use serde::Deserialize;
use serde_json::json;

use super::{common, ToolResult};

#[derive(Debug, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct PipeParams {
    pub secret_name: String,
    pub command: Vec<String>,
}

pub async fn execute(params: PipeParams) -> ToolResult {
    common::validate_secret_name(&params.secret_name, "secret_name")?;
    common::validate_command(&params.command)?;
    tokio::task::spawn_blocking(move || -> Result<(), String> {
        envseal::ops::pipe_with_stdio_isolation(&params.secret_name, &params.command, true)
            .map_err(|e| e.to_string())?;
        Ok(())
    })
    .await
    .map_err(|e| format!("pipe task failed: {e}"))??;
    Ok(json!({"status": "completed", "mode": "pipe", "exit_code": 0}))
}
