: 'sh', args: ['-c', 'echo bye'] }
+            expect(fingerprintServerConfig(a)).to.not.equal(fingerprintServerConfig(b))
+        })
+
+        it('differs when env changes', () => {
+            const a: MCPServerConfig = { command: 'sh', args: [], env: { FOO: '1' } }
+            const b: MCPServerConfig = { command: 'sh', args: [], env: { FOO: '2' } }
+            expect(fingerprintServerConfig(a)).to.not.equal(fingerprintServerConfig(b))
+        })
+
+        it('is stable regardless of env key order', () => {
+            const a: MCPServerConfig = { command: 'sh', args: [], env: { A: '1', B: '2' } }
+            const b: MCPServerConfig = { command: 'sh', args: [], env: { B: '2', A: '1' } }
+            expect(fingerprintServerConfig(a)).to.equal(fingerprintServerConfig(b))
+        })
+
+        it('differs when url changes', () => {
+            const a: MCPServerConfig = { url: 'https://a.example' }
+            const b: MCPServerConfig = { url: 'https://b.example' }
+            expect(fingerprintServerConfig(a)).to.not.equal(fingerprintServerConfig(b))
+        })
+    })
+
+    describe('fingerprintWorkspace', () => {
+        it('is keyed on the directory of the config, not the filename', () => {
+            const a = fingerprintWorkspace('/foo/bar/.amazonq/mcp.json')
+            const b = fingerprintWorkspace('/foo/bar/.amazonq/agents/default.json')
+            // both live under /foo/bar/.amazonq's parent-dir once; path.dirname differs though
+            expect(a).to.not.equal(b)
+        })
+
+        it('is deterministic for the same path', () => {
+            const p = '/foo/bar/.amazonq/mcp.json'
+            expect(fingerprintWorkspace(p)).to.equal(fingerprintWorkspace(p))
+        })
+    })
+
+    describe('hasApproval / recordApproval', () => {
+        const cfg: MCPServerConfig = { command: 'sh', args: ['-c', 'echo ok'] }
+        const configPath = '/tmp/ws-a/.amazonq/mcp.json'
+
+        it('returns false when store is empty', async () => {
+            expect(await hasApproval(workspace, logger, 'poc', cfg, configPath)).to.be.false
+        })
+
+        it('records and finds an approval for same (name, config, workspace)', async () => {
+            await recordApproval(workspace, logger, 'poc', cfg, configPath)
+            expect(await hasApproval(workspace, logger, 'poc', cfg, configPath)).to.be.true
+        })
+
+        it('does not match when workspace path differs', async () => {
+            await recordApproval(workspace, logger, 'poc', cfg, '/tmp/ws-a/.amazonq/mcp.json')
+            expect(await hasApproval(workspace, logger, 'poc', cfg, '/tmp/ws-b/.amazonq/mcp.json')).to.be.false
+        })
+
+        it('does not match when command changes (fingerprint invalidates)', async () => {
+            await recordApproval(workspace, logger, 'poc', cfg, configPath)
+            const mutated: MCPServerConfig = { command: 'sh', args: ['-c', 'curl evil'] }
+            expect(await hasApproval(workspace, logger, 'poc', mutated, configPath)).to.be.false
+        })
+
+        it('does not match when server name differs', async () => {
+            await recordApproval(workspace, logger, 'poc', cfg, configPath)
+            expect(await hasApproval(workspace, logger, 'other', cfg, configPath)).to.be.false
+        })
+
+        it('dedupes repeated approvals for the same key', async () => {
+            await recordApproval(workspace, logger, 'poc', cfg, configPath)
+            await recordApproval(workspace, logger, 'poc', cfg, configPath)
+            const stored = JSON.parse(
+                fs.readFileSync(path.join(tmpHome, '.aws', 'amazonq', 'mcp-approvals.json')).toString()
+            )
+            expect(stored.approvals).to.have.lengthOf(1)
+        })
+
+        it('evicts stale entry when config changes for same server and workspace', async () => {
+            await recordApproval(workspace, logger, 'poc', cfg, configPath)
+            const mutated: MCPServerConfig = { command: 'sh', args: ['-c', 'echo changed'] }
+            await recordApproval(workspace, logger, 'poc', mutated, configPath)
+            const stored = JSON.parse(
+                fs.readFileSync(path.join(tmpHome, '.aws', 'amazonq', 'mcp-approvals.json')).toString()
+            )
+            // Should have exactly 1 entry — the old fingerprint was evicted
+            expect(stored.approvals).to.have.lengthOf(1)
+            expect(stored.approvals[0].fingerprint).to.equal(fingerprintServerConfig(mutated))
+        })
+
+        it('ignores a store with unrecognized version', async () => {
+            const storeDir = path.join(tmpHome, '.aws', 'amazonq')
+            fs.mkdirSync(storeDir, { recursive: true })
+            fs.writeFileSync(path.join(storeDir, 'mcp-approvals.json'), JSON.stringify({ version: 999, approvals: [] }))
+            // record should still work (overwrites with v1)
+            await recordApproval(workspace, logger, 'poc', cfg, configPath)
+            expect(await hasApproval(workspace, logger, 'poc', cfg, configPath)).to.be.true
+        })
+
+        it('treats a malformed store as empty', async () => {
+            const storeDir = path.join(tmpHome, '.aws', 'amazonq')
+            fs.mkdirSync(storeDir, { recursive: true })
+            fs.writeFileSync(path.join(storeDir, 'mcp-approvals.json'), 'not json')
+            expect(await hasApproval(workspace, logger, 'poc', cfg, configPath)).to.be.false
+        })
+    })
+})
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpConsentStore.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpConsentStore.ts
new file mode 100644
index 0000000000..05b64cf9d4
--- /dev/null
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpConsentStore.ts
@@ -0,0 +1,114 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates.
+ * All Rights Reserved. SPDX-License-Identifier: Apache-2.0
+ */
+
+import { createHash } from 'crypto'
+import * as path from 'path'
+import type { Workspace, Logging } from '@aws/language-server-runtimes/server-interface'
+import type { MCPServerConfig } from './mcpTypes'
+
+const APPROVALS_FILE = 'mcp-approvals.json'
+const STORE_VERSION = 1
+
+interface Approval {
+    serverName: string
+    fingerprint: string
+    workspaceHash: string
+    approvedAt: string
+}
+
+interface ApprovalStore {
+    version: number
+    approvals: Approval[]
+}
+
+/**
+ * SHA-256 of a canonical JSON form of the server's execution-relevant fields.
+ * Any change to command/args/env/url yields a new fingerprint, invalidating
+ * prior approvals — so mutation of the config re-prompts.
+ */
+export function fingerprintServerConfig(cfg: MCPServerConfig): string {
+    const canonical = {
+        command: cfg.command ?? null,
+        args: cfg.args ?? [],
+        env: cfg.env ? Object.fromEntries(Object.entries(cfg.env).sort(([a], [b]) => a.localeCompare(b))) : {},
+        url: cfg.url ?? null,
+    }
+    return 'sha256:' + createHash('sha256').update(JSON.stringify(canonical)).digest('hex')
+}
+
+/** Hash of the workspace path so approval is scoped to (workspace, config).
+ *  Normalizes the path to forward slashes for cross-platform consistency. */
+export function fingerprintWorkspace(configPath: string): string {
+    const normalized = path.resolve(path.dirname(configPath)).replace(/\\/g, '/')
+    return 'sha256:' + createHash('sha256').update(normalized).digest('hex')
+}
+
+function getStorePath(workspace: Workspace): string {
+    return path.join(workspace.fs.getUserHomeDir(), '.aws', 'amazonq', APPROVALS_FILE)
+}
+
+async function readStore(workspace: Workspace, logging: Logging): Promise<ApprovalStore> {
+    const file = getStorePath(workspace)
+    try {
+        if (!(await workspace.fs.exists(file))) {
+            return { version: STORE_VERSION, approvals: [] }
+        }
+        const raw = (await workspace.fs.readFile(file)).toString()
+        const parsed = JSON.parse(raw) as ApprovalStore
+        if (parsed?.version !== STORE_VERSION || !Array.isArray(parsed.approvals)) {
+            logging.warn(`MCP consent store: unrecognized format at ${file}, treating as empty`)
+            return { version: STORE_VERSION, approvals: [] }
+        }
+        return parsed
+    } catch (e: any) {
+        logging.warn(`MCP consent store: failed to read ${file}: ${e?.message}`)
+        return { version: STORE_VERSION, approvals: [] }
+    }
+}
+
+async function writeStore(workspace: Workspace, logging: Logging, store: ApprovalStore): Promise<void> {
+    const file = getStorePath(workspace)
+    try {
+        await workspace.fs.mkdir(path.dirname(file), { recursive: true })
+        await workspace.fs.writeFile(file, JSON.stringify(store, null, 2))
+    } catch (e: any) {
+        logging.warn(`MCP consent store: failed to write ${file}: ${e?.message}`)
+    }
+}
+
+export async function hasApproval(
+    workspace: Workspace,
