安装指南

1. ClawHub CLI 从源直接安装技能的最快方式。
   npx clawhub@latest install huawei-cloud-devbridge-tunnel
2. 手动安装 将技能文件夹复制到以下位置之一
   全局模式
   ~/.openclaw/skills/
   工作区
   /skills/
   优先级：工作区 > 本地 > 内置
3. 提示词安装 将此提示词复制到 OpenClaw 即可自动安装。
   请帮我使用 Clawhub 安装 huawei-cloud-devbridge-tunnel。如果尚未安装 Clawhub，请先安装（npm i -g clawhub）。
   更倾向于下载？
   获取包含原生技能文件的ZIP压缩包。
   下载技能 (.zip)

什么是

华为云 DevBridge 开发隧道 (Development Tunnel) 技能通过华为云中继基础设施，实现本地服务与远程设备之间的安全开发隧道自动化。它支持本地 Web 服务器、API、调试端点、Webhook 回调、移动端测试以及临时演示，而无需开放公共入站端口。
针对 Openclaw Skills 工作流构建，它使用 DevBridge CLI v0.2.x、API Key 认证以及动态命令适配层，在运行 tunnel、port、host 和 connect 操作之前自动发现兼容的标志。该技能默认拒绝匿名访问，从主机输出中检索权威的隧道 URL，并管理后台进程以实现可靠的开发工作流。

应用场景

将本地前端、API 或 Web 服务器暴露给远程设备进行测试。
与队友、客户或利益相关者共享开发中的页面。
在本地开发时接收 Webhook 回调。
从移动设备或其他机器连接到开发人员工作站。
运行远程调试和集成测试，而无需打开入站防火墙端口。
创建明确启用匿名访问的临时公共演示。
重用持久化开发隧道用于重复工作。
通过回显服务、ping 检查、进程日志和隧道状态命令诊断连接性。
使用 API Key 在无头 CI 或开发环境中自动化隧道配置。

工作原理

加载 DevBridge 适配层并运行 db_init 以安装或升级 CLI 至 v0.2.x、配置 PATH 并检查认证。
使用来自 HW_API_KEY 或 DEVBRIDGE_API_KEY 的 API Key 进行认证，或者在需要时使用交互式 DevBridge 登录。
解析用户提供的值，如隧道名称、本地端口、协议、描述、过期时间和匿名访问策略；否则应用安全默认值。
使用 db_create 创建隧道，仅返回隧道 ID 以实现可靠的脚本编写。
使用 db_port_create 配置一个或多个端口，支持 HTTP、HTTPS 或自动协议检测。
启动本地服务并在后台运行 db_host；捕获其 PID 并通过 db_tunnel_url 获取权威的公共 URL。
在远程设备上，运行 db_connect 以建立本地端口映射并通过 localhost 访问服务。
使用诊断包装函数验证认证、隧道状态、端口、进程和连接性。
在开发会话结束时，停止 host 或 connect 进程并删除端口或隧道。
如果隧道名称已存在，检查它是处于活动状态、空闲状态还是空白状态，并仅针对该重用决策请求权限。

