The other challenge with ngrok is that it only proxies ssl traffic to an localhost with an ssl certificate, which is a huge pain. When you do implement SSL, will it be able to connect to localhost without ssl?
On another note, I think the cli should warn before creating or destroying infra, even though I have entered the command.
I nearly have SSL automated with Letsencrypt. TLS will be terminated at the ec2 instance and proxy traffic over the ssh tunnel to the local host just as it does now. There may be an option in the future proxy 443 traffic directly to localhost and allow you to deal with SSL termination in your app, but that option isn't scoped yet.
I agree about the warning. I'm re-writing the cli to pure javascript and the cli ui will get some improvements including a warning by default and a --no-interactive flag option if you want to auto-approve changes.