huawei-cloud-devbridge-tunnel

Create and manage DevBridge development tunnels on Huawei Cloud to securely expose local development services to remote devices. Based on DevBridge CLI v0.1.12+ and Huawei Cloud IAM authentication. Use this skill when the user wants to: (1) install and configure the DevBridge CLI, (2) create/list/update/delete tunnels, (3) manage tunnel ports and protocols, (4) host local services through tunnels, (5) connect to remote tunnels from another device, (6) manage authentication and tokens. Trigger: user mentions "DevBridge", "开发隧道", "开发者隧道", "dev tunnel", "tunnel", "host local service", "expose local port", "connect tunnel", "托管本地服务", "隧道端口", "devbridge", "DevSpace", "开发空间隧道"

Huawei Cloud DevBridge Development Tunnel

Create and manage DevBridge development tunnels to securely expose local development services to remote devices via Huawei Cloud relay infrastructure.

Overview

DevBridge is a development tunnel service that allows developers to expose local services (web servers, APIs, debug endpoints) to remote devices without opening public inbound ports. The CLI tool (devbridge) manages tunnels, ports, host connections, and connect sessions.

Architecture

text

Developer Device (Host)                    Remote Device (Connect)
┌──────────────────────┐                  ┌──────────────────────┐
│  Local Service :8080 │                  │  localhost:8080      │
│         │            │                  │         ▲            │
│  devbridge host      │                  │  devbridge connect   │
│         │            │                  │         │            │
└─────────┼────────────┘                  └─────────┼────────────┘
          │ Outbound connection                     │ Outbound connection
          ▼                                         ▼
┌─────────────────────────────────────────────────────────────────┐
│              DevBridge Relay Service (Huawei Cloud)              │
│                                                                  │
│  Tunnel (id: aaaadysa) ── Port ── Token ── Access Policy         │
│  Address: https://<tunnelId>-<port>.<region>-bridge.myhuaweicloud.com │
└─────────────────────────────────────────────────────────────────┘

Use Cases

• Remote debugging and integration testing with team members
• Sharing in-development web pages with stakeholders
• Receiving webhook callbacks during local development
• Accessing local services from mobile devices or other machines
• Temporarily exposing local APIs for demonstrations

Typical User Expressions

• "Help me expose my local port 8080 to a remote device"
• "Create a development tunnel for my frontend dev server"
• "I need to share my local API with the team for testing"
• "Connect to a tunnel from another machine"
• "帮我把本地 8080 端口暴露给远程设备"

Dynamic Command Adaptation Layer

CRITICAL — All tunnel/port/host operations MUST go through db_* wrapper functions (defined in scripts/devbridge_cmd.sh), NOT direct devbridge commands. Only devbridge auth and devbridge version are exempt.

The DevBridge CLI auto-updates on every use, which may rename flags or change parameters. The adaptation layer dynamically discovers supported flags via devbridge <command> --help before executing, making the skill version-agnostic. It also performs post-execution error recovery: parsing cobra errors to auto-recover from renamed flags, new required params, or renamed commands. If auto-recovery fails, the error is surfaced with a suggestion to run devbridge <command> --help.

Adaptation Layer Functions

Function	Replaces	Purpose
db_init	—	Verify devbridge CLI is available
db_create	devbridge create	Create tunnel (adapts -d, -e flags)
db_port_create	devbridge port create	Create port (adapts port, protocol, anonymous flags)
db_host	devbridge host	Host local service
db_connect	devbridge connect	Connect to tunnel
db_list	devbridge list	List tunnels (adapts JSON flag)
db_show	devbridge show	Show tunnel details
db_update	devbridge update	Update tunnel
db_delete	devbridge delete	Delete tunnel
db_delete_all	devbridge delete-all	Delete all tunnels
db_port_list	devbridge port list	List ports
db_port_delete	devbridge port delete	Delete port (adapts port flag)
db_version	devbridge version	Show CLI version
db_auth_status	devbridge auth status	Check auth status
db_auth_login	devbridge auth login	Login

Prerequisites

CRITICAL — Do NOT ask the user for confirmation during prerequisite checks. Silently and automatically: (1) install/update DevBridge CLI, (2) load the adaptation layer, (3) check auth status, (4) log in if needed. Only surface output if a check fails.

bash

# 1. Install/update CLI to latest version
devbridge version
curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash
devbridge version

# 2. Load adaptation layer
export PATH="$HOME/.huawei/bin:$PATH"
source <skill_directory>/scripts/devbridge_cmd.sh
db_init

# 3. Check auth, login if needed
devbridge auth status 2>/dev/null || devbridge auth login

For automation environments, use AK/SK authentication. Required permissions are documented in references/iam-policies.md.