配置指南

DevBridge CLI v0.2.x；不支持 v0.1.x。
Linux 或 macOS 上的 Bash 和 curl，或 Windows 上的 PowerShell 5.1+。
x86-64 或 ARM64 架构。
对 ~/.huawei 的写入权限以及对官方安装源的访问权限。
用于无人值守自动化的 DevBridge API Key。
初始化技能
source /scripts/devbridge_cmd.sh
db_init
初始化层在缺少 CLI 时进行安装、升级不支持的 v0.1.x 客户端、检查认证，并且可以自动使用 DEVBRIDGE_API_KEY 或 HW_API_KEY。
手动安装或更新
devbridge version
curl -fsSL https://gitcode.com/CloudDeveloperDepartment/devbrige/releases/download/latest/install.sh -o /tmp/devbridge_install.sh
bash /tmp/devbridge_install.sh -s
export PATH="$HOME/.huawei/bin:$PATH"
devbridge version
在非交互式或无头环境中需要 -s 安装程序选项以避免终端提示。
使用 API Key 认证
在华为云 DevBridge 管理页面中创建一个 API Key，然后进行认证，同时避免将密钥放在源文件或日志中：
export HW_API_KEY=""
devbridge auth login --api-key "$HW_API_KEY"
devbridge auth status
创建安全的默认隧道
source /scripts/devbridge_cmd.sh
db_init
TUNNEL_NAME="dev-tunnel-$((RANDOM % 9000 + 1000))"
TUNNEL_ID=$(db_create "$TUNNEL_NAME" -d "开发隧道" -e 72)
db_port_create "$TUNNEL_ID" -p 8080 --protocol auto
db_host "$TUNNEL_ID"
TUNNEL_URL=$(db_tunnel_url "$TUNNEL_ID")
echo "Tunnel ID: $TUNNEL_ID"
echo "Tunnel URL: $TUNNEL_URL"
默认拒绝匿名访问。仅当用户明确请求公共访问时，才将 -a 添加到 db_port_create。切勿手动构造隧道 URL，因为集群域可能会更改。

数据架构

隧道和端口模型
实体 关键数据 约束与行为
隧道 ID、名称、描述、过期时间、端口数、工作空间 默认最多 10 个活动隧道；过期时间范围为 1 到 720 小时。
端口 隧道 ID、端口号、协议、匿名访问策略 端口范围为 1 到 65535，在隧道内不能重复。协议值为 http、https 或 auto。
主机进程 PID、隧道 ID、公共 URL、进程日志 作为后台进程运行，必须显式停止。
连接进程 PID、隧道 ID、本地端口映射、进程日志 在远程设备上创建本地连接。
凭据 API Key、host 令牌、connect 令牌、本地认证状态 将 API Key 和令牌视为机密；不要提交或记录它们。
生成和存储的文件
CLI 二进制文件安装在 ~/.huawei/bin 下。
DevBridge 配置和本地状态存储在 ~/.huawei/devbridge 下。
临时服务和进程日志可能会写入诸如 /tmp/devbridge-service.log 等位置。
适配层位于 scripts/devbridge_cmd.sh。
参考资料包括 CLI 安装、IAM 策略、验证、命令参考、REST API、验收标准和故障排除文档。
包装输出约定
db_create 仅将隧道 ID 写入 stdout。
db_host 报告 PID 和隧道 URL。
db_tunnel_url 从主机日志中返回权威的 URL。
db_port_create 报告隧道和端口关联。
db_list 和 db_port_list 返回文本表格；v0.2.x 不提供以前的 JSON 列表输出标志。
db_processes、db_process_stop 和 db_process_logs 按进程 ID 组织生命周期管理。

高级特性

devbridge --help
动态发现标志，保持适配层在不同 DevBridge CLI v0.2.x 版本之间的兼容性。
通过解析 Cobra CLI 错误，自动从重命名的标志、新增的必需参数以及重命名的命令中恢复。
使用基于 PID 的进程检查、日志检索和终止来进行后台托管和连接。
通过环境变量进行 API Key 认证，用于无人值守的 Openclaw Skills 自动化。
用于受控隧道会话的 Host 和 Connect 令牌作用域。
devbridge set
devbridge unset
进行持久化隧道重用。
隧道和端口生命周期管理，包括更新、删除、全部删除和单个端口删除。
db_echo
、
db_ping
、详细日志记录和验证工作流进行连接诊断。
默认安全的匿名访问拒绝，并对公共内容进行显式选择加入（opt-in）。
使用用户意图自动解析参数，同时避免不必要的确认提示。
支持 x86-64 和 ARM64 系统以及 Linux、macOS 和 Windows 兼容的工作流。
db_limits
提供配额和使用情况可见性。
对 DevBridge 域迁移进行显式处理，要求使用 v0.2.x 以及来自
db_tunnel_url
的权威 URL。

name: huawei-cloud-devbridge-tunnel description: | Create and manage DevBridge development tunnels on Huawei Cloud to securely expose local development services to remote devices.
Based on DevBridge CLI v0.2.x and API Key authentication.
Use this skill when the user wants to: (1) install and configure the DevBridge CLI, (2) create/list/update/delete tunnels, (3) manage tunnel ports and protocols, (4) host local services through tunnels, (5) connect to remote tunnels from another device, (6) manage authentication and API Keys.
Trigger: user mentions "DevBridge", "开发隧道", "开发者隧道", "dev tunnel", "tunnel", "host local service", "expose local port", "connect tunnel", "托管本地服务", "隧道端口", "devbridge", "DevSpace", "开发空间隧道"
tags: [huawei-cloud, devbridge, tunnel, devtools, cloud]

