feat(agent): expose DynamoDB/ES/Mongo DBA capabilities to the agent - #496
Merged
Conversation
DynamoDB Local (endpointUrl=http://host:port) over an SSH tunnel failed
with SdkError::DispatchFailure (Connection reset by peer). Root cause:
the AWS SDK's ProxyConfig::http sends origin-form HTTP requests (not
CONNECT) to the proxy for http:// targets, but the dual-protocol tunnel
only accepts SOCKS5 (0x05) and HTTP CONNECT ('C'), so the request byte
0x50 ('P') was dropped and the connection reset.
Fix: resolve_ssh_in_place forces expose_lan for http:// endpoints, which
switches the tunnel to port-forward mode — the client talks plain HTTP
to 127.0.0.1:{local_port} and SSH forwards it to the target. HTTPS and
mongodb:// targets (Mongo/ES/AWS DynamoDB) are unaffected.
Also:
- invoke_capability accepts an optional raw config (for unsaved connect-
dialog connections), routing on config vs connection_id — unifies the
listTables entry point and removes the listTablesViaSsh dual path
- normalize_dynamo falls back to host:port for Local connections missing
endpointUrl (mirrors dynamo_test_connection)
- list_tables errors use Debug format to surface the real transport
cause instead of the generic 'dispatch failure'
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
…ctive) The previous attempt set sshTunnel.exposeLan at the JSON top level, which SshConnectionConfig silently ignores (expose_lan lives in the SSH profile). This is the working fix: - config.rs: add runtime-only force_port_forward field (serde skip, not persisted, distinct from expose_lan — does NOT widen the bind address) - tunnel.rs: effective_tunnel_mode + spawn_tunnel_config honor it; spawn_tunnel/spawn_chain pass it through (multi-hop supported) - ssh_bridge: resolve_ssh_tunnel gains a force_port_forward param; callers pass scheme == "http" for the endpoint. Port-forward mode rewrites endpointUrl to http://127.0.0.1:{local_port}, so the AWS SDK talks plain HTTP to the local port and SSH forwards to the target — sidestepping the origin-form-vs-CONNECT mismatch entirely. - dynamo.rs: ProxyConfig::http -> https. ProxyConfig::http only matches http:// targets; AWS DynamoDB (https://) was silently bypassing the tunnel. - invoke_capability: normalize the raw config arg (nested auth -> flat) so unsaved connect-dialog configs carry accessKeyId; fixes Missing accessKeyId. - dynamo_test_connection: also honor http scheme for the tunnel. Multi-hop chains forward through each hop and reach the target in both schemes. Mongo (mongodb://) and ES (https://) keep SOCKS5/CONNECT. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Completes the in-progress SSH tunnel work: honors socks5Proxy and HTTP-proxy transport in the MongoDB capability client factory, normalizes MongoDB URI auth in tunnel mode, and restores Data Studio auto-scroll with stop/cancel controls on the chat panel. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Adds 7 new DynamoDB backend wrappers and capability handlers: - restore_table (restore_table_from_backup + restore_table_to_point_in_time) - create_backup / list_backups / describe_backup - describe_limits - list_tags / tag_resource All wired into capabilities/dynamo.rs register_all with Safe/Elevated risk levels and both agent + UI tags. Registered via dynamo/mod.rs. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Phase 1+2 of the DBA capability expansion: - DynamoDB: flip 12 UI-only capabilities (create_table, delete_table, truncate_table, update_table_config, GSI/ttl/pitr/streams updates, describe ttl/backups/metrics) to agent-visible; add 7 new handlers (backup/restore/tags/limits) wired to the new backend modules; enrich the 12 newly-exposed descriptions with DBA-scenario guidance - ES: add cluster_health, cat_nodes, cat_shards, list_snapshots, restore_snapshot (Safe reads + Elevated restore) - Mongo: add get_slow_queries (currentOp with system.profile fallback) and list_users (usersInfo) - Agent-tag regression tests assert 33 dynamo / 24 es / 32 mongo capabilities are agent-visible Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Blankll
changed the title
Blankll
force-pushed
the
fix/dynamodb-ssh-http-tunnel
branch
from
August 14, 2026 09:05
883ec32 to
d1d4f8f
Compare
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #496 +/- ##
==========================================
+ Coverage 60.33% 63.66% +3.32%
==========================================
Files 122 129 +7
Lines 19113 21079 +1966
Branches 881 881
==========================================
+ Hits 11531 13419 +1888
- Misses 7322 7400 +78
Partials 260 260
🚀 New features to boost your workflow:
|
Remove the runtime-only force_port_forward field from SshTunnelConfig and pass it as an explicit parameter through start_transport_layers, start_tunnel/start_chain, and spawn_tunnel. - SshTunnelConfig is pure serializable data again (no #[serde(skip)] runtime field; drops force_port_forward: false boilerplate from 5 construction sites) - No mutation of cloned layer configs in resolve_connection_target; the override flows as an explicit parameter - The "force_port_forward only applies to the last hop" invariant is now explicit in start_chain (is_last && force_port_forward) The semantic "force port-forward for DynamoDB Local only" stays at the call sites via force_port_forward_for (type == DYNAMODB && http).
