fix: address PR 653 review comments

- Remove dead canTrack method from task-context-tracker.ts (check inlined in index.ts)
- Rewrite clonedeps/codemap.md to match SKILL.md (no getClonedDepPath, correct paths)
- Fix hooks/codemap.md stateless claim (some hooks maintain state)

src/hooks/codemap.md

@@ -7,7 +7,7 @@ Implements OpenCode lifecycle hooks that transform, process, and manage chat mes
 
 ### Core Architecture
 - **Factory Pattern**: Each hook is created via a factory function (e.g., `createApplyPatchHook()`, `createAutoUpdateCheckerHook()`) that returns a hook function matching the OpenCode hook signature.
-- **Stateless Hooks**: Hooks are pure functions that take configuration and return a processing function; no internal state is maintained between invocations.
+- **Stateful Factories**: Hook factories may maintain closure state between invocations (e.g., `createAutoUpdateCheckerHook` guards with `hasChecked`; `createTaskSessionManagerHook` manages session lifecycle). Other hooks remain stateless — each factory decides based on its needs.
 - **Message Transformation Pipeline**: Hooks operate on the `MessageWithParts[]` type, allowing transformation of user messages, assistant responses, and system messages.
 
 ### Key Types & Interfaces

src/hooks/task-session-manager/task-context-tracker.ts

@@ -35,13 +35,6 @@ export function createTaskContextTracker() {
       }
     },
 
-    canTrack(taskId: string, backgroundJobBoard: { taskIDs(): Set<string> }) {
-      return (
-        pendingManagedTaskIds.has(taskId) ||
-        backgroundJobBoard.taskIDs().has(taskId)
-      );
-    },
-
     prune(backgroundJobBoard: { taskIDs(): Set<string> }) {
       const remembered = backgroundJobBoard.taskIDs();
       for (const taskId of contextByTask.keys()) {

src/skills/clonedeps/codemap.md

@@ -1,31 +1,32 @@
 # src/skills/clonedeps/
 
 ## Responsibility
-Manages the cloning and management of read-only dependency source repositories into a local cache (`.slim/clonedeps/repos/`) for offline inspection and development. This skill ensures that cloned dependency sources are available for agents to inspect without requiring network access or external dependencies.
+Manages the cloning and management of read-only dependency source repositories into `.slim/clonedeps/repos/` for offline inspection. This skill provides a workflow (not a command wrapper) that guides the orchestrator and `@librarian` through cloning dependency sources so agents can inspect library internals without requiring network access.
 
 ## Design
+- **Workflow skill, not a command wrapper**: No helper scripts or TypeScript utility functions. The orchestrator owns the decision-making; `@librarian` recommends sources; the orchestrator performs filesystem/git operations directly.
 - **Read-only clones**: Dependencies are cloned into `.slim/clonedeps/repos/` and should not be modified.
-- **Cache strategy**: Only clones if the repository is not already present or is out of date.
-- **Agent integration**: Provides a utility function (`getClonedDepPath`) for other skills/agents to resolve the local path to a cloned dependency.
-- **Configuration**: Uses a central configuration file (e.g., `clonedeps.jsonc`) to define which repositories to clone and their expected revisions.
+- **Cache strategy**: Existing clones are reused when they satisfy the task. Only fetch when the manifest entry is missing or stale.
+- **Agent-driven**: No runtime TS helpers (no `getClonedDepPath` utility). Agents resolve paths from `.slim/clonedeps.json` if needed.
+- **Configuration**: Uses `.slim/clonedeps.json` in the project root to define which repositories are cloned and their checked-out refs.
 
 ## Flow
-1. **Initialization**: On plugin load, the skill checks if the configured repositories are present in `.slim/clonedeps/repos/`.
-2. **Cloning**: If a repository is missing or the revision does not match, the skill clones or updates the repository using `git clone --depth 1` and checks out the specified revision.
-3. **Path resolution**: Other skills/agents call `getClonedDepPath(depName)` to retrieve the absolute path to the cloned repository for inspection or documentation generation.
-4. **Error handling**: If cloning fails, the skill logs an error and continues, allowing the plugin to function without the cloned dependency.
+1. **Check existing state**: Read `.slim/clonedeps.json` (if it exists). Check whether each listed `path` exists under `.slim/clonedeps/repos/`.
+2. **Ask librarian for plan**: Delegate dependency discovery and source resolution to `@librarian`, who returns a small plan (dependency name, repo URL, ref, package subdirectory, reason).
+3. **Verify and confirm**: Orchestrator verifies refs with `git ls-remote`, avoids unsafe URLs, presents plan to user, and gets approval before cloning.
+4. **Clone sources**: Orchestrator runs git commands directly. Creates one folder per source under `.slim/clonedeps/repos/<safe-repo-name>/`. Prefers shallow clones, pinned tags, HTTPS URLs.
+5. **Write local state**: Writes `.slim/clonedeps.json` with structured manifest (version, updatedAt, dependencies array).
+6. **Update ignore files**: Adds idempotent marker blocks to `.gitignore` and `.ignore`.
+7. **Register in AGENTS.md**: Appends a `## Cloned Dependency Source` section so future agents know what exists.
 
 ## Integration
-- **Consumed by**: Skills and agents that need to inspect dependency internals (e.g., `@librarian`, `@explorer`).
-- **Depends on**: Git CLI, configuration loader, and error handling utilities.
-- **Outputs**: Local filesystem paths to cloned repositories for use by other skills.
-- **Example usage**:
-  ```typescript
-  const path = getClonedDepPath("opencode-ai__opencode");
-  // Returns: /home/user/.slim/clonedeps/repos/opencode-ai__opencode
-  ```
+- **Consumed by**: Agents that need to inspect dependency internals (e.g., `@librarian`, `@explorer`) via the registered paths in AGENTS.md.
+- **Depends on**: Git CLI (for `git clone`, `git ls-remote`), `.slim/clonedeps.json` manifest.
+- **Outputs**: Local filesystem paths under `.slim/clonedeps/repos/` for agent inspection.
 
 ## Notes
 - Cloned repositories are read-only and should not be edited.
-- The cache directory (`.slim/clonedeps/`) is platform-specific and located in the user's home directory.
-- This skill is primarily for development and debugging; it does not affect runtime behavior.
+- The cache directory (`.slim/clonedeps/repos/`) is in the **project directory**, not the user's home directory.
+- This skill is for development and debugging; it does not affect runtime behavior.
+- `.slim/clonedeps.json` is small structured metadata that can be committed.
+- Only `.slim/clonedeps/repos/` is gitignored.