fix(pair-agent): keep the ngrok authtoken out of the transcript and shell argv

The not-authed flow told the user to paste their ngrok authtoken into the
chat so the agent could run `ngrok config add-authtoken` — putting a live
credential in the transcript, tool-call argv, and anything the transcript
syncs to. The user now runs the auth command in their own terminal; the
agent only verifies via `ngrok config check`, and a pasted token triggers a
rotate-and-reauth instruction. A static test pins that no agent-run bash
fence ever contains add-authtoken again.

Fixes #2335.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/pair-agent-token-hygiene.test.ts

@@ -0,0 +1,54 @@
+import { describe, test, expect } from 'bun:test';
+import * as fs from 'fs';
+import * as path from 'path';
+
+// Token hygiene for /pair-agent (#2335): the ngrok authtoken must never walk
+// through the chat transcript or a Bash tool call. The skill may INSTRUCT the
+// user to run `ngrok config add-authtoken` in their own terminal, but no
+// agent-executed bash fence may contain the command — an agent-run
+// `ngrok config add-authtoken THEIR_TOKEN` means the token arrived via the
+// transcript and landed in shell argv/history.
+
+const ROOT = path.resolve(import.meta.dir, '..');
+
+function fencedBashBlocks(markdown: string): string[] {
+  // Line-based fence walk: a naive /```...```/ regex mis-pairs a CLOSING
+  // fence with the next block's opener and swallows the prose in between.
+  const blocks: string[] = [];
+  let inFence = false;
+  let lang = '';
+  let current: string[] = [];
+  for (const line of markdown.split('\n')) {
+    if (line.trimStart().startsWith('```')) {
+      if (!inFence) {
+        inFence = true;
+        lang = line.trim().slice(3).trim().toLowerCase();
+        current = [];
+      } else {
+        inFence = false;
+        if (lang === '' || lang === 'bash' || lang === 'sh') blocks.push(current.join('\n'));
+      }
+      continue;
+    }
+    if (inFence) current.push(line);
+  }
+  return blocks;
+}
+
+describe('pair-agent ngrok token hygiene (#2335)', () => {
+  const files = ['pair-agent/SKILL.md', 'pair-agent/SKILL.md.tmpl'];
+
+  test.each(files)('%s: no agent-run bash fence contains add-authtoken', (rel) => {
+    const content = fs.readFileSync(path.join(ROOT, rel), 'utf-8');
+    for (const block of fencedBashBlocks(content)) {
+      expect(block).not.toContain('add-authtoken');
+    }
+  });
+
+  test.each(files)('%s: instructs that the token never enters the chat', (rel) => {
+    const content = fs.readFileSync(path.join(ROOT, rel), 'utf-8');
+    expect(content.toLowerCase()).toContain('never enter this chat');
+    // The recovery path for an accidentally pasted token must exist.
+    expect(content.toLowerCase()).toContain('rotate');
+  });
+});