docs: put the guided command first, and a prompt for people who use an AI

docs/commands.html

@@ -92,6 +92,24 @@ <h1>Every command, and what it will not do</h1>
     <a href="#limits">Limits</a>
   </div>
 
+  <section class="stack" id="start">
+    <span class="eyebrow">Start here</span>
+    <h2>The guided one</h2>
+    <p>If you do not want to choose between the commands below, this runs the whole sequence and
+    asks you at each step. It is the same work, in the order that actually helps.</p>
+    <div class="panel"><div class="panel-bar"><span class="label">Guided clean-up</span><div class="bar-actions"></div></div>
+      <div class="scroller"><pre>snare respond                   walk through everything, one question at a time
+snare respond --status          where you got to
+snare respond --reset           start the walkthrough again</pre></div></div>
+    <p class="note">Six steps: check the machine, rotate credentials, clean the machine, find what
+    is infected, fix it, tell your collaborators — then a verification pass that re-reads rather
+    than trusting what just happened. Anything that writes to a repository defaults to
+    <strong>no</strong>, and the choice to purge history is asked once rather than per repository.
+    Progress is saved, so stopping and resuming is fine.</p>
+    <p class="note">It refuses to run unattended. With no terminal, or <code>CI</code> set, it
+    exits rather than prompting where nobody can answer — use the individual commands there.</p>
+  </section>
+
   <section class="stack" id="find">
     <span class="eyebrow">Find it</span>
     <h2>Scanning</h2>

docs/infected.html

@@ -63,6 +63,30 @@ <h1>What to do, in the order that matters</h1>
 </div>
 
 <div class="wrap">
+<section class="stack" id="guided">
+  <span class="eyebrow">The short way</span>
+  <h2>One command walks you through all of it</h2>
+  <p class="lede">Everything on this page, asked one question at a time, in the right order.
+  Nothing is changed or pushed without you saying so, and it saves your place if you stop.</p>
+  <div class="panel"><div class="panel-bar"><span class="label">Start here</span><div class="bar-actions"></div></div>
+    <div class="scroller"><pre>snare respond</pre></div></div>
+  <div class="callout">
+    <h3>What it will and will not do</h3>
+    <p>It revokes what it safely can — npm tokens are one keypress, and they are the ones that
+    matter most — opens your browser at the pages it cannot act on, and asks before every push.
+    Anything that writes to a repository defaults to <strong>no</strong>. The destructive choice,
+    whether to purge history, is asked <strong>once</strong> rather than per repository, so a
+    rhythm of "yes" cannot carry you through it by accident.</p>
+    <p>It will not pretend to have rotated your credentials for you. It asks, and if you say no it
+    carries on — but it tells you again before anything is pushed, and again at the end. A step
+    that blocks you is a step you abandon.</p>
+    <p><code>snare respond --status</code> shows where you got to.
+    <code>snare respond --reset</code> starts again.</p>
+  </div>
+  <p class="note">The rest of this page is the same sequence done by hand. Read it if you would
+  rather drive, or if you want to know why the order is what it is.</p>
+</section>
+
 <section class="stack" id="order">
   <span class="eyebrow">The order</span>
   <h2>Four steps, and the sequence is the point</h2>