Blankll
changed the title
Blankll
added a commit
that referenced
this pull request
Aug 17, 2026
#499) ## What this PR does SSH tunnel behavior for the three database types. The tunnel defaults to **SOCKS5/CONNECT** (keeps the real hostname for TLS/SNI); **PortForward** is forced only for DynamoDB Local (plain HTTP), where the AWS SDK emits origin-form HTTP (not CONNECT) that a SOCKS5 proxy cannot forward. ### Port-forward scoped to DynamoDB Local - `force_port_forward` is `true` only when `type == "DYNAMODB" && endpointUrl` is `http://` (`force_port_forward_for`). - Previously the scheme defaulted to `http` for configs without `endpointUrl`, which wrongly forced **MongoDB and ES** into PortForward mode and broke their connections (`Connection reset by peer` on the rewritten `127.0.0.1:port`). Type-based gating plus carrying `type` through `normalize_config` fixes this — Mongo/ES never force. - `https` DynamoDB (AWS), ES, and MongoDB keep SOCKS5/CONNECT. ### Implementation - `force_port_forward` flows as an **explicit parameter** through `start_transport_layers → start_tunnel/start_chain → spawn_tunnel`, not a runtime-only `#[serde(skip)]` field on `SshTunnelConfig`. `SshTunnelConfig` stays pure serializable data; the "last-hop-only" invariant is explicit in `start_chain` (`is_last && force_port_forward`); no mutation of cloned layer configs. ### AWS DynamoDB through the tunnel - `ProxyConfig::http → https` in the DynamoDB client — `http` only matched `http://` targets, so AWS DynamoDB (`https`) silently bypassed the SOCKS5/CONNECT tunnel. `https` matches and tunnels via CONNECT. ### MongoDB through the tunnel - Honor `socks5Proxy` in the MongoDB capability client factory; normalize MongoDB URI auth (`mongodb://u:p@host:port/db`) through the SSH tunnel (single-host host/port rewrite). ## Verification - `cargo build --lib`: clean - `cargo test --lib`: SSH / ssh_bridge / connection_resolver / dynamo / mongo_client suites green - clippy: 0 warnings in touched files - `force_port_forward_for` unit tests cover: DynamoDB-Local→force, AWS-https→no force, MongoDB→no force (even with http endpointUrl), ES/OpenSearch→no force, case-insensitive `type`, missing `type`→no force > Note: the DBA capability expansion lives in #496. This PR is the SSH-tunnel fix only. --------- Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Expands the agent-visible DBA capability surface across the three database types.
DynamoDB (26 → 33 agent-visible tools)
create_table,delete_table,truncate_table,update_table_config,update/delete_gsi,update_ttl,update_pitr,update_streams,describe_ttl,describe_continuous_backups,get_table_metricsrestore_table(from backup + PITR),create_backup,list_backups,describe_backup,describe_limits,list_tags,tag_resourceElasticsearch (19 → 24)
cluster_health,cat_nodes,cat_shards,list_snapshots,restore_snapshotMongoDB (30 → 32)
get_slow_queries(currentOp with system.profile fallback),list_users(usersInfo)Agent-tag regression tests assert 33/24/32 capabilities are agent-visible.
Verification
cargo test --lib: green