Huawei Cloud DevBridge Development Tunnel

Create and manage DevBridge development tunnels to securely expose local development services to remote devices via Huawei Cloud relay infrastructure.

Overview

DevBridge is a development tunnel service that allows developers to expose local services (web servers, APIs, debug endpoints) to remote devices without opening public inbound ports. The CLI tool (devbridge) manages tunnels, ports, host connections, and connect sessions. Host and Connect both initiate outbound connections to the relay service, so the hosting device does not need a public inbound port.

Architecture

Developer Device (Host) Remote Device (Connect)
┌──────────────────────┐ ┌──────────────────────┐
│ Local Service :8080 │ │ localhost:8080 │
│ │ │ │ ▲ │
│ devbridge host │ │ devbridge connect │
│ │ │ │ │ │
└─────────┼────────────┘ └─────────┼────────────┘
│ Outbound connection │ Outbound connection
▼ ▼
┌─────────────────────────────────────────────────────────────────┐
│ DevBridge Relay Service (Huawei Cloud) │
│ │
│ Tunnel (id) ── Port ── API Key / Token ── Access Policy │
│ Address: https://..myhuaweicloud.com │
└─────────────────────────────────────────────────────────────────┘

2026-09-20 域名升级通知：DevBridge 隧道域名已切换，原 *.cn-north-4-bridge.myhuaweicloud.com 变更为新集群域名（如 *.devbridge-s2.hwtunnel.com）。旧版端侧（v0.1.x）已无法连接，必须使用 v0.2.x 并重新创建隧道。以 devbridge host 实际输出的 Tunnel URL 为准。

Use Cases

Remote debugging and integration testing with team members

Sharing in-development web pages with stakeholders

Receiving webhook callbacks during local development

Accessing local services from mobile devices or other machines

Temporarily exposing local APIs for demonstrations

Typical User Expressions

"Help me expose my local port 8080 to a remote device"
"Create a development tunnel for my frontend dev server"
"I need to share my local API with the team for testing"
"Connect to a tunnel from another machine"
"帮我把本地 8080 端口暴露给远程设备"

Version Support

Item Requirement

CLI version v0.2.x (installed from official channel, e.g. 0.2.1-release / 0.2.2-release)
Authentication API Key (devbridge auth login --api-key or env HW_API_KEY) or interactive login
Tunnel domain New cluster domain (devbridge-s2.hwtunnel.com etc.), shown in devbridge host output
Old versions v0.1.x is NOT supported — AK/SK auth flags removed, old domain no longer connects

Dynamic Command Adaptation Layer

CRITICAL — All tunnel/port/host operations MUST go through db_* wrapper functions (defined in scripts/devbridge_cmd.sh), NOT direct devbridge commands. Only devbridge auth and devbridge version are exempt.

The DevBridge CLI may change flags between releases. The adaptation layer dynamically discovers supported flags via devbridge --help before executing, making the skill version-agnostic within v0.2.x. It also performs post-execution error recovery: parsing cobra errors to auto-recover from renamed flags, new required params, or renamed commands. If auto-recovery fails, the error is surfaced with a suggestion to run devbridge --help.