docs/install.html

@@ -168,6 +168,56 @@ <h3>Warn your team</h3>
       each one. It never sends anything — you send from your own account.</p>
     </div>
   </div>
+  <div class="callout">
+    <h3>Not sure where to start?</h3>
+    <p>Run <code>snare respond</code>. It walks you through the whole thing — check the machine,
+    rotate credentials, find what is infected, clean it, tell your collaborators — one question at
+    a time, in the order that actually works. Nothing is changed without you saying so, and it
+    remembers where you got to if you stop.</p>
+  </div>
+  <div class="callout">
+    <h3>Would you rather your AI assistant did this?</h3>
+    <p>Paste the prompt below into Claude Code, Cursor, Copilot or any assistant that can run
+    commands. It installs snare, checks your machine, and reports back — and it is written to stop
+    and ask you before anything is changed.</p>
+    <div class="panel"><div class="panel-bar"><span class="label">Copy this</span><div class="bar-actions"></div></div>
+      <div class="scroller"><pre>Please help me check my machine and my repositories for the supply-chain
+malware described at https://avioflagos.github.io/snare/
+
+1. Clone and install the scanner:
+     git clone https://github.com/AviOfLagos/snare ~/snare
+     cd ~/snare &amp;&amp; ./install.sh
+   It needs bash, git, python3 and the GitHub CLI (gh). Install whatever is
+   missing for my platform first.
+
+2. Confirm the scanner itself works before trusting any result:
+     snare selftest
+   If that fails, stop and tell me — a scanner whose detection is broken
+   reports "clean" on infected repositories.
+
+3. Check this machine and show me the output:
+     snare doctor
+     snare guard scan
+
+4. Scan my repositories and show me exactly what was found:
+     snare scan repo .        # the repo I am in: working tree, branches, history
+     snare scan github        # every repo my gh account can reach
+
+Important, please follow these:
+- Do NOT run "snare fix", "--push" or "--purge-history" without asking me
+  first and showing me what would change. They rewrite git history.
+- If anything is found, tell me to rotate my credentials BEFORE cleaning any
+  repository. Stealing credentials is what this malware is for, and cleaning
+  a repo from an infected machine just lets it re-inject.
+- "snare guard scan" saying "clean" does not mean I was never infected. The
+  loader runs when a build runs or an editor opens the folder, then exits.
+- Explain what you find in plain language, and tell me what you are unsure
+  about rather than guessing.</pre></div></div>
+    <p class="note">The prompt deliberately forbids the destructive commands. If your assistant
+    offers to run <code>snare fix --purge-history</code> unprompted, say no and read
+    <a href="infected.html">the walkthrough</a> first — that rewrites every commit and breaks
+    every existing clone.</p>
+  </div>
   <div class="callout">
     <h3>Already had snare installed before 29 August 2026?</h3>
     <p>Run <code>snare update</code> and then <code>snare selftest</code> before you trust a clean

docs/src/commands.html

@@ -41,6 +41,24 @@ <h1>Every command, and what it will not do</h1>
     <a href="#limits">Limits</a>
   </div>
 
+  <section class="stack" id="start">
+    <span class="eyebrow">Start here</span>
+    <h2>The guided one</h2>
+    <p>If you do not want to choose between the commands below, this runs the whole sequence and
+    asks you at each step. It is the same work, in the order that actually helps.</p>
+    <div class="panel"><div class="panel-bar"><span class="label">Guided clean-up</span><div class="bar-actions"></div></div>
+      <div class="scroller"><pre>snare respond                   walk through everything, one question at a time
+snare respond --status          where you got to
+snare respond --reset           start the walkthrough again</pre></div></div>
+    <p class="note">Six steps: check the machine, rotate credentials, clean the machine, find what
+    is infected, fix it, tell your collaborators — then a verification pass that re-reads rather
+    than trusting what just happened. Anything that writes to a repository defaults to
+    <strong>no</strong>, and the choice to purge history is asked once rather than per repository.
+    Progress is saved, so stopping and resuming is fine.</p>
+    <p class="note">It refuses to run unattended. With no terminal, or <code>CI</code> set, it
+    exits rather than prompting where nobody can answer — use the individual commands there.</p>
+  </section>
+
   <section class="stack" id="find">
     <span class="eyebrow">Find it</span>
     <h2>Scanning</h2>

