菜单
Use when the user reports a tunnel that won't start, won't connect, drops, or shows status 'error'. Pulls the tunnel log buffer and walks through likely causes. Triggers on "tunnel broken", "RDP timed out", "ssh hangs", "why isn't my tunnel working".
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when the user wants to SSH into a Linux GCE VM through IAP — install their key on the VM if needed, start a tunnel, and either return the ssh command or open Terminal. Triggers on "ssh into <vm>", "give me a shell on", "open Linux VM".
Use when the user wants to RDP into a Windows GCE VM through IAP — open an existing saved connection, or set one up from scratch and launch the Microsoft 'Windows App' RDP client. Triggers on phrases like "RDP into <vm>", "open Windows VM", "connect to my Windows server".
Use when the user wants to add one or more new GCE VMs as saved connections in IAP Tunnel Manager — including resolving project + zone + platform from natural language and choosing a sensible local port. Triggers on "add a new VM", "save these instances", "bookmark these for IAP".
Use ONLY when the user explicitly asks to rotate, regenerate, or reset a Windows account password on a GCE VM. Use also when the user reports the saved password is stale and they consent to a fresh one. Triggers on "rotate password", "reset Administrator password", "I lost the Windows password".
| name | debug-tunnel |
| description | Use when the user reports a tunnel that won't start, won't connect, drops, or shows status 'error'. Pulls the tunnel log buffer and walks through likely causes. Triggers on "tunnel broken", "RDP timed out", "ssh hangs", "why isn't my tunnel working". |
tunnels_list — find the failing tunnel (status error, stopped, or stuck in starting).tunnels_get { tunnelId } — read the embedded logs buffer. Or read the resource iap://tunnels/{tunnelId}/logs for the raw newline-joined buffer.auth_check — many "tunnel won't start" failures are stale ADC tokens.| Symptom in logs | Cause | Fix |
|---|---|---|
403 ... required permission ... iap.tunnelInstances.accessViaIAP | The current ADC identity lacks IAP TCP forwarding role | Tell the user to grant roles/iap.tunnelResourceAccessor on the VM/project |
dial tcp 127.0.0.1:<port>: bind: address already in use | Another tunnel or app holds the port | tunnels_active to find the conflict; or tunnels_free_port for a fresh one |
connection refused after dial | App not listening on the remote port (e.g., RDP disabled, sshd not running) | Confirm in GCP console that the service is up on the VM |
oauth2: token expired | Stale ADC | auth_login |
instance ... not found | Wrong zone or project | Re-fetch with vms_list { projectId } |
Tunnel sits at starting for >10s | Cold start of IAP, or network ACL drops outgoing 443 to GCP | Stop it (tunnels_stop) and retry; if it still hangs, check the user's egress firewall |
If auth_check succeeds, IAM is correct, port is free, and the tunnel still errors — capture the full logs buffer and ask the user to file an issue. Do not blindly retry more than ~3 times.