Adaptation Layer Functions

Function Replaces Purpose

db_init — Ensure CLI installed (v0.2.x+), authenticated (auto-login via DEVBRIDGE_API_KEY/HW_API_KEY)
db_create devbridge create Create tunnel, returns just the tunnel ID (stdout)
db_port_create devbridge port create Create port (adapts port, protocol, anonymous flags)
db_host devbridge host Start hosting in background, returns PID (stdout), tunnel URL (stderr)
db_host_bg devbridge host + nohup bash -c Background host (legacy alias, use db_host instead)
db_connect devbridge connect Start connect in background, returns PID (stdout)
db_list devbridge list List tunnels
db_show devbridge show Show tunnel details
db_update devbridge update Update tunnel
db_delete devbridge delete Delete tunnel
db_delete_all devbridge delete-all Delete all tunnels
db_port_list devbridge port list List ports
db_port_delete devbridge port delete Delete port (adapts port flag)
db_limits devbridge limits Show quota / usage / balance
db_echo devbridge echo Start diagnostic echo service
db_ping devbridge ping Ping a URI to test connectivity
db_version devbridge version Show CLI version
db_auth_status devbridge auth status Check auth status
db_auth_login devbridge auth login Login (interactive or --api-key)
db_tunnel_url — Get tunnel public URL from host log (authoritative, do not construct manually)
db_processes — List running host/connect processes
db_process_stop — Stop a host/connect process by PID
db_process_logs — Get process logs by PID

Prerequisites

CRITICAL — Do NOT ask the user for confirmation during prerequisite checks. db_init silently and automatically: (1) install CLI if missing, (2) upgrade if v0.1.x (old domain, cannot connect), (3) check auth, (4) auto-login via DEVBRIDGE_API_KEY or HW_API_KEY env var. Only surface output if a check fails.

source /scripts/devbridge_cmd.sh
db_init

v0.2.x 只支持 API Key：--access-key / --secret-key / --security-token（AK/SK）参数已移除，不要用 AK/SK 尝试登录（旧版 skill 的用法在 v0.2.x 无效）。API Key 在 DevBridge 管理页创建：https://devstation.connect.huaweicloud.com/space/devbridge/apikey。

For automation environments, use an API Key (see references/iam-policies.md). API Keys are created at the DevBridge management page: https://devstation.connect.huaweicloud.com/space/devbridge/apikey.

Install script note: in non-interactive / headless environments, always pass -s (silent) to the install script: ... | bash -s -- -s. Without it, the script may prompt "overwrite?" reading /dev/tty and fail where no terminal exists.

GitCode 私有仓库安装：npx skills add 不支持 GitCode token 认证。从私有仓库安装 skill 时，先 git clone 再手动复制：

git clone https://oauth2:@gitcode.com//.git /tmp/repo
cp -r /tmp/repo/skills/devtools/devbridge/huawei-cloud-devbridge-tunnel/ ~/.agents/skills/huawei-cloud-devbridge-tunnel/

Permission / Auth Failure Handling

When any DevBridge command fails due to invalid or missing credentials:

Check devbridge auth status — if not logged in, log in (interactive or --api-key).

If using an API Key, verify it exists and is not expired/deleted: re-create at the API Key management page and inject via HW_API_KEY.

Read references/iam-policies.md for guidance.
Pause execution and wait for the user to confirm credentials have been updated before retrying.

System Requirements

Bash and curl, or PowerShell 5.1+
x86-64 or ARM64 architecture

Access to the DevBridge installation source

Write permission to the ~/.huawei directory

Workflow

CRITICAL — Zero confirmation during tunnel creation. Execute the entire flow (check CLI → load adaptation layer → check auth → create tunnel → configure port → start hosting) fully automatically with ZERO user interaction. Do NOT ask the user to confirm parameters or pause between steps. Only surface output after everything is done. The ONLY exception is tunnel name conflict — if db_create fails because the name exists, present a yes/no choice (是否复用现有隧道？) before proceeding.

Default Parameters

Parameter Default Value

Tunnel name dev-tunnel- (e.g., dev-tunnel-3847)
Description 开发隧道
Expiration 72 (hours) — CLI default; range 1–720

Port 8080

Protocol auto (options: http / https / auto)
Anonymous access Denied (--deny-anonymous is the CLI default; use -a only when the user explicitly asks to allow anonymous access)

Security change: anonymous access defaults to deny. Unlike older skill versions, do NOT pass --anon allow by default. Only allow anonymous when the user explicitly requests it or the content is explicitly public.