docs/src/infected.html

@@ -12,6 +12,30 @@ <h1>What to do, in the order that matters</h1>
 </div>
 
 <div class="wrap">
+<section class="stack" id="guided">
+  <span class="eyebrow">The short way</span>
+  <h2>One command walks you through all of it</h2>
+  <p class="lede">Everything on this page, asked one question at a time, in the right order.
+  Nothing is changed or pushed without you saying so, and it saves your place if you stop.</p>
+  <div class="panel"><div class="panel-bar"><span class="label">Start here</span><div class="bar-actions"></div></div>
+    <div class="scroller"><pre>snare respond</pre></div></div>
+  <div class="callout">
+    <h3>What it will and will not do</h3>
+    <p>It revokes what it safely can — npm tokens are one keypress, and they are the ones that
+    matter most — opens your browser at the pages it cannot act on, and asks before every push.
+    Anything that writes to a repository defaults to <strong>no</strong>. The destructive choice,
+    whether to purge history, is asked <strong>once</strong> rather than per repository, so a
+    rhythm of "yes" cannot carry you through it by accident.</p>
+    <p>It will not pretend to have rotated your credentials for you. It asks, and if you say no it
+    carries on — but it tells you again before anything is pushed, and again at the end. A step
+    that blocks you is a step you abandon.</p>
+    <p><code>snare respond --status</code> shows where you got to.
+    <code>snare respond --reset</code> starts again.</p>
+  </div>
+  <p class="note">The rest of this page is the same sequence done by hand. Read it if you would
+  rather drive, or if you want to know why the order is what it is.</p>
+</section>
+
 <section class="stack" id="order">
   <span class="eyebrow">The order</span>
   <h2>Four steps, and the sequence is the point</h2>

docs/src/install.html

@@ -117,6 +117,56 @@ <h3>Warn your team</h3>
       each one. It never sends anything — you send from your own account.</p>
     </div>
   </div>
+  <div class="callout">
+    <h3>Not sure where to start?</h3>
+    <p>Run <code>snare respond</code>. It walks you through the whole thing — check the machine,
+    rotate credentials, find what is infected, clean it, tell your collaborators — one question at
+    a time, in the order that actually works. Nothing is changed without you saying so, and it
+    remembers where you got to if you stop.</p>
+  </div>
+  <div class="callout">
+    <h3>Would you rather your AI assistant did this?</h3>
+    <p>Paste the prompt below into Claude Code, Cursor, Copilot or any assistant that can run
+    commands. It installs snare, checks your machine, and reports back — and it is written to stop
+    and ask you before anything is changed.</p>
+    <div class="panel"><div class="panel-bar"><span class="label">Copy this</span><div class="bar-actions"></div></div>
+      <div class="scroller"><pre>Please help me check my machine and my repositories for the supply-chain
+malware described at https://avioflagos.github.io/snare/
+
+1. Clone and install the scanner:
+     git clone https://github.com/AviOfLagos/snare ~/snare
+     cd ~/snare &amp;&amp; ./install.sh
+   It needs bash, git, python3 and the GitHub CLI (gh). Install whatever is
+   missing for my platform first.
+
+2. Confirm the scanner itself works before trusting any result:
+     snare selftest
+   If that fails, stop and tell me — a scanner whose detection is broken
+   reports "clean" on infected repositories.
+
+3. Check this machine and show me the output:
+     snare doctor
+     snare guard scan
+
+4. Scan my repositories and show me exactly what was found:
+     snare scan repo .        # the repo I am in: working tree, branches, history
+     snare scan github        # every repo my gh account can reach
+
+Important, please follow these:
+- Do NOT run "snare fix", "--push" or "--purge-history" without asking me
+  first and showing me what would change. They rewrite git history.
+- If anything is found, tell me to rotate my credentials BEFORE cleaning any
+  repository. Stealing credentials is what this malware is for, and cleaning
+  a repo from an infected machine just lets it re-inject.
+- "snare guard scan" saying "clean" does not mean I was never infected. The
+  loader runs when a build runs or an editor opens the folder, then exits.
+- Explain what you find in plain language, and tell me what you are unsure
+  about rather than guessing.</pre></div></div>
+    <p class="note">The prompt deliberately forbids the destructive commands. If your assistant
+    offers to run <code>snare fix --purge-history</code> unprompted, say no and read
+    <a href="infected.html">the walkthrough</a> first — that rewrites every commit and breaks
+    every existing clone.</p>
+  </div>
   <div class="callout">
     <h3>Already had snare installed before 29 August 2026?</h3>
     <p>Run <code>snare update</code> and then <code>snare selftest</code> before you trust a clean