# Example Rhai scripts
One focused `.rhai` per `recon` script-binding module. Each file
demonstrates the minimal idiom and is runnable as-is:
```sh
recon --script script/http.rhai
recon --script script/dns.rhai example.com A,MX,TXT
```
Or copy into `~/.recon/script/` for bare-name invocation:
```sh
recon --init # one-time bootstrap
cp script/*.rhai ~/.recon/script/
recon --script http example.com # picks up ~/.recon/script/http.rhai
```
Scripts that need external services (Redis, memcached, MQTT, browser
automation) probe reachability first and exit 2 cleanly when the
backend isn't present — safe to run through the whole set without
surprise failures.
## Index
### Protocol probes
| `http.rhai` | GET + status assertion + body length |
| `tcp.rhai` | TCP connect probe with latency |
| `ping.rhai` | TCP or ICMP ping |
| `dns.rhai` | DNS records (default bundle or custom types) |
| `tls.rhai` | Certificate inspection + days-remaining |
| `ntp.rhai` | Clock offset + round-trip delay |
| `redis.rhai` | PING or arbitrary RESP command |
| `ws.rhai` | WebSocket handshake + Ping/Pong |
| `dict.rhai` | RFC 2229 DICT lookup |
| `ldap.rhai` | Anonymous RootDSE query |
| `whois.rhai` | Two-hop whois with registrar referral |
| `memcached.rhai` | Text-protocol version + stats |
| `rtsp.rhai` | RTSP OPTIONS + method list |
| `mqtt.rhai` | MQTT publish with reachability guard |
| `smtp.rhai` | SMTP capability + STARTTLS probe |
### File transfer
| `ftp.rhai` | Anonymous FTP/FTPS directory listing or file retrieval |
| `sftp.rhai` | SSH-backed SFTP directory listing or file retrieval |
| `tftp.rhai` | RFC 1350 UDP download (with optional block-size negotiation) |
| `gopher.rhai` | RFC 1436 selector fetch |
### Mail retrieval
| `pop3.rhai` | POP3 capability probe + optional RETR |
| `imap.rhai` | IMAP capability probe + EXAMINE / FETCH |
### Content addressing
| `ipfs.rhai` | ipfs:// / ipns:// URL rewrite + HTTP gateway fetch |
### Routing
| `proxy.rhai` | http() with proxy opts (HTTP / HTTPS / SOCKS5) |
| `unix-socket.rhai` | http() over a Unix-domain socket (Docker / systemd / kubelet) |
| `hsts.rhai` | HSTS cache populate + http:// upgrade |
| `client-cert.rhai` | mTLS — present a client cert during the TLS handshake |
### Browser impersonation (0.77.0, opt-in)
| `impersonate.rhai` | Browser TLS+H2 fingerprint impersonation via the `impersonate` opts key. Requires a build with `--features impersonate`. |
### Shebang (0.68.0)
| `shebang.rhai` | `#!/usr/bin/env -S recon --script` — run directly after `chmod +x` |
### HTTP opts (0.61.0-0.69.0)
| `retry.rhai` | retry cluster (retry, retry_all_errors, retry_connrefused, retry_delay, retry_max_time) |
| `form.rhai` | multipart uploads via the `form` / `form_string` / `form_escape` opts |
| `netrc.rhai` | .netrc-backed Basic auth via `netrc` / `netrc_file` / `netrc_optional` |
| `time-cond.rhai` | conditional GETs: `time_cond`, `etag_compare`, `etag_save`, `timestamping` |
| `batch-spider.rhai` | bulk link check combining spider + retry + rate limiting |
| `wget-batch.rhai` | wget-style `tries` / `wait` / `accept` / `reject` opts (0.67.0) |
| `oauth2.rhai` | OAuth 2 Bearer token via `oauth2_bearer` |
| `range.rhai` | byte-range + max-filesize |
| `prettify.rhai` | force-format response body via `prettify_as` opt (0.69.0) |
### Sessions (scriptable `browser()`)
| `browser.rhai` | Minimal stateful browser: cookies + headers stick across calls |
| `browser-login.rhai` | JSON login → protected resource with sticky session cookie |
| `browser-persist.rhai` | `use_persistent_session()` — jar survives across runs |
| `browser-multi.rhai` | Three independent browsers with different personas + jars |
| `browser-iso8859.rhai` | Browser posting to a Latin-1 service; auto-transcodes body |
### Documents
| `doc-convert.rhai` | Markdown → HTML (+ TOC) → PDF pipeline demo |
| `pdf.rhai` | Export a single PDF page to PNG / JPEG / WEBP via `pdf_export_page` |
### Comparison
| `compare.rhai` | In-script diff of two strings or Blobs (`compare(a, b)`) |
### Text processing
| `text.rhai` | Charset detect / decode / encode + newline normalisation |