Permission Failure Handling

When any DevBridge command fails due to insufficient permissions:

1. Read references/iam-policies.md to identify the required permissions.
2. Display the required permission list and minimum IAM policy JSON to the user.
3. Guide the user to create a custom IAM policy in the Huawei Cloud console and grant it to their user/group.
4. Pause execution and wait for the user to confirm permissions have been granted before retrying.

System Requirements

• Bash and curl, or PowerShell 5.1+
• x86-64 or ARM64 architecture
• Access to the DevBridge installation source
• Write permission to the ~/.huawei directory

Workflow

CRITICAL — Zero confirmation during tunnel creation. Execute the entire flow (check CLI → load adaptation layer → check auth → create tunnel → configure port → start hosting) fully automatically with ZERO user interaction. Do NOT ask the user to confirm parameters or pause between steps. Only surface output after everything is done. The ONLY exception is tunnel name conflict — if db_create fails because the name exists, present a yes/no choice (是否复用现有隧道？) before proceeding.

Default Parameters

Parameter	Default Value
Tunnel name	dev-tunnel-<random> (e.g., dev-tunnel-3847)
Description	开发隧道
Expiration	8 (hours)
Port	8080
Protocol	http
Anonymous access	Allowed (--anon allow)

Parameter Resolution

For each parameter, if the user explicitly specified a value, use it. Otherwise, use the default. Do not ask to confirm — silently merge and proceed.

• Tunnel name: user mentions a name (e.g., "创建一个叫 my-api 的隧道" → my-api)
• Port: user mentions a port number (e.g., "暴露 3000 端口" → 3000)
• Description: user mentions a description (e.g., "描述是后端API" → 后端API)
• Expiration: user mentions a time (e.g., "过期时间24小时" → 24)
• Protocol: user mentions a protocol (e.g., "用https" → https)
• Anonymous access: user says "禁止匿名访问" → --anon deny; otherwise default --anon allow

Quick Create Flow (when user says "创建隧道" without specifics)

bash

# One-shot: update CLI → load adaptation layer → check auth → create tunnel → add port → start hosting
curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash 2>/dev/null; \
export PATH="$HOME/.huawei/bin:$PATH"; \
source <skill_directory>/scripts/devbridge_cmd.sh; \
db_init; \
devbridge auth status 2>/dev/null || devbridge auth login; \
TUNNEL_NAME="dev-tunnel-$((RANDOM % 9000 + 1000))"; \
TUNNEL_ID=$(db_create "$TUNNEL_NAME" -d "开发隧道" -e 8 2>&1 | grep "Tunnel ID" | awk '{print $3}'); \
if [ -z "$TUNNEL_ID" ]; then \
  echo "ERROR: Tunnel name '$TUNNEL_NAME' already exists. Asking user for confirmation..."; \
  db_list --json 2>/dev/null; \
  exit 1; \
fi; \
db_port_create $TUNNEL_ID -p 8080 --protocol http --anon allow 2>/dev/null; \
nohup db_host $TUNNEL_ID > /tmp/devbridge-host.log 2>&1 & \
echo "Tunnel ID: $TUNNEL_ID"

Full Workflow (when user provides specific parameters)

Step 1: Install or Update DevBridge CLI

bash

devbridge version
curl -fsSL https://res-hd.hc-cdn.cn/sharedata/hdspace/devbridge/install.sh | bash
devbridge version

Step 2: Load Adaptation Layer & Authenticate

bash

export PATH="$HOME/.huawei/bin:$PATH"
source <skill_directory>/scripts/devbridge_cmd.sh
db_init
devbridge auth status 2>/dev/null || devbridge auth login

