docs: SKILL.md description targets actual user phrasings; correct prereqs

The skill description was generic ("manage Cloudflare Tunnel ingress
routes") and missed the phrasings users actually type. Rewrite it
around the core use case (permanent URL for a local Gradio/Streamlit/
FastAPI/webhook service) and list the explicit "do not use" cases so
Claude routes the user elsewhere when this tool is wrong.

Prereq section was misleading: claimed "the only prerequisite is
cloudflared installed". In reality the user also needs a Cloudflare
account and a domain whose zone is managed in that account, plus an
existing tunnel (or consent to create one - setup opens a browser).
Spell out all four prerequisites.

Sync the test count: README and llms.txt said 27 / 78+; the suite is
exactly 78. Make both authoritative.

Author: nachum10

README.md

@@ -359,7 +359,7 @@ CFTR_BINARY=/opt/cloudflared/bin/cloudflared bash scripts/list-routes.sh
 
 ## Tests
 
-A hermetic test suite lives in `tests/run-tests.sh` (27 tests, no real cloudflared / DNS calls):
+A hermetic test suite lives in `tests/run-tests.sh` (78 tests, no real cloudflared / DNS calls):
 
 ```bash
 bash tests/run-tests.sh

SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cloudflare-tunnel-routes
-description: Manage Cloudflare Tunnel ingress routes from the command line - add a new subdomain pointing to a local port, list current routes, remove routes, or set up a brand new tunnel. Use when the user wants to expose a local service to the internet via Cloudflare Tunnel (cloudflared), publish a project under a subdomain, get a public HTTPS URL for a localhost port, or asks "add a Cloudflare link/route/subdomain for project X". Works on any machine and any Cloudflare account - the only prerequisite is that `cloudflared` is installed.
+description: Give any local port (Gradio, Streamlit, FastAPI, webhook receiver, dev server, Docker container) a permanent HTTPS URL on a domain the user owns - in one command, no deployment. Use when the user says "my Gradio share link keeps changing", "replace share=True with a permanent URL", "stable URL for localhost:7860", "permanent link for my local AI demo", "ngrok alternative on my own domain", "expose port X at https://Y.example.com", "persistent webhook URL on my laptop", "add a Cloudflare route/subdomain for project X", or any phrasing about wanting a stable HTTPS URL for a service that stays local instead of being deployed. Do NOT use for throwaway URLs (suggest `cloudflared --url` or `ngrok`), managed hosting (HF Spaces, Modal, Vercel), or when the user has no Cloudflare-managed domain.
 ---
 
 # Cloudflare Tunnel Routes
@@ -21,9 +21,14 @@ Common phrasings: "add a Cloudflare route", "create a tunnel link", "publish thi
 
 ## Prerequisites
 
-The only requirement is `cloudflared` installed and authenticated. To verify, run `scripts/detect.sh` first - it returns key=value lines describing the current state, and exits non-zero if no tunnel is configured.
+The user must have:
 
-If detection fails, run `scripts/setup-new-tunnel.sh <name>` which handles login, tunnel creation, and starter config.
+1. **`cloudflared` installed** locally — `brew install cloudflared`, `apt install cloudflared`, or [download a binary](https://github.com/cloudflare/cloudflared/releases). Run `cloudflared --version` to check.
+2. **A Cloudflare account** — free at https://dash.cloudflare.com.
+3. **A domain managed in that Cloudflare account** — i.e. its DNS zone lives in Cloudflare. The hostname the user wants to expose (e.g. `demo.example.com`) must be on a domain they control via this account; otherwise DNS record creation will fail. If the domain is registered elsewhere, the user can move the zone to Cloudflare for free, or fall back to `ngrok` / `cloudflared --url`.
+4. **An existing tunnel, OR explicit consent to create one** — run `scripts/detect.sh` first. If it returns exit code 1 (no tunnel), `scripts/setup-new-tunnel.sh <name>` will create one, but it opens a browser for `cloudflared tunnel login` — never invoke it without the user's explicit OK.
+
+To verify everything is in place: run `bash scripts/detect.sh` and check that it exits `0` and reports a real `tunnel_id`.
 
 ## Operations
 

llms.txt

@@ -34,7 +34,7 @@ Don't use it when: the user wants to deploy to managed hosting (Vercel / Fly / H
 
 ## Tests
 
-- [tests/run-tests.sh](./tests/run-tests.sh): hermetic test suite (78+ tests, no real cloudflared / DNS calls). CI runs this on every push and PR.
+- [tests/run-tests.sh](./tests/run-tests.sh): hermetic test suite (78 tests, no real cloudflared / DNS calls). CI runs this on every push and PR.
 
 ## Safety properties