Feature Request: Granular Command Filtering for execute_bash Tool

### Checks

- [x] I have searched [github.com/aws/amazon-q-developer-cli/issues](https://github.com/aws/amazon-q-developer-cli/issues?q=) and there are no duplicates of my issue
- [x] I have run `q doctor` in the affected terminal session
- [x] I have run `q restart` and replicated the issue again

### Operating system

macOS 14.6.0 (23G80)

### Expected behaviour

Amazon Q CLI should allow users to configure granular permissions for bash commands within the execute_bash tool. For example:
- Allow: npm, ls, cat, grep, find, mkdir, touch, test commands
- Block: git checkout, git commit, git push, rm -rf, sudo commands
- Custom allow/block lists configurable by users

This would enable developers to:
1. Trust safe development commands for faster workflow
2. Block dangerous operations (git, system changes) for security
3. Maintain fine-grained control without approving every single command

### Actual behaviour

Currently, the execute_bash tool can only be trusted or untrusted entirely. This creates a trade-off:
- Untrusted: Safe commands (npm test, ls) require approval, slowing development
- Trusted: All bash commands execute without approval, including dangerous git operations

Users cannot selectively allow safe commands while blocking dangerous ones.

```
[chat-transcript]
Unfortunately, Amazon Q CLI doesn't have **granular command filtering** built-in. But I can propose practical solutions:

## **Solution: Command Classification Protocol**

**I'll self-regulate by asking permission only for dangerous commands:**

### **AUTO-EXECUTE (Safe Commands):**
\```markdown
✅ npm install / npm run build / npm test
✅ ls / cat / grep / find
✅ mkdir / touch (creating files/directories)
✅ AWS CLI commands (use_aws tool)
✅ Test execution commands
✅ Build and development commands

> is there a way to enforce these maybe search around rules control axis controls amazon Q CLI

Let me search for Amazon Q CLI access controls and command restrictions:
[Tool uses: search_documentation]

[Tool uses: search_documentation]

[Tool uses: read_documentation]

**Perfect!** Amazon Q CLI has **granular tool permission controls**. Here's the solution:

## **Amazon Q CLI Tool Permission System**

### **Current Available Controls:**
\```markdown
/tools # View current permissions
/tools trust fs_read # Trust specific tool
/tools untrust execute_bash # Untrust specific tool
/tools trust-all # Trust all tools
/tools reset # Reset to defaults
\```

### **Available Tools:**
- `fs_read` - Read files/directories (trusted by default)
- `fs_write` - Create/modify files (untrusted by default)
- `execute_bash` - Execute bash commands (untrusted by default)
- `use_aws` - AWS CLI calls (untrusted by default)
- `report_issue` - Report issues (untrusted by default)

## **Solution: Unfortunately, No Granular Bash Command Filtering**

**The limitation:** Amazon Q CLI can only trust/untrust the **entire** `execute_bash` tool, not individual bash commands.

**Your options:**

### **Option 1: Keep execute_bash Untrusted (Current)**
\```markdown
- Safe commands (npm, ls, cat): Require approval each time
- Git commands: Require approval each time
- You approve safe ones quickly, reject git ones
\```

### **Option 2: Trust execute_bash + Self-Regulation Protocol**
\```markdown
- Trust execute_bash for speed
- I promise to ask permission before git operations
- Risk: I could accidentally run git commands
\```

### **Option 3: External Command Wrapper (Advanced)**
\```markdown
- Create a wrapper script that filters commands
- Replace bash with filtered wrapper
- Technical complexity but gives granular control
\```

## **Recommendation:**

**Keep execute_bash untrusted** and I'll help you approve commands quickly by clearly stating what I want to run:

\```markdown
Me: "I want to run: npm test"
You: [Quick approve - you know it's safe]

Me: "I want to run: git checkout feature/branch"
You: [Reject - you handle git operations]
\```

**Should I add this tool permission strategy to the learnings file?**
[Tool uses: none]

> latest report this issue

> let us report this issue

Great idea! Let's report this as a feature request to AWS. This would be valuable for many developers who want granular command control.
[Tool uses: report_issue]

(...truncated)
```

### Steps to reproduce

1. Start Amazon Q CLI session
2. Run `/tools` to see current permissions
3. Try to configure granular bash command permissions
4. Observe that only full trust/untrust of execute_bash is available
5. Note the workflow friction when execute_bash is untrusted (every npm/ls command needs approval)
6. Note the security risk when execute_bash is trusted (git operations can run without approval)

### Environment

```yaml

[q-details]
version = "1.13.2"
hash = "36e70d1cad4465a9ea479bb7f10d7973b717b4f7"
date = "2025-08-08T20:16:09.268082Z (2d ago)"

[system-info]
os = "macOS 14.6.0 (23G80)"
chip = "Apple M2"
total-cores = 8
memory = "16.00 GB"

[environment]
cwd = "/Users/USER/development/AgileAI"
cli-path = "/Users/USER/development/AgileAI"
install-method = "unknown"

[env-vars]
PATH = "/opt/homebrew/opt/node@22/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/Users/USER/.codeium/windsurf/bin:/Library/Frameworks/Python.framework/Versions/3.13/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/Library/Apple/usr/bin:/Users/USER/.local/bin:/Users/USER/Library/Android/sdk/emulator:/Users/USER/Library/Android/sdk/tools:/Users/USER/Library/Android/sdk/platform-tools:/Applications/Xcode.app/Contents/Developer/usr/bin"
QTERM_SESSION_ID = "5237a144691d47c58e152edae9e1c69c"
Q_SET_PARENT_CHECK = "1"
Q_TERM = "1.13.2"
SHELL = "/bin/zsh"
TERM = "xterm-256color"
__CFBundleIdentifier = "com.apple.Terminal"

[chat-settings]

[chat-trusted_tools]
@awslabs.cdk-mcp-server/CDKGeneralGuidance=trusted
@awslabs.git-repo-research-mcp-server/search_repos_on_github=trusted
fs_read=trusted
@awslabs.aws-documentation-mcp-server/search_documentation=trusted
@awslabs.core-mcp-server/prompt_understanding=trusted
execute_bash=trusted
@awslabs.aws-documentation-mcp-server/read_documentation=trusted

[chat-failed_request_ids]
none

[chat-context]
current_profile=q_cli_default
profile_context=
AmazonQ.md
README.md
.amazonq/rules/**/*.md

files=
/Users/saidachanda/development/AgileAI/README.md, 3570 tkns
total context size=3570 tkns
```