Set up ngrok

Get the user authenticated and pointed at the right surface. Every ngrok action requires an authtoken (agent/SDK) or an API key (IaC) - there is no unauthenticated mode; this is deliberate abuse prevention.

1. Figure out the surface

Pick from what the user is doing, then defer the how-to to that surface skill: ngrok-surfaces carries the routing table and the per-surface mechanics - read it off the user's project rather than asking. In short: a terminal means the agent CLI, an ngrok dependency in a manifest means the SDK, *.tf or k8s manifests mean infrastructure-as-code, and a controlplane provisioning per-tenant resources means the REST API.

If it is not obvious, the terminal path is the safe default for one-off tasks.

2. Authenticate

CLI / SDK (authtoken):

1. Check for an existing token: ngrok config check, and check the NGROK_AUTHTOKEN env var.

2. If none is set, have the user set it themselves - do not ask them to paste the token to you. Give them the link and the exact command to run:

   Grab your authtoken from https://dashboard.ngrok.com/get-started/your-authtoken, then run: ngrok config add-authtoken <YOUR_TOKEN>