Manage

Purpose

Personal-use Kindle DRM removal is a fragile multi-tool workflow with state mutations that, if forgotten, leave the user's machine in an awkward state (silent auto-update, stuck firewall rules, half-installed Calibre plugins). This skill captures the lifecycle as discrete reversible actions and tracks every upstream source that drifts independently (Amazon's Kindle for PC release cadence, Satsuoni's DeDRM_tools fork, Kindle_Key_Finder zip with rolling date in URL, techy-notes.com tutorial article).

Scope: Windows-only (Kindle for PC + KFXKeyExtractor are Windows binaries). Single-user. Books the user owns.

First step: probe current state

Probe current state on every invocation. Run scripts/status.sh and read the JSON output before deciding which action applies.

bash "${CLAUDE_PLUGIN_ROOT}/skills/manage/scripts/status.sh"

Output reports: Kindle for PC version, firewall rule presence, ICACLS deny presence, ~/Tools/Kindle_Key_Finder presence, ~/Downloads installer presence, Calibre install presence, Calibre plugin presence (best-effort), book count in My Kindle Content + Calibre Library.

Action router

Smart auto-detect when action is empty: read pre-computed context, classify state, recommend the most-fitting action OR emit status if classification is ambiguous. Never commit to setup/sync/cleanup without user confirmation when ambiguous.

Hard safety rules

Apply across every action. Violating any risks losing the working 2.8.0 setup or stranding the user with an upgraded Kindle that can't be downgraded without re-extracting from a different machine.

• Never open Kindle for PC while the firewall block is disabled UNLESS the user is actively syncing new books AND has the keyfinder ready to run immediately afterward. Amazon stages 2.9.x installers aggressively; one open window with internet access is enough to cache an installer that auto-runs on next launch.
• Never run the cached installer at %LOCALAPPDATA%\Amazon\Kindle\updates\KindleForPC-installer.exe. This is the auto-update payload that breaks key extraction. Delete it whenever it appears.
• Never recommend --no-confirm flags or batch-confirm cleanup. Each reversal is independent; some harder to redo than others (re-pinning Kindle 2.8.0 is easy; re-syncing 50 books isn't).
• Never send any of these scripts, keys, or extracted files outside the user's machine. Personal-use scope only.
• The cached installer + firewall race is real: if user reports "an installer popped up when I opened Kindle," immediately follow scripts/sync-finalize.sh delete logic. Do not let the installer complete.

Action: setup

First-time provisioning lives in the dedicated /kindle-dedrm:setup skill, which conforms to the uniform check/apply contract: check probes prerequisites and current state read-only, apply runs the full provisioning walkthrough (reference/workflow.md). The gated artifact download, install, firewall block, ICACLS lock, Calibre plugins, and keyfinder. When this router's smart auto-detect finds a pristine machine, recommend /kindle-dedrm:setup rather than provisioning inline; the sequence has a single owner (/kindle-dedrm:setup → reference/workflow.md).

Action: sync

Re-sync new books purchased after initial setup. Idempotent. Safe to re-run.

# Dry-run preview first
bash "${CLAUDE_PLUGIN_ROOT}/skills/manage/scripts/sync-prep.sh" --dry-run

Sequence:

1. Verify state via status.sh. Abort if firewall rule absent or ICACLS deny missing (run setup first).
2. Disable firewall block (scripts/firewall.ps1 disable).
3. User opens Kindle for PC, syncs, double-clicks new books, quits Kindle. Agent cannot drive GUI; pause for user confirmation.
4. Delete any newly-staged installer at %LOCALAPPDATA%\Amazon\Kindle\updates\* (scripts/sync-finalize.sh delete-cache). ICACLS deny prevents future writes but doesn't stop one that lands during the brief firewall-disabled window.
5. Re-enable firewall block (scripts/firewall.ps1 enable).
6. Re-run keyfinder (~/Tools/Kindle_Key_Finder/Run_keyfinder_admin.vbs). Saved config auto-loads; tool processes only new books.
7. Verify new EPUBs under Calibre Library.

If user reports a cached installer popped up during step 3, that's expected. Amazon staged 2.9.x. Delete it via step 4 immediately and verify Kindle.exe still reports 2.8.0.70980.

Action: update

Drift check. No mutations. Diffs upstream sources against captured baselines in reference/sources.md + reference/versions.md.

bash "${CLAUDE_PLUGIN_ROOT}/skills/manage/scripts/check-drift.sh"

Sources monitored:

Two further sources are tracked in reference/sources.md but have no automated probe: the epubor companion article, and the supported-version list in Kindle_Key_Finder's code/modules/utils.py. Check those by hand when a drift report leaves a question open.

Output: drift report listing each source's status (current / stale / unreachable) and recommended action (re-download / update version pin / manual review). User decides what to act on; update action itself does not apply changes.

When the user accepts a drift recommendation, the re-pin edit is maintainer work, gated on a working-tree checkout: applying it requires ${CLAUDE_PLUGIN_ROOT} to be inside a git working tree (git -C "${CLAUDE_PLUGIN_ROOT}" rev-parse --is-inside-work-tree succeeds, a marketplace clone or a --plugin-dir load). In installed form ${CLAUDE_PLUGIN_ROOT} is the read-only plugin cache: stop after the drift report and direct the change to the plugin's source repository (file an issue or PR there); never edit bundled files in the cache. Consumers then receive the re-pin through /plugin marketplace update.

In a checkout, when the user accepts a drift recommendation:

1. Apply the change to reference/versions.md (update pin, refresh page summary). The single source of truth; check-drift.sh parses its pins from that file, so no second copy needs editing.
2. Run the affected portion of setup (e.g., re-download DeDRM_tools if a new pre-release is selected).
3. Verify the workflow still works end-to-end on at least one book (run sync mode against a single test book).

Action: cleanup

Reverse every mutation made by this skill. Per-item confirmation by default.

bash "${CLAUDE_PLUGIN_ROOT}/skills/manage/scripts/cleanup.sh"           # confirm-each (default)
bash "${CLAUDE_PLUGIN_ROOT}/skills/manage/scripts/cleanup.sh --soft"    # tools + downloads only
bash "${CLAUDE_PLUGIN_ROOT}/skills/manage/scripts/cleanup.sh --full"    # everything including Kindle for PC + Calibre plugins

Reversal matrix (every row maps a mutation made by setup/sync to its compensating reversal):

The skill should NEVER offer to delete the user's Calibre Library. Those are the decrypted books the entire workflow exists to produce.

What this skill does NOT do

• Modify books the user does not own. Workflow only processes content already present in My Kindle Content/.
• Distribute extracted EPUBs anywhere off the user's machine.
• Bypass updates the user explicitly requests (if user says "I want to upgrade to Kindle 2.9.x", this skill cleanly disengages via cleanup --full).
• Touch other Amazon services or Kindle hardware. Kindle for PC only.
• Mock around with the cached installer at the Amazon binary level (we delete, we don't patch).
• Run on Mac/Linux. KFXKeyExtractor + KFXArchiver are Windows binaries with hard-coded memory offsets.

Reference index. Load on demand

Recheck triggers