#[test]
fn rejects_unknown_fields_in_inject_params() {
    let bad = serde_json::json!({
        "mappings": [{"secret":"api-key","env_var":"API_KEY"}],
        "command": ["/bin/echo", "ok"],
        "unexpected": true
    });

    let result = serde_json::from_value::<envseal_mcp::tools::inject::InjectParams>(bad);
    assert!(
        result.is_err(),
        "Fix: MCP inject params must deny unknown fields to prevent silent contract drift"
    );
}