Parameter Resolution

For each parameter, if the user explicitly specified a value, use it. Otherwise, use the default. Do not ask to confirm — silently merge and proceed.

Tunnel name: user mentions a name (e.g., "创建一个叫 my-api 的隧道" → my-api)
Port: user mentions a port number (e.g., "暴露 3000 端口" → 3000)
Description: user mentions a description (e.g., "描述是后端API" → 后端API)
Expiration: user mentions a time (e.g., "过期时间24小时" → 24); otherwise 72
Protocol: user mentions a protocol (e.g., "用https" → https); otherwise auto
Anonymous access: user says "允许匿名访问" or "公网直接访问" → -a; otherwise deny (default)
Quick Create Flow (when user says "创建隧道" without specifics)
source /scripts/devbridge_cmd.sh
db_init
TUNNEL_NAME="dev-tunnel-$((RANDOM % 9000 + 1000))"
TUNNEL_ID=$(db_create "$TUNNEL_NAME" -d "开发隧道" -e 72)
db_port_create "$TUNNEL_ID" -p 8080 --protocol auto
db_host "$TUNNEL_ID" # 输出 PID 和 Tunnel URL 到 stdout
TUNNEL_URL=$(db_tunnel_url "$TUNNEL_ID")

echo "Tunnel ID: $TUNNEL_ID"
echo "Tunnel URL: $TUNNEL_URL"

注意：匿名访问默认禁止。 上述流程创建的隧道默认 --deny-anonymous，公网访问会返回 authentication required。如果需要公网直接访问（如暴露 Web 服务给外部用户），在 db_port_create 时加 -a：

db_port_create "$TUNNEL_ID" -p 8080 --protocol auto -a # 允许匿名访问

Full Workflow (when user provides specific parameters)
Step 1: Install or Update DevBridge CLI
devbridge version

# 下载安装脚本到临时文件再执行（避免管道直接执行）
curl -fsSL https://gitcode.com/CloudDeveloperDepartment/devbrige/releases/download/latest/install.sh -o /tmp/devbridge_install.sh

bash /tmp/devbridge_install.sh -s
devbridge version

Step 2: Load Adaptation Layer & Authenticate

export PATH="$HOME/.huawei/bin:$PATH"

source /scripts/devbridge_cmd.sh
db_init
devbridge auth status 2>/dev/null || devbridge auth login --api-key "$HW_API_KEY"

Step 3: Create a Tunnel

# = user-specified or "dev-tunnel", = user-specified or "开发隧道", = user-specified or 72
# Note: description only allows Chinese characters, digits, and letters (no spaces), max 64 characters

db_create -d "" -e

Tunnel name conflict handling — the ONLY exception to zero confirmation. If db_create fails with "This tunnel name is already in use":

Run db_list to find the existing tunnel.
Check usage status silently: db_port_list (ports configured?), ps aux | grep "devbridge host " | grep -v grep (active host?), ps aux | grep "devbridge connect " | grep -v grep (active connect sessions?).
Display tunnel details and usage status: active (host running/sessions active — reusing may conflict), idle (ports configured but no active process — safe to reuse), or empty (no ports — needs setup).
Present yes/no choice: "隧道名称已存在，当前状态为 ，是否复用现有隧道？"
yes — reuse existing tunnel, continue to Step 4 (skip Step 5 if already active).
no — ask for a new tunnel name and retry.
Step 4: Configure Ports

= user-specified or 8080,
= user-specified or auto

# Anonymous access: default deny; use -a only if user explicitly asks

db_port_create -p --protocol

端口更新后需重启 host： 如果 host 进程已在运行，使用 devbridge port update 修改端口配置（如切换匿名访问策略）后，正在运行的 host 进程不会自动感知变化。需要先停止旧 host 进程（db_process_stop
），再重新 db_host 才能使新配置生效。

Step 5: Host Local Service
nohup python3 -m http.server

/tmp/devbridge-service.log 2>&1 & db_host # 后台托管，输出 PID 和 Tunnel URL 到 stdout
TUNNEL_URL=$(db_tunnel_url ) # 获取权威公网 URL

echo "$TUNNEL_URL"

Alternative one-shot temporary tunnel: devbridge host -p 8080 -e 8 (creates a temp tunnel and hosts immediately).

