fix: harden orchestration status and skill docs

tests/lib/orchestration-session.test.js

@@ -204,7 +204,34 @@ test('resolveSnapshotTarget handles plan files and direct session names', () =>
 
     const fromSession = resolveSnapshotTarget('workflow-visual-proof', repoRoot);
     assert.strictEqual(fromSession.targetType, 'session');
-    assert.ok(fromSession.coordinationDir.endsWith(path.join('.claude', 'orchestration', 'workflow-visual-proof')));
+    assert.ok(fromSession.coordinationDir.endsWith(path.join('.orchestration', 'workflow-visual-proof')));
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+});
+
+test('resolveSnapshotTarget normalizes plan session names and defaults to the repo name', () => {
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'ecc-orch-target-'));
+  const repoRoot = path.join(tempRoot, 'My Repo');
+  fs.mkdirSync(repoRoot, { recursive: true });
+
+  const namedPlanPath = path.join(repoRoot, 'named-plan.json');
+  const defaultPlanPath = path.join(repoRoot, 'default-plan.json');
+
+  fs.writeFileSync(namedPlanPath, JSON.stringify({
+    sessionName: 'Workflow Visual Proof',
+    repoRoot
+  }));
+  fs.writeFileSync(defaultPlanPath, JSON.stringify({ repoRoot }));
+
+  try {
+    const namedPlan = resolveSnapshotTarget(namedPlanPath, repoRoot);
+    assert.strictEqual(namedPlan.sessionName, 'workflow-visual-proof');
+    assert.ok(namedPlan.coordinationDir.endsWith(path.join('.orchestration', 'workflow-visual-proof')));
+
+    const defaultPlan = resolveSnapshotTarget(defaultPlanPath, repoRoot);
+    assert.strictEqual(defaultPlan.sessionName, 'my-repo');
+    assert.ok(defaultPlan.coordinationDir.endsWith(path.join('.orchestration', 'my-repo')));
   } finally {
     fs.rmSync(tempRoot, { recursive: true, force: true });
   }

tests/lib/tmux-worktree-orchestrator.test.js

@@ -144,6 +144,17 @@ test('normalizeSeedPaths rejects paths outside the repo root', () => {
   );
 });
 
+test('normalizeSeedPaths rejects repo root and git metadata paths', () => {
+  assert.throws(
+    () => normalizeSeedPaths(['.'], '/tmp/ecc'),
+    /must not target the repo root/
+  );
+  assert.throws(
+    () => normalizeSeedPaths(['.git/config'], '/tmp/ecc'),
+    /must not target git metadata/
+  );
+});
+
 test('materializePlan keeps worker instructions inside the worktree boundary', () => {
   const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'ecc-orchestrator-test-'));
 

tests/scripts/orchestration-status.test.js

@@ -0,0 +1,89 @@
+'use strict';
+
+const assert = require('assert');
+
+const { parseArgs } = require('../../scripts/orchestration-status');
+
+console.log('=== Testing orchestration-status.js ===\n');
+
+let passed = 0;
+let failed = 0;
+
+function test(desc, fn) {
+  try {
+    fn();
+    console.log(`  ✓ ${desc}`);
+    passed++;
+  } catch (error) {
+    console.log(`  ✗ ${desc}: ${error.message}`);
+    failed++;
+  }
+}
+
+test('parseArgs reads a target with an optional write path', () => {
+  assert.deepStrictEqual(
+    parseArgs([
+      'node',
+      'scripts/orchestration-status.js',
+      'workflow-visual-proof',
+      '--write',
+      '/tmp/snapshot.json'
+    ]),
+    {
+      target: 'workflow-visual-proof',
+      writePath: '/tmp/snapshot.json'
+    }
+  );
+});
+
+test('parseArgs does not treat the write path as the target', () => {
+  assert.deepStrictEqual(
+    parseArgs([
+      'node',
+      'scripts/orchestration-status.js',
+      '--write',
+      '/tmp/snapshot.json',
+      'workflow-visual-proof'
+    ]),
+    {
+      target: 'workflow-visual-proof',
+      writePath: '/tmp/snapshot.json'
+    }
+  );
+});
+
+test('parseArgs rejects missing write values and unknown flags', () => {
+  assert.throws(
+    () => parseArgs([
+      'node',
+      'scripts/orchestration-status.js',
+      'workflow-visual-proof',
+      '--write'
+    ]),
+    /--write requires an output path/
+  );
+  assert.throws(
+    () => parseArgs([
+      'node',
+      'scripts/orchestration-status.js',
+      'workflow-visual-proof',
+      '--unknown'
+    ]),
+    /Unknown flag/
+  );
+});
+
+test('parseArgs rejects multiple positional targets', () => {
+  assert.throws(
+    () => parseArgs([
+      'node',
+      'scripts/orchestration-status.js',
+      'first',
+      'second'
+    ]),
+    /Expected a single session name or plan path/
+  );
+});
+
+console.log(`\n=== Results: ${passed} passed, ${failed} failed ===`);
+if (failed > 0) process.exit(1);