[ParidelPooya]

Follow-up to #1110 (issue #1107).

Problem

After the round-3 redesign in #1110, the write-access check no longer changed what the customer sees. Every result, can-write or unverified, led to the same warning and the same consent prompt. The check only changed the message text. It was also the most code in #1110, its Redshift queries were never verified on Redshift, and it produced every review round: definer functions, the Redshift LIKE escape, and sequences.

Cause

No catalog query can show that a SELECT cannot change data. So the check could never remove the prompt, and the extra detail did not justify its cost (CONTRIBUTING rules 1 and 2).

Options considered (rule 3)

1. Keep the check as advisory text in the prompt. Rejected. It keeps every catalog query and its review surface, and it changes no outcome.
2. Drop the MCP prompt and put a notice in the first tool result. Rejected. The agent can summarise a tool result away, so the user might never see the notice.
3. Chosen: a fixed one-line notice, confirmed once per session in MCP, and a static line in Settings. The S3 result-location check stays, because it finds a misconfiguration that corrupts data whatever the credentials.

Change

• core: delete checkWriteAccess, its catalog queries, WriteAccessResult, and the writeAccess field of DestinationTestReport. The S3 result-location check stays, moved unchanged to athenaResultLocation.ts. Test connection still skips its Athena SELECT 1 when results would land inside the table's data, or the location cannot be determined.
• MCP: the gate asks once per process to confirm one line: "Queries are written by the agent and run with this server's credentials. It is your responsibility to give this server read-only credentials." For S3 + Athena, the gate also runs the location check. When results land inside the table's data, the finding is added to the prompt and to a blocked result. When the location cannot be determined (for example GetWorkGroup is denied), the prompt says the check did not complete and gives the reason. Elicitation, DURABLE_TELEMETRY_ACCEPT_WRITE_ACCESS, shared prompts and the cancellation check are unchanged. The checkbox field is confirmed (was acceptRisk).
• VS Code and desktop: Settings shows a static warning under Test connection: "Queries are written by a model and run with these credentials. It is your responsibility to use read-only credentials." The wording matches the MCP line, adapted to the host. WriteAccessWarning and the renderer test runner it needed are removed, together with its CI step.
• READMEs: describe the notice instead of the check. The MCP README explains the S3 note and why athena:GetWorkGroup is needed. The S3 + Athena IAM row keeps it.
• Release: the MCP package is 1.1.0, with release-notes/telemetry-mcp-1.1.0.md and an entry under Unreleased in CHANGELOG.md.

Breaking change to the published 1.0.0 output (rules 1.3 and 7)

@aws/durable-execution-sdk-js-telemetry-mcp@1.0.0 includes #1110. Its test_destination output and blocked data-tool results carried a writeAccess field, which this PR removes. The blocked error and howToAccept text also changes. Agents read these results as text, so the version is a minor bump (1.1.0), and the release note states the change.

Decisions (rule 7)

• MCP keeps the consent prompt rather than a notice in a tool result (option 2 above).
• The S3 location check is kept in Test connection and in the MCP prompt. In the prompt it adds the finding when results land inside the data, and the reason when the location cannot be determined, so the user knows the check did not complete before confirming (raised in review). A location outside the data adds nothing.
• The env variable keeps its name, DURABLE_TELEMETRY_ACCEPT_WRITE_ACCESS, so existing 1.0.0 configs keep working.
• The Settings warning shows for every destination, including SQS and CloudWatch Logs. One unconditional line is simpler than per-destination rules.
• checkAthenaResultLocation stays exported from core, because the MCP package uses it.

Edited test expectations (rule 5.4)

• writeAccessGate.test.ts: the prompt and blocked text is now CONSENT_MESSAGE, "The client cannot show a confirmation prompt." and "The user did not confirm.", replacing the can-write / unverified text. The cases that depended on a check result are removed.
• registerTools.test.ts: "blocked until the user confirms" replaces the two per-status blocked cases. test_destination no longer asserts a writeAccess field.
• Both files: the elicitation reply uses confirmed instead of acceptRisk.

Testing

• New: the gate adds a configuration warning to the prompt and to a blocked result. For S3, registerTools.test.ts checks four things: the finding appears when results land inside the data, the reason appears when the location is undetermined, nothing is added for outside, and other destinations never run the check.
• Kept: every data tool is blocked until the user confirms, plus cancellation. The location cases are in athenaResultLocation.test.ts, and the probe-skip cases in destinationTest.test.ts.
• Branch check (rule 4): a script removes or inverts each of 31 branches one at a time. Each mutation makes at least one test fail.
• npm run typecheck:hosts passes. The webview type-checks and builds.
• npm test passes in telemetry-core (476), telemetry-mcp (487), telemetry-vscode (34), telemetry-desktop (48).

[github-actions]

Codex AI review

Two approach findings:

• P1: Breaking output in a minor release — packages/aws-durable-execution-sdk-js-telemetry-mcp/package.json:3.
• P2: S3 fallback contradicts the recorded decision — packages/aws-durable-execution-sdk-js-telemetry-mcp/src/registerTools.ts:84.

Static review only; runtime and renderer tests were not executed.

Suppressed repeats

• arf_v1_nasztqddri7alg4lt6luitdkif — deferred (maintainer verdict)

Reviewed commit d4ce9376bf5cacd3cd43dcb0ca46773d6293df5b. Workflow run

[yaythomas]