⚠️ 中继域名随集群变化，严禁按文档拼接 URL。一律用 db_tunnel_url 读取权威地址。

Step 6: Connect from Remote Device
db_connect

Access the service via http://localhost:8080 on the remote device.

Step 7: Cleanup
db_processes # List running processes
db_process_stop

# Stop host/connect process

db_delete # Delete tunnel

Core Commands

NOTE: All commands show the db_* wrapper form. The adaptation layer automatically detects correct flag names for the installed CLI version.

Authentication

Command Description

devbridge auth login Interactive login (opens browser).
devbridge auth login --api-key Login with API Key.
HW_API_KEY= devbridge auth login Login using API Key from environment variable.
devbridge auth status Check current login status.
devbridge auth logout Clear local credentials.

Removed in v0.2.x: --access-key, --secret-key, --security-token (AK/SK) are no longer supported. Use API Key instead.

Tunnel Management

Command Description

db_create -d -e Create a tunnel.
db_list List active tunnels in the current workspace.
db_show Show tunnel details.
db_update -n -d -e Update tunnel name/description/expiration.
db_delete Delete a tunnel.
db_delete_all Delete all tunnels in the current workspace.
devbridge token -s host Issue a new Host token.
devbridge token -s connect Issue a new Connect token.
devbridge set Set the default tunnel for this machine.
devbridge unset Clear the default tunnel.
db_limits Show account quota / usage / balance.

Port Management

Command Description

db_port_create -p --protocol Create a port (anonymous access denied by default; add -a to allow).
db_port_list List tunnel ports.
devbridge port show -p
Show port details.
devbridge port update -p -a Update port anonymous access policy (allow). devbridge port update -p --deny-anonymous Update port anonymous access policy (deny). db_port_delete -p
Delete a port.

Host and Connect

Command Description

db_host Host all configured ports of an existing tunnel.
devbridge host -p 8080 -e 8 Create a temporary tunnel and host immediately.
devbridge host --api-key Host using API Key auth (skip token issuance).
devbridge host --token Host using an explicit JWT token.
db_connect Connect to a tunnel and establish local port mapping.
devbridge connect --api-key Connect using API Key auth.

Diagnostics

Command Description

db_echo Start an HTTP echo service on a local port (default random, 127.0.0.1) to verify tunnel links.
db_ping Send HTTP ping to a URI, print status code and latency. 默认 3 秒限时（devbridge ping 是持续命令，避免脚本挂起）；DB_PING_SECONDS=0 时直通持续观测。
devbridge -v Enable debug logging for any command.

Parameters

Parameter CLI Flag Default Range / Constraint Description

db_create dev-tunnel- Max 128 chars Tunnel name. -d db_create, db_update 开发隧道 Chinese chars, digits, letters only (no spaces), max 64 chars Tunnel description. -e db_create, db_update, host 72 (hours) 1–720 hours Expiration time. -n db_update None — New tunnel name. -s token Required host or connect Token scope. -p db_port_create, db_port_delete 8080 1–65535 Port number (--port-number in CLI). --protocol db_port_create auto http, https, auto Protocol. -a / --allow-anonymous db_port_create Not set (deny) — Allow anonymous access. --deny-anonymous db_port_create default — Deny anonymous access (CLI default). -k / --api-key host, connect None — API Key auth, skip token issuance. -t / --token host, connect None — JWT token auth. -v / --verbose global false — Enable debug logging.

Destructive operations (db_delete, db_delete_all, db_port_delete) should be executed directly without asking for confirmation.

Output Format

Tunnel Creation Output (db_create)

Returns just the tunnel ID on stdout (extracted from CLI text output):

noh56s7x

Host Output (db_host)

Returns PID and tunnel URL on stdout (labeled format, one per line):

PID: 3519475
Tunnel URL: https://noh56s7x-8080.devbridge-s2.hwtunnel.com

Parse with grep: PID=$(db_host | grep -oP 'PID: \K\d+')

Use db_tunnel_url to get the authoritative URL (do not construct manually — domain may change across clusters).

