feat: distinct sign-in error when Q Developer access is blocked

[ashishrp-aws]

Ports to Eclipse the sign-in experience already shipped in VS Code (Amazon-Q-Developer/amazon-q-vscode#159) and JetBrains (Amazon-Q-Developer/amazon-q-jetbrains#120).

Problem

Amazon Q Developer stopped accepting new Builder ID accounts. Such an account signs in successfully — sign-in is OIDC and is never gated — and then finds Q silently non-functional: every Q request from that identity is refused, and the refusal surfaces as if it were a chat reply. The user gets no explanation and nothing to act on.

Why detection has to come from the language server

The service gates on User-Agent, and only traffic carrying the shared language server's token is gated. The plugin's own SDK calls are allowed unconditionally, so there is no client-side signal to classify — the same constraint that shaped the VS Code and JetBrains ports. The language server observes the refusal and reports it over the existing notification channel; this change teaches the plugin to listen.

Changes

Area	Change
AmazonQLspClient / AmazonQLspClientImpl	Declare and handle aws/window/showNotification; on a match, sign out and route to the new view
AmazonQLspServerBuilder	Advertise window.notifications
QDevAccessBlockedNotification (new)	Classifies the notification by decoding the routed id envelope
ShowNotificationParams (new)	Notification params model
QDevAccessBlockedState (new) + ViewRouter + ViewRouterPluginState	New routing state, resolved ahead of the logged-out state
QDevAccessBlockedView (new) + AmazonQViewType + AmazonQViewContainer	The screen, following ReauthenticateView

Three details that are load-bearing, not defensive

window.notifications must be advertised. Without it the runtime builds no notification router and drops aws/window/showNotification silently — no error, no log. This was the single most expensive failure mode on the earlier two ports; it looks exactly like a server-side problem.

Identification is by id, never by title. The runtime's router rewrites the server's declared id into base64 of {"serverName":...,"id":...}, so the raw id never arrives. An earlier revision of the VS Code change matched on content.title, which would have signed out a working user the first time an unrelated error reused the title "Amazon Q Developer". There is a test asserting exactly that case is ignored.

The blocked state is resolved before the logged-out state. Reacting to the refusal signs the user out, so BLOCKED and logged-out are always true together — checking logged out first shows the ordinary login view and loses the explanation. testAccessBlockedTakesPriorityOverLoggedOut pins the ordering, and testClearingAccessBlockedReturnsToLoginView pins the way back.

On the copy

The screen carries its own text rather than displaying the service's message. That message is a single sentence written for an API consumer and does not say what to do next. The consequence is that the dates on the screen are product copy from the public announcement, not values reported by the service, so they will not follow the service if it changes its cutoff. Same trade-off accepted in the VS Code and JetBrains screens.

Eclipse's other error states (ReauthenticateView, LspStartUpFailedView) are SWT CallToActionViews rather than webviews, so this screen follows that pattern instead of reproducing the richer card layout used in the two webview-based IDEs. The information is the same; the presentation is native.

Testing

mvn -B package on Corretto 17 — BUILD SUCCESS, 508 tests, 0 failures, including 7 new classifier tests (routed envelope, plain id, lookalike title ignored, missing id, null params, malformed base64, absent content) and ViewRouterTest at 14/14 with the 2 new routing tests.

Note for anyone reproducing locally: on JDK 26 the whole suite errors out with Mockito cannot mock this class ... Activator, because Mockito 5.14's inline mock maker cannot instrument that JVM. Build on 17.

Not included

Telemetry for block detection, matching the deferral agreed for the other two clients.