bug: toolsSettings from the new agents launch doesnt work for given example in docs

[NiixShade]

Checks

• I have searched github.com/aws/amazon-q-developer-cli/issues and there are no duplicates of my issue
• I have run q doctor in the affected terminal session
• I have run q restart and replicated the issue again

Operating system

Linux 5.10.239-216.958.amzn2int.x86_64 - Amazon Linux 2

Expected behaviour

I would not get prompted to trust tool for git status (and even git diff since its read only).

Actual behaviour

I got prompted for both:

[coder] > can you check git status and show me the output? Also git diff the latest commit with the previous one

> Hello5.2

I'll check the git status and show you the diff between the latest commit and the previous one.


�️  Using tool: execute_bash
 ⋮ 
 ● I will run the following shell command: git status
 ⋮ 
 ↳ Purpose: Check current git status to see modified, staged, and untracked files


Allow this action? Use 't' to trust (always allow) this tool for the session. [y/n/t]:

[coder] > 

Steps to reproduce

I. tried the example in the docs, in my coder.json

"toolsSettings": {
      "execute_bash": {
        "allowedCommands": ["git status", "git fetch"],
        "allowReadOnly": true
      },
      "fs_write": {
        "allowedPaths": ["/tmp/*", "./**"]
      }
    },

And then ran q --agent coder.
But still got the output above...

Environment

I have oh my zsh:

╰─± q doctor

● /home/mathet/.bashrc does not source pre integration
● /home/mathet/.profile does not source pre integration
● /home/mathet/.bash_profile does not source pre integration
✘ zsh ~/.zshrc integration check: /home/mathet/.zshrc does not source pre integration

  Run q integrations install dotfiles to reinstall shell integrations for zsh
Attempting to fix automatically...
Re-running check...

✔ zsh ~/.zshrc integration check
✘ zsh ~/.zprofile integration check: File does not exist: /home/mathet/.zprofile

  Run q integrations install dotfiles to reinstall shell integrations for zsh
Attempting to fix automatically...
Re-running check...

✔ zsh ~/.zprofile integration check
● File does not exist: /home/mathet/.config/fish/conf.d/00_fig_pre.fish
● File does not exist: /home/mathet/.config/fish/conf.d/99_fig_post.fish
✘ sshd config: Could not read sshd_config

  The /etc/ssh/sshd_config file needs to have the following line:
    AcceptEnv Q_SET_PARENT
    AllowStreamLocalForwarding yes
  
  If your sshd_config is already configured correctly then:
    1. Restart sshd, if using systemd: sudo systemctl restart sshd
    2. Disconnect from the remote host
    3. Run q integrations install ssh on the local machine
    4. Reconnect to the remote host and run q doctor again
  
  See https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/command-line-autocomplete-ssh.html for more info


✘ Doctor found errors. Please fix them and try again.

If you are not sure how to fix it, please open an issue with q issue to let us know!

╭─mathet at dev-dsk-mathet-1b-58aad62a in ~/workspace/MCP/src/XXX on mainline✘✘✘
╰─± q restart
error: Please restart Amazon Q from your host machine
╭─mathet at dev-dsk-mathet-1b-58aad62a in ~/workspace/MCP/src/XXX on mainline✘✘✘
╰─± q diagnostic

[q-details]
version = "1.13.0"
hash = "5f91e9a7619f1460eb2a017f4df5ca8d6bcd01fa"
date = "2025-07-31T03:22:55.322798Z (21h ago)"
variant = "minimal"

[system-info]
chip = "Intel(R) Xeon(R) Platinum 8275CL CPU @ 3.00GHz"
total-cores = 4
memory = "15.16 GB"

[system-info.os.linux]
kernel_version = "5.10.239-216.958.amzn2int.x86_64"
id = "amzn"
name = "Amazon Linux"
pretty_name = "Amazon Linux 2"
version_id = "2"
version = "2"
variant = "internal"

[environment]
cwd = "/workplace/USER/MCP/src/XXX"
cli-path = "/workplace/USER/MCP/src/XXX"
os = "Linux"
shell-path = "/local/apollo/var/env/envImprovement/bin/zsh (deleted)"
install-method = "toolbox"
in-ssh = true

[env-vars]
PATH = "/home/USER/.local/share/mise/installs/python/3.11/bin:/home/USER/.local/share/mise/installs/node/20/bin:/home/USER/.local/bin:/usr/local/share/dotnet:/home/USER/eclipse/active:/Users/USER/.dotnet/tools:/workplace/USER/MCP/src/CodeCerebroMCP/build"
SHELL = "/apollo/env/envImprovement/var/bin/zsh"
TERM = "screen.xterm-256color"

[EtienneDx]

After experimenting, I figured out two things:

1. You need to have the tool in allowedTools to trigger the tool settings logic. If it's not, it will always ask.
2. The path validation is done literally. Let's say you have "./README.md" in your paths, if the agent tries to:

• Write "README.md" -> it fails
• Write "/my/path/to/README.md" -> it fails
• Write "./README.md" -> it allows

Hopefully this can unblock others facing the issue and maybe that can get fixed at some point

[EtienneDx]

WARNING: The above is no longer true, as this has been fixed in #2619. This issue should be closed