+    logging: Logging,
+    serverName: string,
+    cfg: MCPServerConfig,
+    configPath: string
+): Promise<boolean> {
+    const store = await readStore(workspace, logging)
+    const fp = fingerprintServerConfig(cfg)
+    const wh = fingerprintWorkspace(configPath)
+    return store.approvals.some(a => a.serverName === serverName && a.fingerprint === fp && a.workspaceHash === wh)
+}
+
+export async function recordApproval(
+    workspace: Workspace,
+    logging: Logging,
+    serverName: string,
+    cfg: MCPServerConfig,
+    configPath: string
+): Promise<void> {
+    const store = await readStore(workspace, logging)
+    const fp = fingerprintServerConfig(cfg)
+    const wh = fingerprintWorkspace(configPath)
+    // Replace any prior approval for the same (server, workspace) — this evicts
+    // stale entries when the config changes (fingerprint differs).
+    store.approvals = store.approvals.filter(a => !(a.serverName === serverName && a.workspaceHash === wh))
+    store.approvals.push({
+        serverName,
+        fingerprint: fp,
+        workspaceHash: wh,
+        approvedAt: new Date().toISOString(),
+    })
+    await writeStore(workspace, logging, store)
+}
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpManager.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpManager.test.ts
index 170abcc3db..0667d149cc 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpManager.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpManager.test.ts
@@ -1936,3 +1936,150 @@ describe('addRegistryServer with additional headers/env', () => {
         expect(agentCfg.env).to.be.undefined
     })
 })
+
+describe('consent gate for workspace-scoped MCP servers (P417451767)', () => {
+    const fakeHome = '/home/testuser'
+    const globalMcp = mcpUtils.getGlobalMcpConfigPath(fakeHome)
+    const workspaceMcp = '/tmp/ws-a/.amazonq/mcp.json'
+
+    let showMessageStub: sinon.SinonStub
+    let hasApprovalStub: sinon.SinonStub
+    let recordApprovalStub: sinon.SinonStub
+    let setStateSpy: sinon.SinonSpy
+
+    async function buildMgr(): Promise<any> {
+        const consentStore = require('./mcpConsentStore')
+        hasApprovalStub = sinon.stub(consentStore, 'hasApproval').resolves(false)
+        recordApprovalStub = sinon.stub(consentStore, 'recordApproval').resolves()
+
+        showMessageStub = sinon.stub()
+        const featuresWithPrompt = {
+            ...features,
+            workspace: {
+                ...fakeWorkspace,
+                fs: { ...fakeWorkspace.fs, getUserHomeDir: () => fakeHome },
+            },
+            lsp: { window: { showMessageRequest: showMessageStub } },
+        }
+        sinon.stub(mcpUtils, 'loadAgentConfig').resolves({
+            servers: new Map(),
+            serverNameMapping: new Map(),
+            errors: new Map(),
+            agentConfig: {
+                name: 'test',
+                description: '',
+                mcpServers: {},
+                tools: [],
+                allowedTools: [],
+                toolsSettings: {},
+                includedFiles: [],
+                resources: [],
+            },
+        })
+        const mgr = await McpManager.init([], featuresWithPrompt as any)
+        setStateSpy = sinon.spy(mgr as any, 'setState')
+        return mgr
+    }
+
+    afterEach(async () => {
+        sinon.restore()
+        try {
+            await McpManager.instance.close()
+        } catch {}
+    })
+
+    it('does not prompt for global-scoped config', async () => {
+        const mgr = await buildMgr()
+        const cfg: MCPServerConfig = { command: 'sh', args: [], __configPath__: globalMcp }
+        // Fail fast after gate (cleanupExistingServer is safe to call on unknown server)
+        try {
+            await (mgr as any).initOneServerInternal('svc', cfg)
+        } catch {}
+        expect(showMessageStub.called).to.be.false
+    })
+
+    it('does not prompt for global agent config path', async () => {
+        const mgr = await buildMgr()
+        const globalAgent = mcpUtils.getGlobalAgentConfigPath(fakeHome)
+        const cfg: MCPServerConfig = { command: 'sh', args: [], __configPath__: globalAgent }
+        try {
+            await (mgr as any).initOneServerInternal('svc', cfg)
+        } catch {}
+        expect(showMessageStub.called).to.be.false
+    })
+
+    it('does not prompt for global persona config path', async () => {
+        const mgr = await buildMgr()
+        const globalPersona = mcpUtils.getGlobalPersonaConfigPath(fakeHome)
+        const cfg: MCPServerConfig = { command: 'sh', args: [], __configPath__: globalPersona }
+        try {
+            await (mgr as any).initOneServerInternal('svc', cfg)
+        } catch {}
+        expect(showMessageStub.called).to.be.false
+    })
+
+    it('prompts for workspace-scoped config when no prior approval', async () => {
+        const mgr = await buildMgr()
+        showMessageStub.resolves({ title: 'Deny' })
+        const cfg: MCPServerConfig = { command: 'sh', args: ['-c', 'x'], __configPath__: workspaceMcp }
+        try {
+            await (mgr as any).initOneServerInternal('svc', cfg)
+        } catch {}
+        expect(showMessageStub.calledOnce).to.be.true
+    })
+
+    it('denial sets DISABLED state and caches the decision', async () => {
+        const mgr = await buildMgr()
+        showMessageStub.resolves({ title: 'Deny' })
+        const cfg: MCPServerConfig = { command: 'sh', args: ['-c', 'x'], __configPath__: workspaceMcp }
+        try {
+            await (mgr as any).initOneServerInternal('svc', cfg)
+        } catch {}
+        expect(setStateSpy.calledWith('svc', McpServerStatus.DISABLED, 0, 'consent not granted')).to.be.true
+
+        // Second call with same cfg should not re-prompt
+        showMessageStub.resetHistory()
+        try {
+            await (mgr as any).initOneServerInternal('svc', cfg)
+        } catch {}
+        expect(showMessageStub.called).to.be.false
+    })
+
+    it('mutation of args invalidates session denial (fingerprint change)', async () => {
+        const mgr = await buildMgr()
+        showMessageStub.resolves({ title: 'Deny' })
+        const cfg1: MCPServerConfig = { command: 'sh', args: ['-c', 'x'], __configPath__: workspaceMcp }
+        try {
+            await (mgr as any).initOneServerInternal('svc', cfg1)
+        } catch {}
+        expect(showMessageStub.calledOnce).to.be.true
+
+        // Mutate args — fingerprint changes, denial cache key differs, prompt should fire again
+        showMessageStub.resetHistory()
+        const cfg2: MCPServerConfig = { command: 'sh', args: ['-c', 'y'], __configPath__: workspaceMcp }
+        try {
+            await (mgr as any).initOneServerInternal('svc', cfg2)
+        } catch {}
+        expect(showMessageStub.calledOnce).to.be.true
+    })
+
+    it('prior approval short-circuits prompt', async () => {
+        const mgr = await buildMgr()
+        hasApprovalStub.resolves(true)
+        const cfg: MCPServerConfig = { command: 'sh', args: [], __configPath__: workspaceMcp }
+        try {
+            await (mgr as any).initOneServerInternal('svc', cfg)
+        } catch {}
+        expect(showMessageStub.called).to.be.false
+    })
+
+    it('allow records approval', async () => {
+        const mgr = await buildMgr()
+        showMessageStub.resolves({ title: 'Allow for this server' })
+        const cfg: MCPServerConfig = { command: 'sh', args: ['-c', 'x'], __configPath__: workspaceMcp }
+        try {
+            await (mgr as any).initOneServerInternal('svc', cfg)
+        } catch {}
+        expect(recordApprovalStub.calledOnce).to.be.true
+    })
+})
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpManager.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpManager.ts
index f5ab29d946..679a4207ea 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpManager.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpManager.ts
@@ -33,12 +33,15 @@ import {
     getGlobalAgentConfigPath,
     getWorkspaceMcpConfigPaths,
     getGlobalMcpConfigPath,
+    getGlobalPersonaConfigPath,
 } from './mcpUtils'
 import { AgenticChatError } from '../../errors'
 import { EventEmitter } from 'events'
 import { Mutex } from 'async-mutex'
 import path = require('path')
 import { URI } from 'vscode-uri'
+import { MessageType } from '@aws/language-server-runtimes/protocol'
+import { hasApproval, recordApproval, fingerprintServerConfig } from './mcpConsentStore'
 import { sanitizeInput } from '../../../../shared/utils'
 import { ProfileStatusMonitor } from './profileStatusMonitor'
 import { OAuthClient } from './mcpOauthClient'
@@ -78,6 +81,7 @@ export class McpManager {
     private currentRegistry: McpRegistryData | null = null
     private registryUrlProvided: boolean = false
     private isPeriodicSync: boolean = false
+    private sessionDeniedConsent = new Set<string>()
 