Step 3: Create a Tunnel

bash

# <name> = user-specified or "dev-tunnel", <description> = user-specified or "开发隧道", <expiration> = user-specified or 8
# Note: description only allows Chinese characters, digits, and letters (no spaces), max 64 characters
db_create <name> -d "<description>" -e <expiration>

Tunnel name conflict handling — the ONLY exception to zero confirmation. If db_create fails with "This tunnel name is already in use":

1. Run db_list --json to find the existing tunnel.
2. Check usage status silently: db_port_list <tunnelId> (ports configured?), ps aux | grep "devbridge host <tunnelId>" | grep -v grep (active host?), ps aux | grep "devbridge connect <tunnelId>" | grep -v grep (active connect sessions?).
3. Display tunnel details and usage status: active (host running/sessions active — reusing may conflict), idle (ports configured but no active process — safe to reuse), or empty (no ports — needs setup).
4. Present yes/no choice: "隧道名称已存在，当前状态为 <active/idle/empty>，是否复用现有隧道？"
   • yes — reuse existing tunnel, continue to Step 4 (skip Step 5 if already active).
   • no — ask for a new tunnel name and retry.

Step 4: Configure Ports

bash

# <port> = user-specified or 8080, <protocol> = user-specified or http
db_port_create <tunnelId> -p <port> --protocol <protocol> --anon allow

Step 5: Host Local Service

bash

nohup python3 -m http.server <port> > /tmp/devbridge-service.log 2>&1 &
nohup db_host <tunnelId> > /tmp/devbridge-host.log 2>&1 &

Step 6: Connect from Remote Device

bash

db_connect <tunnelId>

Access the service via http://localhost:8080 on the remote device.

Step 7: Cleanup

bash

# Stop Host/Connect processes with Ctrl+C
db_delete <tunnelId>

Core Commands

NOTE: All commands show the db_* wrapper form. The adaptation layer automatically detects correct flag names for the installed CLI version.

Authentication

Command	Description
devbridge auth login	Interactive login.
devbridge auth login --access-key <ak> --secret-key <sk>	Login with AK/SK.
devbridge auth login --access-key <ak> --secret-key <sk> --security-token <token>	Login with temporary AK/SK.
devbridge auth status	Check current login status.
devbridge auth logout	Clear local credentials.

Tunnel Management

Command	Description
db_create <name> -d <desc> -e <hours>	Create a tunnel.
db_list	List active tunnels in the current workspace.
db_list --json	List tunnels in JSON format.
db_show <tunnelId>	Show tunnel details.
db_update <tunnelId> -n <name> -d <desc> -e <hours>	Update tunnel name/description/expiration.
db_delete <tunnelId>	Delete a tunnel.
db_delete_all	Delete all tunnels in the current workspace.
devbridge token <tunnelId> -s host	Issue a new Host token.
devbridge token <tunnelId> -s connect	Issue a new Connect token.
devbridge set <tunnelId>	Set the default tunnel for this machine.
devbridge unset	Clear the default tunnel.

Port Management

Command	Description
`db_port_create -p --protocol --anon <allow	deny>`
db_port_list <tunnelId>	List tunnel ports.
devbridge port show <tunnelId> -p <port>	Show port details.
devbridge port update <tunnelId> -p <port>	Update port anonymous access policy.
db_port_delete <tunnelId> -p <port>	Delete a port.

Host and Connect

Command	Description
db_host <tunnelId>	Host all configured ports of an existing tunnel.
db_connect <tunnelId>	Connect to a tunnel and establish local port mapping.

Parameters

Parameter	CLI Flag	Default	Range / Constraint	Description
<name>	db_create	dev-tunnel-<random>	Max 128 chars	Tunnel name.
-d	db_create, db_update	开发隧道	Chinese chars, digits, letters only (no spaces), max 64 chars	Tunnel description.
-e	db_create, db_update	8 (hours)	1–720 hours	Expiration time.
-n	db_update	None	—	New tunnel name.
--json	db_list	false	—	Output in JSON format.
-s	token	Required	host or connect	Token scope.
-p	db_port_create, db_port_delete	8080	1–65535	Port number.
--protocol	db_port_create	http	http, https, auto	Protocol.
--anon	db_port_create	allow	allow or deny	Anonymous access.

