refactor: removing redundant code from amazon q repo#68
Merged
Conversation
) Remove all AWS Toolkit-specific service code that is not required by the Amazon Q extension (chat, inline, review, transform, scan). This repo was split from aws-toolkit-vscode and carried over service code that Amazon Q never imports or activates. Deleted service directories: - awsService/ (S3, EC2, Lambda, ECS, ECR, CloudFormation, CloudWatch Logs, API Gateway, AppRunner, AppBuilder, CDK, IoT, Redshift, SageMaker, Access Analyzer) - awsexplorer/, applicationcomposer/, codecatalyst/, docdb/, dynamicResources/, eventSchemas/, lambda/, ssmDocument/, stepFunctions/, threatComposer/, templates/, sagemakerunifiedstudio/ Deleted shared code only used by removed services: - shared/sam/, shared/codelens/, shared/debug/, shared/templates/sam/, shared/ui/sam/ - 15 dead SDK client wrappers in shared/clients/ - shared/awsConsole.ts, shared/utilities/treeNodeUtils.ts - login/webview/vue/toolkit/ (Toolkit login webview) - dev/codecatalyst.ts Surgical edits to shared files: - extensionNode.ts replaced with no-op stub - extension.ts, auth/auth.ts, auth/connection.ts, auth/utils.ts, extensionGlobals.ts, extensions.ts, filetypes.ts, settings.ts, globalState.ts, templateRegistry.ts, cloudformation/activation.ts, pickerPrompter.ts, panelNode.ts, commonAuthViewProvider.ts, dev/activation.ts cleaned of dead references Build config fixes: - generateServiceClient.ts: removed SageMaker Unified Studio entries - webpack.config.js: removed Step Functions and SageMaker entry points - copyFiles.ts: removed SSM Document server copy tasks 985 files changed, 175,631 lines removed. Both core and amazonq packages compile with zero TypeScript errors.
Problem: The old chat controller, messenger, webview provider, and supporting code (~3,400 lines) were gated behind the amazonqChatLSP experiment flag (default: true) and no longer executed in production. Solution: - Delete 12 dead files: old chat controller, messenger, prompts generator, tab bar controller, UI message listener, webview provider, HTML generator, connector, constants, and client model - Remove amazonqChatLSP experiment gate from extensionNode.ts - Remove cwChatAppInit from agent activation - Relocate shared types (CodeReference, MatchPolicy, CodeQuery) to their active consumers - Remove dead dispatcher functions from messageDispatcher.ts - Clean up barrel exports in index.ts and indexNode.ts
Will-ShaoHua
approved these changes
Apr 29, 2026
aseemxs
approved these changes
Apr 30, 2026
laileni-aws
added a commit
to laileni-aws/amazon-q-vscode
that referenced
this pull request
May 28, 2026
* refactor: Remove dead AWS Toolkit service code not used by Amazon Q (aws#65) Remove all AWS Toolkit-specific service code that is not required by the Amazon Q extension (chat, inline, review, transform, scan). This repo was split from aws-toolkit-vscode and carried over service code that Amazon Q never imports or activates. Deleted service directories: - awsService/ (S3, EC2, Lambda, ECS, ECR, CloudFormation, CloudWatch Logs, API Gateway, AppRunner, AppBuilder, CDK, IoT, Redshift, SageMaker, Access Analyzer) - awsexplorer/, applicationcomposer/, codecatalyst/, docdb/, dynamicResources/, eventSchemas/, lambda/, ssmDocument/, stepFunctions/, threatComposer/, templates/, sagemakerunifiedstudio/ Deleted shared code only used by removed services: - shared/sam/, shared/codelens/, shared/debug/, shared/templates/sam/, shared/ui/sam/ - 15 dead SDK client wrappers in shared/clients/ - shared/awsConsole.ts, shared/utilities/treeNodeUtils.ts - login/webview/vue/toolkit/ (Toolkit login webview) - dev/codecatalyst.ts Surgical edits to shared files: - extensionNode.ts replaced with no-op stub - extension.ts, auth/auth.ts, auth/connection.ts, auth/utils.ts, extensionGlobals.ts, extensions.ts, filetypes.ts, settings.ts, globalState.ts, templateRegistry.ts, cloudformation/activation.ts, pickerPrompter.ts, panelNode.ts, commonAuthViewProvider.ts, dev/activation.ts