     private constructor(
         private agentPaths: string[],
@@ -408,6 +412,67 @@ export class McpManager {
     ): Promise<void> {
         const DEFAULT_SERVER_INIT_TIMEOUT_MS = 120_000
 
+        // Consent gate for workspace-scoped MCP configs (P417451767).
+        // Workspace-scoped configs live in a folder the user opened and may be attacker-controlled.
+        // Global configs (~/.aws/amazonq/...) are user-authored and trusted implicitly.
+        const home = this.features.workspace.fs.getUserHomeDir()
+        const configPath = cfg.__configPath__
+        const globalMcp = getGlobalMcpConfigPath(home)
+        const globalAgent = getGlobalAgentConfigPath(home)
+        const globalPersona = getGlobalPersonaConfigPath(home)
+        const isWorkspaceScoped =
+            !!configPath && configPath !== globalMcp && configPath !== globalAgent && configPath !== globalPersona
+        if (isWorkspaceScoped && configPath) {
+            const denyKey = `${serverName}|${configPath}|${fingerprintServerConfig(cfg)}`
+            if (this.sessionDeniedConsent.has(denyKey)) {
+                this.setState(serverName, McpServerStatus.DISABLED, 0, 'consent not granted')
+                return
+            }
+            const approved = await hasApproval(
+                this.features.workspace,
+                this.features.logging,
+                serverName,
+                cfg,
+                configPath
+            )
+            if (!approved) {
+                const cmdLine = [cfg.command ?? cfg.url ?? '(none)', ...(cfg.args ?? [])].join(' ').slice(0, 200)
+                const allowBtn = { title: 'Allow for this server' }
+                const denyBtn = { title: 'Deny' }
+                let choice: { title: string } | null | undefined
+                try {
+                    choice = await this.features.lsp.window.showMessageRequest({
+                        type: MessageType.Warning,
+                        message:
+                            `Amazon Q — Untrusted MCP Server\n\n` +
+                            `A workspace configuration file wants to start an MCP server.\n` +
+                            `Server: ${serverName}\n` +
+                            `Command: ${cmdLine}\n` +
+                            `Source: ${configPath}\n\n` +
+                            `Running this server executes the above command on your machine. ` +
+                            `Only allow if you trust the authors of this workspace.\n\n` +
+                            `Your choice will be remembered for this workspace. ` +
+                            `If you allow, you won't be asked again unless the server configuration changes.`,
+                        actions: [allowBtn, denyBtn],
+                    })
+                } catch (e: any) {
+                    this.features.logging.warn(`MCP: consent prompt failed for '${serverName}': ${e?.message}`)
+                    this.setState(serverName, McpServerStatus.FAILED, 0, 'consent prompt failed')
+                    return
+                }
+                if (choice?.title !== allowBtn.title) {
+                    this.features.logging.info(
+                        `MCP: user declined consent for workspace-scoped server '${serverName}' (response: ${choice?.title ?? 'dismissed'})`
+                    )
+                    this.sessionDeniedConsent.add(denyKey)
+                    this.setState(serverName, McpServerStatus.DISABLED, 0, 'consent not granted')
+                    return
+                }
+                await recordApproval(this.features.workspace, this.features.logging, serverName, cfg, configPath)
+                this.features.logging.info(`MCP: recorded consent for workspace-scoped server '${serverName}'`)
+            }
+        }
+
         // Lightweight cleanup - only kill our tracked processes
         await this.cleanupExistingServer(serverName)
 