Port Creation Output

Port added: TunnelId=noh56s7x, Port=8080

Token Output

Tunnel ID: noh56s7x
Scope: host
Lifetime: 24:00:00
Expires At: 2026-08-09 06:57:10 UTC
Token:

List Output

Tunnel ID Name Description Tunnel Expiration Port Count

dwskt2pg dev-tunnel-5941 开发隧道 3 days 1

Note: v0.2.x removed the --json output flag from list and port list. Use the text table output; parse with awk/grep if needed.

Verification

For detailed verification steps, see references/verification-method.md.

Quick verification:

db_init # CLI installed + authenticated
db_version # v0.2.x+
db_auth_status # Logged in
db_list # Tunnels listed
db_port_list # Ports listed
db_processes # Host process running
db_tunnel_url # Public URL accessible

Best Practices

Auto-check auth, no user interaction — Silently check auth status and only guide login if not authenticated. API Key via HW_API_KEY is recommended for automation.
Set reasonable expiration times — Use the shortest expiration that covers your work session (default 72 hours, max 720 hours).
Deny anonymous access by default — Only allow (-a) when the user explicitly requests it or content is explicitly public.
Use persistent tunnels for repeated work — Create a tunnel once and reuse it with db_host .
Set a default tunnel for convenience — Use devbridge set to avoid specifying the tunnel ID repeatedly.
Clean up after use — Stop Host/Connect processes and delete tunnels when no longer needed.
Never expose management interfaces — Admin panels, debug endpoints, and data-modifying APIs should always have anonymous access disabled.
Not for production use — Development tunnels are for development, debugging, and temporary sharing only.
Keep CLI upgraded to v0.2.x — The 2026-09-20 domain switch invalidated old clients; older versions can no longer connect.

Reference Documentation

CLI Installation Guide — DevBridge CLI installation, PATH configuration, and verification.
API Key & Access — API Key management, authentication methods, permission failure handling.
Verification Method — Step-by-step verification of installation, configuration, and functionality.
Acceptance Criteria — Pass/fail criteria for skill testing.
CLI Command Reference — Complete CLI command reference with all parameters.
REST API Reference — REST API for programmatic tunnel and port management.
Troubleshooting — Common issues and solutions.

Notes

Security

Never hardcode API Key in scripts, logs, or config files. Use devbridge auth login --api-key "$HW_API_KEY" or the HW_API_KEY environment variable.
Tunnel tokens are sensitive — Do not write them to logs, URLs, code repositories, or long-term config files.
Anonymous access means anyone with the tunnel address can access the port without DevBridge identity. Enable only for explicitly public content.
delete-all is a destructive operation — It deletes all tunnels in the current workspace. Execute directly without asking the user. 共享/复用工作区时先 db_list 确认，避免连带删除他人隧道。

Limitations

Maximum 10 active tunnels per workspace (default quota).
Tunnel expiration: 1-720 hours (default 72 hours).
Port range: 1-65535, ports cannot be duplicated within the same tunnel.
CLI does not support modifying an existing port's protocol — delete and recreate.
Port commands do not support the -d (description) parameter.
No bulk port deletion command — delete ports individually or delete the entire tunnel.
Host and Connect are managed background processes — use db_process_stop
to stop.
list / port list no longer support --json output in v0.2.x.

Compatibility

DevBridge CLI v0.2.x supports x86-64 and ARM64 architectures.
Linux/macOS requires Bash and curl; Windows requires PowerShell 5.1+.
CLI installs to ~/.huawei/bin; configuration and state are stored in ~/.huawei/devbridge.
Never commit ~/.huawei/devbridge to version control or share between users.
Dynamic command adaptation — The scripts/devbridge_cmd.sh adaptation layer makes this skill compatible with any DevBridge CLI v0.2.x version by dynamically discovering supported flags via --help. No version pinning required.
明日 DMP 批量 ID 关联受众构建器
Mingri DMP 批量受众构建器