| `strutil.rhai` | PHP-style string helpers: trim/ltrim/rtrim, strrev, strip_html, nl2br/br2nl, preg_match/preg_replace, printf/sprintf |
| `jq.rhai` | jq-style filters on any Map/Array via `.jq(filter)` and `.jq_all(filter)` — first vs all results |
### Concurrency
| `thread.rhai` | Spawn workers, collect via channel, demo bounded channels |
| `tcp-echo.rhai` | Concurrent TCP echo server (accept → thread_spawn per conn) |
| `udp-listen.rhai` | UDP beacon listener that prints each datagram |
| `shell.rhai` | `shell(cmd)` and `shell_stream(cmd, callback)` — run subprocesses with cwd / env / timeout opts, stream stdout+stderr line-by-line into a callback |
| `tui.rhai` | `tui::run(|d| { ... })` — multi-pane dashboard. Demonstrates routing subprocess output into one pane while the script logs progress in another. Requires a real TTY. |
### Data primitives
| `file.rhai` | Read file as Blob + sha256 |
| `hash.rhai` | All nine hash algorithms over one payload |
| `compression.rhai` | Round-trip every stream-compression algo |
| `archive.rhai` | Create + extract a zip in /tmp |
| `sqlite.rhai` | In-memory SQLite round-trip |
| `dotenv.rhai` | Layered `.env` loading (common + per-script) plus `env_all()` |
### Domain tools
| `encode.rhai` | QR / DataMatrix / barcode to PNG |
| `decode.rhai` | Scan a PNG/JPEG/WebP for a barcode or 2D code |
| `encrypt.rhai` | age keypair generation (CLI companion for full encrypt/decrypt) |
| `checkdigit.rhai` | Verify or inspect any check-digit algorithm |
| `sample.rhai` | Enumerate built-in sample sources |
| `jwt.rhai` | Sign + view + validate JWT round-trip |
| `email.rhai` | SPF / DMARC / MTA-STS / TLS-RPT / BIMI aggregate |
| `netstatus.rhai` | Connectivity probe set |
### Clipboard (0.70.0)
| `clipboard.rhai` | read+transform+write to system clipboard via arboard (0.70.0) |
### Browser automation (external `agent-browser` CLI)
| `agent-browser.rhai` | Minimal open / title / snapshot / close flow |
| `agent-browser-screenshot.rhai` | Take a screenshot |
| `agent-browser-title.rhai` | Extract the page title |
| `agent-browser-snapshot.rhai` | Accessibility-tree dump |
| `agent-browser-form-login.rhai` | Fill a two-field login form |
| `agent-browser-guard.rhai` | Prefer browser, fall back to HTTP |
| `agent-browser-options.rhai` | Global options: ignore_https_errors, user_agent, headers, per-call overrides (0.75.0) |
| `agent-browser-find.rhai` | Semantic locators (role, text, label, placeholder, alt, title, testid, first/last/nth) (0.75.1) |
| `agent-browser-interaction.rhai` | Click/dblclick/hover/focus/check/uncheck/fill/type/press/scroll/keyboard (0.75.1) |
| `agent-browser-inspect.rhai` | snapshot / eval / get / is_visible / is_enabled / is_checked (0.75.1) |
| `agent-browser-navigation.rhai` | open / back / forward / reload / close / close_all (0.75.1) |
| `agent-browser-pdf.rhai` | Render a JS-rendered page to PDF, with per-call options (0.75.1) |
| `agent-browser-cmd.rhai` | Escape hatch: cookies / storage / tabs / network / console via cmd() (0.75.1) |
### AI agent CLIs (0.79.0)
| `ai.rhai` | `ai::*` request builder + send (subprocess to claude / codex / copilot / gemini) |
| `ai-simple.rhai` | Smallest `ai::request()` builder demo (one-word answer; backend pinned). |
| `ai-system.rhai` | How `.system(...)` steers tone / length; same prompt twice. |
| `ai-context.rhai` | `.context(...)` accumulation; classify a synthetic HTTP response. |
| `ai-multiturn.rhai` | Manual multi-turn replay using `.assistant()` + `.user()`. |
### External CLIs
| `git.rhai` | Drive the `git` CLI — `g.status()` / `g.log()` / `g.diff()` / `g.commit()` and more, all returning parsed Maps/Arrays |
| `gh.rhai` | Drive the GitHub `gh` CLI — `h.pr_list()` / `h.pr_create()` / `h.release_create()` etc, with auto-account-switch driven by `git config user.email` |
Every script starts with a usage comment showing args and a one-line
description. Scripts that take positional args support a sensible
default so `recon --script NAME` alone does something useful.