@@ -1285,6 +1350,7 @@ export class McpManager {
         this.mcpTools = []
         this.mcpServers.clear()
         this.mcpServerStates.clear()
+        this.sessionDeniedConsent.clear()
         this.agentConfig = {
             name: 'q_ide_default',
             description: 'Agent configuration',

From 4a4210a11f9f7021a917d4afebc1e6627397faa5 Mon Sep 17 00:00:00 2001
From: Laxman Reddy <141967714+laileni-aws@users.noreply.github.com>
Date: Tue, 28 Apr 2026 16:03:25 -0700
Subject: [PATCH 17/23] chore: bumpup language server runtime version (#2709)

---
 chat-client/package.json                  |  2 +-
 package-lock.json                         | 10 +++++-----
 server/aws-lsp-codewhisperer/package.json |  2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/chat-client/package.json b/chat-client/package.json
index d6dcc0c496..15bb68c5e1 100644
--- a/chat-client/package.json
+++ b/chat-client/package.json
@@ -25,7 +25,7 @@
     },
     "dependencies": {
         "@aws/chat-client-ui-types": "0.1.68",
-        "@aws/language-server-runtimes": "^0.3.16",
+        "@aws/language-server-runtimes": "^0.3.17",
         "@aws/language-server-runtimes-types": "^0.1.64",
         "@aws/mynah-ui": "^4.40.1"
     },
diff --git a/package-lock.json b/package-lock.json
index 5a47697e47..e26ca5cb9e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -255,7 +255,7 @@
             "license": "Apache-2.0",
             "dependencies": {
                 "@aws/chat-client-ui-types": "0.1.68",
-                "@aws/language-server-runtimes": "^0.3.16",
+                "@aws/language-server-runtimes": "^0.3.17",
                 "@aws/language-server-runtimes-types": "^0.1.64",
                 "@aws/mynah-ui": "^4.40.1"
             },
@@ -4506,9 +4506,9 @@
             }
         },
         "node_modules/@aws/language-server-runtimes": {
-            "version": "0.3.16",
-            "resolved": "https://registry.npmjs.org/@aws/language-server-runtimes/-/language-server-runtimes-0.3.16.tgz",
-            "integrity": "sha512-i5Rlnq1VUWpihGyd65o5gRqA8rxnkWZkx0WLsBCpuD9Lpztscwq2Si6f1dhhKK59905nG/xNE1xvRVAlXxc0IA==",
+            "version": "0.3.17",
+            "resolved": "https://registry.npmjs.org/@aws/language-server-runtimes/-/language-server-runtimes-0.3.17.tgz",
+            "integrity": "sha512-yA7A7o5YChUlOT0zip9vGQu2Q5+UnHW/39cn7LKsTH0VD8ZiB8I8/4SXUggV3as2Vy7nD447xJGVkqjYqlngRA==",
             "license": "Apache-2.0",
             "dependencies": {
                 "@aws/language-server-runtimes-types": "^0.1.64",
@@ -31122,7 +31122,7 @@
                 "@aws-sdk/util-arn-parser": "^3.723.0",
                 "@aws-sdk/util-retry": "^3.374.0",
                 "@aws/chat-client-ui-types": "0.1.68",
-                "@aws/language-server-runtimes": "^0.3.16",
+                "@aws/language-server-runtimes": "^0.3.17",
                 "@aws/lsp-core": "^0.0.21",
                 "@modelcontextprotocol/sdk": "^1.23.0",
                 "@mozilla/readability": "^0.6.0",
diff --git a/server/aws-lsp-codewhisperer/package.json b/server/aws-lsp-codewhisperer/package.json
index 269aabbfa8..621565964e 100644
--- a/server/aws-lsp-codewhisperer/package.json
+++ b/server/aws-lsp-codewhisperer/package.json
@@ -38,7 +38,7 @@
         "@aws-sdk/util-arn-parser": "^3.723.0",
         "@aws-sdk/util-retry": "^3.374.0",
         "@aws/chat-client-ui-types": "0.1.68",
-        "@aws/language-server-runtimes": "^0.3.16",
+        "@aws/language-server-runtimes": "^0.3.17",
         "@aws/lsp-core": "^0.0.21",
         "@modelcontextprotocol/sdk": "^1.23.0",
         "@mozilla/readability": "^0.6.0",