cleaned of dead references Build config fixes: - generateServiceClient.ts: removed SageMaker Unified Studio entries - webpack.config.js: removed Step Functions and SageMaker entry points - copyFiles.ts: removed SSM Document server copy tasks 985 files changed, 175,631 lines removed. Both core and amazonq packages compile with zero TypeScript errors. * refactor: Remove dead old chat code replaced by LSP chat (aws#63) Problem: The old chat controller, messenger, webview provider, and supporting code (~3,400 lines) were gated behind the amazonqChatLSP experiment flag (default: true) and no longer executed in production. Solution: - Delete 12 dead files: old chat controller, messenger, prompts generator, tab bar controller, UI message listener, webview provider, HTML generator, connector, constants, and client model - Remove amazonqChatLSP experiment gate from extensionNode.ts - Remove cwChatAppInit from agent activation - Relocate shared types (CodeReference, MatchPolicy, CodeQuery) to their active consumers - Remove dead dispatcher functions from messageDispatcher.ts - Clean up barrel exports in index.ts and indexNode.ts * refactor: removing codecatalyst code from q repo (aws#64)
laileni-aws
added a commit
to laileni-aws/amazon-q-vscode
that referenced
this pull request
Jul 14, 2026
Problem: The webpack ^5.95.0 -> ^5.104.1 bump (added to fix SSRF alerts aws#68/aws#69) pulls webpack 5.108.4 and enhanced-resolve 5.24.2. The newer resolver applies stricter exports-field resolution and can no longer resolve the aws-core-vscode/shared subpath from compiled packages/core/dist in the web bundle, breaking the webBase build. Only the web jobs (package VSIX, test Web) fail; all Node-based jobs pass. Solution: Revert webpack to ^5.95.0, restoring enhanced-resolve 5.17.1 to match main. Dependabot aws#68/aws#69 are build-time SSRF in webpack's HttpUriPlugin/buildHttp experimental feature, which this repo does not use, so real-world risk is negligible. They are intentionally left open and will be fixed thoroughly in a follow-up PR together with the core exports / webpack resolve compatibility work.
This was referenced Jul 14, 2026
laileni-aws
added a commit
that referenced
this pull request
Jul 14, 2026
* deps: resolve non-breaking Dependabot alerts (category 1) Apply safe, in-major security fixes across all three lockfiles via npm overrides pinned to GHSA-patched versions plus range-respecting updates (no major-version bumps). Resolves 125 of 160 open Dependabot alerts. Root package.json overrides: @xmldom/xmldom, cipher-base, fast-uri, flatted, follow-redirects, form-data, koa, launch-editor, lodash, morgan, node-forge, on-headers, pbkdf2, postcss, protobufjs, qs, serialize-javascript, sha.js, shell-quote, tmp, undici, ws. Also bump webpack devDependency to ^5.104.1 and range-update ajv, bn.js, glob, tar-fs, picomatch, minimatch, brace-expansion, nanoid, playwright. src.gen streaming clients: npm audit fix (lodash, minimatch, @smithy/config-resolver) and override fast-xml-parser to 4.5.7. Remaining alerts require major-version bumps or coordinated @aws-sdk upgrades and are handled separately. * deps: revert webpack bump to keep web build passing Problem: The webpack ^5.95.0 -> ^5.104.1 bump (added to fix SSRF alerts #68/#69) pulls webpack 5.108.4 and enhanced-resolve 5.24.2. The newer resolver applies stricter exports-field resolution and can no longer resolve the aws-core-vscode/shared subpath from compiled packages/core/dist in the web bundle, breaking the webBase build. Only the web jobs (package VSIX, test Web) fail; all Node-based jobs pass. Solution: Revert webpack to ^5.95.0, restoring enhanced-resolve 5.17.1 to match main. Dependabot #68/#69 are build-time SSRF in webpack's HttpUriPlugin/buildHttp experimental feature, which this repo does not use, so real-world risk is negligible. They are intentionally left open and will be fixed thoroughly in a follow-up PR together with the core exports / webpack resolve compatibility work.
