Feature: LspRuntime workspace path containment
  As a security-conscious platform
  I need LspRuntime._read_file to enforce workspace path containment
  So that path traversal attacks cannot read files outside the workspace

  # ── _read_file static method containment ──────────────────────────

  Scenario: read_file allows a file inside the workspace
    Given lspc I have a temp workspace directory
    And lspc I have a file inside the workspace with content "safe content"
    When lspc I call read_file with the workspace path
    Then lspc the file content should be "safe content"
    And lspc no error should be raised

  Scenario: read_file blocks a file outside the workspace
    Given lspc I have a temp workspace directory
    And lspc I have a file outside the workspace
    When lspc I call read_file with the workspace path
    Then lspc an LspError should be raised with message containing "outside workspace"

  Scenario: read_file blocks path traversal using dot-dot segments
    Given lspc I have a temp workspace directory
    And lspc I have a file outside the workspace
    When lspc I call read_file with a traversal path and the workspace path
    Then lspc an LspError should be raised with message containing "outside workspace"

  Scenario: read_file without workspace path has no containment check
    Given lspc I have a file outside the workspace
    When lspc I call read_file without a workspace path
    Then lspc no error should be raised

  # ── get_diagnostics containment ────────────────────────────────────

  Scenario: get_diagnostics blocks file outside workspace
    Given lspc I have a temp workspace directory
    And lspc I have a file outside the workspace
    And lspc I create an LspRuntime with a healthy mock server "local/pyright" and workspace
    When lspc I try to get diagnostics for "local/pyright" on the outside file
    Then lspc an LspError should be raised with message containing "outside workspace"

  Scenario: get_diagnostics allows file inside workspace
    Given lspc I have a temp workspace directory
    And lspc I have a file inside the workspace with content "x = 1"
    And lspc I create an LspRuntime with a healthy mock server "local/pyright" and workspace
    When lspc I get diagnostics for "local/pyright" on the inside file
    Then lspc diagnostics should be returned as a list
    And lspc no error should be raised

  # ── get_completions containment ────────────────────────────────────

  Scenario: get_completions blocks file outside workspace
    Given lspc I have a temp workspace directory
    And lspc I have a file outside the workspace
    And lspc I create an LspRuntime with a healthy mock server "local/pyright" and workspace
    When lspc I try to get completions for "local/pyright" on the outside file at line 1 column 1
    Then lspc an LspError should be raised with message containing "outside workspace"

  # ── get_hover containment ──────────────────────────────────────────

  Scenario: get_hover blocks file outside workspace
    Given lspc I have a temp workspace directory
    And lspc I have a file outside the workspace
    And lspc I create an LspRuntime with a healthy mock server "local/pyright" and workspace
    When lspc I try to get hover for "local/pyright" on the outside file at line 1 column 1
    Then lspc an LspError should be raised with message containing "outside workspace"

  # ── get_definitions containment ────────────────────────────────────

  Scenario: get_definitions blocks file outside workspace
    Given lspc I have a temp workspace directory
    And lspc I have a file outside the workspace
    And lspc I create an LspRuntime with a healthy mock server "local/pyright" and workspace
    When lspc I try to get definitions for "local/pyright" on the outside file at line 1 column 1
    Then lspc an LspError should be raised with message containing "outside workspace"

  # ── workspace path not registered ─────────────────────────────────

  Scenario: get_diagnostics without registered workspace has no containment check
    Given lspc I have a file outside the workspace
    And lspc I create an LspRuntime with a healthy mock server "local/pyright" without workspace
    When lspc I get diagnostics for "local/pyright" on the outside file
    Then lspc diagnostics should be returned as a list
    And lspc no error should be raised