From f5aa1a3b25aa38bfe8dd0e830b5839e1cea1d410 Mon Sep 17 00:00:00 2001
From: Laxman Reddy <141967714+laileni-aws@users.noreply.github.com>
Date: Wed, 29 Apr 2026 12:37:44 -0700
Subject: [PATCH 18/23] fix(amazonq): improve MCP consent gate reliability and
 cleanup (#2711)

* feat(amazonq): add consent prompt for workspace-scoped MCP servers

* fix(amazonq): suppress MCP consent re-prompts within session on deny (#2703)

* test: add consent gate tests for workspace-scoped MCP servers (#2705)

* fix: add missing closing brace in mcpManager.test.ts

* fix: use getGlobalMcpConfigPath for cross-platform path in consent gate test

* fix: addressing review feedback

* fix(amazonq): improve MCP consent gate reliability and cleanup

- Fix spurious re-prompts on IDE reload by using OR matching in
  hasApproval: match on (serverName, fingerprint) OR (serverName,
  workspaceHash). The fingerprint can change slightly between reloads
  due to config migration, and the workspaceHash covers that case.
- Add getGlobalPersonaConfigPath to the trusted set so persona configs
  don't trigger unnecessary consent prompts.
- Clear sessionDeniedConsent in close() for consistency with other state.
- Replace non-null assertion with inline Set initialization.
- Evict stale approval entries when config changes for the same server
  and workspace instead of accumulating them.
- Normalize configPath via normalizePathFromUri before consent checks.
- Add removeApproval and call it from removeServer so deleting a
  workspace MCP server clears its persisted approval.
- Improve prompt text to explain persistence semantics to the user.
- Normalize paths with path.resolve and forward slashes for cross-
  platform consistency in fingerprintWorkspace.

---------

Co-authored-by: Aseem Sharma <aseemxs@amazon.com>
Co-authored-by: Aseem sharma <198968351+aseemxs@users.noreply.github.com>
---
 .../tools/mcp/mcpConsentStore.test.ts         | 38 ++++++++++++++++---
 .../agenticChat/tools/mcp/mcpConsentStore.ts  | 23 ++++++++++-
 .../agenticChat/tools/mcp/mcpManager.ts       | 11 +++++-
 3 files changed, 65 insertions(+), 7 deletions(-)

diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpConsentStore.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpConsentStore.test.ts
index bea38982b5..bf3fdb47c9 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpConsentStore.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpConsentStore.test.ts
@@ -7,7 +7,13 @@ import { expect } from 'chai'
 import * as fs from 'fs'
 import * as os from 'os'
 import * as path from 'path'
-import { fingerprintServerConfig, fingerprintWorkspace, hasApproval, recordApproval } from './mcpConsentStore'
+import {
+    fingerprintServerConfig,
+    fingerprintWorkspace,
+    hasApproval,
+    recordApproval,
+    removeApproval,
+} from './mcpConsentStore'
 import type { MCPServerConfig } from './mcpTypes'
 
 describe('mcpConsentStore', () => {
@@ -97,15 +103,23 @@ describe('mcpConsentStore', () => {
             expect(await hasApproval(workspace, logger, 'poc', cfg, configPath)).to.be.true
         })
 
-        it('does not match when workspace path differs', async () => {
+        it('matches via fingerprint even when workspace path differs', async () => {
             await recordApproval(workspace, logger, 'poc', cfg, '/tmp/ws-a/.amazonq/mcp.json')
-            expect(await hasApproval(workspace, logger, 'poc', cfg, '/tmp/ws-b/.amazonq/mcp.json')).to.be.false
+            expect(await hasApproval(workspace, logger, 'poc', cfg, '/tmp/ws-b/.amazonq/mcp.json')).to.be.true
         })
 
-        it('does not match when command changes (fingerprint invalidates)', async () => {
+        it('matches via workspaceHash even when fingerprint differs', async () => {
+            await recordApproval(workspace, logger, 'poc', cfg, configPath)
+            const mutated: MCPServerConfig = { command: 'sh', args: ['-c', 'echo different'] }
+            // Same workspace, different fingerprint — should still match via workspaceHash fallback
+            expect(await hasApproval(workspace, logger, 'poc', mutated, configPath)).to.be.true
+        })
+
+        it('does not match when both fingerprint and workspace differ', async () => {
             await recordApproval(workspace, logger, 'poc', cfg, configPath)
             const mutated: MCPServerConfig = { command: 'sh', args: ['-c', 'curl evil'] }
-            expect(await hasApproval(workspace, logger, 'poc', mutated, configPath)).to.be.false
+            // Different fingerprint AND different workspace — no match
+            expect(await hasApproval(workspace, logger, 'poc', mutated, '/tmp/ws-other/.amazonq/mcp.json')).to.be.false
         })
 
         it('does not match when server name differs', async () => {
@@ -149,5 +163,19 @@ describe('mcpConsentStore', () => {
             fs.writeFileSync(path.join(storeDir, 'mcp-approvals.json'), 'not json')
             expect(await hasApproval(workspace, logger, 'poc', cfg, configPath)).to.be.false
         })
+
+        it('removeApproval clears a previously recorded approval', async () => {
+            await recordApproval(workspace, logger, 'poc', cfg, configPath)
+            expect(await hasApproval(workspace, logger, 'poc', cfg, configPath)).to.be.true
+            await removeApproval(workspace, logger, 'poc', configPath)
+            expect(await hasApproval(workspace, logger, 'poc', cfg, configPath)).to.be.false
+        })
+
+        it('removeApproval is a no-op when no matching server name exists', async () => {
+            await recordApproval(workspace, logger, 'poc', cfg, configPath)
+            await removeApproval(workspace, logger, 'other', configPath)
+            // Original approval should still be there
+            expect(await hasApproval(workspace, logger, 'poc', cfg, configPath)).to.be.true
+        })
     })
 })
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpConsentStore.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpConsentStore.ts
index 05b64cf9d4..349cd32114 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpConsentStore.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpConsentStore.ts
@@ -88,7 +88,13 @@ export async function hasApproval(
     const store = await readStore(workspace, logging)
     const fp = fingerprintServerConfig(cfg)
     const wh = fingerprintWorkspace(configPath)
-    return store.approvals.some(a => a.serverName === serverName && a.fingerprint === fp && a.workspaceHash === wh)
+    // Primary match: (serverName, fingerprint) — the fingerprint captures the full
+    // execution-relevant config (command/args/env/url). This works even if the
+    // workspaceHash varies between reloads due to configPath format differences.
+    // Fallback match: (serverName, workspaceHash) — covers cases where the
+    // fingerprint changes slightly between reloads (e.g., config migration adds
+    // default values) but the workspace is the same.
+    return store.approvals.some(a => a.serverName === serverName && (a.fingerprint === fp || a.workspaceHash === wh))
 }
 
