MAL-Updater

Treat {baseDir} as the skill root. This repository is the skill package.

Core model

• - Keep business logic in the repo-local Python CLI.
• Keep runtime state outside the skill tree under the workspace runtime root .MAL-Updater/ unless the operator explicitly overrides paths.
• Do not assume host-specific absolute paths, IPs, or preexisting local copies under ~/.openclaw/workspace/skills/.
• For new installs or portability audits, start with bootstrap-audit before doing any live auth or sync work.
• Prefer the long-lived user-systemd daemon over timers or OpenClaw cron for unattended operation.

Bootstrap / onboarding workflow

1. 1. INLINECODE4
2. Run INLINECODE5
3. Read INLINECODE6
4. Use the audit output to:

- verify required binaries - check whether provider-specific optional transport/runtime extras are missing - confirm the external runtime layout under .MAL-Updater/ - identify which user-provided secrets/app settings are still missing for MAL and any enabled source providers - verify the secrets location is outside version control and suitable for restrictive local permissions - decide whether the repo-owned user-systemd daemon can be installed on this host

1. 5. If bootstrap is incomplete, guide the user through the missing steps instead of pretending install is finished.
2. Prompt for provider credentials only when the workflow reaches that provider's bootstrap step; do not request Crunchyroll or HIDIVE secrets preemptively if the user has not chosen or enabled that provider yet.

How to access backend data / operator surfaces

For the most common operator/data tasks, use the repo-local CLI from {baseDir}:

Read-only inspection

• - INLINECODE9
• INLINECODE10
• INLINECODE11
• INLINECODE12
• INLINECODE13

Recommendations / recommendation-related data

• - INLINECODE14
• INLINECODE15
• INLINECODE16

Review queue / mapping triage

• - INLINECODE17
• INLINECODE18
• INLINECODE19
• INLINECODE20

Sync planning / guarded execution

• - INLINECODE21
• INLINECODE22
• INLINECODE23
• INLINECODE24

Operational workflow

Prefer read-only inspection before live writes.

Read-only first:

• - INLINECODE25
• INLINECODE26
• INLINECODE27
• INLINECODE28
• INLINECODE29
• INLINECODE30
• INLINECODE31
• INLINECODE32
• INLINECODE33

Treat these as state-changing:

• - INLINECODE34
• INLINECODE35
• INLINECODE36
• INLINECODE37
• INLINECODE38
• INLINECODE39
• INLINECODE40
• INLINECODE41
• INLINECODE42

High-value references

• - Read {baseDir}/references/bootstrap-onboarding.md for install/onboarding/bootstrap expectations.
• Read {baseDir}/references/cli-recipes.md for copy/paste command patterns.
• Read {baseDir}/references/data-surfaces.md for a concise map of which backend commands expose recommendations, review-queue state, service/runtime state, and guarded sync surfaces.

Guardrails

• - Keep sync behavior conservative; do not invent broader write scope than the CLI already supports.
• Prefer dry-run-sync before apply-sync --execute unless the task explicitly asks for a live apply.
• Treat Crunchyroll auth/fetch instability as real residue; document it plainly.
• Treat staged provider credentials and long-lived tokens as sensitive local files; keep them out of version control and prefer restrictive local permissions.
• When a host cannot satisfy the unattended daemon path, say so clearly instead of silently skipping service setup.
• Recommend manual review before enabling unattended daemon operation on a host that matters.
• Keep outputs short and actionable: counts, blockers, next command, and whether user input is needed.