diff --git a/packages/cli/src/shared/orchestrate.ts b/packages/cli/src/shared/orchestrate.ts
index 59f0098f..3427fc5c 100644
--- a/packages/cli/src/shared/orchestrate.ts
+++ b/packages/cli/src/shared/orchestrate.ts
@@ -41,6 +41,9 @@ export const DOCKER_REGISTRY = "ghcr.io/openrouterteam";
 
 /** Wrap a command to run inside the Docker container instead of the host. */
 export function makeDockerExec(cmd: string): string {
+  if (!cmd || cmd.length === 0) {
+    throw new Error("makeDockerExec: command must be non-empty");
+  }
   return `docker exec ${DOCKER_CONTAINER_NAME} bash -c ${shellQuote(cmd)}`;
 }