 export async function recordApproval(
@@ -112,3 +118,18 @@ export async function recordApproval(
     })
     await writeStore(workspace, logging, store)
 }
+
+export async function removeApproval(
+    workspace: Workspace,
+    logging: Logging,
+    serverName: string,
+    configPath: string
+): Promise<void> {
+    const store = await readStore(workspace, logging)
+    const before = store.approvals.length
+    store.approvals = store.approvals.filter(a => a.serverName !== serverName)
+    if (store.approvals.length < before) {
+        await writeStore(workspace, logging, store)
+        logging.info(`MCP consent store: removed approval for '${serverName}'`)
+    }
+}
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpManager.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpManager.ts
index 679a4207ea..61e7ea75fe 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpManager.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/tools/mcp/mcpManager.ts
@@ -34,6 +34,7 @@ import {
     getWorkspaceMcpConfigPaths,
     getGlobalMcpConfigPath,
     getGlobalPersonaConfigPath,
+    normalizePathFromUri,
 } from './mcpUtils'
 import { AgenticChatError } from '../../errors'
 import { EventEmitter } from 'events'
@@ -41,7 +42,7 @@ import { Mutex } from 'async-mutex'
 import path = require('path')
 import { URI } from 'vscode-uri'
 import { MessageType } from '@aws/language-server-runtimes/protocol'
-import { hasApproval, recordApproval, fingerprintServerConfig } from './mcpConsentStore'
+import { hasApproval, recordApproval, removeApproval, fingerprintServerConfig } from './mcpConsentStore'
 import { sanitizeInput } from '../../../../shared/utils'
 import { ProfileStatusMonitor } from './profileStatusMonitor'
 import { OAuthClient } from './mcpOauthClient'
@@ -417,6 +418,8 @@ export class McpManager {
         // Global configs (~/.aws/amazonq/...) are user-authored and trusted implicitly.
         const home = this.features.workspace.fs.getUserHomeDir()
         const configPath = cfg.__configPath__
+            ? normalizePathFromUri(cfg.__configPath__, this.features.logging)
+            : undefined
         const globalMcp = getGlobalMcpConfigPath(home)
         const globalAgent = getGlobalAgentConfigPath(home)
         const globalPersona = getGlobalPersonaConfigPath(home)
@@ -1138,6 +1141,12 @@ export class McpManager {
         this.mcpTools = this.mcpTools.filter(t => t.serverName !== serverName)
         this.mcpServerStates.delete(serverName)
 
+        // Clean up any persisted consent approval for this server
+        if (cfg.__configPath__) {
+            const normalizedPath = normalizePathFromUri(cfg.__configPath__, this.features.logging)
+            await removeApproval(this.features.workspace, this.features.logging, serverName, normalizedPath)
+        }
+
         // Check if this is a legacy MCP server (from MCP config file)
         const isLegacyMcpServer = cfg.__configPath__?.endsWith('mcp.json')
         let agentPath: string | undefined

From 71c53d10a14c154e1790c622ffaa3f476f15fc22 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 29 Apr 2026 14:20:22 -0700
Subject: [PATCH 19/23] chore(release): release packages from branch main
 (#2699)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 .release-please-manifest.json             |  2 +-
 package-lock.json                         |  2 +-
 server/aws-lsp-codewhisperer/CHANGELOG.md | 14 ++++++++++++++
 server/aws-lsp-codewhisperer/package.json |  2 +-
 4 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 9ae14a3a11..961de9e84a 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -2,7 +2,7 @@
     "chat-client": "0.1.51",
     "core/aws-lsp-core": "0.0.21",
     "server/aws-lsp-antlr4": "0.1.25",
-    "server/aws-lsp-codewhisperer": "0.0.112",
+    "server/aws-lsp-codewhisperer": "0.0.113",
     "server/aws-lsp-json": "0.1.26",
     "server/aws-lsp-partiql": "0.0.23",
     "server/aws-lsp-yaml": "0.1.26"
diff --git a/package-lock.json b/package-lock.json
index e26ca5cb9e..74df6617dd 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -31102,7 +31102,7 @@
         },
         "server/aws-lsp-codewhisperer": {
             "name": "@aws/lsp-codewhisperer",
-            "version": "0.0.112",
+            "version": "0.0.113",
             "bundleDependencies": [
                 "@amzn/codewhisperer",
                 "@amzn/codewhisperer-runtime",
diff --git a/server/aws-lsp-codewhisperer/CHANGELOG.md b/server/aws-lsp-codewhisperer/CHANGELOG.md
index 059db3379a..08bf1c874b 100644
--- a/server/aws-lsp-codewhisperer/CHANGELOG.md
+++ b/server/aws-lsp-codewhisperer/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.0.113](https://github.com/aws/language-servers/compare/lsp-codewhisperer/v0.0.112...lsp-codewhisperer/v0.0.113) (2026-04-29)
+
+
+### Features
+
+* **amazonq:** add consent prompt for workspace-scoped MCP servers ([#2708](https://github.com/aws/language-servers/issues/2708)) ([7b8595a](https://github.com/aws/language-servers/commit/7b8595a4e638562f79d5f71dcf22b0c700490458))
+
+
+### Bug Fixes
+
+* **amazonq:** improve MCP consent gate reliability and cleanup ([#2711](https://github.com/aws/language-servers/issues/2711)) ([f5aa1a3](https://github.com/aws/language-servers/commit/f5aa1a3b25aa38bfe8dd0e830b5839e1cea1d410))
+* deprecate [@workspace](https://github.com/workspace) vector search + fix [@folder](https://github.com/folder) files not appearing in context ([#2698](https://github.com/aws/language-servers/issues/2698)) ([ae7d3fc](https://github.com/aws/language-servers/commit/ae7d3fcd26f57d6cc5d3d26dd5ec79983c4103df))
+* guard workspaceFolderManager null reference in updateConfiguration ([#2695](https://github.com/aws/language-servers/issues/2695)) ([dcd7829](https://github.com/aws/language-servers/commit/dcd78298766d09902ba51cb12547780f518d48a9))
+
 ## [0.0.112](https://github.com/aws/language-servers/compare/lsp-codewhisperer/v0.0.111...lsp-codewhisperer/v0.0.112) (2026-04-07)
 
 
diff --git a/server/aws-lsp-codewhisperer/package.json b/server/aws-lsp-codewhisperer/package.json
index 621565964e..325d183d16 100644
--- a/server/aws-lsp-codewhisperer/package.json
+++ b/server/aws-lsp-codewhisperer/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@aws/lsp-codewhisperer",
-    "version": "0.0.112",
+    "version": "0.0.113",
     "description": "CodeWhisperer Language Server",
     "main": "out/index.js",
     "repository": {

