fix: harden orchestration status and skill docs

scripts/lib/orchestration-session.js

@@ -17,6 +17,16 @@ function stripCodeTicks(value) {
   return trimmed;
 }
 
+function normalizeSessionName(value, fallback = 'session') {
+  const normalized = String(value || '')
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+
+  return normalized || fallback;
+}
+
 function parseSection(content, heading) {
   if (typeof content !== 'string' || content.length === 0) {
     return '';
@@ -246,22 +256,29 @@ function resolveSnapshotTarget(targetPath, cwd = process.cwd()) {
   if (fs.existsSync(absoluteTarget) && fs.statSync(absoluteTarget).isFile()) {
     const config = JSON.parse(fs.readFileSync(absoluteTarget, 'utf8'));
     const repoRoot = path.resolve(config.repoRoot || cwd);
+    const sessionName = normalizeSessionName(
+      config.sessionName || path.basename(repoRoot),
+      'session'
+    );
     const coordinationRoot = path.resolve(
       config.coordinationRoot || path.join(repoRoot, '.orchestration')
     );
 
     return {
-      sessionName: config.sessionName,
-      coordinationDir: path.join(coordinationRoot, config.sessionName),
+      sessionName,
+      coordinationDir: path.join(coordinationRoot, sessionName),
       repoRoot,
       targetType: 'plan'
     };
   }
 
+  const repoRoot = path.resolve(cwd);
+  const sessionName = normalizeSessionName(targetPath, path.basename(repoRoot));
+
   return {
-    sessionName: targetPath,
-    coordinationDir: path.join(cwd, '.claude', 'orchestration', targetPath),
-    repoRoot: cwd,
+    sessionName,
+    coordinationDir: path.join(repoRoot, '.orchestration', sessionName),
+    repoRoot,
     targetType: 'session'
   };
 }

scripts/lib/tmux-worktree-orchestrator.js

@@ -56,6 +56,12 @@ function normalizeSeedPaths(seedPaths, repoRoot) {
     }
 
     const normalizedPath = relativePath.split(path.sep).join('/');
+    if (!normalizedPath || normalizedPath === '.') {
+      throw new Error('seedPaths entries must not target the repo root');
+    }
+    if (normalizedPath === '.git' || normalizedPath.startsWith('.git/')) {
+      throw new Error(`seedPaths entries must not target git metadata: ${entry}`);
+    }
     if (seen.has(normalizedPath)) {
       continue;
     }

scripts/orchestration-status.js

@@ -20,9 +20,32 @@ function usage() {
 
 function parseArgs(argv) {
   const args = argv.slice(2);
-  const target = args.find(arg => !arg.startsWith('--'));
-  const writeIndex = args.indexOf('--write');
-  const writePath = writeIndex >= 0 ? args[writeIndex + 1] : null;
+  let target = null;
+  let writePath = null;
+
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+
+    if (arg === '--write') {
+      const candidate = args[index + 1];
+      if (!candidate || candidate.startsWith('--')) {
+        throw new Error('--write requires an output path');
+      }
+      writePath = candidate;
+      index += 1;
+      continue;
+    }
+
+    if (arg.startsWith('--')) {
+      throw new Error(`Unknown flag: ${arg}`);
+    }
+
+    if (target) {
+      throw new Error('Expected a single session name or plan path');
+    }
+
+    target = arg;
+  }
 
   return { target, writePath };
 }
@@ -56,4 +79,4 @@ if (require.main === module) {
   }
 }
 
-module.exports = { main };
+module.exports = { main, parseArgs };