#[tokio::test]
async fn rejects_unknown_supervised_sandbox() {
    let result =
        envseal_mcp::tools::supervised::execute(envseal_mcp::tools::supervised::SupervisedParams {
            secret_name: "api-key".to_string(),
            env_var: "API_KEY".to_string(),
            command: vec!["/bin/echo".to_string(), "ok".to_string()],
            sandbox: Some("ultra".to_string()),
        })
        .await;

    let err = result.expect_err("expected unknown sandbox to be rejected");
    assert!(
        err.contains("invalid sandbox profile"),
        "unexpected error: {err}"
    );
}
