#[tokio::test]
async fn rejects_empty_pipe_command() {
    let result = envseal_mcp::tools::pipe::execute(envseal_mcp::tools::pipe::PipeParams {
        secret_name: "token".to_string(),
        command: vec![],
    })
    .await;

    let err = result.expect_err("expected empty command to be rejected");
    assert!(
        err.contains("command must not be empty"),
        "unexpected error: {err}"
    );
}