From b6226e758d52d8db85c844cab82e6b604566e2ef Mon Sep 17 00:00:00 2001
From: Laxman Reddy <141967714+laileni-aws@users.noreply.github.com>
Date: Tue, 5 May 2026 10:52:03 -0700
Subject: [PATCH 20/23] fix(amazonq): route inline chat through getChatResponse
 for correct API selection (#2713) (#2714)

The onInlineChatPrompt handler was hardcoded to call client.sendMessage()
regardless of the authentication type. This caused Kiro Enterprise
subscription users on Eclipse to get Your subscription does not support
this application errors because SendMessage is not in the Kiro
Enterprise API allowlist.

Route inline chat through getChatResponse() which correctly selects
GenerateAssistantResponse for token-based (SSO/IdC) clients and
SendMessage only for IAM clients, matching the behavior of regular chat.
---
 .../agenticChat/agenticChatController.test.ts | 25 +++++++++++--------
 .../agenticChat/agenticChatController.ts      | 22 ++++++++--------
 2 files changed, 26 insertions(+), 21 deletions(-)

diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.test.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.test.ts
index a6bcc00404..7f90c54fb6 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.test.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.test.ts
@@ -2159,8 +2159,8 @@ describe('AgenticChatController', () => {
             assert.deepStrictEqual(chatResult, expectedCompleteInlineChatResult)
         })
 
-        it('returns a ResponseError if sendMessage returns an error', async () => {
-            sendMessageStub.callsFake(() => {
+        it('returns a ResponseError if generateAssistantResponse returns an error', async () => {
+            generateAssistantResponseStub.callsFake(() => {
                 throw new Error('Error')
             })
 
@@ -2172,8 +2172,8 @@ describe('AgenticChatController', () => {
             assert.ok(chatResult instanceof ResponseError)
         })
 
-        it('returns a Response error if sendMessage returns an auth error', async () => {
-            sendMessageStub.callsFake(() => {
+        it('returns a Response error if generateAssistantResponse returns an auth error', async () => {
+            generateAssistantResponseStub.callsFake(() => {
                 throw new Error('Error')
             })
 
@@ -2189,12 +2189,12 @@ describe('AgenticChatController', () => {
         })
 
         it('returns a ResponseError if response streams return an error event', async () => {
-            sendMessageStub.callsFake(() => {
+            generateAssistantResponseStub.callsFake(() => {
                 return Promise.resolve({
                     $metadata: {
                         requestId: mockMessageId,
                     },
-                    sendMessageResponse: createIterableResponse([
+                    generateAssistantResponseResponse: createIterableResponse([
                         // ["Hello ", "World"]
                         ...mockChatResponseList.slice(1, 3),
                         { error: { message: 'some error' } },
@@ -2213,12 +2213,12 @@ describe('AgenticChatController', () => {
         })
 
         it('returns a ResponseError if response streams return an invalid state event', async () => {
-            sendMessageStub.callsFake(() => {
+            generateAssistantResponseStub.callsFake(() => {
                 return Promise.resolve({
                     $metadata: {
                         requestId: mockMessageId,
                     },
-                    sendMessageResponse: createIterableResponse([
+                    generateAssistantResponseResponse: createIterableResponse([
                         // ["Hello ", "World"]
                         ...mockChatResponseList.slice(1, 3),
                         { invalidStateEvent: { message: 'invalid state' } },
@@ -2279,7 +2279,8 @@ describe('AgenticChatController', () => {
                     mockCancellationToken
                 )
 
-                const calledRequestInput: SendMessageCommandInput = sendMessageStub.firstCall.firstArg
+                const calledRequestInput: GenerateAssistantResponseCommandInput =
+                    generateAssistantResponseStub.firstCall.firstArg
 
                 assert.strictEqual(
                     calledRequestInput.conversationState?.currentMessage?.userInputMessage?.userInputMessageContext
@@ -2304,7 +2305,8 @@ describe('AgenticChatController', () => {
                     mockCancellationToken
                 )
 
-                const calledRequestInput: SendMessageCommandInput = sendMessageStub.firstCall.firstArg
+                const calledRequestInput: GenerateAssistantResponseCommandInput =
+                    generateAssistantResponseStub.firstCall.firstArg
 
                 assert.strictEqual(
                     calledRequestInput.conversationState?.currentMessage?.userInputMessage?.userInputMessageContext
@@ -2330,7 +2332,8 @@ describe('AgenticChatController', () => {
                     mockCancellationToken
                 )
 
-                const calledRequestInput: SendMessageCommandInput = sendMessageStub.firstCall.firstArg
+                const calledRequestInput: GenerateAssistantResponseCommandInput =
+                    generateAssistantResponseStub.firstCall.firstArg
 
                 assert.deepStrictEqual(
                     calledRequestInput.conversationState?.currentMessage?.userInputMessage?.userInputMessageContext
diff --git a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
index a3384faf17..6a8846c3cb 100644
--- a/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
+++ b/server/aws-lsp-codewhisperer/src/language-server/agenticChat/agenticChatController.ts
@@ -37,12 +37,7 @@ import {
     SUFFIX_UNDOALL,
     SUFFIX_EXPLANATION,
 } from './constants/toolConstants'
-import {
-    SendMessageCommandInput,
-    SendMessageCommandOutput,
-    ChatCommandInput,
-    ChatCommandOutput,
-} from '../../shared/streamingClientService'
+import { SendMessageCommandInput, ChatCommandInput, ChatCommandOutput } from '../../shared/streamingClientService'
 import {
     Button,
     Status,
@@ -3776,8 +3771,8 @@ export class AgenticChatController implements ChatHandlers {
                 throw new Error('amazonQServiceManager is not initialized')
             }
 
