//! Invariant: the check tool must reject file paths that escape CWD.

#[tokio::test]
async fn rejects_dotdot_path_in_check_file() {
    let result = envseal_mcp::tools::check::execute(envseal_mcp::tools::check::CheckParams {
        file: "../../etc/hosts".to_string(),
    })
    .await;

    let err = result.expect_err("expected path traversal to be rejected");
    assert!(
        err.contains("must not escape the working directory"),
        "Fix: check file must reject traversal paths, got: {err}"
    );
}
