Bundled Script Reference

Bundled Script Reference

These are the scripts shipped in Scripts/. Each script has its own --help where applicable; the summaries below describe the actual intent and the important sharp edges.

Files and transfer

checksum

checksum file
checksum file EXPECTED
checksum file checksum-file

Calculates or verifies MD5, SHA-1, SHA-256, and SHA-512 values. It accepts prefixed values such as SHA256:... and common checksum-file lines.

copy

copy [--dry-run|-n] SRC... DEST

Uses rsync with partial-transfer resume, in-place updates, human-readable progress, and --info=progress2. Multiple sources require a destination directory.

move

move [--dry-run|-n] SRC... DEST

Transfers with rsync, performs a checksum-based dry-run comparison, and only deletes each source after verification succeeds. Directory removal uses rm -rf --one-file-system; review the destination before running it.

rsync-backup

rsync-backup SRC DEST_MOUNT

Creates backup-YYYYMMDD-HHMM and mirrors the source with rsync -aHAX --delete. The destination must be the intended mounted backup location; --delete means stale files in that new mirror are not retained.

Verification and disk care

verify

verify FILE_OR_DIR
verify FILE EXPECTED_CHECKSUM
verify --watch DIRECTORY

Combines checksum comparison with ClamAV scanning. Normal exit codes are 0 clean/verified, 1 mismatch or infection, 2 usage error, 3 scanner error, and 4 no checksum available while scanning still ran. Watch mode uses inotifywait and reports new files.

sysclean

sysclean [--dry-run] [--yes] [--deep] [--show-only]
         [--top N] [--no-pkg] [--no-steam] [--raw]

Reports filesystem usage, large files, package caches, journals, developer caches, and Steam/Heroic/Lutris footprints. It is dry-run by default; --yes enables deletion. It does not replace a backup, and it does not know whether a large file is your beloved irreplaceable masterpiece.

Search and inspection

finder

finder [--all] [--tags] PATTERN

Searches names with find -iname. --all searches system-wide through sudo; --tags is currently a placeholder and does not add tag search behaviour.

findinfiles

findinfiles [--all|--root DIR] [--ext py,js,md] TEXT

This is Python 3 despite its .sh filename. It defaults to case-insensitive search, skips noisy directories and common binary extensions, ignores files over 5 MB, and detects NUL bytes. --case, --no-skip, --skip-dir, --skip-ext, --max-size, --context, --count, --files-with-matches, and --no-color tune the scan.

Network and Wi-Fi

scanner

scanner --range 192.168.1.0/24 --ports 22,80,443

Performs bounded ICMP and TCP probes. Defaults are 100 workers, one-second timeouts, and ports 22, 80, 443, 5900, 8080, 111, and 5000. It is an inventory scanner, not a vulnerability assessment.

wifi-scanner

wifi-scanner [--interface IFACE] [--backend nmcli|iw|iwlist|auto]
             [--format table|csv|json] [--strict]

Selects nmcli, iw, or iwlist, optionally using fzf for interface selection. It scans nearby networks but does not connect to them.

netdiag

netdiag [--quick|--full] [--iface IFACE] [--target HOST]
        [--json] [--write-report PATH] [--support-bundle DIR]

Reports interfaces, addresses, routes, firewall state, kernel and NetworkManager details, and connectivity. Full mode may use sudo. Support bundles are intended to be reviewed for sensitive data before sharing.

Raspberry Pi and storage

sd-list

Runs lsblk and lists candidate whole disks whose names resemble sd, mmcblk, or nvme. It is a candidate list, not proof that a device is safe.

find-pi

Uses arp-scan --localnet when available and falls back to bounded nmap discovery. Hostnames and MAC prefixes are heuristic.

prep-headless

prep-headless BOOT_PART SSID PSK [COUNTRY]

Mounts a Pi boot partition, writes an ssh marker and WPA configuration, then unmounts it. It does not prove that the supplied partition is the correct one.

flash

flash IMAGE
flash [--verify] [--expand] [--gadget|--no-gadget] IMAGE DEVICE
flash --diagnose-mounts [BOOT] [ROOT]

Flashes compressed or uncompressed images and can configure Pi headless Wi-Fi, SSH, USB gadget networking, and expansion. It performs destructive block-device operations and requires root-capable tools. Never treat /dev/sdX as a device you can blindly paste.

Git and SSH

gitprep

Initialises or reconciles a repository, seeds files, and can create/push a GitHub remote. Options include --branch, --public, --private, --proto, --owner, --name, --no-push, and --no-gh.

gitremove

gitremove [PATH] [--remote] [--yes]

Requires confirmation before removing a local repository. --remote adds a second literal DELETE confirmation before deleting the GitHub repository. --yes skips confirmations and is for tightly controlled automation only.

push

Stages, commits, and pushes. -v patch|minor|major bumps VERSION, -t creates a tag, -r creates a GitHub release through gh, and --dry shows the plan without changing Git.

refresh-ssh

refresh-ssh [--all] [--connect] [--file PATH] [--port PORT] HOST

Uses ssh-keygen -R to remove stale known-host entries. It does not disable strict host-key checking; the next connection still verifies the new key.

linux-connect

Configures Raspberry Pi USB-gadget networking, NAT, peer discovery, and SSH. It can persist through a systemd service/timer and supports nftables or iptables. It changes live network and firewall state; inspect it before use.

Package and remote helpers

kinstall

Searches and installs through detected apt, dnf, pacman, zypper, Flatpak, or Homebrew backends. --dry-run, --search, --prefer, --force-source, --choose, --fail-fast, and --continue-on-error control behaviour. Search matching is heuristic; use an exact identifier when ambiguity matters.

tailscalesetup

Runs Tailscale's current official installer through curl. This is convenient but intentionally not pinned or checksum-verified; review the upstream script when auditability matters.