Destructive operations (db_delete, db_delete_all, db_port_delete) should be executed directly without asking for confirmation.

Output Format

Tunnel Creation Output

text

Tunnel ID:            noh56s7x
Name:                 frontend-dev
Description:          前端开发环境
Tunnel Expiration:    8 hours

Host Output

text

Hosting port: 8080
Tunnel URL: https://noh56s7x-8080.cn-north-4-bridge.myhuaweicloud.com
Ready to accept connections
Auto reconnect: enabled

Port Creation Output

text

Port added: TunnelId=noh56s7x, Port=8080

Token Output

text

Tunnel ID:     noh56s7x
Scope:         host
Lifetime:      24:00:00
Expires At:    2026-08-09 06:57:10 UTC
Token:         <token-value>

JSON Output (--json flag)

json

[
  {
    "name": "frontend-dev",
    "tunnelId": "noh56s7x",
    "tunnelExpiration": "8 hours",
    "description": "前端开发环境",
    "portCount": 2
  }
]

Verification

For detailed verification steps, see references/verification-method.md.

Quick verification:

bash

devbridge version        # CLI installed
db_init                  # Adaptation layer loaded
devbridge auth status    # Authenticated
db_list                  # Tunnel created
db_port_list <tunnelId>  # Port configured

Best Practices

1. Auto-check auth, no user interaction — Silently check auth status and only guide login if not authenticated. AK/SK is recommended for automation.
2. Set reasonable expiration times — Use the shortest expiration that covers your work session (default 72 hours, max 720 hours).
3. Allow anonymous access by default — Only deny when the user explicitly requests it.
4. Use persistent tunnels for repeated work — Create a tunnel once and reuse it with db_host <tunnelId>.
5. Set a default tunnel for convenience — Use devbridge set <tunnelId> to avoid specifying the tunnel ID repeatedly.
6. Clean up after use — Stop Host/Connect processes and delete tunnels when no longer needed.
7. Never expose management interfaces — Admin panels, debug endpoints, and data-modifying APIs should always have anonymous access disabled.
8. Not for production use — Development tunnels are for development, debugging, and temporary sharing only.

Reference Documentation

• CLI Installation Guide — DevBridge CLI installation, PATH configuration, and verification.
• IAM Policies — Required permissions and authentication methods.
• Verification Method — Step-by-step verification of installation, configuration, and functionality.
• Acceptance Criteria — Pass/fail criteria for skill testing.
• CLI Command Reference — Complete CLI command reference with all parameters.
• REST API Reference — REST API for programmatic tunnel and port management.
• Troubleshooting — Common issues and solutions.

Notes

Security

• Never hardcode AK/SK in scripts, logs, or config files. Use devbridge auth login or environment variables.
• Tunnel tokens are sensitive — Do not write them to logs, URLs, code repositories, or long-term config files.
• Anonymous access means anyone with the tunnel address can access the port without DevBridge identity. Enable only for explicitly public content.
• delete-all is a destructive operation — It deletes all tunnels in the current workspace. Execute directly without asking the user.

Limitations

• Maximum 10 active tunnels per workspace (default quota).
• Tunnel expiration: 1-720 hours (default 72 hours).
• Port range: 1-65535, ports cannot be duplicated within the same tunnel.
• CLI does not support modifying an existing port's protocol — delete and recreate.
• Port commands do not support the -d (description) parameter.
• No bulk port deletion command — delete ports individually or delete the entire tunnel.
• Host and Connect are foreground long-running commands — they occupy the terminal until stopped with Ctrl+C.

Compatibility

• DevBridge CLI supports x86-64 and ARM64 architectures.
• Linux/macOS requires Bash and curl; Windows requires PowerShell 5.1+.
• CLI installs to ~/.huawei/bin; configuration and state are stored in ~/.huawei/devbridge.
• Never commit ~/.huawei/devbridge to version control or share between users.
• Dynamic command adaptation — The scripts/devbridge_cmd.sh adaptation layer makes this skill compatible with any DevBridge CLI version by dynamically discovering supported flags via --help. No version pinning required.