laileni-aws
added a commit
to laileni-aws/amazon-q-vscode
that referenced
this pull request
Jul 14, 2026
Resolve the security alerts that require major-version bumps or coordinated transitive upgrades, on top of the safe (category 1) fixes. Brings total resolved to 152 of 160 open Dependabot alerts. Direct bumps: - markdown-it 13 -> ^14.2.0 (+ @types/markdown-it ^14.1.2) [core] - esbuild-loader 2.20.0 -> 4.5.0 [core] (ESBuildMinifyPlugin -> EsbuildPlugin in webpack.base.config.js; pulls esbuild 0.25+) - webpack-dev-server ^4.15.2 -> ^5.2.5 (devServer config uses only options still valid in v5) Overrides / range updates (root): - fast-xml-parser -> 5.7.0 (GHSA-gh4j has no 4.x backport; forces the AWS SDK's XML parser to 5.x - see risk note) - markdown-it 14.2.0, linkify-it 5.0.1, jsonata 2.2.1 - js-yaml@4 -> 4.2.0 (scoped so js-yaml 3.x consumers are untouched) - @smithy/config-resolver, @opentelemetry/core updated to patched lines src.gen streaming clients: - fast-xml-parser override 4.5.7 -> 5.7.0 Note: keeps webpack at ^5.95.0 (see PR aws#136) so the web build stays green; webpack aws#68/aws#69 remain deferred and are addressed separately in this PR. Risk to validate in CI: forcing fast-xml-parser 5.x onto the AWS SDK may affect XML-based SDK responses (S3/EC2/CloudFormation).
laileni-aws
added a commit
that referenced
this pull request
Jul 14, 2026
Resolve the security alerts that require major-version bumps or coordinated transitive upgrades, on top of the safe (category 1) fixes. Brings total resolved to 152 of 160 open Dependabot alerts. Direct bumps: - markdown-it 13 -> ^14.2.0 (+ @types/markdown-it ^14.1.2) [core] - esbuild-loader 2.20.0 -> 4.5.0 [core] (ESBuildMinifyPlugin -> EsbuildPlugin in webpack.base.config.js; pulls esbuild 0.25+) - webpack-dev-server ^4.15.2 -> ^5.2.5 (devServer config uses only options still valid in v5) Overrides / range updates (root): - fast-xml-parser -> 5.7.0 (GHSA-gh4j has no 4.x backport; forces the AWS SDK's XML parser to 5.x - see risk note) - markdown-it 14.2.0, linkify-it 5.0.1, jsonata 2.2.1 - js-yaml@4 -> 4.2.0 (scoped so js-yaml 3.x consumers are untouched) - @smithy/config-resolver, @opentelemetry/core updated to patched lines src.gen streaming clients: - fast-xml-parser override 4.5.7 -> 5.7.0 Note: keeps webpack at ^5.95.0 (see PR #136) so the web build stays green; webpack #68/#69 remain deferred and are addressed separately in this PR. Risk to validate in CI: forcing fast-xml-parser 5.x onto the AWS SDK may affect XML-based SDK responses (S3/EC2/CloudFormation).
laileni-aws
added a commit
to laileni-aws/amazon-q-vscode
that referenced
this pull request
Jul 14, 2026
Problem: Bumping webpack to the patched ^5.104.1 (fixes GHSA build-time SSRF alerts aws#68/aws#69) pulls enhanced-resolve 5.24.x, whose stricter exports resolution breaks the web bundle (aws-core-vscode/shared no longer resolves from packages/core/dist), failing package VSIX and test Web. Solution: Bump webpack to ^5.104.1 and override enhanced-resolve to 5.17.1 (the version main uses and known to resolve core's exports). npm overrides bypass webpack's declared enhanced-resolve range, so the SSRF fix lands while the lenient, working resolver is retained. Brings total resolved to 154 of 160 Dependabot alerts. Remaining 6 alerts are unpatched upstream (aws-sdk v2, elliptic), require major upstream package upgrades (@opentelemetry/core via @aws/language-server-runtimes, @smithy/config-resolver via old @aws-sdk clients), or are stale/false-positive (@protobufjs/utf8).
laileni-aws
added a commit
that referenced
this pull request
Jul 15, 2026
Problem: Bumping webpack to the patched ^5.104.1 (fixes GHSA build-time SSRF alerts #68/#69) pulls enhanced-resolve 5.24.x, whose stricter exports resolution breaks the web bundle (aws-core-vscode/shared no longer resolves from packages/core/dist), failing package VSIX and test Web. Solution: Bump webpack to ^5.104.1 and override enhanced-resolve to 5.17.1 (the version main uses and known to resolve core's exports). npm overrides bypass webpack's declared enhanced-resolve range, so the SSRF fix lands while the lenient, working resolver is retained. Brings total resolved to 154 of 160 Dependabot alerts. Remaining 6 alerts are unpatched upstream (aws-sdk v2, elliptic), require major upstream package upgrades (@opentelemetry/core via @aws/language-server-runtimes, @smithy/config-resolver via old @aws-sdk clients), or are stale/false-positive (@protobufjs/utf8).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Notes:
feature/xbranches will not be squash-merged at release time.