-            const client = this.#serviceManager.getStreamingClient()
-            response = await client.sendMessage(requestInput as SendMessageCommandInput)
+            const session = new ChatSessionService(this.#serviceManager, this.#features.lsp, this.#features.logging)
+            response = await session.getChatResponse(requestInput)
             this.#log('Response for inline chat', JSON.stringify(response.$metadata), JSON.stringify(response))
         } catch (err) {
             if (err instanceof AmazonQServicePendingSigninError || err instanceof AmazonQServicePendingProfileError) {
@@ -4697,14 +4692,21 @@ export class AgenticChatController implements ChatHandlers {
     }
 
     async #processSendMessageResponseForInlineChat(
-        response: SendMessageCommandOutput,
+        response: ChatCommandOutput,
         metric: Metric<AddMessageEvent>,
         partialResultToken?: string | number
     ): Promise<Result<ChatResultWithMetadata, string>> {
         const requestId = response.$metadata.requestId!
         const chatEventParser = new ChatEventParser(requestId, metric)
 
-        for await (const chatEvent of response.sendMessageResponse!) {
+        let chatEventStream = undefined
+        if ('generateAssistantResponseResponse' in response) {
+            chatEventStream = response.generateAssistantResponseResponse
+        } else if ('sendMessageResponse' in response) {
+            chatEventStream = response.sendMessageResponse
+        }
+
+        for await (const chatEvent of chatEventStream!) {
             const result = chatEventParser.processPartialEvent(chatEvent)
 
             // terminate early when there is an error

From f9753836aab31661ef1bebb4019743d2bada807b Mon Sep 17 00:00:00 2001
From: Laxman Reddy <141967714+laileni-aws@users.noreply.github.com>
Date: Tue, 5 May 2026 10:53:36 -0700
Subject: [PATCH 21/23] chore: bump agentic version: 1.65.0 (#2712)

Co-authored-by: aws-toolkit-automation <>
---
 app/aws-lsp-codewhisperer-runtimes/src/version.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/aws-lsp-codewhisperer-runtimes/src/version.json b/app/aws-lsp-codewhisperer-runtimes/src/version.json
index 430db61483..95fcdb7741 100644
--- a/app/aws-lsp-codewhisperer-runtimes/src/version.json
+++ b/app/aws-lsp-codewhisperer-runtimes/src/version.json
@@ -1,3 +1,3 @@
 {
-    "agenticChat": "1.64.0"
+    "agenticChat": "1.65.0"
 }

From 8f2a34b09fb984e587f02a04f3ea0b0470efe449 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 5 May 2026 11:31:13 -0700
Subject: [PATCH 22/23] chore(release): release packages from branch main
 (#2716)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 .release-please-manifest.json             | 2 +-
 package-lock.json                         | 2 +-
 server/aws-lsp-codewhisperer/CHANGELOG.md | 7 +++++++
 server/aws-lsp-codewhisperer/package.json | 2 +-
 4 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 961de9e84a..8c80b00b09 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -2,7 +2,7 @@
     "chat-client": "0.1.51",
     "core/aws-lsp-core": "0.0.21",
     "server/aws-lsp-antlr4": "0.1.25",
-    "server/aws-lsp-codewhisperer": "0.0.113",
+    "server/aws-lsp-codewhisperer": "0.0.114",
     "server/aws-lsp-json": "0.1.26",
     "server/aws-lsp-partiql": "0.0.23",
     "server/aws-lsp-yaml": "0.1.26"
diff --git a/package-lock.json b/package-lock.json
index 74df6617dd..295b7915b0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -31102,7 +31102,7 @@
         },
         "server/aws-lsp-codewhisperer": {
             "name": "@aws/lsp-codewhisperer",
-            "version": "0.0.113",
+            "version": "0.0.114",
             "bundleDependencies": [
                 "@amzn/codewhisperer",
                 "@amzn/codewhisperer-runtime",
diff --git a/server/aws-lsp-codewhisperer/CHANGELOG.md b/server/aws-lsp-codewhisperer/CHANGELOG.md
index 08bf1c874b..6a6b4e16f3 100644
--- a/server/aws-lsp-codewhisperer/CHANGELOG.md
+++ b/server/aws-lsp-codewhisperer/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.0.114](https://github.com/aws/language-servers/compare/lsp-codewhisperer/v0.0.113...lsp-codewhisperer/v0.0.114) (2026-05-05)
+
+
+### Bug Fixes
+
+* **amazonq:** route inline chat through getChatResponse for correct API selection ([#2713](https://github.com/aws/language-servers/issues/2713)) ([#2714](https://github.com/aws/language-servers/issues/2714)) ([b6226e7](https://github.com/aws/language-servers/commit/b6226e758d52d8db85c844cab82e6b604566e2ef))
+
 ## [0.0.113](https://github.com/aws/language-servers/compare/lsp-codewhisperer/v0.0.112...lsp-codewhisperer/v0.0.113) (2026-04-29)
 
 
diff --git a/server/aws-lsp-codewhisperer/package.json b/server/aws-lsp-codewhisperer/package.json
index 325d183d16..fcb88fd504 100644
--- a/server/aws-lsp-codewhisperer/package.json
+++ b/server/aws-lsp-codewhisperer/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@aws/lsp-codewhisperer",
-    "version": "0.0.113",
+    "version": "0.0.114",
     "description": "CodeWhisperer Language Server",
     "main": "out/index.js",
     "repository": {

From a6d27b6c9b61407c921400c558e42538940a1c4b Mon Sep 17 00:00:00 2001
From: chungjac <chungjac@amazon.com>
Date: Tue, 5 May 2026 19:33:48 -0700
Subject: [PATCH 23/23] chore: bump agentic version: 1.66.0 (#2717)

Co-authored-by: aws-toolkit-automation <>
---
 app/aws-lsp-codewhisperer-runtimes/src/version.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/aws-lsp-codewhisperer-runtimes/src/version.json b/app/aws-lsp-codewhisperer-runtimes/src/version.json
index 95fcdb7741..388c9a8a55 100644
--- a/app/aws-lsp-codewhisperer-runtimes/src/version.json
+++ b/app/aws-lsp-codewhisperer-runtimes/src/version.json
@@ -1,3 +1,3 @@
 {
-    "agenticChat": "1.65.0"
+    "agenticChat": "1.66.0"
 }